Things required :
Some PPC knowledge.
A custom firmware PS3.
Visual studio. So you can test your RPC by calling functions.
Now let`s get started !
First you wanna open up IDA Pro with your game`s ELF file. Once you have loaded the ELF file you want to look for an empty address.
You find an empty address by finding a function that you dont think do anything. When you find the address you will have to go in debugger and put a breakpoint on the address. If you freeze that means the address is being used, if you dont freeze then it`s an empty address
We need an empty address because we need to store our PPC in the memory. Storing it in an address that is being used will overwrite the coding and most likely freeze you. That`s why we did this ^^
Now we have to write our RPC, right?
I will show you what to write and explain what it does.
You will write this :
stdu r1, r1, -0x70
mfspr r0, LR
std r0, r1, 0x80
lis r6, 0x210
lwz r3, r6, 0x04
lwz r4, r6, 0x08
lwz r5, r6, 0x0C
lwz r6, r6
li r6, 0
lis r6, 0x210
stw r3, r6, 0x10
li r3, 0
stw r3, r6
ld r0, r1, 0x80
mtspr LR, r0
addi r1, r1, 0x70
Now i will explain this.
Line 1 : Allocate some space in the stack. So we can store some things.
Line 2 : Receive the link register and set r0 to it.
Line 3 : Stores link register in stack.
Line 4 : Just a memory spot.
Line 5 , 6, 7, 8 : If you know a little PowerPC i shouldn`t have to explain this.
Line 9 : The count register is the address : 0x2100000.
Line 10 : Stops r6 from being parsed as an argument.
Line 11 : Call the address that you stored in the count register.
Line 12 : Sets 0x210 to the register r6
Line 13 : The returned value will be stored at : 0x2100010
Line 14 : Gives the register r3 the value of 0
Line 15 : Erases the function stored at 0x2100000. Important!! Keeps it from calling more than once.
Line 16 : Get the link register.
Line 17 : Set LR to the original link register.
Line 18 : Unallocate the stack.
Line 19 : Return
How to use this.
You would also have to know how to use this, else it`s pretty much useless right??
Include the PS3 library in your projct ofcourse ^^
Then you can use it like this :
Calling an addres :