From df31f1554dd7d0e937a4ec56b3c9e47a626a0012 Mon Sep 17 00:00:00 2001 From: illusiony <37698908+illusionyy@users.noreply.github.com> Date: Sun, 12 Jul 2026 05:27:04 +0000 Subject: [PATCH 1/4] clang-format --- patch-server/server_patch.cpp | 30 +++++++++++++++--------------- shared/strstrid.hpp | 3 +-- 2 files changed, 16 insertions(+), 17 deletions(-) diff --git a/patch-server/server_patch.cpp b/patch-server/server_patch.cpp index d507547..35e0898 100644 --- a/patch-server/server_patch.cpp +++ b/patch-server/server_patch.cpp @@ -267,21 +267,21 @@ void run_elf_user_patch(client_data& read_client) { if (enable_prx_patch) { - patch_frame_context libkernel_eh_frame_patch = {}; - kernel_dynlib_obj(read_client.clientPid, 0x2001, &libkernel_eh_frame_patch.frame_info.obj); - if (!libkernel_eh_frame_patch.frame_info.obj.eh_frame || !libkernel_eh_frame_patch.frame_info.obj.eh_frame_size) - { - memset(&libkernel_eh_frame_patch, 0, sizeof(libkernel_eh_frame_patch)); - kernel_dynlib_obj(read_client.clientPid, 0x1, &libkernel_eh_frame_patch.frame_info.obj); - } - if (libkernel_eh_frame_patch.frame_info.obj.eh_frame && libkernel_eh_frame_patch.frame_info.obj.eh_frame_size) - { - libkernel_eh_frame_patch.frame_start = libkernel_eh_frame_patch.frame_info.obj.eh_frame; - libkernel_eh_frame_patch.frame_size = libkernel_eh_frame_patch.frame_info.obj.eh_frame_size; - func_ret(kill(read_client.clientPid, SIGSTOP)); - patch_prx_load_for_signal(libkernel_eh_frame_patch, read_client); - func_ret(kill(read_client.clientPid, SIGCONT)); - } + patch_frame_context libkernel_eh_frame_patch = {}; + kernel_dynlib_obj(read_client.clientPid, 0x2001, &libkernel_eh_frame_patch.frame_info.obj); + if (!libkernel_eh_frame_patch.frame_info.obj.eh_frame || !libkernel_eh_frame_patch.frame_info.obj.eh_frame_size) + { + memset(&libkernel_eh_frame_patch, 0, sizeof(libkernel_eh_frame_patch)); + kernel_dynlib_obj(read_client.clientPid, 0x1, &libkernel_eh_frame_patch.frame_info.obj); + } + if (libkernel_eh_frame_patch.frame_info.obj.eh_frame && libkernel_eh_frame_patch.frame_info.obj.eh_frame_size) + { + libkernel_eh_frame_patch.frame_start = libkernel_eh_frame_patch.frame_info.obj.eh_frame; + libkernel_eh_frame_patch.frame_size = libkernel_eh_frame_patch.frame_info.obj.eh_frame_size; + func_ret(kill(read_client.clientPid, SIGSTOP)); + patch_prx_load_for_signal(libkernel_eh_frame_patch, read_client); + func_ret(kill(read_client.clientPid, SIGCONT)); + } } metadata_buf meta = {}; const int mr = get_app_metadata(read_client.clientPid, &meta); diff --git a/shared/strstrid.hpp b/shared/strstrid.hpp index 977b65e..0d4e7d3 100644 --- a/shared/strstrid.hpp +++ b/shared/strstrid.hpp @@ -13,8 +13,7 @@ __attribute__((noinline)) static size_t ConstStrLen(const char* str) } // runtime function to strstr by sid -__attribute__((noinline)) -static const char* +__attribute__((noinline)) static const char* StrStrSid(const char* haystackStr, const StringId needleSid, const size_t needleLen) { const size_t hlen = ConstStrLen(haystackStr); From a9be492ec6741b077e3df590816fd8c7f8c4b42c Mon Sep 17 00:00:00 2001 From: illusiony <37698908+illusionyy@users.noreply.github.com> Date: Sun, 12 Jul 2026 05:29:00 +0000 Subject: [PATCH 2/4] patchMountRoot: enable for ps4 --- patch/patch_shellcore.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/patch/patch_shellcore.c b/patch/patch_shellcore.c index 3f15935..5efc0f0 100644 --- a/patch/patch_shellcore.c +++ b/patch/patch_shellcore.c @@ -79,7 +79,6 @@ static void patchAppTimeoutForMonitoredProcs(const dynlib_info* obj, const pid_t static void patchMountRoot(patch_frame_context* frame, const dynlib_info* obj, const pid_t pid) { -#if defined(__PROSPERO__) const uintptr_t mapbase = obj->obj.mapbase; const size_t mapsize = obj->obj.mapsize; @@ -121,7 +120,6 @@ static void patchMountRoot(patch_frame_context* frame, const dynlib_info* obj, c pid_write_call(pid, target_branch, frame->frame_base + __export_mount_root_hook_offset, true); pid_write_call(pid, frame->frame_base + (__export_mount_root_original_offset + num_originals), target_branch + num_originals, true); } -#endif } static void patchOnNewProcess(patch_frame_context* frame, const dynlib_info* obj, const pid_t pid) @@ -249,10 +247,7 @@ static void patchOnNewProcess(patch_frame_context* frame, const dynlib_info* obj } const size_t nbytes = sizeof(code_copy); userland_copyin(pid, code_copy, codebase, nbytes); - if (!is_ps4) - { - patchMountRoot(frame, obj, pid); - } + patchMountRoot(frame, obj, pid); frame->frame_start += nbytes; frame->frame_consumed += nbytes; frame->frame_size -= nbytes; From 801da241ded69b15bfea18950c9bf2809e1bbb51 Mon Sep 17 00:00:00 2001 From: illusiony <37698908+illusionyy@users.noreply.github.com> Date: Sun, 12 Jul 2026 05:58:13 +0000 Subject: [PATCH 3/4] mount_root_hook: check for pre patched environment --- host/shellcode/shellcore_mountroot.cpp | 40 +++++++++++++++++++++----- 1 file changed, 33 insertions(+), 7 deletions(-) diff --git a/host/shellcode/shellcore_mountroot.cpp b/host/shellcode/shellcore_mountroot.cpp index bb630a0..cc2a969 100644 --- a/host/shellcode/shellcore_mountroot.cpp +++ b/host/shellcode/shellcore_mountroot.cpp @@ -1,7 +1,11 @@ #include "../../shared/macro.h" +#include "../../shared/debug.h" #include "../../shared/strstrid.hpp" #include +// exports +extern "C" int __export_mount_root_original(void* pThis, const char* fs, const char* src, const char* dst, void* param_5, uint32_t* param_6); + static bool valid_str(const char* p) { return p && *p; @@ -12,22 +16,44 @@ static const char* check_str(const char* p) return valid_str(p) ? p : ""; } +static bool is_valid_src_dst(const char* src, const char* dst) +{ + return valid_str(src) && valid_str(dst); +} + static bool is_avContents(const char* src, const char* dst) { - return valid_str(src) && valid_str(dst) && + return is_valid_src_dst(src, dst) && ConstStrStrId(src, "/user/av_contents/content_tmp") && ConstStrStrId(dst, "/av_contents/content_tmp"); } -extern "C" int __export_mount_root_original(void* pThis, const char* fs, const char* src, const char* dst, void* param_5, uint32_t* param_6); +static bool is_userData(const char* src, const char* dst) +{ + return is_valid_src_dst(src, dst) && + ConstStrStrId(src, "/user/data") && ConstStrStrId(dst, "/data"); +} + +static int mountUserData(void* pThis, void* param_5, uint32_t* param_6) +{ + static const char src_p[] = "/user/data"; + static const char dst_p[] = "/data"; + debugf("allocating \"%s\" -> \"%s\" path\n", src_p, dst_p); + return __export_mount_root_original(pThis, "nullfs", src_p, dst_p, param_5, param_6); +} + extern "C" int __export_mount_root_hook(void* pThis, const char* fs, const char* src, const char* dst, void* param_5, uint32_t* param_6) { - printf(FILE_FUNC_LINE ": fs: \"%s\" src \"%s\" -> dst \"%s\"\n", check_str(fs), check_str(src), check_str(dst)); + debugf("fs: \"%s\" src \"%s\" -> dst \"%s\"\n", check_str(fs), check_str(src), check_str(dst)); + // check for pre patched environment + if (is_userData(src, dst)) + { + printf("attempting to mount \"%s\" to \"%s\"! this is handled by \"mountUserData\" already!\n", src, dst); + return 0; + } + // not patched, mount data folder if (is_avContents(src, dst)) { - static const char src_p[] = "/user/data"; - static const char dst_p[] = "/data"; - printf("allocating \"%s\" -> \"%s\" path\n", src_p, dst_p); - __export_mount_root_original(pThis, "nullfs", src_p, dst_p, param_5, param_6); + mountUserData(pThis, param_5, param_6); } return __export_mount_root_original(pThis, fs, src, dst, param_5, param_6); } From 88fd4410bd25c7d30e302e2f4e808a33a7947c43 Mon Sep 17 00:00:00 2001 From: illusiony <37698908+illusionyy@users.noreply.github.com> Date: Sun, 12 Jul 2026 06:25:48 +0000 Subject: [PATCH 4/4] mount_root_hook: mount data during `/system_tmp` --- host/shellcode/shellcore_mountroot.cpp | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/host/shellcode/shellcore_mountroot.cpp b/host/shellcode/shellcore_mountroot.cpp index cc2a969..de4ac99 100644 --- a/host/shellcode/shellcore_mountroot.cpp +++ b/host/shellcode/shellcore_mountroot.cpp @@ -21,10 +21,10 @@ static bool is_valid_src_dst(const char* src, const char* dst) return valid_str(src) && valid_str(dst); } -static bool is_avContents(const char* src, const char* dst) +static bool is_validPathForMounting(const char* src, const char* dst) { return is_valid_src_dst(src, dst) && - ConstStrStrId(src, "/user/av_contents/content_tmp") && ConstStrStrId(dst, "/av_contents/content_tmp"); + ConstStrStrId(src, "/system_tmp") && ConstStrStrId(dst, "/system_tmp"); } static bool is_userData(const char* src, const char* dst) @@ -47,13 +47,14 @@ extern "C" int __export_mount_root_hook(void* pThis, const char* fs, const char* // check for pre patched environment if (is_userData(src, dst)) { - printf("attempting to mount \"%s\" to \"%s\"! this is handled by \"mountUserData\" already!\n", src, dst); + debugf("attempting to mount \"%s\" to \"%s\"! this is handled by \"mountUserData\" already!\n", src, dst); return 0; } // not patched, mount data folder - if (is_avContents(src, dst)) + if (is_validPathForMounting(src, dst)) { - mountUserData(pThis, param_5, param_6); + const int r = mountUserData(pThis, param_5, param_6); + debugf("mountUserData: 0x%08x\n", r); } return __export_mount_root_original(pThis, fs, src, dst, param_5, param_6); }