Change auth info for the initial ucred to a proper one #377

ultimaweapon · 2023-10-01T12:09:16Z

Need to find (or dump?) auth info from the PS4 process that run exec on the game binary after forked.

The text was updated successfully, but these errors were encountered:

ultimaweapon · 2023-10-07T02:40:06Z

@red-prig do you know the name of (S)ELF file of the process that exec the game binary?

red-prig · 2023-10-07T13:02:12Z

@ultimaweapon I suspect that it is somewhere in the depths of vsh, but I have not found the exact location.

ultimaweapon · 2023-10-07T13:09:49Z

Thanks.

red-prig · 2023-10-08T21:31:42Z

@ultimaweapon Here is a log dump from the console, I think in combination with FW research, this can be used to judge the order of initialization
https://www.psdevwiki.com/ps4/Bootprocess

ultimaweapon · 2023-10-08T23:56:40Z

Thanks.

ultimaweapon · 2023-10-24T10:26:59Z

I think I found it. It is /system/sys/SceSysCore.elf.

ultimaweapon · 2023-10-24T11:40:07Z

@VocalFan can you help on finding auth info for /system/sys/SceSysCore.elf? Some example of auth info: https://www.psdevwiki.com/ps4/Auth_Info

VocalFan · 2023-10-24T11:41:24Z

Where is this specifically?

ultimaweapon · 2023-10-24T11:42:47Z

It need to be dumped from the kernel somehow. The scene developers should be able to give you some clues.

VocalFan · 2023-10-24T11:57:54Z

okay so, /system/vsh is the location. Will try to snag later :P

ultimaweapon · 2023-10-24T12:06:26Z

okay so, /system/vsh is the location. Will try to snag later :P

No, it is /system/sys/SceSysCore.elf.

Found some evident that it is SceSysCore.elf: OpenOrbis/mira-project#154. It is quite small which mean it is likely to be an importance and highly privileged process.

VocalFan · 2023-10-24T12:19:55Z

Eh, I found a SceSysCore.elf in /vsh/ ... Not sure how to snag the /sys/ elf if there is one.

VocalFan · 2023-10-24T12:31:27Z

Uh, email.

ultimaweapon · 2023-10-24T12:33:12Z

That one is SceShellCore.elf, not SceSysCore.elf.

VocalFan · 2023-10-24T12:43:29Z

...I am the dumb.

VocalFan · 2023-10-24T15:06:04Z

I found a payload that can get authinfo values, will do when home.

VocalFan · 2023-10-24T15:12:08Z

Or uh...
3800000000000007

https://www.psdevwiki.com/ps4/Program_Authority_ID#User_Modules

ultimaweapon · 2023-10-24T15:22:59Z

Strange. Why the value for exe and library does not match with #329 (comment). We still need the value for capabilities and attributes.

red-prig · 2023-10-24T16:18:41Z

It seems that using sys_get_self_auth_info you can dump all files in order, I’m also interested in this topic

ultimaweapon · 2023-10-24T16:27:29Z

@red-prig looking good! The problem is it seems like this syscall need to be called from the process we want to dump the auth info.

ultimaweapon · 2023-10-24T16:30:57Z

Wait, seems like the first parameter is the path for the SELF file to get the auth info!

VocalFan · 2023-10-24T16:38:59Z

Soooo, good thing, Ultima?

ultimaweapon · 2023-10-24T16:47:34Z

Yeah, I guess the payload you mentioned use this syscall to dump the auth info.

VocalFan · 2023-10-24T21:18:14Z

https://github.com/stooged/Auth-Info-Dumper/blob/master/Auth_Info_Dumper/source/main.c

Can you build a 9.00 payload for me @ultimaweapon ? Latest official build is for 5.05

ultimaweapon · 2023-10-24T21:24:58Z

Seems like it have more works than just compiling. Let me check to see if we can build a simple payload just for SceSysCore.

VocalFan · 2023-10-24T21:29:16Z

Alright, because this payload just either kills the GUI, or kernel panics

ultimaweapon · 2023-10-24T22:07:59Z

Required some works because we can't just call sys_get_self_auth_info due to the kernel will filter out most of the data we need.

VocalFan · 2023-10-24T22:45:12Z

Alrighty, just keep me updated!

red-prig · 2023-10-25T09:16:13Z

I'm also confused by unsigned char buf[136]; here you probably need to pass a link to the buffer in the guest code, because it will not return the argument data back to you

ultimaweapon · 2023-10-25T15:35:32Z

Although, probably if the application is launched in sandbox mode

We already escaped from the sandbox by calling jailbreak.

I'm also confused by unsigned char buf[136]; here you probably need to pass a link to the buffer in the guest code, because it will not return the argument data back to you

Sorry I don't understand what you mean. Could you elaborate this?

ultimaweapon · 2023-10-25T15:40:04Z

I think I found the bug in my code now. The second parameter for kexec is not directly passed to the handler. It got wrapped in another struct.

red-prig · 2023-10-25T15:55:54Z

We already escaped from the sandbox by calling jailbreak.

Yes, you are jailbreaking, but in what context does the application launch? If it's an imitation of a game, then it's a sandbox.

ultimaweapon · 2023-10-25T15:56:13Z

@VocalFan this should work.

dump-auth.zip

red-prig · 2023-10-25T15:56:39Z

I think I found the bug in my code now. The second parameter for kexec is not directly passed to the handler. It got wrapped in another struct.

Yes it is copied.

ultimaweapon · 2023-10-25T15:58:24Z

Yes, you are jailbreaking, but in what context does the application launch? If it's an imitation of a game, then it's a sandbox.

Normally the payload will be executed by the web browser. Not sure what method of Guest Payload that @VocalFan use.

red-prig · 2023-10-25T16:04:42Z

Yes, you are jailbreaking, but in what context does the application launch? If it's an imitation of a game, then it's a sandbox.

Normally the payload will be executed by the web browser. Not sure what method of Guest Payload that @VocalFan use.

I think sys_is_in_sandbox will give an exact answer to the question

red-prig · 2023-10-25T16:19:53Z

Sorry I don't understand what you mean. Could you elaborate this?

i mean:

struct get_auth_args {
	const char *file;
	const char *buf;
};

red-prig · 2023-10-25T16:31:15Z

Although if args is copied simply as a link, then for args->file you must first do copyin(args->file, file, 8); and then error = kern_get_self_auth_info(td, file, 0, info);

VocalFan · 2023-10-25T17:06:31Z

Normally the payload will be executed by the web browser. Not sure what method of Guest Payload that @VocalFan use.

I use AlAzif's Payload Guest, which puts the payload into GoldenHen's payload server... Basically, it has jailbreak/admin access.

ultimaweapon · 2023-10-25T17:38:45Z

@VocalFan see my above comments for the newer version. That one should work.

VocalFan · 2023-10-25T17:39:48Z

I am having the ultimate battle of moving myself from my bed.

VocalFan · 2023-10-25T17:45:03Z

07 00 00 00 00 00 00 38 00 00 00 00 00 1C 00 40
00 FF 00 00 00 00 00 80 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 80 00 40 00 40
00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 08
00 40 FF FF 00 00 00 F0 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

Or just whole:

07 00 00 00 00 00 00 38 00 00 00 00 00 1C 00 40 00 FF 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 00 40 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 08 00 40 FF FF 00 00 00 F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

red-prig · 2023-10-25T17:48:29Z

Seems true

VocalFan · 2023-10-25T17:55:22Z

Seems true

Its similar to another SELF's Auth Info

VocalFan · 2023-10-25T17:56:56Z

  0000  01 00 00 00 00 10 00 38 00 00 00 00 00 1c 00 40  .......8.......@
  0010  00 ff 00 00 00 00 00 80 00 00 00 00 00 00 00 00  ................
  0020  00 00 00 00 00 00 00 00 00 00 00 c0 00 40 00 40  .............@.@
  0030  00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 f0  ................
  0040  00 40 ff ff 00 00 00 f0 00 00 00 00 00 00 00 00  .@..............
  0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0080  00 00 00 00 00 00 00 00

orbis_swu.self

  0000  07 00 00 00 00 00 00 38 00 00 00 00 00 1c 00 40  .......8.......@
  0010  00 ff 00 00 00 00 00 80 00 00 00 00 00 00 00 00  .ÿ.....€........
  0020  00 00 00 00 00 00 00 00 00 00 00 80 00 40 00 40  ...........€.@.@
  0030  00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 08  .......€........
  0040  00 40 ff ff 00 00 00 f0 00 00 00 00 00 00 00 00  .@ÿÿ...ð........
  0050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  0080  00 00 00 00 00 00 00 00

SceSysCore.self

Note, I added SceSysCore to the Wiki's Auth Info page now, but it's pending approval... Either way, these two SELFs are similar in some ways, different in others.

red-prig · 2023-10-25T18:09:20Z

07 00 00 00 00 00 00 38 00 00 00 00 00 1C 00 40
00 FF 00 00 00 00 00 80 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 80 00 40 00 40
00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 08
00 40 FF FF 00 00 00 F0 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00

Or just whole:

07 00 00 00 00 00 00 38 00 00 00 00 00 1C 00 40 00 FF 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 40 00 40 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 08 00 40 FF FF 00 00 00 F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Judging by: https://www.psdevwiki.com/ps4/Program_Authority_ID#User_Modules 3800000000000007 this is SceSysCore.self so I think everything is correct

ultimaweapon · 2023-10-25T19:20:23Z

@red-prig do you know what is Decid process?

red-prig · 2023-10-25T19:38:03Z

@red-prig do you know what is Decid process?

This probably has something to do with the debug, I didn't dig into it. Probably the hackers who broke the console can tell you more.

ultimaweapon · 2023-10-25T19:53:32Z

Thanks.

VocalFan · 2023-10-26T05:26:48Z

@ultimaweapon

For your working payload ^

ultimaweapon · 2023-10-26T22:35:50Z

It is just a very basic payload with hard coded input. Also it is fixed to 9.0 kernel only. So I don't want to create a repository for a quick and dirty thing.

VocalFan · 2023-10-26T23:06:06Z

It is just a very basic payload with hard coded input. Also it is fixed to 9.0 kernel only. So I don't want to create a repository for a quick and dirty thing.

But 9.00 is the latest jailbreakable, plus people can just modify the input before compiling.

ultimaweapon · 2023-10-27T20:20:51Z

https://github.com/obhq/auth-dumper

ultimaweapon added the T-enhancement Type: Enhancement label Oct 1, 2023

ultimaweapon mentioned this issue Oct 23, 2023

Fix syscall 610 to return a proper process type #411

Closed

ultimaweapon mentioned this issue Nov 5, 2023

Implements syscall 487 #426

Merged

ultimaweapon assigned ultimaweapon, VocalFan and red-prig Nov 5, 2023

SuchAFuriousDeath closed this as completed in #426 Nov 7, 2023

Change auth info for the initial ucred to a proper one #377

Change auth info for the initial ucred to a proper one #377

Comments

ultimaweapon commented Oct 1, 2023

ultimaweapon commented Oct 7, 2023

red-prig commented Oct 7, 2023

ultimaweapon commented Oct 7, 2023

red-prig commented Oct 8, 2023

ultimaweapon commented Oct 8, 2023

ultimaweapon commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

VocalFan commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

red-prig commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

ultimaweapon commented Oct 24, 2023

VocalFan commented Oct 24, 2023

red-prig commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

red-prig commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

red-prig commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

red-prig commented Oct 25, 2023

red-prig commented Oct 25, 2023

red-prig commented Oct 25, 2023

VocalFan commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

VocalFan commented Oct 25, 2023

VocalFan commented Oct 25, 2023 • edited Loading

red-prig commented Oct 25, 2023

VocalFan commented Oct 25, 2023

VocalFan commented Oct 25, 2023

red-prig commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

red-prig commented Oct 25, 2023

ultimaweapon commented Oct 25, 2023

VocalFan commented Oct 26, 2023

ultimaweapon commented Oct 26, 2023

VocalFan commented Oct 26, 2023

ultimaweapon commented Oct 27, 2023

VocalFan commented Oct 25, 2023 •

edited

Loading