- Spanish PlayStation 3 developer PS3MrEnigma
has recently started a blog (linked above) sharing his experiences with PS3 LV2 kernel reversal and memory hooks.
Below are the details thus far, roughly translated:
In this post we will see how to make hooks (hooks) in the LV-2 SYSCALL. The possibilities are endless da hook, only to be limited to our imagination and what we want to achieve with the hook.
For this section we should bear in mind that we need to meet the following requirements:
â€¢ Having a dump of the entire LV-2, possibly without being modified in any way by a payload.
â€¢ Knowledge of assembler to understand the original SYSCALL to create our hooks.
â€¢ Understand how the / s SYSCALL we will modify.
For this post'll take the example of a LV-2 3.41 Debug (for it is that I work mostly), but can be applied just as in a LV-2 Retail.
The first thing you need to know is the beginning of the SYSCALL_TABLE, and the number of SYSCALL we want to put a hook.
For example put a hook to the SYSCALL 0 Ã– 363 (867) to alter the machine model that we will return.
The SYSCALL_TABLE is at position 0 Ã– 303130 (at any position in the LV-2 assume that they add the base address 0 Ã– 8000 ...), knowing the number of the...