mirror of
https://github.com/hrydgard/ppsspp.git
synced 2026-09-04 19:55:27 +02:00
Henrik RydgårdandClaude Opus 5
708e7e1d9c
pspDecryptPRX() tried types 0, 1, 2, 5 and 6. flash0:/vsh/etc/index_XXg.dat - the index of what the XMB shows, fetched through sceResmgr_9DC14891 - needs type 9, so it failed and the shell had no menu to build. Type 9 is type 6 with three differences, all following from a type 9 file carrying a real ECDSA signature at 0x104..0x12C where a type 6 file has nothing: - The "must be empty" header check stops at 0x104 instead of 0x10C. The index's signature starts there, so 8 of its bytes were failing type 6's check - the original failure. - The signature is left out of the hashed header rather than fed into it. JPCSP zeroes buf2[0x34..0x5C), which is that same range once its header rearrangement is undone, so PRXType9 just leaves the field zero. - ecdsa_hash in the KIRK CMD1 header stays 0. Type 6/7 set it, but the branch type 9 takes writes only the mode word, and setting it made KIRK reject the block. Tried last in the chain: its header check is a subset of type 6's, so a genuine type 6 PRX would pass it and then fail on the hash, and trying it earlier would shadow the real answer. False positives are not really possible either way - the SHA1 check inside has to match before anything is decrypted. Verified end to end: 496 bytes in, 159 out (the comp_size in the header), starting "release:". sceResmgr checks that prefix and says so in its log line, since a wrong-but-plausible decrypt would otherwise look like success here and fail much later as an unreadable index. The VSH now draws something different - the per-frame display list settles at 24 stall points rather than 38 - but what it shows is not visually confirmed; framebuffer readback doesn't work under headless on either backend. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GZq8ZtJmFY7bkX5FVkr3P9
81 lines
3.7 KiB
C++
81 lines
3.7 KiB
C++
// Copyright (c) 2012- PPSSPP Project.
|
|
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, version 2.0 or later versions.
|
|
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License 2.0 for more details.
|
|
|
|
// A copy of the GPL 2.0 should have been included with the program.
|
|
// If not, see http://www.gnu.org/licenses/
|
|
|
|
// Official git repository and contact information can be found at
|
|
// https://github.com/hrydgard/ppsspp and http://www.ppsspp.org/.
|
|
|
|
#include <vector>
|
|
|
|
// MemMap.h first: PrxDecrypter.h's PSP_Header is written in u32_le and friends, and doesn't pull
|
|
// in the header that defines them.
|
|
#include "Core/MemMap.h"
|
|
#include "Core/Debugger/MemBlockInfo.h"
|
|
#include "Core/ELF/PrxDecrypter.h"
|
|
#include "Core/HLE/FunctionWrappers.h"
|
|
#include "Core/HLE/HLE.h"
|
|
#include "Core/HLE/sceResmgr.h"
|
|
|
|
// The resource manager. Games never touch this - it exists for the VSH, which uses the one
|
|
// function below to decrypt flash0:/vsh/etc/index_XXg.dat, the index of what the XMB shows. With
|
|
// this unresolved the call traps, the index stays encrypted, the job thread building the top menu
|
|
// gives up, and the shell ends on an error screen instead.
|
|
|
|
// Decrypts a buffer in place. Named after its NID, as in JPCSP - the real name isn't known, though
|
|
// the index file is the only caller we've seen.
|
|
//
|
|
// Parameters:
|
|
// - bufferAddr: encrypted data in, decrypted data out.
|
|
// - bufferSize: how much is there.
|
|
// - resultLengthAddr: receives the decrypted length, which is smaller - the header goes away.
|
|
static int sceResmgr_9DC14891(u32 bufferAddr, int bufferSize, u32 resultLengthAddr) {
|
|
if (bufferSize < 0 || !Memory::IsValidRange(bufferAddr, bufferSize))
|
|
return hleLogError(Log::sceMisc, -1, "bad buffer");
|
|
|
|
u8 *buffer = Memory::GetPointerWriteUnchecked(bufferAddr);
|
|
|
|
// Already plaintext - the check JPCSP uses, and cheap insurance against decrypting twice.
|
|
if (bufferSize >= 8 && !memcmp(buffer, "release:", 8)) {
|
|
if (Memory::IsValidAddress(resultLengthAddr))
|
|
Memory::WriteUnchecked_U32(bufferSize, resultLengthAddr);
|
|
return hleLogDebug(Log::sceMisc, 0, "already decrypted");
|
|
}
|
|
|
|
// Decrypting in place is fine for the caller, but pspDecryptPRX walks the input while writing
|
|
// the output, so give it somewhere separate to write and copy back on success. On failure the
|
|
// guest buffer is left exactly as it was.
|
|
std::vector<u8> decrypted(bufferSize);
|
|
const int decryptedSize = pspDecryptPRX(buffer, decrypted.data(), bufferSize);
|
|
if (decryptedSize <= 0) {
|
|
return hleLogError(Log::sceMisc, -1, "failed to decrypt %d bytes (decrypter said %d)", bufferSize, decryptedSize);
|
|
}
|
|
|
|
memcpy(buffer, decrypted.data(), decryptedSize);
|
|
NotifyMemInfo(MemBlockFlags::WRITE, bufferAddr, decryptedSize, "sceResmgrDecrypt");
|
|
if (Memory::IsValidAddress(resultLengthAddr))
|
|
Memory::WriteUnchecked_U32(decryptedSize, resultLengthAddr);
|
|
// A correctly decrypted index starts "release:", so say whether it does - a wrong-but-plausible
|
|
// decrypt otherwise just looks like success here and fails much later as an unreadable index.
|
|
const bool plausible = decryptedSize >= 8 && !memcmp(buffer, "release:", 8);
|
|
return hleLogInfo(Log::sceMisc, 0, "decrypted %d bytes to %d (%s)", bufferSize, decryptedSize,
|
|
plausible ? "looks right" : "SUSPECT - does not start with 'release:'");
|
|
}
|
|
|
|
const HLEFunction sceResmgr[] = {
|
|
{0X9DC14891, &WrapI_UIU<sceResmgr_9DC14891>, "sceResmgr_9DC14891", 'i', "xix"},
|
|
};
|
|
|
|
void Register_sceResmgr() {
|
|
RegisterHLEModule("sceResmgr", ARRAY_SIZE(sceResmgr), sceResmgr);
|
|
}
|