From 7ac490f24052d33b2d36ea9ddd243c5799bbd0d8 Mon Sep 17 00:00:00 2001 From: Alvaro Date: Sat, 24 Oct 2026 02:47:31 +0200 Subject: [PATCH] feat(libSceLibreSsl): implement X509_STORE_CTX_get_current_cert --- core/libs/prx/libSceLibreSsl/Export.cpp | 5 ----- .../prx/libSceLibreSsl/src/X509StoreContext.cpp | 4 ++++ core/libs/tests/GuestLibreSslX509StoreContext.cpp | 14 ++++++++++++++ docs/dev/debt/libSceLibreSsl.md | 4 ++-- 4 files changed, 20 insertions(+), 7 deletions(-) diff --git a/core/libs/prx/libSceLibreSsl/Export.cpp b/core/libs/prx/libSceLibreSsl/Export.cpp index fed8e7149d..1ff1e5350c 100644 --- a/core/libs/prx/libSceLibreSsl/Export.cpp +++ b/core/libs/prx/libSceLibreSsl/Export.cpp @@ -1488,11 +1488,6 @@ int APS5_VABI X509_STORE_CTX_get_chain_nid_postfix(void) { return 0; } -int APS5_VABI X509_STORE_CTX_get_current_cert_nid_postfix(void) { - NotImplemented_nid_no_patch(__func__); - return 0; -} - int APS5_VABI X509_STORE_CTX_get_ex_data_nid_postfix(void) { NotImplemented_nid_no_patch(__func__); return 0; diff --git a/core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp b/core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp index 83bc0fb790..dfe188c18a 100644 --- a/core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp +++ b/core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp @@ -58,4 +58,8 @@ int APS5_VABI X509_STORE_CTX_get_error_depth_nid_postfix(LibreSslX509StoreContex return Context(context, __func__)->errorDepth; } +void* APS5_VABI X509_STORE_CTX_get_current_cert_nid_postfix(LibreSslX509StoreContext* context) { + return Context(context, __func__)->currentCert; +} + } diff --git a/core/libs/tests/GuestLibreSslX509StoreContext.cpp b/core/libs/tests/GuestLibreSslX509StoreContext.cpp index b83ee7cd38..ce71397d63 100644 --- a/core/libs/tests/GuestLibreSslX509StoreContext.cpp +++ b/core/libs/tests/GuestLibreSslX509StoreContext.cpp @@ -11,6 +11,7 @@ extern "C" { int APS5_VABI X509_STORE_CTX_get_error_nid_postfix(void*); void APS5_VABI X509_STORE_CTX_set_error_nid_postfix(void*, int); int APS5_VABI X509_STORE_CTX_get_error_depth_nid_postfix(void*); +void* APS5_VABI X509_STORE_CTX_get_current_cert_nid_postfix(void*); } static void Require(bool condition, std::source_location location = std::source_location::current()) { @@ -27,6 +28,7 @@ template static void RequireThrows(TAction action, std::source constexpr std::size_t ContextSize = 240; constexpr std::size_t ErrorDepthOffset = 180; constexpr std::size_t ErrorOffset = 184; +constexpr std::size_t CurrentCertOffset = 192; struct alignas(8) TestContext { unsigned char bytes[ContextSize]; @@ -86,9 +88,21 @@ static void TestGetErrorDepth() { RequireThrows([] { X509_STORE_CTX_get_error_depth_nid_postfix(nullptr); }); } +static void TestGetCurrentCert() { + TestContext context; + int certificate = 0; + context.Write(CurrentCertOffset, nullptr); + Require(X509_STORE_CTX_get_current_cert_nid_postfix(&context) == nullptr); + context.Write(CurrentCertOffset, &certificate); + Require(X509_STORE_CTX_get_current_cert_nid_postfix(&context) == &certificate); + Require(OnlyChanged(context, CurrentCertOffset, 8)); + RequireThrows([] { X509_STORE_CTX_get_current_cert_nid_postfix(nullptr); }); +} + int main() { TestGetError(); TestSetError(); TestGetErrorDepth(); + TestGetCurrentCert(); std::puts("libSceLibreSsl X509_STORE_CTX tests passed"); } diff --git a/docs/dev/debt/libSceLibreSsl.md b/docs/dev/debt/libSceLibreSsl.md index 68e7afe9d2..1e3704eb86 100644 --- a/docs/dev/debt/libSceLibreSsl.md +++ b/docs/dev/debt/libSceLibreSsl.md @@ -2,7 +2,7 @@ ### Unknown function info -- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 316 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`. +- [libSceLibreSsl pending exports](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - 315 named callable exports are listed in the [PS5 3.20 export table](https://github.com/DNNDHH/PS5-3.20_Libs/blob/b2a77c09cd71c01f34c790cfbe98c751a13262ad/libSceLibreSsl.c) and were cross-checked against the same module in PS5 firmware 13.60. Their signatures and behaviour are unverified; the declarations use the no-parameter unknown-signature convention and throw through `NotImplemented_nid_no_patch`. - [MD4, MD5, SHA1, SHA224, SHA256, SHA384 and SHA512 Init/Update/Final and SHA256](../../../core/libs/prx/libSceLibreSsl/src/Digest.cpp) (libSceLibreSsl) - signatures and context layouts follow the [LibreSSL headers](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha/sha.h), and buffering and `Final` follow its [sources](https://github.com/libressl/openbsd/tree/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/sha); nothing is checked on the console. Null contexts, null input with a nonzero length, null digest buffers in the 32-bit `Final` functions and a buffered byte count that is not below the block size, which LibreSSL does not check, throw - [DES_set_key, DES_ecb_encrypt, DES_set_odd_parity](../../../core/libs/prx/libSceLibreSsl/Export.cpp) (libSceLibreSsl) - the 128-byte `DES_key_schedule` holds the 8-byte key followed by zeros instead of LibreSSL's precomputed subkeys, so a title reading its contents sees different bytes; `DES_ecb_encrypt` derives the subkeys through mbedtls on each call. Not compared with the console. Results follow LibreSSL [des_key.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des_key.c) and [des.c](https://github.com/libressl/openbsd/blob/bc9483725c5815efb64b6d9acc52fc5fba139212/src/lib/libcrypto/des/des.c): `DES_set_key` skips the parity and weak-key checks and returns 0, as it does while `DES_check_key` is 0 (that variable is not in the PS5 export inventory), a nonzero `enc` encrypts, and `DES_set_odd_parity` sets each byte's low bit for odd parity. Null pointers throw where LibreSSL faults - [X509_verify_cert_error_string](../../../core/libs/prx/libSceLibreSsl/Export.cpp) - no console call is verified. The 64-bit argument, low-32-bit lookup, messages and shared numeric fallback follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509/x509_txt.c), the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Console modifications and other firmware versions remain unverified. Unknown-code results share an overwritten static buffer and are not safe for concurrent use, as in that release; code 1 and codes above 54 use the numeric fallback. @@ -15,7 +15,7 @@ - [SSL_CIPHER_get_bits, SSL_CIPHER_get_name and SSL_CIPHER_get_version](../../../core/libs/prx/libSceLibreSsl/src/Cipher.cpp) - the 88-byte guest cipher layout and these calls are not console-verified. They follow [LibreSSL 2.5.4 ssl.h](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libssl/ssl.h) and [ssl_ciph.c](https://github.com/libressl/openbsd/blob/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libssl/ssl_ciph.c), matching the version in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). Console modifications and other firmware layouts remain unverified. Protocol labels use the full 64-bit cipher ID, not the protocol flags; TLS 1.2 ciphers still report `TLSv1/SSLv3`, as in that release. - [sk_num, sk_value, sk_pop, sk_pop_free](../../../core/libs/prx/libSceLibreSsl/src/Stack.cpp) (libSceLibreSsl) - the 32-byte `_STACK` layout (`num`, `data`, `sorted`, `num_alloc`, `comp`) and the results follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/tree/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/stack) `stack.h` and `stack.c`, the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214); nothing is checked on the console. `sk_pop_free` releases the element array and the stack with the guest `free`, as the module would through libc. No export of this module creates a stack yet, so only stacks the caller builds reach them. A null element array that LibreSSL would read through, and a null free function with a non-null element, throw where LibreSSL faults - [RSA_flags, RSA_size](../../../core/libs/prx/libSceLibreSsl/src/Rsa.cpp) (libSceLibreSsl) - nothing is checked on the console. Layouts and results follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/tree/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto) `rsa.h`, `rsa_crpt.c` and `bn_lib.c`, the version in the [firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214). No export of this module creates a key yet, so only keys the caller builds reach them. `RSA_size` counts the modulus bytes from its top word, as `BN_num_bytes`, so a zero top word is not skipped. A null method, a null key or modulus, and a positive word count with null words, which LibreSSL dereferences, throw, as do a negative word count and a bit count that overflows `int` -- [X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, X509_STORE_CTX_get_error_depth](../../../core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp) (libSceLibreSsl) - the 240-byte `X509_STORE_CTX` layout and the results follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/tree/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509) `x509_vfy.h` and `x509_vfy.c`, the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214); nothing is checked on the console. No export of this module creates or fills a context yet, so only contexts the caller builds reach them. A null context, which LibreSSL dereferences, throws +- [X509_STORE_CTX_get_error, X509_STORE_CTX_set_error, X509_STORE_CTX_get_error_depth, X509_STORE_CTX_get_current_cert](../../../core/libs/prx/libSceLibreSsl/src/X509StoreContext.cpp) (libSceLibreSsl) - the 240-byte `X509_STORE_CTX` layout and the results follow [LibreSSL 2.5.4](https://github.com/libressl/openbsd/tree/2e2c612066aa993717528a0249c15c51128d61cb/src/lib/libcrypto/x509) `x509_vfy.h` and `x509_vfy.c`, the version identified in [published firmware 13.40 measurements](https://github.com/boykopovar/AnyPS5/discussions/8981#discussioncomment-19111214); nothing is checked on the console. No export of this module creates or fills a context yet, so only contexts the caller builds reach them. A null context, which LibreSSL dereferences, throws ### Functional