True Blue USB Dongle PS3 ELF Dumper and Source Code Surfaces

// Author: Shadoxi
// Modified: 

// Backup the original /dev_flash/sys/external/libsysutil_np_trophy.sprx to /dev_hdd0
// Replace /dev_blind/sys/external/libsysutil_np_trophy.sprx by this sprx


#include <stdio.h>
#include <stdlib.h>

#include <cell/error.h>
#include <cell/cell_fs.h>

#include <sys/process.h>
#include <sys/paths.h>
#include <sys/prx.h>
#include <sys/tty.h>

SYS_MODULE_INFO (sceNpTrophyhook, 0, 1, 0 );
SYS_MODULE_START( _start );
SYS_MODULE_STOP ( _stop  );

SYS_LIB_DECLARE( sceNpTrophyhook, SYS_LIB_AUTO_EXPORT | SYS_LIB_WEAK_IMPORT );
SYS_LIB_EXPORT ( loader_sprx, sceNpTrophyhook );

int _start(void);
int _stop(void);
void DumpELF_Payload(void);
void loader_sprx(const char* PATH_PRX);

static void write_message (char const * message)
{
	unsigned int write_length;
	char const * end;
	for (end = message; *end != '\0'; ++end);
	sys_tty_write(SYS_TTYP_PPU_STDERR, message,end - message, &write_length);
}

void DumpELF_Payload(void)
{
	write_message("Dumping ELF from RAM...\n");
	int fd;
	uint64_t nread;
	uint64_t ptr= 0x00010000ULL;		//ELF offset in RAM;
	uint64_t sizeelf = 35*1024*1024;	//Need a way to get size of ELF

	char dump_path[30]="/dev_hdd0/RAMDUMP-00.BIN";
	for(uint8_t i=0; i<100; i++)
	{
		dump_path[18]=0x30+i/10;
		dump_path[19]=0x30+i%10;
		if (cellFsOpen(dump_path, CELL_FS_O_RDONLY, &fd, NULL, 0) != CELL_FS_SUCCEEDED)
		{
			cellFsOpen(dump_path, CELL_FS_O_CREAT|CELL_FS_O_RDWR|CELL_FS_O_TRUNC, &fd, NULL, 0);
			cellFsWrite(fd, (void*)ptr, sizeelf, &nread);
			cellFsClose(fd);
			return;
		}
		else
			cellFsClose(fd);
	}
	return;
}

void loader_sprx(const char* PATH_PRX)
{
	sys_prx_id_t prx_id ;
	write_message ("Loading original prx... ");
	prx_id = sys_prx_load_module(PATH_PRX, 0, NULL);
	if (prx_id <= CELL_OK) 
	{
		write_message ("Failed!\n");
		return;
	} 
	else
		write_message ("Done!\n\nStarting module... ");

	int modres;
	if(sys_prx_start_module( prx_id, 0, NULL, &modres, 0, NULL) != CELL_OK)
		write_message ("Failed!\n");
}

int _start(void)
{
	write_message ("By shadoxi\n");
	DumpELF_Payload();

	// place here original libsysutil_np_trophy.sprx
	loader_sprx("/dev_hdd0/libsysutil_np_trophy.sprx");

	return SYS_PRX_RESIDENT;
}

int _stop(void)
{
	return SYS_PRX_STOP_OK;
}