From 116a576d71140df0254236b70396a9d963e56a83 Mon Sep 17 00:00:00 2001 From: Kameleon <77245601+kmeps4@users.noreply.github.com> Date: Sat, 17 May 2025 08:00:57 -0600 Subject: [PATCH] Suggested by ABC + ChendoChap Kernel Patches --- kpatch/900.c | 165 ++++++++++++++----------------------------------- kpatch/900.elf | Bin 5216 -> 5272 bytes kpatch/900.o | Bin 1832 -> 1864 bytes lapse.mjs | 15 ++++- 4 files changed, 61 insertions(+), 119 deletions(-) diff --git a/kpatch/900.c b/kpatch/900.c index bff4857..5468a4a 100644 --- a/kpatch/900.c +++ b/kpatch/900.c @@ -35,7 +35,7 @@ void restore(struct kexec_args *uap); __attribute__((section (".text.start"))) int kpatch(void *td, struct kexec_args *uap) { do_patch(); - restore(uap); + //restore(uap); Disable to backtrace return 0; } @@ -53,124 +53,55 @@ void restore(struct kexec_args *uap) { void do_patch(void) { // offset to fast_syscall() - const size_t off_fast_syscall = 0x1c0; - void * const kbase = (void *)rdmsr(0xc0000082) - off_fast_syscall; + const size_t off_fast_syscall = 0x1C0; + void * const kbase = (void *)rdmsr(0xC0000082) - off_fast_syscall; disable_cr0_wp(); - - // patch amd64_syscall() to allow calling syscalls everywhere - - // struct syscall_args sa; // initialized already - // u64 code = get_u64_at_user_address(td->tf_frame-tf_rip); - // int is_invalid_syscall = 0 - // - // // check the calling code if it looks like one of the syscall stubs at a - // // libkernel library and check if the syscall number correponds to the - // // proper stub - // if ((code & 0xff0000000000ffff) != 0x890000000000c0c7 - // || sa.code != (u32)(code >> 0x10) - // ) { - // // patch this to " = 0" instead - // is_invalid_syscall = -1; - // } - write32(kbase, 0x490, 0); - // these code corresponds to the check that ensures that the caller's - // instruction pointer is inside the libkernel library's memory range - // - // // patch the check to always go to the "goto do_syscall;" line - // void *code = td->td_frame->tf_rip; - // if (libkernel->start <= code && code < libkernel->end - // && is_invalid_syscall == 0 - // ) { - // goto do_syscall; - // } - // - // do_syscall: - // ... - // lea rsi, [rbp - 0x78] - // mov rdi, rbx - // mov rax, qword [rbp - 0x80] - // call qword [rax + 8] ; error = (sa->callp->sy_call)(td, sa->args) - // - // sy_call() is the function that will execute the requested syscall. - write16(kbase, 0x4b5, 0x9090); - write16(kbase, 0x4b9, 0x9090); - write8(kbase, 0x4c2, 0xeb); - - // patch sys_mmap() to allow rwx mappings - - // patch maximum cpu mem protection: 0x33 -> 0x37 - // the ps4 added custom protections for their gpu memory accesses - // GPU X: 0x8 R: 0x10 W: 0x20 - // that's why you see other bits set - // ref: https://cturt.github.io/ps4-2.html - write8(kbase, 0x16632A, 0x37); - write8(kbase, 0x16632D, 0x37); - - // patch vm_map_protect() (called by sys_mprotect()) to allow rwx mappings - // - // this check is skipped after the patch - // - // if ((new_prot & current->max_protection) != new_prot) { - // vm_map_unlock(map); - // return (KERN_PROTECTION_FAILURE); - // } - write32(kbase, 0x80b8d, 0); - - // patch sys_dynlib_dlsym() to allow dynamic symbol resolution everywhere - - // call ... - // mov r14, qword [rbp - 0xad0] - // cmp eax, 0x4000000 - // jb ... ; patch jb to jmp - write8(kbase, 0x23b67f, 0xeb); - // patch called function to always return 0 - // - // sys_dynlib_dlsym: - // ... - // mov edi, 0x10 ; 16 - // call patched_function ; kernel_base + 0x221b40 - // test eax, eax - // je ... - // mov rax, qword [rbp - 0xad8] - // ... - // patched_function: ; patch to "xor eax, eax; ret" - // push rbp - // mov rbp, rsp - // ... - write32(kbase, 0x221b40, 0xC3C03148); - - // patch sys_setuid() to allow freely changing the effective user ID - - // ; PRIV_CRED_SETUID = 50 - // call priv_check_cred(oldcred, PRIV_CRED_SETUID, 0) - // test eax, eax - // je ... ; patch je to jmp - write8(kbase, 0x1A06, 0xeb); - - // overwrite the entry of syscall 11 (unimplemented) in sysent - // - // struct args { - // u64 rdi; - // u64 rsi; - // u64 rdx; - // u64 rcx; - // u64 r8; - // u64 r9; - // }; - // - // int sys_kexec(struct thread td, struct args *uap) { - // asm("jmp qword ptr [rsi]"); - // } - - // sysent[11] + //ChendoChap Patches For 900 + const size_t KERNEL_enable_syscalls_1 = 0x490; + const size_t KERNEL_enable_syscalls_2 = 0x4B5; + const size_t KERNEL_enable_syscalls_3 = 0x4B9; + const size_t KERNEL_enable_syscalls_4 = 0x4C2; + const size_t KERNEL_mprotect = 0x80B8D; + const size_t KERNEL_prx = 0x23AEC4; + const size_t KERNEL_mmap_1 = 0x16632A; + const size_t KERNEL_mmap_2 = 0x16632D; + const size_t KERNEL_dlsym_1 = 0x23B67F; + const size_t KERNEL_dlsym_2 = 0x221b40; + const size_t KERNEL_setuid = 0x1A06; + const size_t KERNEL_bzero = 0x2713FD; + const size_t KERNEL_pagezero = 0x271441; + const size_t KERNEL_memcpy = 0x2714BD; + const size_t KERNEL_pagecopy = 0x271501; + const size_t KERNEL_copyin = 0x2716AD; + const size_t KERNEL_copyinstr = 0x271B5D; + const size_t KERNEL_copystr = 0x271C2D; + const size_t KERNEL_veriPatch = 0x626874; + const size_t KERNEL_setcr0_patch = 0x3ade3B; + write32(kbase, KERNEL_enable_syscalls_1, 0); + write16(kbase, KERNEL_enable_syscalls_2, 0x9090); + write16(kbase, KERNEL_enable_syscalls_3, 0x9090); + write8(kbase, KERNEL_enable_syscalls_4, 0xEB); + write8(kbase, KERNEL_mmap_1, 0x37); + write8(kbase, KERNEL_mmap_2, 0x37); + write32(kbase, KERNEL_mprotect, 0); + write8(kbase, KERNEL_dlsym_1, 0xEB); + write32(kbase, KERNEL_dlsym_2, 0xC3C03148); + write8(kbase, KERNEL_setuid, 0xEB); + write16(kbase, KERNEL_prx, 0xE990); + write8(kbase, KERNEL_bzero, 0xEB); + write8(kbase, KERNEL_pagezero, 0xEB); + write8(kbase, KERNEL_memcpy, 0xEB); + write8(kbase, KERNEL_pagecopy, 0xEB); + write8(kbase, KERNEL_copyin, 0xEB); + write8(kbase, KERNEL_copyinstr, 0xEB); + write8(kbase, KERNEL_copystr, 0xEB); + write16(kbase, KERNEL_veriPatch, 0x9090); + write32(kbase, KERNEL_setcr0_patch, 0xC3C7220F); const size_t offset_sysent_11 = 0x1100520; - // .sy_narg = 6 - write32(kbase, offset_sysent_11, 6); - // .sy_call = gadgets['jmp qword ptr [rsi]'] + write32(kbase, offset_sysent_11, 2); write64(kbase, offset_sysent_11 + 8, kbase + 0x4c7ad); - // .sy_thrcnt = SY_THR_STATIC - write32(kbase, offset_sysent_11 + 0x2c, 1); - + write32(kbase, offset_sysent_11 + 0x2c, 1); + enable_cr0_wp(); -} +} \ No newline at end of file diff --git a/kpatch/900.elf b/kpatch/900.elf index b7cb1f9a2307f16745ecbbba25fe4008b56e779d..f41b7debf38d85fe4086646c2e2d939d518c7bc1 100644 GIT binary patch delta 393 zcmaE$F++2L2IGy1n&yTF7#Y9-Ml%RN_yJE#Qdoe@If4-W9H2T*5P##uVt%d{PC(`k zkj!Lhf$bq_#~Y8VQ)Za(@>t_vVReSr#~K|)z|>v{#V88qtrY`PvC?2lR|ZG{b(Ul# zF-(|nywUoe6$8K0@x#X(6<7rrnI_*9@Q+yj@Be=rkTpO6a+m=Sp9hM40|@{DNX!L@ z3xHz$AORp?lxDVG@&EsSW*|ESDEE(X#^fb@DGeFI2OJSZ`FfuMyU%vWHIKtc+L zg%}tayn!^xw=jE@q2m0LIfdjI`6p`%U1xNh%qXlc=m8BE4`?`rOm-C3=Y*L%XL6;m cJ>!ANJAq`zn&yTbj0|7^qZtGs{D7w=DJ(!{iXeoa0#wHd;%}T-%r747(fRp> zH<0VmdH)4Fklq1O6+M|xU_1NqMg>*@Mz+b4g8m6#{{8=N1Cjy)kiiB(Ec5^W|CJyC zAdmoJ7a-mMR3`%xaOD$dW(wou05Tb+nXMN9)iMLwbAa+sfb1PWdJm8WnR@|9Pdq3w z`G%kcW6ESfA#uqFph}P%VWuks*+LAA3^J1)h2$A!CMODAXJnjgDXcHZ0rd?B)ORtH gD~0tr;eMRFQP`fbWAaBJX)xJP#GWx}a-oPi09PVWtN;K2 diff --git a/kpatch/900.o b/kpatch/900.o index 9fde2d4aa8b97b697f66eae88d41055ee195d2f2..7fd37c8c3a753063bb0e731f764d65c91f6d5b9a 100644 GIT binary patch delta 298 zcmZ3%cY<$%2IGl|nrB1OjyE1zr_3MY4fVwf=Dc%$__D+Ye0tV4m#6X2+z#G`We*j`70egKYMU0h1Zo)d43GOKJcB delta 238 zcmX@Xw}Nki2IGo}nrGRMH!83SFtSbdV$=~2_UQclf&mCTI`4z&9UxBhStUzc_WiJqs-)!OzMoBlRq+v^9n-MvH)q8&3~D+ z85y5WHe?c>Y{R0$s5&{3#U4m5WU=Q|WrV1d0n7ejQQ_Rd1Q9WqtjTK5=r}o%)t)hT x@>?J?8|dj)cjYZ01Zam?kH&*)e@!oV