wip:

- add full 3.00 support.
- add more partial 3.10 support.
- fix dumpserver bug.

Author: CC

README.md

@@ -9,7 +9,7 @@ Those interested in contributing to PS5 research/dev can join a discord I have s
 
 Exploit should now support the following firmwares:
 
-- 3.00 (partially)
+- 3.00
 - 3.10 (partially)
 - 3.20
 - 3.21

document/en/ps5/offsets/3.00.js

@@ -373,12 +373,12 @@ let syscall_map = {
     0x2D2: 0x32750, // sys_workspace_ctrl
 };
 
-const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD    = 0x7301; //check
-const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE  = 0x0; //check
-const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x0; //check
+const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD    = 0x7301;
+const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE  = 0x317301;
+const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE  = 0xEE7301;
+const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x276DC58;
+const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x6466474;
+const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x6466498;
+const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x6466500;
+const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x1CC2670;
+const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x67AB4C0;

document/en/ps5/offsets/3.10.js

@@ -376,9 +376,9 @@ let syscall_map = {
 const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD    = 0x0; //check
 const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE  = 0x0; //check
 const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x0; //check
+const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x276DC58;
+const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x6466474;
+const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x6466498;
+const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x6466500;
+const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x1CC2670;
+const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x67AB4C0;

dumpserver.py

@@ -15,26 +15,25 @@ def server_program():
     conn.settimeout(60) # 60 second timeout
     print("Connection from: " + str(address))
 
-    dump_data = bytearray()
-    while True:
-        try:
-            data = conn.recv(0x10000)
-            if not data:
-                break
-            dump_data.extend(data)
-            print("Received " + str(len(dump_data)) + " bytes...")
-        except socket.timeout:
-            print("Timeout reached for receiving data (1 min)")
-            break
-
-    # write to file
+    
     timestr = time.strftime("%Y%m%d-%H%M%S")
     print("[+] Writing dump to dump-" + timestr + ".bin...")
-    f = open("dump-" + timestr + ".bin", "wb")
-    f.write(dump_data)
-    f.close()
 
+    total_received = 0
+    with open("dump-" + timestr + ".bin", "wb") as f:
+        while True:
+            try:
+                data = conn.recv(0x10000)
+                total_received += len(data)
+                print("Received " + str(total_received) + " bytes...")
+                if not data:
+                    break
+                f.write(data);
+            except:
+                break
+        f.close()
     conn.close()
+    server_socket.close()
 
 if __name__ == '__main__':
     server_program()