This repository was archived by the owner on Oct 1, 2025. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 2
Expand file tree
/
Copy pathFreebootPatches.cpp
More file actions
270 lines (227 loc) · 15.5 KB
/
Copy pathFreebootPatches.cpp
File metadata and controls
270 lines (227 loc) · 15.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
#include "stdafx.h"
// Check https://github.com/Byrom90/Xbox_360_Research/blob/main/xeBuild_Patches/KHV_17559/17559_KHV_Patchset.s for more patch notes.
const BYTE FREEBOOT_HV_PRIMARY_PATCHES[] = {
// Memory Protections Pt1
0x00, 0x00, 0x15, 0x4C, 0x00, 0x00, 0x00, 0x04, 0x38, 0x80, 0x00, 0x07, 0x7C, 0x21, 0x20, 0x78, 0x7C, 0x35, 0xEB, 0xA6, 0x48, 0x00, 0x11, 0xC2,
// Memory Protections Pt2
0x00, 0x00, 0x11, 0xBC, 0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0x15, 0x4E,
// HV peek poke etc by replacing HvxGetVers syscall
0x00, 0x00, 0xB5, 0x10, 0x00, 0x00, 0x00, 0x48, 0x7D, 0x08, 0x02, 0xA6, 0xA0, 0x60, 0x00, 0x06,
0x38, 0x80, 0x00, 0x21, 0x7C, 0x63, 0x20, 0x78, 0xB0, 0x60, 0x00, 0x06, 0x38, 0x60, 0x00, 0x21,
0x48, 0x00, 0xB5, 0x3F, 0x38, 0x60, 0x00, 0x0A, 0x48, 0x00, 0xB5, 0x3F, 0x7D, 0x08, 0x03, 0xA6,
0x48, 0x00, 0x02, 0xDA, 0x3C, 0x80, 0x80, 0x00, 0x60, 0x84, 0x02, 0x00, 0x78, 0x84, 0x07, 0xC6,
0x64, 0x84, 0xEA, 0x00, 0x54, 0x63, 0xC0, 0x0E, 0x90, 0x64, 0x10, 0x14, 0x80, 0x64, 0x10, 0x18,
0x54, 0x63, 0x01, 0x8D, 0x41, 0x82, 0xFF, 0xF8, 0x4E, 0x80, 0x00, 0x20, 0x3D, 0x60, 0x72, 0x62,
0x61, 0x6B, 0x74, 0x72, 0x7F, 0x03, 0x58, 0x40, 0x41, 0x9A, 0x00, 0x08, 0x48, 0x00, 0x1C, 0xCA,
0x2B, 0x04, 0x00, 0x04, 0x41, 0x99, 0x00, 0x94, 0x41, 0x9A, 0x00, 0x44, 0x38, 0xA0, 0x15, 0x4C,
0x3C, 0xC0, 0x38, 0x80, 0x2B, 0x04, 0x00, 0x02, 0x40, 0x9A, 0x00, 0x0C, 0x60, 0xC6, 0x00, 0x07,
0x48, 0x00, 0x00, 0x0C, 0x2B, 0x04, 0x00, 0x03, 0x40, 0x9A, 0x00, 0x1C, 0x38, 0x00, 0x00, 0x00,
0x90, 0xC5, 0x00, 0x00, 0x7C, 0x00, 0x28, 0x6C, 0x7C, 0x00, 0x2F, 0xAC, 0x7C, 0x00, 0x04, 0xAC,
0x4C, 0x00, 0x01, 0x2C, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20, 0x7D, 0x88, 0x02, 0xA6,
0xF9, 0x81, 0xFF, 0xF8, 0xF8, 0x21, 0xFF, 0xF1, 0x7C, 0xA8, 0x03, 0xA6, 0x7C, 0xE9, 0x03, 0xA6,
0x80, 0x86, 0x00, 0x00, 0x90, 0x85, 0x00, 0x00, 0x7C, 0x00, 0x28, 0x6C, 0x7C, 0x00, 0x2F, 0xAC,
0x7C, 0x00, 0x04, 0xAC, 0x4C, 0x00, 0x01, 0x2C, 0x38, 0xA5, 0x00, 0x04, 0x38, 0xC6, 0x00, 0x04,
0x42, 0x00, 0xFF, 0xE0, 0x4E, 0x80, 0x00, 0x20, 0x38, 0x21, 0x00, 0x10, 0xE9, 0x81, 0xFF, 0xF8,
0x7D, 0x88, 0x03, 0xA6, 0x4E, 0x80, 0x00, 0x20, 0x2B, 0x04, 0x00, 0x05, 0x40, 0x9A, 0x00, 0x14,
0x7C, 0xC3, 0x33, 0x78, 0x7C, 0xA4, 0x2B, 0x78, 0x7C, 0xE5, 0x3B, 0x78, 0x48, 0x00, 0xA8, 0x82,
0x38, 0x60, 0x00, 0x02, 0x4E, 0x80, 0x00, 0x20,
// Replace the actual syscall so it branches to custom function in the above patches
0x00, 0x01, 0x5F, 0xD0, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xB5, 0x64,
0xFF, 0xFF, 0xFF, 0xFF
};
const BYTE FREEBOOT_HV_PATCHES[] = {// Prob don't need all of them but appears to work fine
// ??? - Branches to a function added before the peek poke syscall in the patches above
0x00, 0x00, 0x18, 0x80, 0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0xB5, 0x13, 0x00, 0x00, 0x00, 0xF0,
// Devkit xex aes key
0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
// ???
0x00, 0x00, 0x31, 0x20, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// Disable fuse blowing ???
0x00, 0x00, 0xA5, 0x60, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// HvxLoadImageData
0x00, 0x02, 0xA3, 0x0C, 0x00, 0x00, 0x00, 0x02, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00,
// HvxResolveImports - Bypass STATUS_REVISION_MISMATCH - C0000059
0x00, 0x02, 0xAA, 0x80, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// HvxResolveImports - Bypass STATUS_REVISION_MISMATCH - C0000059
0x00, 0x02, 0xAA, 0x8C, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// HvxSecuritySetDetected
0x00, 0x00, 0x6B, 0xB0, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// HvxSecurityGetDetected
0x00, 0x00, 0x6C, 0x48, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// HvxSecuritySetActivated
0x00, 0x00, 0x6C, 0x98, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// HvxSecurityGetActivated
0x00, 0x00, 0x6D, 0x08, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// HvxSecuritySetStat ???
0x00, 0x00, 0x6D, 0x58, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// HvxKeysGetKey
0x00, 0x00, 0x81, 0x3C, 0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0x00, 0x30,
// KV Patch ??? XeCryptBnQwBeSigVerify
0x00, 0x00, 0x70, 0xBC, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x01,
// KV Patch ???
0x00, 0x00, 0x72, 0x68, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x00,
// NOP MachineCheck
0x00, 0x00, 0x72, 0xB4, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// NOP MachineCheck
0x00, 0x00, 0x72, 0xC4, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// NOP MachineCheck
0x00, 0x00, 0x72, 0xEC, 0x00, 0x00, 0x00, 0x02, 0x60, 0x00, 0x00, 0x00, 0x39, 0x60, 0x00, 0x01,
// ??? - Both HvxImageTransformImageKey & HvxCreateImageMapping use this
0x00, 0x02, 0x4D, 0x58, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// Replaces HvpPkcs1Verify branch
0x00, 0x02, 0x64, 0xF0, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x01,
// ???
0x00, 0x02, 0x9B, 0x08, 0x00, 0x00, 0x00, 0x0E, 0x2B, 0x3C, 0x00, 0x00, 0x41, 0x9A, 0x00, 0x30,
0x2F, 0x03, 0x00, 0x00, 0x40, 0x9A, 0x00, 0x10, 0x38, 0x80, 0x00, 0xF0, 0x48, 0x00, 0x00, 0x18,
0x60, 0x00, 0x00, 0x00, 0x2B, 0x1D, 0x00, 0x00, 0x38, 0x9F, 0x04, 0x40, 0x40, 0x9A, 0x00, 0x08,
0x38, 0x80, 0x00, 0x54, 0x7F, 0x83, 0xE3, 0x78, 0x4B, 0xFF, 0x65, 0xC1, 0x3B, 0xE0, 0x00, 0x00,
// HvxImageTransformImageKey - Disables a conditional branch
0x00, 0x02, 0xB7, 0x78, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// HvxCreateImageMapping hash check
0x00, 0x02, 0xCA, 0xE8, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x00,
// HvxCreateImageMapping HV XEX region check ???
0x00, 0x02, 0xCD, 0xD8, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// HvxExpansionInstall - Disable conditional branch after XeCryptBnQwBeSigVerify
0x00, 0x03, 0x08, 0x9C, 0x00, 0x00, 0x00, 0x04, 0x40, 0x9A, 0x00, 0x08, 0x3B, 0xA0, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00,
// Function is branched to from HvxExpansionInstall - Another check???
0x00, 0x03, 0x04, 0xE8, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
// Function is branched to from HvxExpansionInstall - Another check???
0x00, 0x03, 0x04, 0xFC, 0x00, 0x00, 0x00, 0x01, 0x60, 0x00, 0x00, 0x00,
0xFF, 0xFF, 0xFF, 0xFF
};
BOOL ApplyFreebootHVPatches()
{
cprintf("[ApplyFreebootHVPatches] Attempting to apply Primary Freeboot HV Patches...");
DWORD NumPriPatchesApplied = ApplyPatches(NULL, FREEBOOT_HV_PRIMARY_PATCHES);
cprintf("[ApplyFreebootHVPatches] %i HV patches applied!", NumPriPatchesApplied);
BOOL SetMemRes = Hvx::ToggleMemProtect(FALSE);
if (!SetMemRes)
{
cprintf("[ApplyFreebootHVPatches] Failed to disable memory protections... Skipping remaining patches");
return FALSE;
}
cprintf("[ApplyFreebootHVPatches] Attempting to apply remaining Freeboot HV Patches...");
DWORD NumSecPatchesApplied = ApplyPatches(NULL, FREEBOOT_HV_PATCHES);
cprintf("[ApplyFreebootHVPatches] %i HV patches applied!", NumSecPatchesApplied);
return TRUE;
}
const BYTE FREEBOOT_KERN_PATCHES[] = { // Prob don't need all of them but appears to work fine
// Patches XexpConvertError
0x80, 0x07, 0xB9, 0x20, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches branch to XexpVerifyMediaType within XexpLoadXexHeaders
0x80, 0x07, 0xC4, 0xB8, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x01,
// Patches branch to RtlImageXexHeaderString within XexpLoadFile
0x80, 0x07, 0xC5, 0xE8, 0x00, 0x00, 0x00, 0x01, 0x38, 0x60, 0x00, 0x00,
// Patch within XexpLoadFile
0x80, 0x07, 0xC6, 0x34, 0x00, 0x00, 0x00, 0x01, 0x39, 0x60, 0x00, 0x00,
// Patch within XexpLoadFile
0x80, 0x07, 0xC6, 0x84, 0x00, 0x00, 0x00, 0x01, 0x39, 0x60, 0x00, 0x00,
// Patches XexpVerifyMinimumVersion
0x80, 0x07, 0xAF, 0x08, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patch within SfcxInspectLargeDataBlock
0x80, 0x09, 0x4F, 0x78, 0x00, 0x00, 0x00, 0x01, 0x3A, 0xE0, 0x00, 0x10,
// Patch within SataCdRomAuthenticationExInitialize
0x80, 0x09, 0x98, 0xD0, 0x00, 0x00, 0x00, 0x01, 0x2B, 0x0B, 0x00, 0xFF,
// Patches to disable fatal error screen E66 (VdDisplayFatalError). Caused by DVD drive(ERROR_XSS_CDROM_COULD_NOT_CREATE_DEVICE)
0x80, 0x09, 0x92, 0xB4, 0x00, 0x00, 0x00, 0x05, 0x38, 0x60, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00, 0x60, 0x00, 0x00, 0x00,
// Patches XeKeysVerifyRSASignature
0x80, 0x10, 0x9C, 0x90, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysSecurityConvertError
0x80, 0x10, 0xA7, 0x88, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysDvdAuthExConvertError
0x80, 0x10, 0xAA, 0x68, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches _XeKeysRevokeIsValid
0x80, 0x10, 0xAF, 0x30, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysRevokeIsRevoked
0x80, 0x10, 0xB1, 0x38, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches _XeKeysRevokeIsRevoked
0x80, 0x10, 0xB0, 0xE8, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysRevokeIsDeviceRevoked
0x80, 0x10, 0xB2, 0x78, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysRevokeConvertError
0x80, 0x10, 0xB3, 0xF8, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches XeKeysConsoleSignatureVerification
0x80, 0x10, 0xBF, 0x20, 0x00, 0x00, 0x00, 0x05, 0x2B, 0x05, 0x00, 0x00, 0x38, 0x60, 0x00, 0x01,
0x41, 0x9A, 0x00, 0x08, 0x90, 0x65, 0x00, 0x00, 0x4E, 0x80, 0x00, 0x20,
// Patches XeCryptBnQwBeSigVerify
0x80, 0x11, 0x19, 0x90, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// Patch within MassConfigureTransferCable (Skips hdd security sector verification???)
0x80, 0x0E, 0x17, 0x54,0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0x00, 0x54,
// Patch within MassConfigureTransferCable
0x80, 0x0E, 0x17, 0xCC, 0x00, 0x00, 0x00, 0x03, 0x83, 0x5C, 0x00, 0x98, 0x60, 0x00, 0x00, 0x00,
0x60, 0x00, 0x00, 0x00,
// Patches SataDiskAuthenticateDevice (Disables hdd security sector verification???)
0x80, 0x15, 0xD9, 0xD8,0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
// Patches here use the space available within XeKeysConsoleSignatureVerification due to it being patched out earlier and no longer used.
// Contains multiple functions. launch.xex loader and two delay loops
0x80, 0x10, 0xBF, 0x40, 0x00, 0x00, 0x00, 0x2C, 0x40, 0x98, 0x00, 0x08, 0x4E, 0x80, 0x00, 0x20,
0x3C, 0x60, 0x80, 0x10, 0x3C, 0xA0, 0x00, 0x00, 0x38, 0x80, 0x00, 0x00, 0x60, 0x84, 0x00, 0x08,
0x60, 0x63, 0xBF, 0xD0, 0x38, 0xC0, 0x00, 0x00, 0x4B, 0xF7, 0x18, 0x61, 0x38, 0x60, 0x00, 0x00,
0x3C, 0x80, 0x80, 0x10, 0x60, 0x84, 0xBF, 0xEC, 0x4C, 0x00, 0x01, 0x2C, 0x90, 0x64, 0x00, 0x00,
0x4B, 0xF5, 0x54, 0x64, 0x38, 0xA1, 0x00, 0x54, 0x3C, 0xE0, 0x80, 0x10, 0x60, 0xE7, 0xBF, 0xEC,
0x81, 0x07, 0x00, 0x00, 0x4C, 0x00, 0x01, 0x2C, 0x2B, 0x08, 0x00, 0x00, 0x41, 0x9A, 0x00, 0x0C,
0x7F, 0xFF, 0xFB, 0x78, 0x4B, 0xFF, 0xFF, 0xEC, 0x4E, 0x80, 0x00, 0x20, 0x2B, 0x03, 0x00, 0x14,
0x40, 0x9A, 0x00, 0x24, 0x3C, 0xE0, 0x80, 0x10, 0x60, 0xE7, 0xBF, 0xEC, 0x81, 0x07, 0x00, 0x00,
0x4C, 0x00, 0x01, 0x2C, 0x2B, 0x08, 0x00, 0x00, 0x41, 0x9A, 0x00, 0x0C, 0x7F, 0xFF, 0xFB, 0x78,
0x4B, 0xFF, 0xFF, 0xEC, 0x4B, 0xFF, 0xC4, 0x44, 0x5C, 0x44, 0x65, 0x76, 0x69, 0x63, 0x65, 0x5C,
0x46, 0x6C, 0x61, 0x73, 0x68, 0x5C, 0x6C, 0x61, 0x75, 0x6E, 0x63, 0x68, 0x2E, 0x78, 0x65, 0x78,
0x00, 0x00, 0x00, 0x00, /*0x12, 0x34, 0x56, 0x78,*/ // This is set to zero after launch.xex is loaded on boot. It appears to used to delay execution of other functions. (XexLoadExecutable & XeKeysGetKeyProperties)
0x00, 0x00, 0x00, 0x00, // Setting to zero allow the functions to run as if it was set on boot
// Patch within Phase1Initialization. Branch to check if xam was loaded. This is the first part of the launch.xex loader
0x80, 0x06, 0x13, 0xCC, 0x00, 0x00, 0x00, 0x01, 0x48, 0x0A, 0xAB, 0x75,
// Patch within XexLoadExecutable to branch to the delay loop mentioned above
0x80, 0x07, 0xD7, 0xF8, 0x00, 0x00, 0x00, 0x01, 0x48, 0x08, 0xE7, 0x85,
// Patches XeKeysGetKeyProperties to branch to the delay loop mentioned above
0x80, 0x10, 0x8E, 0x70, 0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0x31, 0x34,
// = ADDITONAL PATCHES=
// Usbdsec patches for controllers - Credit to InvoxiPlayGames
0x80, 0x0D, 0x87, 0x48, 0x00, 0x00, 0x00, 0x02, 0x38, 0x60, 0x00, 0x01, 0x4E, 0x80, 0x00, 0x20,
0x80, 0x0F, 0x98, 0xE0, 0x00, 0x00, 0x00, 0x01, 0x48, 0x00, 0x00, 0x10,
0xFF, 0xFF, 0xFF, 0xFF
};
BOOL ApplyFreebootKernPatches()
{
cprintf("[ApplyFreebootKernPatches] Attempting to apply Freeboot Kernel Patches...");
DWORD NumKernPatchesApplied = ApplyPatches(NULL, FREEBOOT_KERN_PATCHES);
cprintf("[ApplyFreebootKernPatches] %i Kernel patches applied!", NumKernPatchesApplied);
cprintf("[ApplyFreebootKernPatches] All patches applied for full Freeboot patchset!");
return TRUE;
}
// Undo the patches made during the initial exploit to avoid any potential conflicts with the Freeboot patches
const BYTE BU_REVERT_PATCHES[] = {
// Comment this out to leave the HvxPostOutput backdoor in place
0x00, 0x01, 0x60, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x25, 0x40,
/// Undo HV RSA patch to allow xex files - Restores branch to XeCryptBnQwBeSigVerify in HvpImageSignatureVerification
0x00, 0x02, 0x9B, 0x04, 0x00, 0x00, 0x00, 0x01, 0x4B, 0xFF, 0x6B, 0x7D, // Freeboot adds patches at 0x29B08 to cover this
// Undo Kernel RSA patch to allow xex files - Restores branch to XeCryptBnQwBeSigVerify in XexpVerifyXexHeaders
0x80, 0x07, 0xBF, 0xDC, 0x00, 0x00, 0x00, 0x01, 0x48, 0x08, 0xDD, 0x75,
// End of patches
0xFF, 0xFF, 0xFF, 0xFF
};
VOID RevertBadExploitPatches()
{
cprintf("[RevertBadExploitPatches] Attempting to revert BadUpdate changes...");
DWORD NumPatchesApplied = ApplyPatches(NULL, BU_REVERT_PATCHES);
cprintf("[RevertBadExploitPatches] %i patches applied!", NumPatchesApplied);
}
VOID RestoreRoL()
{
cprintf("[RevertBadExploitPatches] Restoring RoL state...");
// Disable SMC RoL LED override - Restores the LEDs default state and allows controller pairing to function correctly - Credit to InvoxiPlayGames
BYTE rol_led_buf[0x10] = { 0x99,0x00,0x00,0,0,0,0,0,0,0,0,0,0,0,0,0 };
HalSendSMCMessage(rol_led_buf, NULL);
}
// Patches to fix various things
const BYTE ADDITIONAL_PATCHES[] = {
// Wipes HvpProtectedFlags that have been set on boot due to patches not being in place
// This should hopefully fix at least one issue. (dvd drive checks causing "The disc is unreadable" error when running xex files extracted from discs)
0x00, 0x01, 0x66, 0x18, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
// End of patches
0xFF, 0xFF, 0xFF, 0xFF
};
VOID ApplyAdditionalPatches()
{
cprintf("[ApplyAdditionalPatches] Attempting to apply additional patches for fixes etc...");
DWORD NumPatchesApplied = ApplyPatches(NULL, ADDITIONAL_PATCHES);
cprintf("[ApplyAdditionalPatches] %i patches applied!", NumPatchesApplied);
}