diff --git a/Filesystems/3.04M+ - English language/VIDEO_TS/VIDEO_TS.IFO b/Filesystems/3.04M+ - English language/VIDEO_TS/VIDEO_TS.IFO index 4c65026..d97fe69 100644 Binary files a/Filesystems/3.04M+ - English language/VIDEO_TS/VIDEO_TS.IFO and b/Filesystems/3.04M+ - English language/VIDEO_TS/VIDEO_TS.IFO differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/build.sh b/PAYLOADS/All PS2 slims (3.10 + 3.11)/build.sh index 7351010..238f677 100644 --- a/PAYLOADS/All PS2 slims (3.10 + 3.11)/build.sh +++ b/PAYLOADS/All PS2 slims (3.10 + 3.11)/build.sh @@ -12,17 +12,25 @@ ENTRY=0x01fff99c echo $ENTRY -echo "Building crt0 (3.10)" +echo "Building jump for 3.04J" +ee-gcc -Ttext=0x012811E4 -DJUMP=0x01281340 jump.S -o jump.elf -nostartfiles -nostdlib -ffreestanding -Wl,-z,max-page-size=0x1 +ee-objcopy -O binary jump.elf jump.bin -Wl,-z,max-page-size=0x1 +echo "Building crt0 (3.04J)" +ee-gcc -Ttext=0x01281340 -DENTRY=$ENTRY -DGETBUFFERINTERNAL=0x261560 crt0.S -o crt0_3.04J.elf -nostartfiles -nostdlib -ffreestanding -Wl,-z,max-page-size=0x1 +ee-objcopy -O binary crt0_3.04J.elf crt0_3.04J.bin -Wl,-z,max-page-size=0x1 + +echo "Building crt0 (3.10)" ee-gcc -Ttext=0x01500014 -DENTRY=$ENTRY -DGETBUFFERINTERNAL=0x2986a0 crt0.S -o crt0_3.10.elf -nostartfiles -nostdlib -ffreestanding -Wl,-z,max-page-size=0x1 ee-objcopy -O binary crt0_3.10.elf crt0_3.10.bin -Wl,-z,max-page-size=0x1 echo "Building crt0 (3.11)" - ee-gcc -Ttext=0x01500014 -DENTRY=$ENTRY -DGETBUFFERINTERNAL=0x2952f0 crt0.S -o crt0_3.11.elf -nostartfiles -nostdlib -ffreestanding -Wl,-z,max-page-size=0x1 ee-objcopy -O binary crt0_3.11.elf crt0_3.11.bin -Wl,-z,max-page-size=0x1 echo "Done." +echo "Insert jump.bin into VIDEO_TS.IFO at offset 0x2724" +echo "Insert crt0_3.04J.bin into VIDEO_TS.IFO at offset 0x2880" echo "Insert crt0_3.10.bin into VIDEO_TS.IFO at offset 0x2bb4" echo "Insert crt0_3.11.bin into VIDEO_TS.IFO at offset 0x2954" echo "Insert payload.bin into VIDEO_TS.IFO at offset 0x3000" diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.bin b/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.bin new file mode 100644 index 0000000..56c2d04 Binary files /dev/null and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.bin differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.elf b/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.elf new file mode 100644 index 0000000..0f58533 Binary files /dev/null and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/crt0_3.04J.elf differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.S b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.S new file mode 100644 index 0000000..ee22303 --- /dev/null +++ b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.S @@ -0,0 +1,8 @@ +.set noreorder # If we're writing assembly, why would we want this? + +.section .text.startup + +.global _start +_start: + j JUMP + nop diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.bin b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.bin new file mode 100644 index 0000000..e6861a6 Binary files /dev/null and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.bin differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.elf b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.elf new file mode 100644 index 0000000..ccdf4b4 Binary files /dev/null and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/jump.elf differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.bin b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.bin index b26df22..a459837 100644 Binary files a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.bin and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.bin differ diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.c b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.c index 58babe9..cd6b7a3 100644 --- a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.c +++ b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.c @@ -95,7 +95,19 @@ __attribute__((noreturn)) void _start(void) { int i; // Identify version based on jump target location - if((*(void **)0x5f1f38) == (void *)0x1500014) { + if((*(void **)0x6D9C3C) == (void *)0x126b7e0) { + // 3.04J + pointToIFO = (void *)0x23dfe0; + getDiscData = (void *)0x23e150; + + getBufferInternal = (void *)0x261560; + + SifIopReset = (void *)0x84fe0; + SifIopSync = (void *)0x85110; + SifInitRpc = (void *)0x84180; + SifExitRpc = (void *)0x84310; + } + else if((*(void **)0x5f1f38) == (void *)0x1500014) { // 3.10 pointToIFO = (void *)0x25c880; getDiscData = (void *)0x25c9f0; diff --git a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.elf b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.elf index 888b6fa..01537c8 100644 Binary files a/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.elf and b/PAYLOADS/All PS2 slims (3.10 + 3.11)/payload.elf differ diff --git a/exploit.iso b/exploit.iso new file mode 100644 index 0000000..86a900f Binary files /dev/null and b/exploit.iso differ