欢迎转载 请注明转自:WWW.PSPer.NET PSP玩家网 近日，PSP技术玩家组放出ChickHEN 破解程序反编译代码，有兴趣研究和觉得有用的玩家 可以参考一下。 TIFF图片中隐藏的代码： 以下为引用的内容： # libTIFF Exploit by MaTiaZ, modified by Team Typhoon # Eggcode in TIFF, disassembled and commented # Any new information or questions: http://advancedpsp.freeforums.org -- CHICKHEN程序开始-- # I初始化 00000000: a0 <- 0x04400000 00000004: a1 <- 0x047a0000 -- 添零 -- # Fills with zeros the memory segment between (a0) and (a1) 00000008: w(a0) <- 0 0000000c: a0 <- a0 + 4 00000010: if a0 <> a1 then pc <- pc - 8 (ZERO_FILLING) # Saves in s0 current pc value, which is EGG_START + 0x20 # This is done because we don't know at which memory address # the egg is loaded, and we need to know to reference data # s0 = EGG_START + 0x20 00000018: pc <- pc + 0x8; ra <- pc + 8 00000020: s0 <- ra # a0 = (EGG_START + 0x20) + OFFSET_MODULE_NAME_WANTED = STRING_POINTER # PUNTERO CADENA points to "scePaf_Module\0" 00000024: a0 <- s0 + 0x0508 # 更多的初始化操作 # v1 and s2 looks like base segments # s3 looks like an offset # v1 = SCEPAF_MODULE_START # s2 = UNKNOWN_ADDRESS ¿? # s3 = OFFSET_MODULE_NAME 00000028: v1 <- 0x08810000 00000030: s2 <- 0x09ea0c46 00000038: s3 <- 0x0015f3ac -- 处理模块未发现情况 -- # t0 = MODULE_NAME_POINTER # t1 = STRING_POINTER 0000003c: t0 <- v1 + s3 00000040: t1 <- a0 -- 比较字符 -- # Compares two strings, pointed by t0 and t1 # Loads t2 with first/next character from MODULE_NAME_POINTER # Loads t2 with first/next character from STRING_POINTER # t0 = MODULE_NAME_POINTER # t1 = STRING_POINTER 00000044: t2 <- b(t0) 00000048: t3 <- b(t1) 0000004c: if t2 = t3 then pc <- pc + 0xc (SAME_CHARS) # If characters are different, then it's not the module we're searching for 00000054: pc <- pc + 0x1c 00000058: v0 <- 1 (DECISION) -- 字符相同的情况-- # If we character is NULL, then we've reached the end of the string # so the strings are equal # Go to DECISION 0000005c: if t2 = 0 then pc <- pc + 14; v0 <- 0 (DECISION) # If not, compare next character 00000064: t0 <- t0 + 1 00000068: pc <- pc - 0x24 0000006c: t1 <- t1 + 1 (COMPARE_CHARS) -- DECISION -- # If v0 = 0, we found the module # If v0 = 1, we didn't found the module # v1 = SCEPAF_MODULE_START # s0 = EGG_START + 0x20 # s3 = OFFSET_MODULE_NAME # If we found it, go to MODULE_FOUND with s3 = SCEPAF_MODULE_START 00000070: if v0 = 0 then pc <- pc + 0x20; s3 <- v1 (MODULE_FOUND) # If not, SCEPAF_MODULE_START++ 00000078: v1 <- v1 + 1 0000007c: if v1 < s0 then t0 <- 1, else t0 <- 0 # If we reach the egg, go to MODULE_FOUND with s3 = 0 00000080: if t0 = 0 then pc <- pc + 0x10; s3 <- 0 (MODULE_FOUND) # If we haven't found the module, try again with v1 + 1 00000088: pc <- pc - 0x4c (MODULE_NOT_FOUND) -- 处理模块发现的情况-- # s3 = SCEPAF_MODULE_START # Let's consider this piece of code as if the module was found # t0 = SCEPAF_MODULE_START + OFFSET_1 = DATA_POINTER_1 00000094: t0 <- 0x40138c30 00000098: t0 <- s3 + t0 # t1 = SCEPAF_MODULE_START + OFFSET_2 = DATA_POINTER_2 000000a0: t1 <- 0x000d74c0 000000a4: t1 <- s3 + t1 # Copy two words (8 bytes) from DATA_POINTER_2 to DATA_POINTER_1 000000a8: t2 <- w(t1) 000000ac: w(t0) <- t2 000000b0: t2 <- w(t1+4) 000000b4: w(t0+4) <- t2 # t0 = SCEPAF_MODULE_START + OFFSET_3 = FUNCTION_1 000000bc: t0 <- 0x0015ee90 000000c0: t0 <- s3 + t0 # Call FUNCTION_1(1) 000000c4: ra <- pc + 8; pc <- t0 000000c8: a0 <- 1 # Kernel_Library_5F10D406 # sceKernelCpuResumeIntr # Resume interruptions # Ignores FUNCTION_1() return value # t0 = SCEPAF_MODULE_START + OFFSET_4 = FUNCTION_2 000000d0: t0 <- 0x0015ee70 000000d4: t0 <- t0 + s3 # a0 = (EGG_START + 0x20) + OFFSET_RUTA_H.BIN = PATH_POINTER # PATH_POINTER points to "ms0:/h.bin\0" 000000d8: a0 <- s0 + 0x4f8 000000dc: a1 <- 0x00000801 000000e0: ra <- pc + 8; pc <- t0 000000e4: a2 <- 0x000001ff # Call FUNCTION_2(PATH_POINTER,0x0801,0x01ff) # I suppose FUNCTION_2 is fopen() (sceIoOpen) # IoFileMgrForUser_109F50BC # sceIoOpen # FUNCTION_2() returns file descriptor # v0 = FILE_DESCRIPTOR # t0 = SCEPAF_MODULE_START + OFFSET_5 = FUNCTION_3 000000ec: t0 <- 0x0015ee58 000000f0: t0 <- t0 + s3 # Pass FILE_DESCRIPTOR to FUNCTION_3 # a0,s2 = FILE_DESCRIPTOR 000000f4: s2 <- v0 000000f8: a0 <- s2 # Looks like number of bytes to copy: 65 KB # a2 = NUMBER_BYTES 000000fc: a2 <- 0x00010000 00000100: ra <- pc + 8; pc <- t0 # Looks like destination buffer # a1 = DIRECCION_BUFFER # Bit 30 = 1 -> real address: 0x08800000 uncached 00000104: a1 <- 0x48800000 # FUNCTION_3(FILE_DESCRIPTOR,DIRECCION_BUFFER,NUMBER_BYTES) # I suppose FUNCTION_3 is read() (sceIoRead) # IoFileMgrForUser_6A638D83 # sceIoRead # Ignoring FUNCTION_3() return value # t0 = SCEPAF_MODULE_START + OFFSET_6 = FUNCTION_4 0000010c: t0 <- 0x0015ee60 00000110: t0 <- s3 + t0 00000114: ra <- pc + 8; pc <- t0 00000118: a0 <- s2 # FUNCTION_4(FILE_DESCRIPTOR) # IoFileMgrForUser_810C4BC3 # sceIoClose 0000011c: pc <- 0x08800000 00000120: a0 <- s3 # Jump to loaded code # Passing it SCEPAF_MODULE_START in a0 -- 进入战国时代..?? http://www.psper.net/psp/M33/05232FZ2009.html --

※ 发信站: 批踢踢实业坊(ptt.cc) ◆ From: 114.47.223.27