Skip to content

Commit cb657b6

Browse files
MFDGamingMFDGaming
committed
Added support for 3.02E & 3.02C
1 parent 342258a commit cb657b6

14 files changed

Lines changed: 465 additions & 31 deletions

File tree

‎compile.sh‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,12 @@ if [[ "$1" == "3.00j" || "$1" == "3.00J" ]]; then
88
elif [[ "$1" == "3.00u" || "$1" == "3.00U" ]]; then
99
echo "Building for DVD Player v3.00U"
1010
dvd_ver="300U"
11+
elif [[ "$1" == "3.02e" || "$1" == "3.02E" ]]; then
12+
echo "Building for DVD Player v3.02E"
13+
dvd_ver="302E"
14+
elif [[ "$1" == "3.02c" || "$1" == "3.02C" ]]; then
15+
echo "Building for DVD Player v3.02C"
16+
dvd_ver="302C"
1117
else
1218
echo "Building for DVD Player v3.00E/A"
1319
fi
@@ -17,9 +23,17 @@ mkdir build
1723
rm -f fs/VIDEO_TS/VTS_01_0.IFO
1824
rm -f fs/VIDEO_TS/VTS_02_0.BUP
1925
rm -f fs/VIDEO_TS/VTS_02_0.IFO
26+
rm -f fs/VIDEO_TS/VTS_03_0.BUP
27+
rm -f fs/VIDEO_TS/VTS_03_0.IFO
28+
rm -f fs/VIDEO_TS/VTS_04_0.BUP
29+
rm -f fs/VIDEO_TS/VTS_04_0.IFO
2030
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_01_0.IFO
2131
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_02_0.BUP
2232
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_02_0.IFO
33+
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_03_0.BUP
34+
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_03_0.IFO
35+
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_04_0.BUP
36+
cp fs/VIDEO_TS/VTS_01_0.BUP fs/VIDEO_TS/VTS_04_0.IFO
2337

2438
mipsel-none-elf-gcc \
2539
-T src/ld/code.ld \
@@ -79,11 +93,17 @@ cp --recursive fs build/
7993

8094
./build/injector.elf
8195

82-
truncate -s 6144 build/code.bin
96+
truncate -s 8192 build/code.bin
8397
cp build/code.bin build/fs/VIDEO_TS/VIDEO_TS.BUP
8498
cp build/fs/VIDEO_TS/VTS_01_1.VOB build/fs/VIDEO_TS/VTS_02_1.VOB
99+
cp build/fs/VIDEO_TS/VTS_01_1.VOB build/fs/VIDEO_TS/VTS_03_1.VOB
100+
cp build/fs/VIDEO_TS/VTS_01_1.VOB build/fs/VIDEO_TS/VTS_04_1.VOB
85101

86102
genisoimage -dvd-video -V "" -o build/exploit.iso build/fs/
87103
rm fs/VIDEO_TS/VTS_01_0.IFO
88104
rm fs/VIDEO_TS/VTS_02_0.BUP
89105
rm fs/VIDEO_TS/VTS_02_0.IFO
106+
rm fs/VIDEO_TS/VTS_03_0.BUP
107+
rm fs/VIDEO_TS/VTS_03_0.IFO
108+
rm fs/VIDEO_TS/VTS_04_0.BUP
109+
rm fs/VIDEO_TS/VTS_04_0.IFO

‎fs/BOOT.ELF‎

24.1 KB
Binary file not shown.

‎fs/VIDEO_TS/VIDEO_TS.IFO‎

2 KB
Binary file not shown.

‎src/code/code.c‎

Lines changed: 105 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,37 +4,124 @@
44
#include "ps2cstd.h"
55
#include "ps2iop.h"
66
#include "ps2rpc.h"
7+
#include "ps2cdvd.h"
78

8-
typedef int (*readBufferInternal_t)(char *, int, int, void *, int, int);
9-
readBufferInternal_t readBufferInternal;
9+
int no_reset = 0;
1010

1111
static void setup_pointers() {
1212
u32 *video_ts_ifo_300e = (u32 *)0x009091a0;
1313
u32 *video_ts_ifo_300u = (u32 *)0x009090a0;
1414
u32 *video_ts_ifo_300j = (u32 *)0x00684920;
15+
u32 *video_ts_ifo_302e = (u32 *)0x0090c310;
16+
u32 *video_ts_ifo_302c = (u32 *)0x006ee290;
1517
if (video_ts_ifo_300e[0] == 0x45444956) {
16-
readBufferInternal = (readBufferInternal_t)0x00244438;
1718
sceSifSyncIop = (sceSifSyncIop_t)0x00283460;
1819
sceSifResetIop = (sceSifResetIop_t)0x002832f8;
1920
sceSifInitRpc = (sceSifInitRpc_t)0x00207c60;
2021
sceSifExitRpc = (sceSifExitRpc_t)0x00207e00;
22+
sceSifCallRpc = (sceSifCallRpc_t)0x002084a0;
23+
sceSifWriteBackDCache = (sceSifWriteBackDCache_t)0x00209fc0;
24+
sceCdNCmdDiskReady = (sceCdNCmdDiskReady_t)0x00268a58;
25+
_sceCd_ncmd_prechk = (_sceCd_ncmd_prechk_t)0x002688e8;
26+
_sceCd_cd_read_intr = (_sceCd_cd_read_intr_t)0x002682ac;
27+
sceCdSync = (sceCdSync_t)0x00268af0;
28+
sceCdDiskReady = (sceCdDiskReady_t)0x00268ff0;
29+
sceCdCbfunc_num = (int *)0x008c9114;
30+
_sceCd_c_cb_sem = (int *)0x008c90f0;
31+
_sceCd_cd_ncmd = (void *)0x008ca290;
32+
_sceCd_ncmd_semid = (int *)0x008c90e8;
2133
} else if (video_ts_ifo_300u[0] == 0x45444956) {
22-
readBufferInternal = (readBufferInternal_t)0x00244378;
2334
sceSifSyncIop = (sceSifSyncIop_t)0x00283340;
2435
sceSifResetIop = (sceSifResetIop_t)0x002831d8;
2536
sceSifInitRpc = (sceSifInitRpc_t)0x00207c60;
2637
sceSifExitRpc = (sceSifExitRpc_t)0x00207e00;
38+
sceSifCallRpc = (sceSifCallRpc_t)0x002084a0;
39+
sceSifWriteBackDCache = (sceSifWriteBackDCache_t)0x00209fc0;
40+
sceCdNCmdDiskReady = (sceCdNCmdDiskReady_t)0x00268938;
41+
_sceCd_ncmd_prechk = (_sceCd_ncmd_prechk_t)0x002687c8;
42+
_sceCd_cd_read_intr = (_sceCd_cd_read_intr_t)0x00268190;
43+
sceCdSync = (sceCdSync_t)0x002689d0;
44+
sceCdDiskReady = (sceCdDiskReady_t)0x00268ed0;
45+
sceCdCbfunc_num = (int *)0x008c9014;
46+
_sceCd_c_cb_sem = (int *)0x008c8ff0;
47+
_sceCd_cd_ncmd = (void *)0x008ca190;
48+
_sceCd_ncmd_semid = (int *)0x008c8fe8;
49+
no_reset = 1; // For some reason 3.00U breaks if the IOP is reset
2750
} else if (video_ts_ifo_300j[0] == 0x45444956) {
28-
readBufferInternal = (readBufferInternal_t)0x00244018;
2951
sceSifSyncIop = (sceSifSyncIop_t)0x002834f0;
3052
sceSifResetIop = (sceSifResetIop_t)0x00283388;
3153
sceSifInitRpc = (sceSifInitRpc_t)0x00207c60;
3254
sceSifExitRpc = (sceSifExitRpc_t)0x00207e00;
55+
sceSifCallRpc = (sceSifCallRpc_t)0x002084a0;
56+
sceSifWriteBackDCache = (sceSifWriteBackDCache_t)0x00209fc0;
57+
sceCdNCmdDiskReady = (sceCdNCmdDiskReady_t)0x00268ae0;
58+
_sceCd_ncmd_prechk = (_sceCd_ncmd_prechk_t)0x00268970;
59+
_sceCd_cd_read_intr = (_sceCd_cd_read_intr_t)0x00268338;
60+
sceCdSync = (sceCdSync_t)0x00268b78;
61+
sceCdDiskReady = (sceCdDiskReady_t)0x00269078;
62+
sceCdCbfunc_num = (int *)0x00644894;
63+
_sceCd_c_cb_sem = (int *)0x00644870;
64+
_sceCd_cd_ncmd = (void *)0x00645a10;
65+
_sceCd_ncmd_semid = (int *)0x00644868;
66+
} else if (video_ts_ifo_302e[0] == 0x45444956) {
67+
sceSifSyncIop = (sceSifSyncIop_t)0x00284d00;
68+
sceSifResetIop = (sceSifResetIop_t)0x00284b98;
69+
sceSifInitRpc = (sceSifInitRpc_t)0x00207ce0;
70+
sceSifExitRpc = (sceSifExitRpc_t)0x00207e80;
71+
sceSifCallRpc = (sceSifCallRpc_t)0x00208520;
72+
sceSifWriteBackDCache = (sceSifWriteBackDCache_t)0x0020a040;
73+
sceCdNCmdDiskReady = (sceCdNCmdDiskReady_t)0x00258b00;
74+
_sceCd_ncmd_prechk = (_sceCd_ncmd_prechk_t)0x00258990;
75+
_sceCd_cd_read_intr = (_sceCd_cd_read_intr_t)0x00258358;
76+
sceCdSync = (sceCdSync_t)0x00258b98;
77+
sceCdDiskReady = (sceCdDiskReady_t)0x00259098;
78+
sceCdCbfunc_num = (int *)0x004d4254;
79+
_sceCd_c_cb_sem = (int *)0x004d4230;
80+
_sceCd_cd_ncmd = (void *)0x004d53d0;
81+
_sceCd_ncmd_semid = (int *)0x004d4228;
82+
} else if (video_ts_ifo_302c[0] == 0x45444956) {
83+
sceSifSyncIop = (sceSifSyncIop_t)0x00284f30;
84+
sceSifResetIop = (sceSifResetIop_t)0x00284dc8;
85+
sceSifInitRpc = (sceSifInitRpc_t)0x00207ce0;
86+
sceSifExitRpc = (sceSifExitRpc_t)0x00207e80;
87+
sceSifCallRpc = (sceSifCallRpc_t)0x00208520;
88+
sceSifWriteBackDCache = (sceSifWriteBackDCache_t)0x0020a040;
89+
sceCdNCmdDiskReady = (sceCdNCmdDiskReady_t)0x00258ae0;
90+
_sceCd_ncmd_prechk = (_sceCd_ncmd_prechk_t)0x00258970;
91+
_sceCd_cd_read_intr = (_sceCd_cd_read_intr_t)0x00258338;
92+
sceCdSync = (sceCdSync_t)0x00258b78;
93+
sceCdDiskReady = (sceCdDiskReady_t)0x00259078;
94+
sceCdCbfunc_num = (int *)0x004d4454;
95+
_sceCd_c_cb_sem = (int *)0x004d4430;
96+
_sceCd_cd_ncmd = (void *)0x004d55d0;
97+
_sceCd_ncmd_semid = (int *)0x004d4428;
3398
}
3499
}
35100

101+
int readSector(int n, u8 *s) {
102+
const int max_tries = 30;
103+
int tries = 0;
104+
sceCdRMode rm;
105+
rm.spindlctrl = SCECdSpinNom;
106+
rm.datapattern = SCECdSecS2048;
107+
rm.trycount = max_tries;
108+
109+
while (tries < max_tries) {
110+
sceCdDiskReady(0);
111+
if (sceCdReadDVDV(n, 1, s, &rm)) {
112+
break;
113+
}
114+
++tries;
115+
}
116+
if (tries == max_tries) {
117+
return -1;
118+
}
119+
sceCdSync(0);
120+
return 0;
121+
}
122+
36123
static void readDiscData(int off, u8 *dest, int len) {
37-
u8 tmp[0x800];
124+
u8 tmp[2064];
38125
if (len <= 0) {
39126
return;
40127
}
@@ -44,27 +131,28 @@ static void readDiscData(int off, u8 *dest, int len) {
44131
if (skip) {
45132
int first = 0x800 - skip;
46133
if (first > len) first = len;
47-
readBufferInternal("", 0, s++, tmp, 1, 0);
48-
memcpy(dest, &tmp[skip], first);
134+
readSector(s++, tmp);
135+
memcpy(dest, &tmp[12+skip], first);
49136
dest += first;
50137
len -= first;
51138
}
52139
int sc = len >> 11;
53140
for (int i = 0; i < sc; ++i) {
54-
readBufferInternal("", 0, s++, tmp, 1, 0);
55-
memcpy(dest, tmp, 0x800);
141+
readSector(s++, tmp);
142+
memcpy(dest, &tmp[12], 0x800);
56143
dest += 0x800;
57144
}
58145
int rem = len - (sc << 11);
59146
if (rem > 0) {
60-
readBufferInternal("", 0, s, tmp, 1, 0);
61-
memcpy(dest, tmp, rem);
147+
readSector(s, tmp);
148+
memcpy(dest, &tmp[12], rem);
62149
}
63150
}
64151

65152
void main() {
66-
int off = (396 - 278) << 11;
153+
int off = 516 << 11;
67154
Elf32_Ehdr ehdr;
155+
68156
readDiscData(off, (u8 *)&ehdr, sizeof(Elf32_Ehdr));
69157

70158
// Validate ELF header
@@ -89,10 +177,12 @@ void main() {
89177
}
90178
FlushCache(0);
91179
FlushCache(2);
92-
/*sceSifResetIop("rom0:UDNL rom0:EELOADCNF", 0);
93-
while(!sceSifSyncIop());*/
94180
sceSifInitRpc(0);
95181
sceSifExitRpc();
182+
if (!no_reset) {
183+
sceSifResetIop("rom0:UDNL rom0:EELOADCNF", 0);
184+
while(!sceSifSyncIop());
185+
}
96186
ExecPS2((void *)(unsigned long)ehdr.e_entry, 0, 0, NULL);
97187
}
98188

‎src/code/ps2cdvd.c‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#include "ps2cdvd.h"
2+
#include "ps2rpc.h"
3+
#include "ps2cstd.h"
4+
#include "ps2syscalls.h"
5+
6+
sceCdNCmdDiskReady_t sceCdNCmdDiskReady;
7+
_sceCd_ncmd_prechk_t _sceCd_ncmd_prechk;
8+
_sceCd_cd_read_intr_t _sceCd_cd_read_intr;
9+
sceCdSync_t sceCdSync;
10+
sceCdDiskReady_t sceCdDiskReady;
11+
12+
int *sceCdCbfunc_num;
13+
int *_sceCd_c_cb_sem;
14+
void *_sceCd_cd_ncmd;
15+
int *_sceCd_ncmd_semid;
16+
17+
static u32 readData[6] __attribute__((aligned(64)));
18+
static u32 _sceCd_rd_intr_data[64] __attribute__((aligned(64)));
19+
static u32 _sceCd_Read_cur_pos __attribute__((aligned(64)));
20+
21+
int sceCdReadDVDV(u32 lbn, u32 nsectors, void *buf, sceCdRMode *rm) {
22+
if (sceCdNCmdDiskReady() == SCECdNotReady) {
23+
return 0;
24+
}
25+
if (_sceCd_ncmd_prechk(CD_NCMD_DVDREAD) == 0) {
26+
return 0;
27+
}
28+
29+
readData[0] = lbn;
30+
readData[1] = nsectors;
31+
readData[2] = (u32)(unsigned long)buf;
32+
readData[3] = (rm->trycount) | (rm->spindlctrl << 8) | (rm->datapattern << 16);
33+
readData[4] = (u32)(unsigned long)_sceCd_rd_intr_data;
34+
35+
sceSifWriteBackDCache(buf, nsectors * 2064);
36+
37+
*sceCdCbfunc_num = CD_NCMD_DVDREAD;
38+
*_sceCd_c_cb_sem = 1;
39+
40+
if (sceSifCallRpc(_sceCd_cd_ncmd, CD_NCMD_DVDREAD, 1, readData, 24, NULL, 0, _sceCd_cd_read_intr, _sceCd_rd_intr_data) < 0) {
41+
*sceCdCbfunc_num = 0;
42+
*_sceCd_c_cb_sem = 0;
43+
SignalSema(*_sceCd_ncmd_semid);
44+
return 0;
45+
}
46+
47+
return 1;
48+
}

‎src/code/ps2cdvd.h‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
#ifndef YADE_CDVD
2+
#define YADE_CDVD
3+
4+
#include "ps2int.h"
5+
6+
enum CD_NCMD_CMDS {
7+
CD_NCMD_READ = 0x01,
8+
CD_NCMD_CDDAREAD,
9+
CD_NCMD_DVDREAD,
10+
CD_NCMD_GETTOC,
11+
CD_NCMD_SEEK,
12+
CD_NCMD_STANDBY,
13+
CD_NCMD_STOP,
14+
CD_NCMD_PAUSE,
15+
CD_NCMD_STREAM,
16+
CD_NCMD_CDDASTREAM,
17+
CD_NCMD_READ_KEY,
18+
CD_NCMD_NCMD,
19+
CD_NCMD_READIOPMEM,
20+
CD_NCMD_DISKREADY,
21+
CD_NCMD_READCHAIN
22+
};
23+
24+
enum SCECdvdSectorType {
25+
SCECdSecS2048 = 0,
26+
SCECdSecS2328,
27+
SCECdSecS2340,
28+
SCECdSecS2352 = 0,
29+
SCECdSecS2368,
30+
SCECdSecS2448,
31+
};
32+
33+
enum SCECdvdSpinValue {
34+
SCECdSpinMax = 0,
35+
SCECdSpinStm = 0,
36+
SCECdSpinDvdDL0 = 0,
37+
SCECdSpinNom = 1,
38+
SCECdSpinX1,
39+
SCECdSpinX2,
40+
SCECdSpinX4,
41+
SCECdSpinX12,
42+
SCECdSpinNm2 = 10,
43+
SCECdSpin1p6,
44+
SCECdSpinMx = 20,
45+
};
46+
47+
enum SCECdvdMModeMediaType {
48+
SCECdMmodeCd = 1,
49+
SCECdMmodeDvd
50+
};
51+
52+
enum SCECdvdInitMode {
53+
SCECdINIT = 0x00,
54+
SCECdINoD,
55+
SCECdEXIT = 0x05
56+
};
57+
58+
enum SCECdvdInterruptCode {
59+
CdlNoIntr = 0x00,
60+
CdlDataReady,
61+
SCECdComplete,
62+
CdlAcknowledge,
63+
CdlDataEnd,
64+
CdlDiskError,
65+
SCECdNotReady
66+
};
67+
68+
typedef struct {
69+
u8 trycount;
70+
u8 spindlctrl;
71+
u8 datapattern;
72+
u8 pad;
73+
} sceCdRMode;
74+
75+
typedef int (*sceCdNCmdDiskReady_t)(void);
76+
typedef int (*_sceCd_ncmd_prechk_t)(int);
77+
typedef void (*_sceCd_cd_read_intr_t)(void *);
78+
typedef int (*sceCdSync_t)(int);
79+
typedef int (*sceCdDiskReady_t)(int);
80+
81+
extern sceCdNCmdDiskReady_t sceCdNCmdDiskReady;
82+
extern _sceCd_ncmd_prechk_t _sceCd_ncmd_prechk;
83+
extern _sceCd_cd_read_intr_t _sceCd_cd_read_intr;
84+
extern sceCdSync_t sceCdSync;
85+
extern sceCdDiskReady_t sceCdDiskReady;
86+
87+
extern int *sceCdCbfunc_num;
88+
extern int *_sceCd_c_cb_sem;
89+
extern void *_sceCd_cd_ncmd;
90+
extern int *_sceCd_ncmd_semid;
91+
92+
int sceCdReadDVDV(u32 lbn, u32 nsectors, void *buf, sceCdRMode *rm);
93+
94+
#endif

‎src/code/ps2rpc.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,5 @@
22

33
sceSifInitRpc_t sceSifInitRpc;
44
sceSifExitRpc_t sceSifExitRpc;
5+
sceSifCallRpc_t sceSifCallRpc;
6+
sceSifWriteBackDCache_t sceSifWriteBackDCache;

‎src/code/ps2rpc.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,12 @@
33

44
typedef void (*sceSifInitRpc_t)(int);
55
typedef void (*sceSifExitRpc_t)(void);
6+
typedef int (*sceSifCallRpc_t)(void *, int, int, void *, int, void *, int, void (*)(void *), void *);
7+
typedef void (*sceSifWriteBackDCache_t)(void *, int);
68

79
extern sceSifInitRpc_t sceSifInitRpc;
810
extern sceSifExitRpc_t sceSifExitRpc;
11+
extern sceSifCallRpc_t sceSifCallRpc;
12+
extern sceSifWriteBackDCache_t sceSifWriteBackDCache;
913

1014
#endif

0 commit comments

Comments
 (0)