Aujourd'hui je m essaye au hack natif avec YAHM (parait que c est ce qu'il y a de mieux .... blablablabla)
Bref ...
Extrait de la doc :
CITATION
'TRA5' resource.
This resource hold info about 'armc' resource with appropriate resource index. Resource contains structure (with m68k byte order!):
struct ArmTrapInfo{
UInt32 baseTableOffset; // offset of table from R9 (without negative sign)
UInt32 offset; // offset into table
UInt32 thumb; // 0 for ARM code, 1 for thumb code
UInt32 zero0; // should be zero
UInt32 zero1; // should be zero
};
Following sample show declaration of 'TRA5' resource in PilRC file.
HEX "TRA5" ID 1000
00 00 00 12
00 00 02 04
00 00 00 00
00 00 00 00
00 00 00 00
This is declaration for FrmCustomAlert syscall. This syscall calls as
LDR R12, [R9,-12]MOV LR,PC
LDR PC, [R12,#516]
Complete list of syscalls you can found in file SysTables.txt inside archive.
This resource hold info about 'armc' resource with appropriate resource index. Resource contains structure (with m68k byte order!):
struct ArmTrapInfo{
UInt32 baseTableOffset; // offset of table from R9 (without negative sign)
UInt32 offset; // offset into table
UInt32 thumb; // 0 for ARM code, 1 for thumb code
UInt32 zero0; // should be zero
UInt32 zero1; // should be zero
};
Following sample show declaration of 'TRA5' resource in PilRC file.
HEX "TRA5" ID 1000
00 00 00 12
00 00 02 04
00 00 00 00
00 00 00 00
00 00 00 00
This is declaration for FrmCustomAlert syscall. This syscall calls as
LDR R12, [R9,-12]MOV LR,PC
LDR PC, [R12,#516]
Complete list of syscalls you can found in file SysTables.txt inside archive.
Le probleme est le suivant je souhaite appeler une api qui necessite un selector (comme les api de la libnet et de la high res) ....
Quelqu'un saurait m'orienter la dessus ...
J'essaye entre autre de patcher la l'appel WinSetCoordinateSystem et donc en assembleur arm je n'arrive pas a retrouver une reference au registre R9 (ps je compile avec pp)...
Mais avec gcc j'ai reussi a trouver un appel du genre
LDR R12, [R9,#-8]
LDR PC, [R12,#1060]
j'ai donc ecrit ma ressource tra5 de la maniere suivante :
HEX "TRA5" ID 1000
00 00 00 08
00 00 04 24
00 00 00 00
00 00 00 00
00 00 00 00
Mais le hack reponds a l'appel system correspond a la trap highres sans selector ...
une idee ?
