hen.c

/* hen.c -- kernel signature patches
 *
 * Copyright (C) 2016 Yifan Lu
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */
#include <psp2kern/types.h>
#include <psp2kern/io/fcntl.h>
#include <psp2kern/kernel/modulemgr.h>
#include <psp2kern/kernel/sysmem.h>
#include <string.h>
#include <taihen/parser.h>
#include "error.h"
#include "hen.h"
#include "module.h"
#include "patches.h"
#include "taihen_internal.h"

#define MAX_SEGMENTS 8

#define OFFSET_PATCH_ARG 168

/*
 *  S/ELF header
 */
typedef uint16_t Elf32_Half;
typedef uint32_t Elf32_Word;
typedef int32_t Elf32_Sword;
typedef void * Elf32_Addr;
typedef size_t Elf32_Off;

#define EI_NIDENT 16

typedef struct {
  unsigned char e_ident[EI_NIDENT]; /* ident bytes */
  Elf32_Half  e_type;     /* file type */
  Elf32_Half  e_machine;    /* target machine */
  Elf32_Word  e_version;    /* file version */
  Elf32_Addr  e_entry;    /* start address */
  Elf32_Off e_phoff;    /* phdr file offset */
  Elf32_Off e_shoff;    /* shdr file offset */
  Elf32_Word  e_flags;    /* file flags */
  Elf32_Half  e_ehsize;   /* sizeof ehdr */
  Elf32_Half  e_phentsize;    /* sizeof phdr */
  Elf32_Half  e_phnum;    /* number phdrs */
  Elf32_Half  e_shentsize;    /* sizeof shdr */
  Elf32_Half  e_shnum;    /* number shdrs */
  Elf32_Half  e_shstrndx;   /* shdr string index */
} __attribute__((packed)) Elf32_Ehdr;

typedef struct {
  uint32_t magic;                 /* 53434500 = SCE\0 */
  uint32_t version;               /* header version 3*/
  uint16_t sdk_type;              /* */
  uint16_t header_type;           /* 1 self, 2 unknown, 3 pkg */
  uint32_t metadata_offset;       /* metadata offset */
  uint64_t header_len;            /* self header length */
  uint64_t elf_filesize;          /* ELF file length */
  uint64_t self_filesize;         /* SELF file length */
  uint64_t unknown;               /* UNKNOWN */
  uint64_t self_offset;           /* SELF offset */
  uint64_t appinfo_offset;        /* app info offset */
  uint64_t elf_offset;            /* ELF #1 offset */
  uint64_t phdr_offset;           /* program header offset */
  uint64_t shdr_offset;           /* section header offset */
  uint64_t section_info_offset;   /* section info offset */
  uint64_t sceversion_offset;     /* version offset */
  uint64_t controlinfo_offset;    /* control info offset */
  uint64_t controlinfo_size;      /* control info size */
  uint64_t padding;               
} __attribute__((packed)) self_header_t;

typedef struct {
  uint64_t offset;
  uint64_t size;
  uint32_t compressed; // 2=compressed
  uint32_t unknown1;
  uint32_t encrypted; // 1=encrypted
  uint32_t unknown2;
} __attribute__((packed)) self_section_info_t;
static tai_hook_ref_t g_parse_headers_hook;

static tai_hook_ref_t g_setup_buffer_hook;

static tai_hook_ref_t g_decrypt_buffer_hook;

static tai_hook_ref_t g_rif_check_vita_hook;

static tai_hook_ref_t g_rif_check_psp_hook;

static tai_hook_ref_t g_rif_get_info_hook;

static tai_hook_ref_t g_package_check_hook;

static tai_hook_ref_t g_package_check_2_hook;

static tai_hook_ref_t g_load_user_libs_hook;

static tai_hook_ref_t g_nid_poison_hook;

static tai_hook_ref_t g_unload_process_hook;

static SceUID g_hooks[11];

static SceUID g_config_blk;

char *g_config = NULL;

static int g_is_homebrew;

static self_section_info_t g_seg_info[MAX_SEGMENTS];

static int parse_headers_patched(int ctx, const void *headers, size_t len, void *args) {
  self_header_t *self;
  Elf32_Ehdr *elf;
  int ret;
  int num_segs;

  memset(&g_seg_info, 0, sizeof(g_seg_info));
  if (len >= sizeof(self_header_t) && len >= sizeof(Elf32_Ehdr)) {
    self = (self_header_t *)headers;
    if (self->elf_offset <= len - sizeof(Elf32_Ehdr)) {
      elf = (Elf32_Ehdr *)(headers + self->elf_offset);
      num_segs = elf->e_phnum;
      if (num_segs <= MAX_SEGMENTS && 
          self->section_info_offset < self->section_info_offset + num_segs * sizeof(self_section_info_t) &&
          self->section_info_offset + num_segs * sizeof(self_section_info_t) < len
         ) {
        memcpy(&g_seg_info, headers + self->section_info_offset, num_segs * sizeof(self_section_info_t));
      }
    }
  }
  ret = TAI_CONTINUE(int, g_parse_headers_hook, ctx, headers, len, args);
  if (ctx == 1) { // as of 3.60, only one decrypt context exists
    if (ret == 0x800f0624 || ret == 0x800f0616 || ret == 0x800f0024 || ((unsigned)ret >= 0x800f0b30 && (unsigned)ret <= 0x800f0b3f)) {
      g_is_homebrew = 1;
      // we only do this patch if another hook hasn't modified it already
      if (*(uint32_t *)(args + OFFSET_PATCH_ARG) == 0) {
        *(uint32_t *)(args + OFFSET_PATCH_ARG) = 0x20;
      }
      ret = 0;
    } else {
      g_is_homebrew = 0;
    }
    LOG("parse ret %x, decrypt is homebrew? %d", ret, g_is_homebrew);
  }
  return ret;
}

static int setup_buffer_patched(int ctx, int segidx) {
  int ret;

  ret = TAI_CONTINUE(int, g_setup_buffer_hook, ctx, segidx);
  if (ctx == 1 && g_is_homebrew && segidx < MAX_SEGMENTS) {
    ret = g_seg_info[segidx].compressed;
    LOG("segidx %d, compression type: %d", segidx, ret);
  }
  return ret;
}

static int decrypt_buffer_patched(int ctx, void *buffer, size_t len) {
  int ret;

  ret = TAI_CONTINUE(int, g_decrypt_buffer_hook, ctx, buffer, len);
  if (ctx == 1 && g_is_homebrew) {
    LOG("patching decrypt buffer bypass");
    ret = 0;
  }
  return ret;
}

static int rif_check_vita_patched(int a1, int a2, int a3, int a4, int a5, int a6) {
  int ret;
  ret = TAI_CONTINUE(int, g_rif_check_vita_hook, a1, a2, a3, a4, a5, a6);
  if (ret == 0x80870003) {
    LOG("patched rif check return: %x => 0", ret);
    ret = 0;
  }
  return ret;
}

static int rif_check_psp_patched(int a1, int a2, int a3, int a4, int a5) {
  int ret;
  ret = TAI_CONTINUE(int, g_rif_check_psp_hook, a1, a2, a3, a4, a5);
  if (ret == 0x80870003) {
    LOG("patched rif check return: %x => 0", ret);
    ret = 0;
  }
  return ret;
}

static int rif_get_info_patched(int a1, int a2, int a3, int a4, int a5, int a6, int a7, int a8, int a9, int a10, int a11, int a12) {
  int ret;
  ret = TAI_CONTINUE(int, g_rif_get_info_hook, a1, a2, a3, a4, a5, a6, a7, a8, a9, a10, a11, a12);
  if (ret == 0x80870003) {
    LOG("patched rif check return: %x => 0", ret);
    ret = 0;
  }
  return ret;
}

static int package_check_patched(void) {
  int ret;
  ret = TAI_CONTINUE(int, g_package_check_hook);
  LOG("patching fpkg enabled: %x => 1", ret);
  return 1;
}

static int package_check_2_patched(void) {
  int ret;
  ret = TAI_CONTINUE(int, g_package_check_2_hook);
  LOG("patching fpkg enabled: %x => 1", ret);
  return 1;
}

static int load_user_libs_patched(SceUID pid, void *args, int flags) {
  tai_plugin_load_t param;
  int ret;
  SceUID mod;
  char titleid[32];

  ret = TAI_CONTINUE(int, g_load_user_libs_hook, pid, args, flags);

  sceKernelGetProcessTitleIdForKernel(pid, titleid, 32);
  LOG("title started: %s, pid: %x", titleid, pid);

  if (g_config) {
    param.pid = pid;
    param.flags = 0x8000; // queue for load
    taihen_config_parse(g_config, titleid, hen_load_plugin, &param);
  } else {
    LOG("config not loaded, skipping plugin load");
  }

  return ret;
}

static int nid_poison_patched(uintptr_t dst, int set, size_t len) {
  // we're breaking the rules here. we don't call TAI_CONTINUE
  // because we do not want the effect to take place
  //LOG("patched out nid poison request: %p, %x, len: %x", dst, set, len);
  return 0;
}

static int unload_process_patched(SceUID pid) {
  int ret;

  LOG("unloading pid:%x", pid);
  ret = tai_try_cleanup_process(pid);
  LOG("cleanup: %x", ret);
  ret = TAI_CONTINUE(int, g_unload_process_hook, pid);
  LOG("process unloaded: %x", ret);

  return ret;
}

int hen_load_config(void) {
  SceUID fd;
  SceOff len;
  int ret;
  char *config;
  int rd, total;

  LOG("opening config %s", TAIHEN_CONFIG_FILE);
  fd = sceIoOpenForDriver(TAIHEN_CONFIG_FILE, SCE_O_RDONLY, 0);
  if (fd < 0) {
    LOG("failed to open config %s", TAIHEN_CONFIG_FILE);
    return fd;
  }

  len = sceIoLseekForDriver(fd, 0, SCE_SEEK_END);
  if (len < 0) {
    LOG("failed to seek config");
    sceIoCloseForDriver(fd);
    return TAI_ERROR_SYSTEM;
  }

  sceIoLseekForDriver(fd, 0, SCE_SEEK_SET);

  if (!g_config) {
    LOG("allocating %d bytes for config", (len + 0xfff) & ~0xfff);
    g_config_blk = sceKernelAllocMemBlockForKernel("tai_config", SCE_KERNEL_MEMBLOCK_TYPE_KERNEL_RW, (len + 0xfff) & ~0xfff, NULL);
    if (g_config_blk < 0) {
      LOG("failed to allocate memory: %x", g_config_blk);
      sceIoCloseForDriver(fd);
      return g_config_blk;
    }

    ret = sceKernelGetMemBlockBaseForKernel(g_config_blk, (void **)&config);
    if (ret < 0) {
      LOG("failed to get base for %x: %x", g_config_blk, ret);
      sceIoCloseForDriver(fd);
      return ret;
    }
  } else {
    config = g_config;
  }

  LOG("reading config to memory");
  rd = total = 0;
  while (total < len) {
    rd = sceIoReadForDriver(fd, config+total, len-total);
    if (rd < 0) {
      LOG("failed to read config: rd %x, total %x, len %x", rd, total, len);
      ret = rd;
      break;
    }
    total += rd;
  }

  sceIoCloseForDriver(fd);
  if (ret < 0) {
    sceKernelFreeMemBlockForKernel(g_config_blk);
    return ret;
  }

  if ((ret = taihen_config_validate(config)) != 0) {
    LOG("config parsing failed: %x", ret);
    sceKernelFreeMemBlockForKernel(g_config_blk);
    return ret;
  }

  g_config = config;
  return TAI_SUCCESS;
}

int hen_free_config(void) {
  if (g_config) {
    sceKernelFreeMemBlockForKernel(g_config_blk);
  }
  return 0;
}

void hen_load_plugin(const char *path, void *param) {
  tai_plugin_load_t *load = (tai_plugin_load_t *)param;
  int ret;
  int result;

  if (!g_config) {
    LOG("no config loaded! skipping plugin load");
    return;
  }

  LOG("pid:%x loading module %s (flags:%x)", load->pid, path, load->flags);
  if ((load->flags & 0x8000) == 0x8000) {
    ret = sceKernelLoadModuleForPid(load->pid, path, load->flags, NULL);
    result = ret;
  } else {
    ret = sceKernelLoadStartModuleForPid(load->pid, path, 0, NULL, load->flags, NULL, &result);
  }
  LOG("load result: %x", ret);
}

int hen_add_patches(void) {
  memset(g_hooks, 0, sizeof(g_hooks));
  g_hooks[0] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_parse_headers_hook, 
                                              "SceKernelModulemgr", 
                                              0x7ABF5135, // SceSblAuthMgrForKernel
                                              0xF3411881, 
                                              parse_headers_patched);
  if (g_hooks[0] < 0) goto fail;
  LOG("parse_headers_patched added");
  g_hooks[1] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_setup_buffer_hook, 
                                              "SceKernelModulemgr", 
                                              0x7ABF5135, // SceSblAuthMgrForKernel
                                              0x89CCDA2C, 
                                              setup_buffer_patched);
  if (g_hooks[1] < 0) goto fail;
  LOG("setup_buffer_patched added");
  g_hooks[2] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_decrypt_buffer_hook, 
                                              "SceKernelModulemgr", 
                                              0x7ABF5135, // SceSblAuthMgrForKernel
                                              0xBC422443, 
                                              decrypt_buffer_patched);
  if (g_hooks[2] < 0) goto fail;
  LOG("decrypt_buffer_patched added");
  g_hooks[3] = taiHookFunctionExportForKernel(KERNEL_PID, 
                                              &g_rif_check_vita_hook, 
                                              "SceNpDrm", 
                                              0xD84DC44A, // SceNpDrmForDriver
                                              0x723322B5, 
                                              rif_check_vita_patched);
  if (g_hooks[3] < 0) goto fail;
  LOG("rif_check_vita added");
  g_hooks[4] = taiHookFunctionExportForKernel(KERNEL_PID, 
                                              &g_rif_check_psp_hook, 
                                              "SceNpDrm", 
                                              0xD84DC44A, // SceNpDrmForDriver
                                              0xDACB71F4, 
                                              rif_check_psp_patched);
  if (g_hooks[4] < 0) goto fail;
  LOG("rif_check_psp added");
  g_hooks[5] = taiHookFunctionExportForKernel(KERNEL_PID, 
                                              &g_rif_get_info_hook, 
                                              "SceNpDrm", 
                                              0xD84DC44A, // SceNpDrmForDriver
                                              0xDB406EAE, 
                                              rif_get_info_patched);
  if (g_hooks[5] < 0) goto fail;
  LOG("rif_get_info added");
  g_hooks[6] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_package_check_hook, 
                                              "SceNpDrm", 
                                              0xFD00C69A, // SceSblAIMgrForDriver
                                              0xD78B04A2,
                                              package_check_patched);
  LOG("package_check added");
  if (g_hooks[6] < 0) goto fail;
  g_hooks[7] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_package_check_2_hook, 
                                              "SceNpDrm", 
                                              0xFD00C69A, // SceSblAIMgrForDriver
                                              0xF4B98F66,
                                              package_check_2_patched);
  LOG("package_check_2 added");
  if (g_hooks[7] < 0) goto fail;
  g_hooks[8] = taiHookFunctionExportForKernel(KERNEL_PID, 
                                              &g_load_user_libs_hook, 
                                              "SceKernelModulemgr", 
                                              0xC445FA63, // SceModulemgrForKernel
                                              0x3AD26B43,
                                              load_user_libs_patched);
  if (g_hooks[8] < 0) goto fail;
  LOG("load_user_libs added");
  g_hooks[9] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_nid_poison_hook, 
                                              "SceKernelModulemgr", 
                                              0x63A519E5, // SceSysmemForKernel
                                              0xECF9435A, 
                                              nid_poison_patched);
  if (g_hooks[9] < 0) goto fail;
  LOG("nid_poison_patched added");
  g_hooks[10] = taiHookFunctionImportForKernel(KERNEL_PID, 
                                              &g_unload_process_hook, 
                                              "SceProcessmgr", 
                                              0xC445FA63, // SceModulemgrForKernel
                                              0x0E33258E, 
                                              unload_process_patched);
  if (g_hooks[10] < 0) goto fail;
  LOG("unload_process_patched added");

  return TAI_SUCCESS;
fail:
  if (g_hooks[0] >= 0) {
    taiHookReleaseForKernel(g_hooks[0], g_parse_headers_hook);
  }
  if (g_hooks[1] >= 0) {
    taiHookReleaseForKernel(g_hooks[1], g_setup_buffer_hook);
  }
  if (g_hooks[2] >= 0) {
    taiHookReleaseForKernel(g_hooks[2], g_decrypt_buffer_hook);
  }
  if (g_hooks[3] >= 0) {
    taiHookReleaseForKernel(g_hooks[3], g_rif_check_vita_hook);
  }
  if (g_hooks[4] >= 0) {
    taiHookReleaseForKernel(g_hooks[4], g_rif_check_psp_hook);
  }
  if (g_hooks[5] >= 0) {
    taiHookReleaseForKernel(g_hooks[5], g_rif_get_info_hook);
  }
  if (g_hooks[6] >= 0) {
    taiHookReleaseForKernel(g_hooks[6], g_package_check_hook);
  }
  if (g_hooks[7] >= 0) {
    taiHookReleaseForKernel(g_hooks[7], g_package_check_2_hook);
  }
  if (g_hooks[8] >= 0) {
    taiHookReleaseForKernel(g_hooks[8], g_load_user_libs_hook);
  }
  if (g_hooks[9] >= 0) {
    taiHookReleaseForKernel(g_hooks[9], g_nid_poison_hook);
  }
  if (g_hooks[10] >= 0) {
    taiHookReleaseForKernel(g_hooks[10], g_unload_process_hook);
  }
  return TAI_ERROR_SYSTEM;
}

int hen_remove_patches(void) {
  int ret;

  ret = taiHookReleaseForKernel(g_hooks[0], g_parse_headers_hook);
  ret |= taiHookReleaseForKernel(g_hooks[1], g_setup_buffer_hook);
  ret |= taiHookReleaseForKernel(g_hooks[2], g_decrypt_buffer_hook);
  ret |= taiHookReleaseForKernel(g_hooks[3], g_rif_check_vita_hook);
  ret |= taiHookReleaseForKernel(g_hooks[4], g_rif_check_psp_hook);
  ret |= taiHookReleaseForKernel(g_hooks[5], g_rif_get_info_hook);
  ret |= taiHookReleaseForKernel(g_hooks[6], g_package_check_hook);
  ret |= taiHookReleaseForKernel(g_hooks[7], g_package_check_2_hook);
  ret |= taiHookReleaseForKernel(g_hooks[8], g_load_user_libs_hook);
  ret |= taiHookReleaseForKernel(g_hooks[9], g_nid_poison_hook);
  ret |= taiHookReleaseForKernel(g_hooks[10], g_unload_process_hook);
  return ret;
}