Kameleon
145 lines
4.5 KiB
C
145 lines
4.5 KiB
C
/* Copyright (C) 2024 anonymous
|
|
|
|
This file is part of PSFree.
|
|
|
|
PSFree is free software: you can redistribute it and/or modify
|
|
it under the terms of the GNU Affero General Public License as
|
|
published by the Free Software Foundation, either version 3 of the
|
|
License, or (at your option) any later version.
|
|
|
|
PSFree is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
GNU Affero General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Affero General Public License
|
|
along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
|
|
|
#include <stddef.h>
|
|
|
|
#include "types.h"
|
|
#include "utils.h"
|
|
|
|
// Args:
|
|
// res:
|
|
// Needed value to return (as to not crash) if the caller of the hijacked
|
|
// function is expecting some valid value.
|
|
// error:
|
|
// Address to return an error. 0 for success.
|
|
__attribute__((section (".text.start")))
|
|
u64 kpatch(u64 res, u64 *error) {
|
|
// offset to fast_syscall()
|
|
const size_t off_fast_syscall = 0x1c0;
|
|
void * const kbase = (void *)rdmsr(0xc0000082) - off_fast_syscall;
|
|
|
|
disable_cr0_wp();
|
|
|
|
// patch amd64_syscall() to allow calling syscalls everywhere
|
|
|
|
// mov ecx, 0xffffffff ; at 0x490, patch to "mov ecx, 0"
|
|
// mov rax, qword [r15 + 0x340] ; check if libkernel is loaded
|
|
// test rax, rax
|
|
// je not_loaded
|
|
// ; 0x4b5 and 0x4b9 are replaced with NOPs so that we always reach
|
|
// ; 0x4c2
|
|
// ...
|
|
// je target ; at 0x4c2, patch je to jmp
|
|
// not_loaded:
|
|
// test ecx, ecx, ; ecx = 0, always jump to target
|
|
// je target
|
|
// ...
|
|
// target:
|
|
// test byte [rbx + 0x469], 2
|
|
// jne ...
|
|
//
|
|
// Following the target code path, you will at one point reach this:
|
|
// lea rsi, [rbp + 0x78]
|
|
// mov rdi, rbx
|
|
// mov rax, qword [rbp + 0x80]
|
|
// call qword [rax + 8] ; error = (sa->callp->sy_call)(td, sa->args)
|
|
//
|
|
// sy_call() is the function that will execute the requested syscall.
|
|
write32(kbase, 0x490, 0);
|
|
write16(kbase, 0x4b5, 0x9090);
|
|
write16(kbase, 0x4b9, 0x9090);
|
|
write8(kbase, 0x4c2, 0xeb);
|
|
|
|
// patch sys_mmap() to allow rwx mappings
|
|
|
|
// patch maximum cpu mem protection: 0x33 -> 0x37
|
|
// the ps4 added custom protections for their gpu memory accesses
|
|
// GPU R: 0x10, W: 0x20, X:, 0x40
|
|
// that's why you see other bits set
|
|
write8(kbase, 0xfd03a, 0x37);
|
|
write8(kbase, 0xfd03d, 0x37);
|
|
|
|
// patch vm_map_protect() (called by sys_mprotect()) to allow rwx mappings
|
|
write32(kbase, 0x3ec68d, 0);
|
|
|
|
// patch sys_dynlib_dlsym() to allow dynamic symbol resolution everywhere
|
|
|
|
// call ...
|
|
// mov r14, qword [rbp + 0xad0]
|
|
// cmp eax, 0x4000000
|
|
// jb ... ; patch je to jmp
|
|
write8(kbase, 0x31953f, 0xeb);
|
|
// patch called function to always return 0
|
|
//
|
|
// sys_dynlib_dlysm:
|
|
// ...
|
|
// mov edi, 0x10 ; 16
|
|
// call patched_function ; kernel_base + 0x951c0
|
|
// test eax, eax
|
|
// je ...
|
|
// mov rax, qword [rbp + 0xad8]
|
|
// ...
|
|
// patched_function: ; patch to "xor eax, eax; ret"
|
|
// push rbp
|
|
// mov rbp, rsp
|
|
// ...
|
|
write32(kbase, 0x951c0, 0xC3C03148);
|
|
|
|
// patch sys_setuid() to allow freely changing the effective user ID
|
|
|
|
// ; PRIV_CRED_SETUID = 50
|
|
// call priv_check_cred(oldcred, PRIV_CRED_SETUID, 0)
|
|
// test eax, eax
|
|
// je ... ; patch je to jmp
|
|
write8(kbase, 0x34d696, 0xeb);
|
|
|
|
// overwrite the entry of syscall 11 (unimplemented) in sysent
|
|
//
|
|
// struct args {
|
|
// u64 rdi;
|
|
// u64 rsi;
|
|
// u64 rdx;
|
|
// u64 rcx;
|
|
// u64 r8;
|
|
// u64 r9;
|
|
// }
|
|
//
|
|
// jumps to uap->rdi
|
|
// u64 sys_kexec(struct thread td, struct args *uap)
|
|
|
|
// sysent[11]
|
|
const size_t offset_sysent_11 = 0x10fc6e0;
|
|
// .sy_narg = 6
|
|
write32(kbase, offset_sysent_11, 6);
|
|
// .sy_call = gadgets['jmp qword ptr [rsi]']
|
|
write64(kbase, offset_sysent_11 + 8, kbase + 0xe629c);
|
|
// .sy_thrcnt = SY_THR_STATIC
|
|
write32(kbase, offset_sysent_11 + 0x2c, 1);
|
|
|
|
// restore socketops.fo_chmod
|
|
// it was used initially to perform kernel code execution
|
|
write64(kbase, 0x1a76060, kbase + 0x3d0a60);
|
|
|
|
enable_cr0_wp();
|
|
|
|
if (error != NULL) {
|
|
*error = 0;
|
|
}
|
|
end:
|
|
return res;
|
|
}
|