Draft notes from developing shadps4
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Fri May 26, 2023 8:12 am
First demo from sdk that i am trying to get it working.
Started with elf loading :
ELF header is :
Code: Select all
======= Elf header ===========
ident ............: 0x7F454C46
ident class.......: ELF_CLASS_64
ident data .......: ELF_DATA_2LSB
ident version.....: ELF_VERSION_CURRENT
ident osabi .....: ELF_OSABI_FREEBSD
ident abiversion..: ELF_ABI_VERSION_AMDGPU_HSA_V2
ident UNK ........: 0x000000000000
type ............: ET_SCE_DYNEXEC
machine ..........: EM_X86_64
version ..........: EV_CURRENT
entry ............: 0x0000000000000de0
phoff ............: 0x0000000000000040
shoff ............: 0x000000000003a7e4
flags ............: 0x00000000
ehsize ...........: 64
phentsize ........: 56
phnum ............: 11
shentsize ........: 64
shnum ............: 29
shstrndx .........: 26
it has program and section headers , we won't do more about section headers since it appears to be valid only in debug applications
We got 11 program headers :
Code: Select all
====== PROGRAM HEADER 0 ========
p_type ....: Loadable
p_flags ...: PF_READ_EXEC
p_offset ..: 0x0000000000004000
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000023668
p_memsz ...: 0x0000000000023668
p_align ...: 0x0000000000004000
====== PROGRAM HEADER 1 ========
p_type ....: SCE Read-Only After Relocation
p_flags ...: PF_READ
p_offset ..: 0x0000000000028000
p_vaddr ...: 0x0000000000024000
p_paddr ...: 0x0000000000024000
p_filesz ..: 0x0000000000000450
p_memsz ...: 0x0000000000004000
p_align ...: 0x0000000000004000
====== PROGRAM HEADER 2 ========
p_type ....: Loadable
p_flags ...: PF_READ_WRITE
p_offset ..: 0x000000000002c000
p_vaddr ...: 0x0000000000028000
p_paddr ...: 0x0000000000028000
p_filesz ..: 0x00000000000000b0
p_memsz ...: 0x00000000000000e0
p_align ...: 0x0000000000004000
====== PROGRAM HEADER 3 ========
p_type ....: SCE Processor Parameters
p_flags ...: PF_READ
p_offset ..: 0x000000000002c000
p_vaddr ...: 0x0000000000028000
p_paddr ...: 0x0000000000028000
p_filesz ..: 0x0000000000000050
p_memsz ...: 0x0000000000000050
p_align ...: 0x0000000000000008
====== PROGRAM HEADER 4 ========
p_type ....: Dynamic
p_flags ...: PF_READ_WRITE
p_offset ..: 0x000000000002d6c8
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000000340
p_memsz ...: 0x0000000000000340
p_align ...: 0x0000000000000008
====== PROGRAM HEADER 5 ========
p_type ....: Interpreter Path
p_flags ...: PF_READ
p_offset ..: 0x0000000000004000
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000000015
p_memsz ...: 0x0000000000000015
p_align ...: 0x0000000000000001
====== PROGRAM HEADER 6 ========
p_type ....: Thread-Local Storage
p_flags ...: PF_READ
p_offset ..: 0x0000000000000000
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000000000
p_memsz ...: 0x0000000000000000
p_align ...: 0x0000000000000001
====== PROGRAM HEADER 7 ========
p_type ....: GNU Entry Header Frame
p_flags ...: PF_READ
p_offset ..: 0x0000000000026c0c
p_vaddr ...: 0x0000000000022c0c
p_paddr ...: 0x0000000000022c0c
p_filesz ..: 0x0000000000000a5c
p_memsz ...: 0x0000000000000a5c
p_align ...: 0x0000000000000004
====== PROGRAM HEADER 8 ========
p_type ....: SCE Dynamic Library Data
p_flags ...: PF_READ
p_offset ..: 0x000000000002c0b0
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000001958
p_memsz ...: 0x0000000000000000
p_align ...: 0x0000000000000010
====== PROGRAM HEADER 9 ========
p_type ....: SCE Comment
p_flags ...: PF_NONE
p_offset ..: 0x000000000002da10
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000000078
p_memsz ...: 0x0000000000000000
p_align ...: 0x0000000000000010
====== PROGRAM HEADER 10 ========
p_type ....: SCE Library Version
p_flags ...: PF_NONE
p_offset ..: 0x000000000002da88
p_vaddr ...: 0x0000000000000000
p_paddr ...: 0x0000000000000000
p_filesz ..: 0x0000000000000183
p_memsz ...: 0x0000000000000000
p_align ...: 0x0000000000000010
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Fri May 26, 2023 8:14 am
The above can be seen in the self/elf viewer in imgui
elfviewer.png (15.52 KiB) Viewed 18155 times
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Fri May 26, 2023 8:16 am
Now let's start parsing program headers and load them to memory.
We have 2 headers with LOAD and 1 with RECOLATION we shall progress
Code: Select all
program header = [0] type = Loadable
segment_addr ..........: 0x0000000900000000
segment_file_size .....: 145000
segment_memory_size ...: 147456
segment_mode ..........: (R_X)
program header = [1] type = SCE Read-Only After Relocation
segment_addr ..........: 0x0000000900024000
segment_file_size .....: 1104
segment_memory_size ...: 16384
segment_mode ..........: (R__)
program header = [2] type = Loadable
segment_addr ..........: 0x0000000900028000
segment_file_size .....: 176
segment_memory_size ...: 16384
segment_mode ..........: (RW_)
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Fri May 26, 2023 8:20 am
The rest 8 program headers defines as
Code: Select all
Unimplemented type SCE Processor Parameters
Unimplemented type Dynamic
Unimplemented type Interpreter Path
Unimplemented type Thread-Local Storage
Unimplemented type GNU Entry Header Frame
Unimplemented type SCE Dynamic Library Data
Unimplemented type SCE Comment
Unimplemented type SCE Library Version
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Tue May 30, 2023 3:03 pm
just a bit dissasembly (using zydis library) seems that shadps4 setup stack frame properly
Code: Select all
program entry addr ..........: 0x0000000900000de0
0000000900000DE0 push rbp
0000000900000DE1 mov rbp, rsp
0000000900000DE4 push r15
0000000900000DE6 push r14
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Thu Jun 08, 2023 9:36 am
Started parsing dynamic info tags appears to be normal
Code: Select all
dynamic tags ..........: 0x0000000061000025
dynamic tags ..........: 0x0000000061000035
dynamic tags ..........: 0x0000000061000037
dynamic tags ..........: 0x0000000061000039
dynamic tags ..........: 0x000000006100003d
dynamic tags ..........: 0x000000006100003f
dynamic tags ..........: 0x000000000000000c
dynamic tags ..........: 0x000000000000000d
dynamic tags ..........: 0x0000000061000027
dynamic tags ..........: 0x0000000061000029
dynamic tags ..........: 0x000000006100002d
dynamic tags ..........: 0x000000006100002b
dynamic tags ..........: 0x000000006100002f
dynamic tags ..........: 0x0000000061000031
dynamic tags ..........: 0x0000000061000033
dynamic tags ..........: 0x0000000000000019
dynamic tags ..........: 0x000000000000001b
dynamic tags ..........: 0x000000000000001a
dynamic tags ..........: 0x000000000000001c
dynamic tags ..........: 0x0000000000000020
dynamic tags ..........: 0x0000000000000021
dynamic tags ..........: 0x000000006100003b
dynamic tags ..........: 0x0000000000000015
dynamic tags ..........: 0x0000000000000016
dynamic tags ..........: 0x000000000000001e
dynamic tags ..........: 0x0000000000000001
dynamic tags ..........: 0x0000000000000001
dynamic tags ..........: 0x0000000000000001
dynamic tags ..........: 0x0000000000000001
dynamic tags ..........: 0x0000000000000001
dynamic tags ..........: 0x000000006100000f
dynamic tags ..........: 0x000000006100000f
dynamic tags ..........: 0x000000006100000f
dynamic tags ..........: 0x000000006100000f
dynamic tags ..........: 0x000000006100000f
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000015
dynamic tags ..........: 0x0000000061000019
dynamic tags ..........: 0x0000000061000007
dynamic tags ..........: 0x0000000061000009
dynamic tags ..........: 0x000000006100000d
dynamic tags ..........: 0x0000000061000011
shadow
Site Admin
Posts: 18 Joined: Wed May 10, 2023 4:35 pm
Post
by shadow Tue Jun 13, 2023 1:13 pm
next coming the symbols loading dummy atm
Code: Select all
symbol b0xyllnVY-I#C#D
symbol b08AgtPlHPg#C#D
symbol ihxrbsoSKWc#C#D
symbol 5udAm+6boVg#C#D
symbol qpGITzPE+Zc#C#D
symbol jtkqXpAOY6w#C#D
symbol XiyzNZ9J4nQ#C#D
symbol +xuDhxlWRPg#C#D
symbol zwY0YV91TTI#C#D
symbol xbxNatawohc#C#D
symbol Ga6r7H6Y0RI#C#D
symbol f33OrruQYbM#C#D
symbol jRcI8VcgTz4#C#D
symbol PVT+fuoS9gU#C#D
symbol yvZ73uQUqrk#C#D
symbol UtObDRQiGbs#C#D
symbol bX5IbRvECXk#C#D
symbol byXlqupd8cE#C#D
symbol HHo1BAljZO8#C#D
symbol TLV4mswiZ4A#C#D
symbol ArSg-TGinhk#C#D
symbol R6z1xM3pW-w#C#D
symbol d88anrgNoKY#C#D
symbol Fa3x75OOLRA#C#D
symbol iBt3Oe00Kvc#C#D
symbol UoYY0DWMC0U#C#D
symbol H7-fgvEutM0#C#D
symbol oL4hGI1PMpw#C#D
symbol tZCSL5ulnB4#C#D
symbol iFirFzgYsvw#C#D
symbol KnldROUkWJY#C#D
symbol FFVZcCu3zWU#C#D
symbol dewXw5roLs0#C#D
symbol fzJdEihTFV4#C#D
symbol nEyFbYUloIM#C#D
symbol k7iGTvDQPLQ#C#D
symbol ln33zjBrfjk#C#D
symbol jg33rEKLfVs#C#D
symbol 26PM5Mzl8zc#C#D
symbol RU74kek-N0c#C#D
symbol 29oKvKXzEZo#C#D
symbol A+uGq+3KFtQ#C#D
symbol u9YKpRRHe-M#C#D
symbol gObODli-OH8#C#D
symbol 6YRHhh5mHCs#C#D
symbol f85orjx7qts#C#D
symbol HXzjK9yI30k#B#C
symbol SbU3dwp80lQ#B#C
symbol 6kPnj51T62Y#B#C
symbol zgXifHT9ErY#B#C
symbol Up36PTk687E#B#C
symbol w3BY+tAEiQY#B#C
symbol i6-sR91Wt-4#B#C
symbol CBiu4mCE1DA#B#C
symbol U46NwOiJpys#B#C
symbol P330P3dFF68#F#F
symbol bzQExy189ZI#F#F
symbol 8G2LB+A3rzg#F#F
symbol XKRegsFpEpk#F#F
symbol uMei1W9uyNo#F#F
symbol 3GPpjQdAMTw#F#F
symbol 9rAeANT2tyE#F#F
symbol DfivPArhucg#F#F
symbol Q3VBxCXhUHs#F#F
symbol Ou3iL1abvng#E#B
symbol f7uOxY9mM1U#E#B
symbol rTXw65xmLIA#E#B
symbol D0OdFMjp46I#E#B
symbol pO96TwzOm5E#E#B
symbol WslcK1FQcGI#E#B
symbol L-Q3LEjIbgA#E#B
symbol MBuItvba6z8#E#B
symbol fzyMKs9kim0#E#B