From 3717573887504046961817cebbe89b70f23203df Mon Sep 17 00:00:00 2001 From: orezraey Date: Fri, 23 Oct 2026 11:49:24 -0300 Subject: [PATCH] fix(libkernel): answer sceKernelGetModuleInfoFromAddr's flags and failures as measured on a PS5 Flags 1 finds any module and flags 2 only non-system ones; other flags return EINVAL instead of throwing, every failure clears the 0x1A8 bytes, and st_size is left 0. Co-Authored-By: Claude Opus 5.5 --- core/libs/prx/libSceLibcInternal/Export.cpp | 2 +- core/libs/prx/libkernel/Module/src/Module.cpp | 2 +- .../prx/libkernel/Module/src/ModuleInfo.cpp | 26 +++++++++++----- core/libs/tests/GuestForceTlsDestructor.cpp | 2 +- .../tests/GuestKernelSysModuleInternal.cpp | 5 +-- core/libs/tests/GuestModuleInfo.cpp | 31 ++++++++++++++++--- docs/dev/debt/libkernel.md | 4 +-- 7 files changed, 53 insertions(+), 19 deletions(-) diff --git a/core/libs/prx/libSceLibcInternal/Export.cpp b/core/libs/prx/libSceLibcInternal/Export.cpp index b8c3288715..d7c86c15f1 100644 --- a/core/libs/prx/libSceLibcInternal/Export.cpp +++ b/core/libs/prx/libSceLibcInternal/Export.cpp @@ -67,7 +67,7 @@ void APS5_VABI RunThreadDestructors_nid_no_patch() { bool FindDsoModule(const void* dsoSymbol, KernelModule& handle) { ModuleInfoEx info{}; info.st_size = sizeof(ModuleInfoEx); - if (sceKernelGetModuleInfoFromAddr(reinterpret_cast(dsoSymbol), 2, &info) != 0) { + if (sceKernelGetModuleInfoFromAddr(reinterpret_cast(dsoSymbol), 1, &info) != 0) { handle = 0; return false; } diff --git a/core/libs/prx/libkernel/Module/src/Module.cpp b/core/libs/prx/libkernel/Module/src/Module.cpp index 9e71a3183c..44877cf635 100644 --- a/core/libs/prx/libkernel/Module/src/Module.cpp +++ b/core/libs/prx/libkernel/Module/src/Module.cpp @@ -142,7 +142,7 @@ bool IsRelinkedImage(std::uint64_t address) { void FillGuestUnwindInfo(std::uint64_t address, ModuleInfoForUnwind* info) { ModuleInfoEx module{}; module.st_size = sizeof(ModuleInfoEx); - if (sceKernelGetModuleInfoFromAddr(address, 2, &module) != 0) + if (sceKernelGetModuleInfoFromAddr(address, 1, &module) != 0) throw std::runtime_error("sceKernelGetModuleInfoForUnwind: failed to query guest module information"); info->eh_frame_hdr_addr = module.eh_frame_hdr_addr; info->eh_frame_addr = module.eh_frame_addr; diff --git a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp index c240b13f9d..f3931ee478 100644 --- a/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp +++ b/core/libs/prx/libkernel/Module/src/ModuleInfo.cpp @@ -394,22 +394,32 @@ int FillModuleList(KernelModule* handles, std::size_t count, std::size_t* actual extern "C" { int APS5_VABI sceKernelGetModuleInfoFromAddr(std::uint64_t address, int flags, ModuleInfoEx* info) { + if (flags != 1 && flags != 2) { + if (!info) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: null info with flags " + std::to_string(flags)); + *info = {}; + return SCE_KERNEL_ERROR_EINVAL; + } if (!info) return SCE_KERNEL_ERROR_EFAULT; - if (flags != 2) throw std::invalid_argument("sceKernelGetModuleInfoFromAddr: unsupported flags " + std::to_string(flags)); ModuleInfoEx result{}; - result.st_size = sizeof(ModuleInfoEx); #ifdef _WIN32 - if (!Fill(static_cast(address), result)) return SCE_KERNEL_ERROR_ESRCH; + MEMORY_BASIC_INFORMATION memory{}; + const bool found = Fill(static_cast(address), result) && + VirtualQuery(reinterpret_cast(address), &memory, sizeof(memory)) == sizeof(memory); + const GuestImage image{nullptr, found ? reinterpret_cast(memory.AllocationBase) : 0}; #else Dl_info symbol{}; link_map* native = nullptr; - if (!dladdr1(reinterpret_cast(address), &symbol, reinterpret_cast(&native), RTLD_DL_LINKMAP) || !native) - return SCE_KERNEL_ERROR_ESRCH; ImageSearch search{static_cast(address), &result, false}; - dl_iterate_phdr(FindImage, &search); - if (!search.found) return SCE_KERNEL_ERROR_ESRCH; - result.id = ModuleIdForImage_nid_no_patch(native); + if (dladdr1(reinterpret_cast(address), &symbol, reinterpret_cast(&native), RTLD_DL_LINKMAP) && native) + dl_iterate_phdr(FindImage, &search); + const bool found = search.found; + if (found) result.id = ModuleIdForImage_nid_no_patch(native); + const GuestImage image{native, 0}; #endif + if (!found || (flags == 2 && SystemImage(image))) { + *info = {}; + return SCE_KERNEL_ERROR_ESRCH; + } *info = result; return 0; } diff --git a/core/libs/tests/GuestForceTlsDestructor.cpp b/core/libs/tests/GuestForceTlsDestructor.cpp index 6f900b9396..2bf6d13807 100644 --- a/core/libs/tests/GuestForceTlsDestructor.cpp +++ b/core/libs/tests/GuestForceTlsDestructor.cpp @@ -57,7 +57,7 @@ void* APS5_VABI Worker(void*) { KernelModule ModuleOf(const void* address) { ModuleInfoEx info{}; info.st_size = sizeof(ModuleInfoEx); - Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(address), 2, &info) == 0); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(address), 1, &info) == 0); return info.id; } diff --git a/core/libs/tests/GuestKernelSysModuleInternal.cpp b/core/libs/tests/GuestKernelSysModuleInternal.cpp index 0d477ebd9f..0785445b57 100644 --- a/core/libs/tests/GuestKernelSysModuleInternal.cpp +++ b/core/libs/tests/GuestKernelSysModuleInternal.cpp @@ -57,11 +57,12 @@ static void CheckEachModule() { static void CheckMatchesAddressLookup() { ModuleInfoEx byAddress{}; byAddress.st_size = sizeof(ModuleInfoEx); - Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(&sceKernelGetModuleInfo), 2, &byAddress) == 0); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(&sceKernelGetModuleInfo), 1, &byAddress) == 0); ModuleInfoEx byHandle{}; byHandle.st_size = sizeof(ModuleInfoEx); Require(sceKernelGetModuleInfoInternal(byAddress.id, &byHandle) == 0); - Require(std::memcmp(&byHandle, &byAddress, sizeof(ModuleInfoEx)) == 0); + Require(byAddress.st_size == 0 && byHandle.st_size == sizeof(ModuleInfoEx)); + Require(std::memcmp(byHandle.name, byAddress.name, sizeof(ModuleInfoEx) - offsetof(ModuleInfoEx, name)) == 0); } static void CheckRefusals() { diff --git a/core/libs/tests/GuestModuleInfo.cpp b/core/libs/tests/GuestModuleInfo.cpp index d596bf0280..5f4ed327c4 100644 --- a/core/libs/tests/GuestModuleInfo.cpp +++ b/core/libs/tests/GuestModuleInfo.cpp @@ -41,7 +41,7 @@ static bool ThrowsInvalidArgument(TFunction function) { static ModuleInfoEx Query(const void* address, int expected) { ModuleInfoEx info{}; info.st_size = sizeof(ModuleInfoEx); - Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(address), 2, &info) == expected); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(address), 1, &info) == expected); return info; } int main(int argc, char** argv) { @@ -51,7 +51,7 @@ int main(int argc, char** argv) { const void* add = dlsym_nid_postfix(module, "GuestModuleAdd"); Require(add != nullptr); const auto info = Query(add, 0); - Require(info.st_size == sizeof(ModuleInfoEx)); + Require(info.st_size == 0); Require(info.id == static_cast(reinterpret_cast(module))); Require(std::string(info.name) == std::string(argv[1]).substr(std::string(argv[1]).find_last_of("/\\") + 1)); Require(info.segment_count > 0 && info.segment_count <= 4 && info.ref_count == 1); @@ -169,10 +169,33 @@ int main(int argc, char** argv) { Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 2, nullptr) == SCE_KERNEL_ERROR_EFAULT); ModuleInfoEx invalid{}; invalid.st_size = sizeof(ModuleInfoEx); - Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 1, &invalid); })); + for (const int flags : {-1, 0, 3, 4, 8}) { + std::memset(&invalid, 0xbb, sizeof(invalid)); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), flags, &invalid) == SCE_KERNEL_ERROR_EINVAL); + Require(std::all_of(reinterpret_cast(&invalid), reinterpret_cast(&invalid + 1), [](unsigned char value) { return value == 0; })); + } + Require(ThrowsInvalidArgument([&] { sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 0, nullptr); })); + std::vector everyModule(64); + std::vector titleOnlyModules(64); + std::size_t everyCount = 0; + std::size_t titleOnlyCount = 0; + Require(sceKernelGetModuleList(everyModule.data(), everyModule.size(), &everyCount) == 0); + Require(sceKernelGetModuleList2(titleOnlyModules.data(), titleOnlyModules.size(), &titleOnlyCount) == 0); + const auto systemModule = std::find_if(everyModule.begin(), everyModule.begin() + static_cast(everyCount), + [&](KernelModule handle) { return std::find(titleOnlyModules.begin(), titleOnlyModules.begin() + static_cast(titleOnlyCount), handle) == titleOnlyModules.begin() + static_cast(titleOnlyCount); }); + Require(systemModule != everyModule.begin() + static_cast(everyCount)); + ModuleInfo systemInfo{}; + systemInfo.st_size = sizeof(ModuleInfo); + Require(sceKernelGetModuleInfo(*systemModule, &systemInfo) == 0 && systemInfo.segment_count > 0); + const auto systemAddress = static_cast(systemInfo.segments[0].address); + ModuleInfoEx anyModule{}; + Require(sceKernelGetModuleInfoFromAddr(systemAddress, 1, &anyModule) == 0 && anyModule.id == *systemModule); + std::memset(&anyModule, 0xbb, sizeof(anyModule)); + Require(sceKernelGetModuleInfoFromAddr(systemAddress, 2, &anyModule) == SCE_KERNEL_ERROR_ESRCH && anyModule.segment_count == 0 && anyModule.name[0] == 0); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 1, &anyModule) == 0 && anyModule.id == info.id); ModuleInfoEx unset{}; unset.st_size = 0xf0000; - Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 2, &unset) == 0 && unset.st_size == sizeof(ModuleInfoEx)); + Require(sceKernelGetModuleInfoFromAddr(reinterpret_cast(add), 1, &unset) == 0 && unset.st_size == 0); const auto again = Query(add, 0); Require(again.eh_frame_hdr_addr == info.eh_frame_hdr_addr && again.eh_frame_hdr_size == info.eh_frame_hdr_size); Require(again.eh_frame_addr == info.eh_frame_addr && again.eh_frame_size == info.eh_frame_size); diff --git a/docs/dev/debt/libkernel.md b/docs/dev/debt/libkernel.md index 515c8d8c2b..9b5acbf23e 100644 --- a/docs/dev/debt/libkernel.md +++ b/docs/dev/debt/libkernel.md @@ -43,10 +43,10 @@ - [sceCoredumpWriteUserString](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `32KQRUK13kI`) - `(uint32_t, const char* text, int)` follows the console's `libkernel.sprx` (SDK 4.5x build of `J03950001`) at 0x13050: a null `text` returns `0x81180000`; otherwise the three arguments go to syscall 601 (command 10), whose `EPERM` becomes `SCE_COREDUMP_ERROR_NOT_IN_COREDUMP_HANDLER` (0x81180003), `EINVAL` `0x81180000`, and a success returns the value the kernel wrote back. Measured on a PS5 (firmware 13.60) from a homebrew payload with no core dump handler: the call succeeds with 0, the kernel rejects a first argument above 15 or a third outside 0 to 256 with `0x81180000`, and a 2047-character text is accepted. Those checks are reproduced and anything else returns 0; nothing is recorded, as there is no dump, and what the two numbers mean is unknown. PPSA16064 imports it - [sceCoredumpConfigDumpMode](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `gzLt9Qrauk0`) - `(int mode)` follows the same `libkernel.sprx` at 0x134D0: a mode other than 1 returns `0x81180000`; mode 1 issues syscall 601 (command 16, arguments 0 and 1) and returns 0 whether or not it fails, since only a raw return of 22 would map to `0x81180000`. No dump is produced here, so mode 1 returns 0 without the syscall. PPSA16833 imports it - [sceCoredumpGetStopInfoGpu_Agc](../../../core/libs/prx/libkernel/System/src/Coredump.cpp) (libkernel, NID `Jrs7UUkGOFo`) - `(void* info, size_t size)` follows the same `libkernel.sprx` at 0x137E0: a null `info` returns `0x81180000`; syscall 601 (command 21) failing with `EPERM` returns `NOT_IN_COREDUMP_HANDLER`; otherwise two `libSceAgcDriver` imports (NIDs `+NIAY3DWpOw` and `LgctzJSGy7s`, names unknown) decide between `0x81180005` and, for a `size` of 8, storing the second one's 64-bit result and returning 0, with any other size returning `0x81180000`. The handler is never invoked here, so a non-null `info` returns `NOT_IN_COREDUMP_HANDLER` without writing, assuming `EPERM` outside the handler as above; the AGC branch is not reached -- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the `(InternalSegmentInfo* result)` signature, the 16-byte `{address, size}` result and the choice of the main program's first segment follow [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) only, which fills it through its `sceKernelGetLibkernelTextLocation` from the first segment of `eboot.bin`; whether the console reports that segment, the text of libkernel itself or the calling module's is unknown. The segment is the first one `sceKernelGetModuleInfo` reports for the main program, and 0 is returned. A null result throws. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed +- [sceKernelInternalMemoryGetModuleSegmentInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - returns the main program's first segment, as [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/kernel/ps4_libkernel.pas#L343-L355) does through its `sceKernelGetLibkernelTextLocation`. In a payload process on a PS5 (firmware 13.60) both returned 0 with address and size 0, and a null result faulted (here it throws); what a title process gets is not known. 44 audited titles that bundle their own `libc.prx` import it; no call has been observed - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Linux the tables come from `sceKernelGetModuleInfoFromAddr`, whose `eh_frame_size` includes the zero terminator, as measured on firmware 13.60 (reported in [#2419](https://github.com/boykopovar/AnyPS5/issues/2419), not reproduced here); on Windows it is assumed to stop before the terminator. LLVM libunwind's `CFI_Parser::findFDE` stops at the terminator or the length, whichever comes first, so it finds the same FDEs either way. Only the main executable and `.guest.prx` images report tables; other host images report none, as on Windows - [sceKernelGetModuleInfoForUnwind](../../../core/libs/prx/libkernel/Module/src/Module.cpp) (libkernel) - on Windows the `.ehmeta` tables and the image file name are cached per allocation base and dropped after a loader free (`dlclose`, `sceKernelStopUnloadModule`, the thread atexit release) when the module is no longer loaded. A table changed in place, or an image freed by anything other than the loader, is not noticed. An address inside an image of the Windows loader's module list whose tables are cached is resolved with `RtlPcToFileHeader` and no `VirtualQuery`; other addresses, and images without tables, still use `VirtualQuery`. The `.eh_frame` walk that finds its end is done once per image instead of once per call -- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x1A8-byte info layout follows the [shadPS4](https://github.com/shadps4-emu/shadPS4) reimplementation; a title's `libc.prx` reads only `id` (PPSA14632). The meaning of `flags` is unknown; only 2 is accepted. The input `st_size` is ignored, because PPSA21703's `libc.prx` passes an uninitialized 0x1A8-byte buffer; the full size is written back. The id is the `sceKernelLoadStartModule` handle of an image opened through the loader and otherwise a stable id from the same range. The name is the host file name without `.guest.prx`. An image with more than 4 load segments (the converted executable has 7) reports its first 4. `tls_offset` is 0 and `ref_count` is 1, as the host loader exposes neither. On Windows the module is the PE image holding the address: a relinked image reports its `.elf` sections as segments and the eh_frame_hdr recorded in `.ehmeta`, any other image its first 4 sections with memory access and the `.ehfram` section without an eh_frame_hdr; the TLS fields and `init_proc_addr`/`fini_proc_addr` are 0 +- [sceKernelGetModuleInfoFromAddr](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - as in a payload process on a PS5 (firmware 13.60), flags 1 finds any module and flags 2 refuses the system ones (`ESRCH`), here the host libraries; other flags clear the 0x1A8 bytes and return `EINVAL`, any failure clears them, `st_size` is left 0, and a null info returns `EFAULT` (with other flags the console faulted; here it throws). Flags 2 finding a title module was not measured. The layout follows [shadPS4](https://github.com/shadps4-emu/shadPS4). The id is the loader handle or a stable id from that range, and the name is the host file name without `.guest.prx`, where the console keeps `.sprx`. Only the first 4 load segments are reported. `tls_offset` is 0 and `ref_count` 1 (the console gave 5 for system modules). On Windows a relinked image reports its `.elf` sections and the `.ehmeta` eh_frame_hdr; the TLS fields and init/fini are 0 - [sceKernelGetModuleList](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - lists the main program and every loaded `.prx` image in load order; host runtime libraries are left out. The handles are the ids `sceKernelGetModuleInfoFromAddr` reports, not the console's. The `(int32_t* handles, size_t count, size_t* actual)` signature and returning `ENOMEM` without writing `actual` after filling the first `count` handles when more images are loaded follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/libraries/kernel/process.cpp#L244-L264); whether the console writes any handles in that case is unknown - [sceKernelGetModuleInfo](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the 0x160-byte layout (`st_size`, `name[256]`, 4 segments, `segment_count`, `fingerprint[20]`) follows [fpPS4](https://github.com/red-prig/fpPS4/blob/04cefd43e6fddd1ab033e7980cd356d14c964905/sys/sys_types.pas#L319-L337) and [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/0fe263a4760dfbfa973366890061749b4af0de97/src/core/module.h#L15-L31). Only that `st_size` is accepted, as in shadPS4; other sizes return `EINVAL`, a null pointer `EFAULT` and a handle `sceKernelGetModuleList` does not list `ESRCH`. Name and segments are the ones `sceKernelGetModuleInfoFromAddr` reports, on Windows from the same PE sections, so `prot` uses the read/write/execute bits 1/2/4, while fpPS4 and shadPS4 store the ELF `p_flags`. The fingerprint is left zero, as the host image does not carry it - [sceKernelGetModuleList2 and sceKernelGetModuleInfo2](../../../core/libs/prx/libkernel/Module/src/ModuleInfo.cpp) (libkernel) - the title-module variants follow [shadPS4](https://github.com/shadps4-emu/shadPS4/blob/main/src/core/libraries/kernel/process.cpp): `sceKernelGetModuleList2` lists what `sceKernelGetModuleList` lists without system libraries, and `sceKernelGetModuleInfo2` answers `EPERM` for a system library after the `EFAULT`, `EINVAL` and `ESRCH` checks of `sceKernelGetModuleInfo`. A system library here is a loaded `.prx` image that is not a relinked title module (`.guest.prx`); the main program and the title's own modules are listed. Not verified on the console. PPSA34063 imports both and fails to load without them