PS3UserCheat PS3 Cheat Dongle v2.3 Update Arrives From Oct0xor

// Patch PS3UserCheat Cheat to an ELF File
// 1. Decrypt EBOOT.BIN to EBOOT.ELF
// 2. Provide PATCH.TXT with the following Format (From PS3 Cheats Editor)
// Example PATCH.TXT
//00002000 0002A878 33FE034C
// Another Example of PATCH.TXT
//00002000 010AF534 00000000
//00002000 010AF538 00000000
//00002000 010AF53C 00000000
//00002000 010AF540 00000000
// 3. Run this Code
// 4. Rencrypt EBOOT.KDSBest.ELF to EBOOT.BIN
// 5. Replace EBOOT.BIN of your game with the new one

// Sorry I couldn't provide a One Click Tool I lack in time 
// the 0000c001 patches are button mapping for cheat pkgs, since we fixed patch it this isn't supported.
// Example Tales of Grace F Move Fast Speed (Press []) is the following PATCH.TXT
//00002000 007DF6FC 3F800000
//0000C001 00000000 00000080
//00002000 007DF6FC 3FE00000
// If you don't want to patch the speed the PATCH.TXT you provide
//00002000 007DF6FC 3F800000
// If you want constant faster speed you provide
//00002000 007DF6FC 3FE00000
// It reads the following way
// 00002000 = Patch Memory (Eboot)
// 0000C001 = Button Event
// Look how easy
// If nothing is pressed
// {
//00002000 007DF6FC 3F800000 => Patch Memory At 007DF6FC to 3F800000
// }
//0000C001 00000000 00000080 => else If(Button Event(00000080)) => 00000080 = []
// {
//00002000 007DF6FC 3FE00000 => Patch Memory At 007DF6FC to 3FE00000
// }

// Why I write this tool
// I provided the patches by hand
// 1. Load ELF in IDA
// 2. Check bytes at Address
// 3. Search Bytes from IDA (Which can parse the elf header and knows the exact locations) in Hex Editor
// 4. Patch Bytes by hand
// 5. ....

// Why is this tool written like bullshit
// I don't have the mood to write it clean 

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.IO;

namespace Patch_ELF_PS3UserCheat
{
class Program
{
public struct ELFLocation
{
public uint Offset;
public uint OffsetFile;
public uint Size;
}

public struct Patch
{
public uint Offset;
public uint PatchValue;
}

public static uint byteToUInt(byte[] b)
{
return byteToUInt(b, 0);
}

public static uint byteToUInt(byte[] b, int offset)
{
uint a = (uint)b[offset] << 24;
a |= (uint)b[offset + 1] << 16;
a |= (uint)b[offset + 2] << 8;
a |= (uint)b[offset + 3] << 0;
return a;
}

public static byte[] uintToByte(uint i)
{
byte[] b = new byte[4];
b[0] = (byte)((i >> 24) & 0xFF);
b[1] = (byte)((i >> 16) & 0xFF);
b[2] = (byte)((i >> 8) & 0xFF);
b[3] = (byte)((i) & 0xFF);
return b;
}

public static int LoadElfPHDR(BinaryReader br, List Elf, uint phdr_offset, uint phdr_size, uint i)
{
byte[] phdr = new byte[phdr_size];

br.BaseStream.Seek(phdr_offset + phdr_size * i, SeekOrigin.Begin);
br.Read(phdr, 0, phdr.Length);
ELFLocation elfLocation = new ELFLocation();
elfLocation.OffsetFile = byteToUInt(phdr, 0x0C);
elfLocation.Offset = byteToUInt(phdr, 0x14);
elfLocation.Size = byteToUInt(phdr, 0x24);
Elf.Add(elfLocation);
return 0;
}

public static ushort byteToUShort(byte[] b, int offset)
{
ushort a = (ushort)(b[offset] << 8);
a |= (ushort)b[offset + 1];
return a;
}

public static List LoadElf(string FileName)
{
List Elf = new List();
BinaryReader br = new BinaryReader(File.OpenRead(FileName));

byte[] elfMagic = new byte[4];
br.Read(elfMagic, 0, 4);
if (elfMagic[0] != 0x7F ||
elfMagic[1] != 0x45 ||
elfMagic[2] != 0x4C ||
elfMagic[3] != 0x46)
{
Console.WriteLine("Elf Magic Wrong (" + FileName + ")");
br.Close();
return Elf;
}
br.BaseStream.Seek(0, SeekOrigin.Begin);
byte[] eHDR = new byte[0x40];
br.Read(eHDR, 0, eHDR.Length);
uint phdr_offset = byteToUInt(eHDR, 0x24);
ushort n_phdrs = byteToUShort(eHDR, 0x38);
ushort phdr_size = byteToUShort(eHDR, 0x36);
for (ushort i = 0; i < n_phdrs; i++)
{
int error = LoadElfPHDR(br, Elf, phdr_offset, phdr_size, i);
if (error == 1)
Console.WriteLine("Didn't Load phdr " + i + " of File " + FileName);
}

br.Close();
return Elf;
}

public static List LoadPatchFile(string FileName)
{
List patches = new List();
StreamReader sr = new StreamReader(File.OpenRead(FileName));

string input;
while(!string.IsNullOrEmpty(input = sr.ReadLine()))
{
string[] vals = input.Split(new char[] { ' ' });
if (vals.Length != 3 || vals[0] != "00002000")
{
Console.WriteLine("This is not an ELF Patch!");
patches.Clear();
return patches;
}
Patch p = new Patch();

try
{
p.Offset = uint.Parse(vals[1], System.Globalization.NumberStyles.AllowHexSpecifier);
p.PatchValue = uint.Parse(vals[2], System.Globalization.NumberStyles.AllowHexSpecifier);
patches.Add(p);
}
catch (Exception)
{
Console.WriteLine("Patch file wrong!");
patches.Clear();
return patches;
}
}
return patches;
}

static void Main(string[] args)
{
if (!File.Exists("EBOOT.ELF"))
{
Console.WriteLine("Couldn't find EBOOT.ELF");
Console.ReadLine();
return;
}
if (!File.Exists("PATCH.TXT"))
{
Console.WriteLine("Couldn't find PATCH.TXT");
Console.ReadLine();
return;
}
if (File.Exists("EBOOT.KDSBest.ELF"))
File.Delete("EBOOT.KDSBest.ELF");
List locations = LoadElf("EBOOT.ELF");
List patches = LoadPatchFile("PATCH.TXT");
for(int i = 0; i < patches.Count; i++)
{
ELFLocation? locationForPatch = null;
Patch p = patches[i];
for (int ii = 0; ii < locations.Count; ii++)
{
if (p.Offset >= locations[ii].Offset && p.Offset < locations[ii].Offset + locations[ii].Size)
{
locationForPatch = locations[ii];
break;
}
}

if (locationForPatch == null)
{
Console.WriteLine("Patch is not for this ELF!");
Console.ReadLine();
return;
}
else
{
p.Offset = p.Offset - locationForPatch.Value.Offset + locationForPatch.Value.OffsetFile;
patches[i] = p;
}
}

Console.WriteLine("Patching ELF...");
File.Copy("EBOOT.ELF", "EBOOT.KDSBest.ELF");
BinaryWriter bw = new BinaryWriter(File.OpenWrite("EBOOT.KDSBest.ELF"));
foreach (Patch p in patches)
{
bw.Seek((int) p.Offset, SeekOrigin.Begin);
bw.Write(uintToByte(p.PatchValue));
}
bw.Close();
Console.WriteLine("DONE!");
Console.ReadLine();
}
}
}

// The full Code for the hack
// It doesn't work yet, because of the 2. stage
// shellcode crash on read sometimes.
// Have to check things out
// Next I start to bring up a working version.
// Maybe someone finds a trick or has a tip in the // mean time 
#define uint64_t unsigned long long

register uint64_t r3 __asm("r3");
register uint64_t r4 __asm ("r4");
register uint64_t r11 __asm ("r11");
uint64_t firstStageSC[] = {
// blr PREVENT SYSCALL 900 FROM DESTROY INFORMATION
// blr PREVENT SYSCALL 900 FROM DESTROY INFORMATION
0x4E8000204E800020ULL,
//li %r3, 0x80
//rldicr %r3, %r3, 48,15
0x38600080786383C6ULL,
//addi %r3, %r3, 0x7FFF
//rldicr %r3, %r3, 8,55
0x38637FFF786345E4ULL,
//addi %r3, %r3, 0xC0
//std %r5, 0(%r3)
0x386300C0F8A30000ULL,
//li %r3, 0
//b
0x38600000480345D0ULL
};
int firstStageSCLen = 5;

/*uint64_t secondStageSC[] = {
0xF821FFA1F8610058ULL,
0xFB21005038600080ULL,
0x786383C638637FFFULL,
0x786345E4386300C0ULL,
0xEB2300002FB90000ULL,
0x419E003CE8790000ULL,
0x786300222FA30000ULL,
0x419E002CA0790008ULL,
0x5463073E2FA300FFULL,
0x409E001C38600100ULL,
0x3880000038A00000ULL,
0x38C000003960017BULL,
0x44000002E8610058ULL,
0xEB210050E8210000ULL,
0x4E8000204E800020ULL
};*/
uint64_t secondStageSC[] = {
0xF821FFA1F8610058ULL,
0xFB210050F8810048ULL,
0x38600080786383C6ULL,
0x38637FFF786345E4ULL,
0x386300C0EB230000ULL,
0x388000017884C1E4ULL,
0x7FB92040409D0038ULL,
0x7C641B78A0790008ULL,
0xF8640010F8840020ULL,
0x5463073E2FA3000FULL,
0x409E001C38600100ULL,
0x3880000038A00000ULL,
0x38C000003960017BULL,
0x44000002E8610058ULL,
0xEB210050E8810048ULL,
0xE82100004E800020ULL

};

int secondStageSCLen = 16;

#define SCStartFirstStage 0x800000000008FC2CULL
#define SCStartSecondStage 0x800000000008FC8CULL

int __volatile__ main(int argc, const char* argv[])
{
for(int i = 0; i < firstStageSCLen; i++)
{
r4 = firstStageSC[i];
r3 = SCStartFirstStage + (8*i);
r11 = 0x07;
__asm("sc");
}
for(int i = 0; i < secondStageSCLen; i++)
{
r4 = secondStageSC[i];
r3 = SCStartSecondStage + (8*i);
r11 = 0x07;
__asm("sc");
}

// Patch li r3, 0 to first Stage Payload
r4 = 0x4BFCBA18FB410080ULL;
r3 = 0x80000000000C421CULL;
r11 = 0x07;
__asm("sc");

// Patch blr to second Stage Payload
r4 = 0x4BFCB9C07C7F07B4ULL;
r3 = 0x80000000000C42CCULL;
r11 = 0x07;
__asm("sc");

return 0;
}

// Shellcode development
// First Stage does it's job just well
// Saves the parameter to a memory adress lv2 will find
// but we need to save more parameters to precisly pick
// the package we want

// Second Stage crashes often on the read of userland
// data. And the check isn't right yet. I lack of time
// like always

// PS: Ignore the main Function it is just for
// compiler to have sth todo
// I copy the instructions with a IDA out of the ELF

#define uint64_t unsigned long long

register uint64_t sp __asm("r1");
register uint64_t r3 __asm("r3");
register uint64_t r4 __asm ("r4");
register uint64_t r5 __asm ("r5");
register uint64_t r6 __asm ("r6");
register uint64_t r7 __asm ("r7");
register uint64_t r8 __asm ("r8");
register uint64_t r9 __asm ("r9");
register uint64_t r11 __asm ("r11");
register uint64_t r25 __asm("r25");

void __volatile__ FirstStage()
{
__asm("li %r3, 0x80");
__asm("sldi %r3, %r3, 48");
__asm("addi %r3, %r3, 0x7FFF");
__asm("sldi %r3, %r3, 8");
__asm("addi %r3, %r3, 0xC0");
__asm("std %r5, 0x00(%r3)");
__asm("li %r3, 0");
}

void __volatile__ SecondStage()
{
__asm("stdu %r1, -0x60(%r1)");
__asm("std %r3, 0x58(%r1)");
__asm("std %r25, 0x50(%r1)");
__asm("std %r4, 0x48(%r1)");
__asm("li %r3, 0x80");
__asm("sldi %r3, %r3, 48");
__asm("addi %r3, %r3, 0x7FFF");
__asm("sldi %r3, %r3, 8");
__asm("addi %r3, %r3, 0xC0");
__asm("ld %r25, 0x0(%r3)");
__asm("li %r4, 0x01");
__asm("sldi %r4, %r4, 24");
__asm("cmpld cr7, %r25, %r4");
__asm("ble cr7, 0x38");
__asm("mr %r4, %r3");
__asm("lhz %r3, 0x8(%r25)");
__asm("std %r3, 0x10(%r4)");
__asm("std %r4, 0x20(%r4)");
__asm("clrlwi %r3, %r3, 28");
__asm("cmpdi cr7, %r3, 0xF");
__asm("bne cr7, 0x1C");
r3 = 0x100;
r4 = 0;
r5 = 0;
r6 = 0;
r11 = 0x017B;
__asm("sc");
__asm("ld %r3, 0x58(%r1)");
__asm("ld %r25, 0x50(%r1)");
__asm("ld %r4, 0x48(%r1)");
__asm("ld %r1, 0x00(%r1)");
__asm("blr");
}

int main(int argc, const char* argv[])
{
FirstStage();
SecondStage();
return 0;
}

// Shutdown on Gamepad L3+R3+Start+Select by KDSBest
// ONLY press those 4 buttons to Shutdown
// Works on REX 4.21 with CEX LV2 KERNEL
// DON'T compile with make or libs or so else
// the funny gcc will optimize the poke and uses other register
// ppu-lv2-gcc KDSBestGamepadHack.c -o KDSBestGamepadHack.elf

#define uint64_t unsigned long long

register uint64_t r3 __asm("r3");
register uint64_t r4 __asm ("r4");
register uint64_t r11 __asm ("r11");

uint64_t sc[] = {
/* SAVE ALL REGISTER */
//stdu %sp, var_60(%sp)
//std %r3, arg_58(%sp)
0xF821FFA1F8610058ULL,
//std %r4, arg_48(%sp)
//std %r5, arg_50(%sp)
0xF8810048F8A10050ULL,
//std %r6, arg_38(%sp)

/* READ SRC OF MEMCPY FROM SC 502 */
//ld %r6, 0(%r19)
0xF8C10038E8D30000ULL,

/* CUT OUT OTHER BUTTONS */
//rldicl %r6, %r6, 48,16

/* MAKE COMPARE REGISTER */
//li %r3, 0x7C
0x78C684023860007CULL,
//rldicr %r3, %r3, 16,47
//addi %r3, %r3, 0xF
0x786383E43863000FULL,

/* COMPARE AND DO NOT SHUTDOWN ON MISS */
//cmpw cr7, %r3, %r6
//bne cr7, loc_106D8
0x7F833000409E001CULL,

/* SHUTDOWN */
//li %r3, 0x100
//li %r4, 0
0x3860010038800000ULL,
//li %r5, 0
//li %r6, 0
0x38A0000038C00000ULL,
//li %r11, 0x17B
//sc
0x3960017B44000002ULL,

/* RESTORE REGISTER */
//noShutdown:
//ld %r3, arg_58(%sp)
//ld %r4, arg_48(%sp)
0xE8610058E8810048ULL,
//ld %r5, arg_50(%sp)
//ld %r6, arg_38(%sp)
0xE8A10050E8C10038ULL,
//ld %sp, arg_0(%sp)
//mr %r4, %r28
0xE82100007F84E378ULL,
//mr %r4, %r28 (DUMMY TO LAZY TO CALC NEW ADDR FOR BACK JUMP)
//mr %r4, %r28 (DUMMY TO LAZY TO CALC NEW ADDR FOR BACK JUMP)
0x7F84E3787F84E378ULL,
//b back
//dummy
0x4BFE2C884BFE2C88ULL
};

int scLen = 14;

#define SCStart 0x800000000008FC8CULL

uint64_t test123;

int __volatile__ main(int argc, const char* argv[])
{
// Copy Shellcode
for(int i = 0; i < scLen; i++)
{
r4 = sc[i];
r3 = SCStart + (8*i);
r11 = 0x07;
__asm("sc");
}

// Redirect to Shellcode
r4 = 0x4801D3147D635B78ULL;
r3 = 0x8000000000072978ULL;
r11 = 0x07;
__asm("sc");

return 0;
}

// Shutdown on Gamepad L3+R3+Start+Select by KDSBest
// ONLY press those 4 buttons to Shutdown
// Works on REX 4.21 with CEX LV2 KERNEL
// DON'T compile with make or libs or so else
// the funny gcc will optimize the poke and uses other register
// ppu-lv2-gcc KDSBestGamepadHack.c -o KDSBestGamepadHack.elf

#define uint64_t unsigned long long

register uint64_t r3 __asm("r3");
register uint64_t r4 __asm ("r4");
register uint64_t r11 __asm ("r11");

uint64_t sc[] = {
/* SAVE ALL REGISTER */
//stdu %sp, var_60(%sp)
//std %r3, arg_58(%sp)
0xF821FFA1F8610058ULL,
//std %r4, arg_48(%sp)
//std %r5, arg_50(%sp)
0xF8810048F8A10050ULL,
//std %r6, arg_38(%sp)

/* READ SRC OF MEMCPY FROM SC 502 */
//ld %r6, 0(%r19)
0xF8C10038E8D30000ULL,

/* CUT OUT OTHER BUTTONS */
//rldicl %r6, %r6, 48,16

/* MAKE COMPARE REGISTER */
//li %r3, 0x7C
0x78C684023860007CULL,
//rldicr %r3, %r3, 16,47
//addi %r3, %r3, 0xF
0x786383E43863000FULL,

/* COMPARE AND DO NOT SHUTDOWN ON MISS */
//cmpw cr7, %r3, %r6
//bne cr7, loc_106D8
0x7F833000409E001CULL,

/* SHUTDOWN */
//li %r3, 0x100
//li %r4, 0
0x3860010038800000ULL,
//li %r5, 0
//li %r6, 0
0x38A0000038C00000ULL,
//li %r11, 0x17B
//sc
0x3960017B44000002ULL,

/* RESTORE REGISTER */
//noShutdown:
//ld %r3, arg_58(%sp)
//ld %r4, arg_48(%sp)
0xE8610058E8810048ULL,
//ld %r5, arg_50(%sp)
//ld %r6, arg_38(%sp)
0xE8A10050E8C10038ULL,
//ld %sp, arg_0(%sp)
//mr %r4, %r28
0xE82100007F84E378ULL,
//mr %r4, %r28 (DUMMY TO LAZY TO CALC NEW ADDR FOR BACK JUMP)
//mr %r4, %r28 (DUMMY TO LAZY TO CALC NEW ADDR FOR BACK JUMP)
0x7F84E3787F84E378ULL,
//b back
//dummy
0x4BFE2C884BFE2C88ULL
};

int scLen = 14;

#define SCStart 0x800000000008FC8CULL

uint64_t test123;

int __volatile__ main(int argc, const char* argv[])
{
// Copy Shellcode
for(int i = 0; i < scLen; i++)
{
r4 = sc[i];
r3 = SCStart + (8*i);
r11 = 0x07;
__asm("sc");
}

// Redirect to Shellcode
r4 = 0x4801D3147D635B78ULL;
r3 = 0x8000000000072978ULL;
r11 = 0x07;
__asm("sc");

return 0;
}