Skip to content

Instantly share code, notes, and snippets.

View psxdev's full-sized avatar

Antonio Jose Ramos Marquez psxdev

186 followers · 8 following
View GitHub Profile
@psxdev
psxdev / gist:1c2a96fa387d82fc34eb09e7fc1b6a5c
Created August 3, 2022 21:56
Prospero module and handle list dumped from libSceSysmodule.sprx
libkernel
libSceLibcInternal
libSceFios2
libc
libSceNet 0x8000001C
libSceIpmi 0x8000001D
libSceMbus 0x8000001E
libSceRegMgr 0x8000001F
libSceRtc 0x80000020
libSceAvSetting 0x80000021
@psxdev
psxdev / gist:ff44f0eb20bcc08e56af3585b022b13c
Created August 1, 2022 21:39
prospero module handle list
libkernel 0x2001
libSceLibcInternal 0x2
libSceSysmodule 0x11
libbdj 0x13 from bdj environment
libSceIpmi 0x16
libSceNetCtl 0x17
libSceRegMgr 0x19
libSceSystemService 0x1a
libSceNet 0x2b
libSceMbus 0x3a
@psxdev
psxdev / gist:b876404d30cea461ed54feaa752bc780
Created July 31, 2022 22:38
prospero handle for modules
[PROSPERO][INFO] [+] before call sceKernelGetModuleInfo for module 0x2
[PROSPERO][INFO] [+] module name libSceLibcInternal.sprx
[PROSPERO][INFO] [+] module base 0x8058d8000
[PROSPERO][INFO] [+] module size 901120
[PROSPERO][INFO] [+] before call sceKernelGetModuleInfo for module 0x11
[PROSPERO][INFO] [+] module name libSceSysmodule.sprx
[PROSPERO][INFO] [+] module base 0x807f90000
[PROSPERO][INFO] [+] module size 49152
[PROSPERO][INFO] [+] handle 11 dlsym symbol sceSysmoduleIsLoaded address 0x807f90290
[PROSPERO][INFO] [+] handle 11 dlsym symbol sceSysmoduleIsLoadedInternal address 0x807f90540
@psxdev
psxdev / gist:7b44e8399d5061c8ce44e307c9394062
Created July 31, 2022 21:42
[PROSPERO][INFO] [+] tryng to load module /haSpcNQDjO/common/lib/libkernel_sys.sprx
[PROSPERO][INFO] [+] handle 2001 dlsym symbol sceKernelLoadStartModule address 0x80f4a9730
[PROSPERO][INFO] [+] sceKernelLoadStartModule return 0x2001
[PROSPERO][INFO] [+] sceKernelLoadStartModule result 0xb42ae6
[PROSPERO][INFO] [+] tryng to load module /haSpcNQDjO/common/lib/libSceSystemService.sprx
[PROSPERO][INFO] [+] sceKernelLoadStartModule return 0x1a
[PROSPERO][INFO] [+] sceKernelLoadStartModule result 0xf401bb00
[PROSPERO][INFO] [+] tryng to load module /haSpcNQDjO/common/lib/libSceSysmodule.sprx
[PROSPERO][INFO] [+] sceKernelLoadStartModule return 0x11
[PROSPERO][INFO] [+] sceKernelLoadStartModule result 0x81114ea0
@psxdev
psxdev / gist:55102f7b588ea804e2ccd89a0e4b8374
Created July 30, 2022 17:45
prospero proc vmap virtualquery
debug.sh
[HOST] debugnet listener up
[HOST] ready to have a lot of fun!!!
[PROSPERO][INFO] [+] Logger initialized...
[PROSPERO][INFO] [+] Receive udp log in 192.168.1.12 with: socat udp-recv:18194 stdout
[PROSPERO][INFO] [+] Creating File Socket use socat -u TCP-LISTEN:18194,reuseaddr OPEN:app0.zip,creat,trunc
[PROSPERO][ERROR] Connection refused (Connection refused)
[PROSPERO][INFO] [+] bd-jb by bigboss based on TheFlow and sleirsgoevy implementation
[PROSPERO][INFO] [+] Creating JavaSecurityAccess
[PROSPERO][INFO] [+] Creating fake JavaSecurityProxy
@psxdev
psxdev / gist:a9f5ccff9bb9023231673ab88f5773e6
Created July 30, 2022 01:41
prospero native execution bdj.elf proc and vmap
./debug.sh
[HOST] debugnet listener up
[HOST] ready to have a lot of fun!!!
[PROSPERO][INFO] [+] Logger initialized...
[PROSPERO][INFO] [+] Receive udp log in 192.168.1.12 with: socat udp-recv:18194 stdout
[PROSPERO][INFO] [+] Creating File Socket use socat -u TCP-LISTEN:18194,reuseaddr OPEN:app0.zip,creat,trunc
[PROSPERO][INFO] [+] bd-jb by bigboss based on TheFlow and sleirsgoevy implementation
[PROSPERO][INFO] [+] Creating JavaSecurityAccess
[PROSPERO][INFO] [+] Creating fake JavaSecurityProxy
[PROSPERO][INFO] [+] Set fake JavaSecurityProxy
@psxdev
psxdev / gist:e9dca11a2f41e334627a921632c83c14
Created July 23, 2022 17:17
retrieve java System properties from your bdj please share yours from each firmware version you have
Using the java logger at https://gist.github.com/psxdev/fb3fc1c9c329758c7aebaf4b4858afdc
and after you have done SecurityManager bypass add this code
```
Properties p=System.getProperties();
Enumeration keys = p.keys();
while (keys.hasMoreElements())
{
String key = (String)keys.nextElement();
String value = (String)p.get(key);
log.info(key + ": " + value);
@psxdev
psxdev / gist:fb3fc1c9c329758c7aebaf4b4858afdc
Created July 23, 2022 17:00
udp logger for bdj
//add this class to your bdj project change host for your host ip
//To use initialize with:
//Logger log=Logger.getInstance();
//send info logs to host with log.info(".......");
//use this listener on host for example with(remember wsl2 has not direct map for udp ports):
//socat udp-recv:18194 stdout
package org.homebrew;
@psxdev
psxdev / gist:4b09f9f417f5cebce7e9ac77043e38b2
Created July 21, 2022 23:33
prospero implementation :P
debug.sh
[HOST] debugnet listener up
[HOST] ready to have a lot of fun!!!
[PROSPERO][INFO] [+] Logger initialized...
[PROSPERO][INFO] [+] Receive udp log in 192.168.1.12 with: socat udp-recv:18194 stdout
[PROSPERO][INFO] [+] bd-jb by bigboss based on TheFlow and sleirsgoevy implementation
[PROSPERO][INFO] [+] Creating JavaSecurityAccess
[PROSPERO][INFO] [+] Creating fake JavaSecurityProxy
[PROSPERO][INFO] [+] Set fake JavaSecurityProxy
[PROSPERO][INFO] [+] Creating URLClassLoader
@psxdev
psxdev / gist:daa1e2590372d8dd7e115043f9d17629
Created July 20, 2022 00:15
Prospero java system variables
[PROSPERO][INFO] Java specification version : 11
[PROSPERO][INFO] Java specification vendor : Oracle Corporation
[PROSPERO][INFO] Java specification name : Java Platform API Specification
[PROSPERO][INFO] Java Virtual Machine specification version : 11
[PROSPERO][INFO] Java Virtual Machine specification vendor : Oracle Corporation
[PROSPERO][INFO] Java Virtual Machine specification name : Java Virtual Machine Specification
[PROSPERO][INFO] Java Virtual Machine implementation version : 11.0.11-internal+0-javamecdc
[PROSPERO][INFO] Java Virtual Machine implementation vendor : Oracle Corporation
[PROSPERO][INFO] Java Virtual Machine implementation name : Java HotSpot(TM) 64-Bit Minimal VM
[PROSPERO][INFO] Java home : /app0/cdc/