System calls

[Bobby_Downgrades]

@habib Firstly good job on the new cobra 8 payload, very good job removing stage 1.
I noticed that you use system call 10 and 15 (put back into lv2), can you explain what these system calls are used for please and should I add these into cfw ?

 

[habib]

Sc 10 is used to make lv1 calls since user mode can't do lv1 call. I saw couple of apps use that syscall including the toolbox, I use it there too.

Sc 15 is for calling any internal kernel function,check it's usage and an lv2 dumper src was provided by me. Recently with cobra 8.01 you can acquire residence kernel plugin location and use sc15 to send arguments and communicate with your plugin

 

[Bobby_Downgrades]

Sc 10 is used to make lv1 calls since user mode can't do lv1 call. I saw couple of apps use that syscall including the toolbox, I use it there too.

Sc 15 is for calling any internal kernel function,check it's usage and an lv2 dumper src was provided by me. Recently with cobra 8.01 you can acquire residence kernel plugin location and use sc15 to send arguments and communicate with your plugin

Thanks for the info, I will leave them out of cfw as static.
Unless cfw with cobra 8.01 will need this hard coded sc 15 into lv2 in order to use it's full capabilities ?

 

[habib]

Sc 15 just won't work if you won't add. It's easy to add regardless I see no reason to not add it as a standard
Sc 10 is used a lot of times without cobra

 

[haxxxen]

@ habib
btw, you have said you have fixed scrambling of the syscall table, but still it is not working for me. tbh, this is the problem of ida using search patterns for the table itself and adding sc15 will "kill" the search function

and can you please elaborate what is the difference to a kernel plugin? does it work only for small binary payloads or any normal prx file? for example, I have tried to run sMAN, but this does not work and crashes ps3

 

[habib]

It's a kernel plugin. Imagine taihook or even cobra.
Cobra is a kernel plugin per se.
Just like that you can add multiple payloads which can be referred to as plugin since it's memory residence is there and interaction can be done between user->kernel plugin using sc 15 and kernel->kernel plugin using hooks.
Check the payload environment included with cobra 8.01 and it's pretty self explanatory.

Now this would be a better feature if added on a standard cfw as well....pretty easy to add I suppose

For ida....I don't know why it causes issue tbh. What I fixed was toc being set was wrong when sc15 was called in 4.81 I think it was fixed. Kernel toc was set when sc15 was called