Join Us and become a Member for a Verified Badge to access private areas with the latest PS4 PKGs.
PS4 CFW and Hacks       Thread starter PSXHAX       Start date Sep 21, 2020 at 12:15 AM       110      
Status
Not open for further replies.
Earlier this month @2much4u (Twitter) shared a GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack via @Andrew Marques (Twitter), and today he extended the invitation to anyone else interested in finishing his work-in-progress (WIP) for Grand Theft Auto V PS4 scene fans. :geek:

Download: PS4-GTA-V-Native-Caller.bin (1 MB - US) / PS4-GTA-V-Native-Caller.bin (1 MB - EU - Crashes) / PS4-GTA-V-Native-Caller.zip (515 KB - WIP Pack) / PS4-GTA-V-Menu-Base-6.72-1.00.zip / ArabicGuy-1.0-6.72-1.32.zip via cspencer49519 (GraFfiX49519) / PS4 GTA V Native Caller GIT / PS4-GTA-V-Menu-Base-6.72-1.00.zip via Mustafa0436 / PS4 GTA V Menu Base GIT / ArabicGuy.rar (60 KB - 1.27 bin) / ArabicGuy-1.0-132.bin.zip (70 KB - 1.32 bin) / GTA ArabicGuy Menu.zip (201 KB - includes ArabicGuy100.bin, ArabicGuy127.bin and ArabicGuy132.bin) / Lamance_672_132_.bin (1.02 MB - Lamance Menu v0.8 for 1.32 on PS4 6.72) via david1337hax / Lamance_672_132_fixed.bin (1.02 MB - Lamance Menu v0.8.1 for 1.32 on PS4 6.72) via david1337hax / GTAV Mods 7.02 Ports via @karo218 / BeefQueefMod-672-702-v133.zip (323 KB) / GTAV 75X.zip (7.1 MB - GTAV 75X Payload Ports) / BeefQueefMod-PS4-900-133.zip (165 KB - includes BeefQueefMod-PS4.bin)

From 2much4ux's Tweet below, to quote: "I mostly ported GTA V Native Caller to GTA 1.32, but didn't have time to finish before school hit. I tossed the unfinished source at Andrew a while back. If anyone wants to try to complete it, go for it!"

This latest Grand Theft Auto V pack comes following the previously released GTA V Native Caller, GTA 5 Native Caller Updates, GTA V Menu Base PS4 Mod Menu GUI, more GTA V Native Caller Updates, another GTA V Native Caller / Invoker, GTA V PS4 5.05 LTS Menu Base 1.27 with Native Caller and GTA 5 Mod Menus from earlier this year.

From the README.md: PS4 GTA V Native Caller

A simple example of calling natives on PS4 GTA V using Vortex's adaptation of CTurt's PS4 ***.

Brief Explanation

Purpose


A large part of GTA V is controlled by custom script files Rockstar writes in their own format. A virtual processor is included in each version of the game to interpret these scripts. The main way for them to interact with and control the game is to invoke natives.

Natives are functions defined within the game's executable. In the same way that scripts use natives to control the game, arbitrarily calling them will allow the caller to control the game to his/her desire. The purpose of this payload is to provide an easy way of doing just that. It includes a few small examples: making the player invincible, giving the player super jump, and teleporting the player when a button combination is pressed.

Setting Up Execution

First, a kernel payload is executed to escape the sandbox, escalate the web browser's privileges, and make appropriate kernel patches. The kernel payload also disables ASLR for newly created processes, making it easier to modify them. Afterward, the browser payload constantly checks the running processes waiting for one called eboot.bin.

Once a game process is found, the syscall ptrace is used to read and write to it. With ASLR disabled, the EBOOT always starts at 0x400000 in memory. A few bytes are read from the EBOOT to verify that the game is GTA V and to detect the region. A small function for setting up the execution environment is copied into free executable space in the EBOOT and IS_PLAYER_ONLINE is hooked to call it.

This function allocates more memory within GTA's process since the EBOOT has limited space. Once the setup is complete, the GTA payload is copied into the newly allocated space, the setup function starts executing it, and the browser payload exits.

Executing Inside GTA V

The GTA payload will execute any time the native IS_PLAYER_ONLINE is called by one of Rockstar's scripts. GTA V has a native lookup table that allows for quickly obtaining a native's address from its hash. However, on newer versions of the game, that table is obfuscated. Therefore, this payload calls natives directly by address rather than using the lookup table.

Native functions are the same as they are on the PC version of the game, meaning the documentation on NativeDB can be used. The majority of the code in the GTA payload is filtered to only execute once a frame (IS_PLAYER_ONLINE is called multiple times a frame), in order to keep things smooth. This will be more important for any drawing.

Miscellaneous Notes

Building


The GTA payload is automatically built and included in the browser payload, so you only need to run make in the main directory.

Buttons

An official documentation of button indices is included in gtaPayload/include/types.h, however it uses XBOX names. So, Y is triangle, X is square, etc.

Testing

Since this injects a payload into GTA's process, multiple versions can be tested without having to restart the game. Each instance will replace the previous one, so multiple payloads cannot be run at once.

Credits
  • Specter, CTurt, qwertyoruiopz, flatz, idc, SKFU, droogie, Xerpi, bigboss, Hunger, Takezo, and Proxima - PS4 research making all this possible
  • Alexander Blade and NativeDB Contributors - Native research making GTA V stuff relatively easy to port to PS4
  • EROOTIIK - Obtaining and parsing the vast majority of native addresses
Also from the README.md: LTS Menu Base Port

A simple menu base ported from PS3 LTS Menu using the source.

Credits:

2Much4u and EROOTIK, 2Much4u for the native caller and EROOTIK for everything for 1.27. Oh, and whoever leaked the LTS menu source.

And from the other README.md: PS4 GTA V Menu Base

A mod menu GUI for PS4 GTA V built on top of my native caller.

How to Activate
  • Press DPAD RIGHT + SQUARE
PAY ATTENTION PLEASE!

This mod menu is very unstable and will most likely crash GTA V many times before you get it to work. If you load ArabicGuy first, then close the game. Then load this mod menu, it will work. Also the mod menu will only work with Leeful's HEN

Pictures

GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack by 2much4u 2.jpg GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack by 2much4u 3.jpg GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack by 2much4u 4.jpg GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack by 2much4u 5.jpg
PAY ATTENTION PLEASE!

This mod menu is very unstable and will most likely crash GTA V many times before you get it to work. If you load ArabicGuy first, then close the game. Then load this mod menu, it will work.

Key Features
  • Unlimited submenus
  • Unlimited options
  • Option & submenu remembrance
  • Auto adjusting and scrolling background
  • Full customization
  • Simple keyboard input and handling
  • Support for numerous dynamic option types
  • Button instructions display
  • Example options and vehicle spawner
Notes

While the example submenus showcase much of the menu base's functionality, more is possible. Check out menu.cpp for all supported option types.

Menu::vehicleSpawn and Menu::vehicleToSpawn are only for the example vehicleSpawner submenu and are unnecessary to the overall menu base.

The UI is fairly simple and open to more advanced customization such as the addition of sprites.

Spoiler: Related Tweets / Videos

GTA V Native Caller PS4 Port to GTA 1.32 WIP Pack by 2much4u.jpg
 

Comments

So i tried to port the Native Caller that is linked in this forum, and through putty i get this error on the ps4. Mira_Escape is when i load the bin loader. The rest is when the payload is loaded. Seems like i get a kp.
Code:
mira_escape
<118>[SceShellCore] Libc Heap Status: free 43%, in-use 3470.0 KB, trend +3.9 KB/min, peak 3923.1 KB, when 764 [sec]
## Kernel panic: received fatal trap 12 (page fault) while in kernel mode.
##
## fault virtual address: 0x926200110
## fault code: supervisor read instruction, page not present
##
## instruction pointer: 0x20:0x926200110
## stack pointer: 0x28:0xffffff8068f17980
## frame pointer: 0x28:0xffffff8068f17aa0
## code segment:  base 0x0, limit 0xfffff, type 0x1b
##                DPL 0, pres 1, long 1, def32 0, gran 1
## processor eflags: interrupt enabled, resume, IOPL = 0
## current process: 67 (SceNKWebProcessMain)
##
## kernel base: 0xffffffff8f62c000
## mira base:   0xffffff8069120000 (size: 0x50c10)
## mira allocated base: 0xffffff8069178008 (size: 0x50c10)
## mira proc:   0xffffe88b1d3b8000 (entry: 0xffffff8069191078)
## mira entrypoint (mira_entry): 0xffffff8069191078
## instruction pointer offset (mira allocated base: 0x88bd088108)
##     messageManager: 0xffffe88b1d155800
##     pluginManager:  0xffffe88b1d097580
##     rpcServer:      0xffffe88b1d895600
##
## instruction pointer offset (kernel: 0x996bd4110) (mira_entry: 0x88bd06f098)
##
## last branch from: 0xffffffff8f94805c
## last branch to:   0x926200110
##
## registers:
## rax: 0xffffffff9074a210  rbx: 0xffffe88b1d45b210
## rcx: 0x0000000000000001  rdx: 0x0000000206f615d0
## rsi: 0xffffff8068f17a28  rdi: 0xffffe88b1d45b210
## rbp: 0xffffff8068f17aa0  rsp: 0xffffff8068f17998
## r8 : 0xffffffff8f9eda70  r9 : 0x0000000000000000
## r10: 0xffffff8068f17960  r11: 0xffffff8068f17b80
## r12: 0x0000000000000000  r13: 0xffffffff91d900c0
## r14: 0xffffffff91887c50  r15: 0xffffe88b1d3b56d0
##
## backtrace:
##  [0] [return: 0xffffffff8f62c313] [from: 0xffffff8068f17aa0]
## hanging crashed thread..
 
how do we find these address for 6.72, is there a tutorial anywhere i assume we use ida ?
  • KERN_XFAST_SYSCALL
  • KERN_PROCESS_ASLR
  • KERN_PRISON_0
  • KERN_ROOTVNODE
  • KERN_PTRACE_CHECK
 
I haven't done any PS4 development, but I would assume these addresses could be found by looking at decrypted firmware from 5.x and diffing it with a decrypted 6.72 firmware. I believe decrypted updates are out there.
 
@kevambert Look at the first page of comments in this thread. I released the codes you need. But it isn't that simple. I've already changed the offsets and compiled the mod menu, But the results of it is a crashing ps4 with Kernel Panic. I think some structures has to be changed before it works in 6.72.

@GraFfiX420 You simply get the kernel dump of 5.05 and 6.72, then you compare the offsets after looking them up in 5.05. Then you find these that looks most similar on 6.72 kernel dump.

Sony did some huge changes in the kernel between 5.05 to 6.72. That's why i think the mods has to be rewritten.
 
Status
Not open for further replies.
Back
Top