org.ps5jb
diff --git a/xlet/src/main/java/org/ps5jb/loader/RemoteLogger.java b/xlet/src/main/java/org/ps5jb/loader/RemoteLogger.java
index 74f456b..98217e6 100644
--- a/xlet/src/main/java/org/ps5jb/loader/RemoteLogger.java
+++ b/xlet/src/main/java/org/ps5jb/loader/RemoteLogger.java
@@ -1,13 +1,10 @@
package org.ps5jb.loader;
-import java.io.IOException;
import java.io.PrintWriter;
import java.io.StringWriter;
-import java.io.UnsupportedEncodingException;
import java.net.DatagramPacket;
import java.net.DatagramSocket;
import java.net.InetAddress;
-import java.util.Arrays;
import java.util.StringTokenizer;
/**
diff --git a/xlet/src/main/java/org/ps5jb/loader/Status.java b/xlet/src/main/java/org/ps5jb/loader/Status.java
index a06dd47..bb8978d 100644
--- a/xlet/src/main/java/org/ps5jb/loader/Status.java
+++ b/xlet/src/main/java/org/ps5jb/loader/Status.java
@@ -71,7 +71,7 @@ public static void println(String msg, boolean replaceLast) {
// Remote logger does not seem to work before jailbreak
if (System.getSecurityManager() == null) {
initLogger();
- LOGGER.info(msg);
+ LOGGER.info(finalMsg);
}
}
diff --git a/xploit/src/main/java/org/ps5jb/client/payloads/DumpClasses.java b/xploit/src/main/java/org/ps5jb/client/payloads/DumpClasses.java
index 9b43145..0529c6d 100644
--- a/xploit/src/main/java/org/ps5jb/client/payloads/DumpClasses.java
+++ b/xploit/src/main/java/org/ps5jb/client/payloads/DumpClasses.java
@@ -33,12 +33,12 @@
*
*
* To use, simply send this class to the PS5 for execution in the JAR Loader.
- * Then use nc or another tool to connect to the PS5:
+ * Then use `nc` or another tool to connect to the PS5:
* nc [PS5 IP] 9125 > classpath.zip
*
*
* Upon connection, the classpath will be dumped and sent back to `nc`.
- * Depending on OS `nc` may not terminate by itself. When PS5 reports that
+ * Depending on OS, `nc` may not terminate by itself. When PS5 reports that
* the dump is finished, simply terminate it by force.
*
*/
@@ -208,7 +208,7 @@ protected boolean tryDumpBuiltinClassLoader(ClassLoader cl, Class clClass, ZipOu
OpenModuleAction.execute("java.lang.module.ModuleReference");
OpenModuleAction.execute("jdk.internal.module.SystemModuleFinders");
- // On PS5, stream API is put away in jdk.internal.utl package.
+ // On PS5, stream API is put away in jdk.internal.util package.
// Because of this, all the calls to iterate over modules below have to use reflection.
try {
OpenModuleAction.execute("jdk.internal.util.Optional");
@@ -237,15 +237,12 @@ protected boolean tryDumpBuiltinClassLoader(ClassLoader cl, Class clClass, ZipOu
final ModuleReader mr = mref.open();
try {
- Method listMethod = mr.getClass().getMethod("list", new Class[0]);
- listMethod.setAccessible(true);
+ Method listMethod = getMethod(mr.getClass(), "list", new Class[0]);
- Method openMethod = mr.getClass().getMethod("open", new Class[] { String.class });
- openMethod.setAccessible(true);
+ Method openMethod = getMethod(mr.getClass(), "open", new Class[] { String.class });
Object resourceStream = listMethod.invoke(mr, new Object[0]);
- Method toArrayMethod = resourceStream.getClass().getMethod("toArray", new Class[0]);
- toArrayMethod.setAccessible(true);
+ Method toArrayMethod = getMethod(resourceStream.getClass(), "toArray", new Class[0]);
Object[] resources = (Object[]) toArrayMethod.invoke(resourceStream, new Object[0]);
for (Object res : resources) {
@@ -253,13 +250,11 @@ protected boolean tryDumpBuiltinClassLoader(ClassLoader cl, Class clClass, ZipOu
if (!dumpedEntries.contains(resName)) {
Object isOptional = openMethod.invoke(mr, new Object[] { res });
- Method isPresentMethod = isOptional.getClass().getMethod("isPresent", new Class[0]);
- isPresentMethod.setAccessible(true);
- Method getMethod = isOptional.getClass().getMethod("get", new Class[0]);
- getMethod.setAccessible(true);
+ Method Optional_isPresentMethod = getMethod(isOptional.getClass(), "isPresent", new Class[0]);
+ Method Optional_getMethod = getMethod(isOptional.getClass(), "get", new Class[0]);
- if (((Boolean) isPresentMethod.invoke(isOptional, new Object[0])).booleanValue()) {
- InputStream is = (InputStream) getMethod.invoke(isOptional, new Object[0]);
+ if (((Boolean) Optional_isPresentMethod.invoke(isOptional, new Object[0])).booleanValue()) {
+ InputStream is = (InputStream) Optional_getMethod.invoke(isOptional, new Object[0]);
try {
createZipEntry(is, resName, zip);
dumpedEntries.add(resName);
@@ -287,6 +282,52 @@ protected boolean tryDumpBuiltinClassLoader(ClassLoader cl, Class clClass, ZipOu
return false;
}
+ /**
+ * Returns the method by reflection and makes it accessible. If method is not found,
+ * prints the existing methods of the class for debugging purposes.
+ *
+ * @param cl Class whose method to return.
+ * @param methodName Name of the method.
+ * @param parameterTypes Parameter types of the method.
+ * @return Reflective reference to the method.
+ * @throws NoSuchMethodException If the method could not be found.
+ * @see Class#getMethod(String, Class[])
+ * @see Method#setAccessible(boolean)
+ */
+ protected Method getMethod(Class cl, String methodName, Class[] parameterTypes) throws NoSuchMethodException {
+ try {
+ Method result = cl.getMethod(methodName, new Class[0]);
+ result.setAccessible(true);
+
+ return result;
+ } catch (NoSuchMethodException e) {
+ // Print methods to debug why its not found
+ printClassMethods(cl, "");
+ throw e;
+ }
+ }
+
+ /**
+ * Prints the all the methods of the given class and its descendants.
+ *
+ * @param cl Class whose methods to print.
+ * @param indent Indent to use when printing.
+ */
+ protected void printClassMethods(Class cl, String indent) {
+ Method[] methods = cl.getDeclaredMethods();
+ String nextIndent = indent + " ";
+ if (methods.length > 0) {
+ Status.println(indent + cl.getName() + ":");
+ for (Method method : methods) {
+ Status.println(nextIndent + method.toString());
+ }
+ }
+
+ if (cl.getSuperclass() != null) {
+ printClassMethods(cl.getSuperclass(), nextIndent);
+ }
+ }
+
/**
* Dumps a JarFile to the zip output stream.
*
diff --git a/xploit/src/main/java/org/ps5jb/client/payloads/MiniTennisGame.java b/xploit/src/main/java/org/ps5jb/client/payloads/MiniTennisGame.java
new file mode 100644
index 0000000..8fd1634
--- /dev/null
+++ b/xploit/src/main/java/org/ps5jb/client/payloads/MiniTennisGame.java
@@ -0,0 +1,237 @@
+package org.ps5jb.client.payloads;
+
+import java.awt.BorderLayout;
+import java.awt.Color;
+import java.awt.Font;
+import java.awt.Graphics;
+import java.awt.Graphics2D;
+import java.awt.Rectangle;
+import java.awt.image.BufferedImage;
+
+import org.dvb.event.EventManager;
+import org.dvb.event.OverallRepository;
+import org.dvb.event.UserEvent;
+import org.dvb.event.UserEventListener;
+import org.havi.ui.HContainer;
+import org.havi.ui.HScene;
+import org.havi.ui.HSceneFactory;
+import org.havi.ui.event.HRcEvent;
+import org.ps5jb.loader.Config;
+import org.ps5jb.loader.Status;
+
+/**
+ * Implementation of a Mini-Tennis game on PS5. Originally from:
+ * Edu4Java.
+ */
+public class MiniTennisGame extends HContainer implements Runnable, UserEventListener {
+ private static final int RACQUET_WIDTH = 150;
+ private static final int RACQUET_HEIGHT = 10;
+ private static final int RAQUET_SPEED = 10;
+
+ private static final int BALL_DIAMETER = 30;
+ private static int BALL_SPEED = 15;
+
+ /** Ball x position */
+ private int x = 0;
+ /** Ball y position */
+ private int y = 0;
+ /** Ball horizontal shift per frame */
+ int xa = BALL_DIAMETER / BALL_SPEED;
+ /** Ball vertical shift per frame */
+ int ya = BALL_DIAMETER / BALL_SPEED;
+
+ /** Raquet x position */
+ int rx = 0;
+ /** Raquet horizontal shift per frame */
+ int rxa = 0;
+ /** Raquet y position */
+ int ry = 0;
+
+ /** Indicates whether to terminate the game */
+ private boolean terminated = false;
+
+ /** Indicates that the ball did not hit the raquet and game is over */
+ private boolean isGameOver = false;
+
+ /** Start time of the current game round. */
+ private long startTime;
+
+ /** All the rendering happens into this image off-screen. Then the main rendering loop just shows this image. */
+ private BufferedImage offscreenBuffer;
+ /** Graphics object associated with the off-screen buffer. */
+ private Graphics2D offscreenGraphics;
+ /** Scale of the off-screen buffer. The final image is scaled to 1 to simulate anti-aliasing. */
+ private int offscreenScale = 3;
+
+ /** Game entry point. */
+ @Override
+ public void run() {
+ EventManager.getInstance().addUserEventListener(this, new OverallRepository());
+ try {
+ setSize(Config.getLoaderResolutionWidth(), Config.getLoaderResolutionHeight());
+ setBackground(Color.darkGray);
+ setForeground(Color.lightGray);
+ setVisible(true);
+
+ HScene scene = HSceneFactory.getInstance().getDefaultHScene();
+ scene.add(this, BorderLayout.CENTER, 0);
+ try {
+ scene.validate();
+
+ Graphics2D g2d = (Graphics2D) getGraphics();
+ offscreenBuffer = g2d.getDeviceConfiguration().createCompatibleImage(offscreenScale * getWidth(), offscreenScale * getHeight());
+ offscreenGraphics = offscreenBuffer.createGraphics();
+ try {
+ startTime = System.currentTimeMillis();
+ while (!terminated) {
+ moveBall();
+ moveRacquet();
+ repaint();
+
+ try {
+ Thread.sleep(isGameOver ? 5000L : 10);
+ } catch (InterruptedException e) {
+ Status.printStackTrace(e.getMessage(), e);
+ terminated = true;
+ }
+
+ if (isGameOver) {
+ x = 0;
+ y = 0;
+ xa = BALL_DIAMETER / BALL_SPEED;
+ ya = BALL_DIAMETER / BALL_SPEED;
+ rx = 0;
+ rxa = 0;
+ ry = 0;
+ isGameOver = false;
+ startTime = System.currentTimeMillis();
+ BALL_SPEED = 15;
+ } else {
+ BALL_SPEED = Math.max(5, 15 - (int) ((System.currentTimeMillis() - startTime) / 1000 / 10));
+ }
+ }
+ } finally {
+ setVisible(false);
+ scene.remove(this);
+ }
+ } finally {
+ if (offscreenGraphics != null) {
+ offscreenGraphics.dispose();
+ }
+ }
+ } finally {
+ EventManager.getInstance().removeUserEventListener(this);
+ }
+
+ Status.println("Mini-Tennis Terminated");
+ }
+
+ /**
+ * Paint a scaled image of this container using the given Graphics object.
+ *
+ * @param g Graphics to use for paining.
+ * @param scale Scale at which to paint.
+ */
+ private synchronized void paintTo(Graphics g, int scale) {
+ g.setColor(getBackground());
+ g.fillRect(0, 0, scale * getWidth(), scale * getHeight());
+
+ g.setColor(getForeground());
+ g.fillOval(scale * x, scale * y, scale * BALL_DIAMETER, scale * BALL_DIAMETER);
+ g.fillRect(scale * rx, scale * ry, scale * RACQUET_WIDTH, scale * RACQUET_HEIGHT);
+
+ if (isGameOver) {
+ g.setColor(Color.red);
+ g.setFont(new Font(null, Font.BOLD, scale * 25));
+
+ String text = "Game over, restarting in 5 seconds unless RED button is pressed...";
+ int height = g.getFontMetrics().getHeight();
+ int width = g.getFontMetrics().stringWidth(text);
+ g.drawString(text, (scale * getWidth() - width) / 2, (scale * getHeight() - height) / 2);
+ }
+ }
+
+ /**
+ * Paint this component with the given Graphics object.
+ *
+ * @param g Graphics to paint with.
+ */
+ @Override
+ public synchronized void paint(Graphics g) {
+ paintTo(offscreenGraphics, offscreenScale);
+ g.drawImage(offscreenBuffer, 0, 0, getWidth(), getHeight(), 0, 0, offscreenBuffer.getWidth(), offscreenBuffer.getHeight(), null);
+ }
+
+ /**
+ * Move th ball position.
+ */
+ private void moveBall() {
+ if (x + xa < 0)
+ xa = BALL_DIAMETER / BALL_SPEED;
+ if (x + xa > getWidth() - BALL_DIAMETER)
+ xa = -(BALL_DIAMETER / BALL_SPEED);
+ if (y + ya < 0)
+ ya = BALL_DIAMETER / BALL_SPEED;
+ if (y + ya > getHeight() - BALL_DIAMETER)
+ isGameOver = true;
+ if (isCollision()) {
+ ya = -(BALL_DIAMETER / BALL_SPEED);
+ y = ry - BALL_DIAMETER;
+ }
+ x = Math.min(x + xa, getWidth() - BALL_DIAMETER);
+ y = Math.min(y + ya, getHeight() - BALL_DIAMETER);
+ }
+
+ /**
+ * Move the raquet position based on whether user key is pressed or no.
+ */
+ public void moveRacquet() {
+ ry = getHeight() - 50;
+
+ if (rx + rxa > 0 && rx + rxa < getWidth() - RACQUET_WIDTH)
+ rx = rx + rxa;
+ }
+
+ /**
+ * Check if the ball collided with the racquet.
+ *
+ * @return True of ball has collided with the racquet.
+ */
+ private boolean isCollision() {
+ Rectangle rBounds = new Rectangle(rx, ry, RACQUET_WIDTH, RACQUET_HEIGHT);
+ Rectangle bBounds = new Rectangle(x, y, BALL_DIAMETER, BALL_DIAMETER);
+
+ return rBounds.intersects(bBounds);
+ }
+
+ /**
+ * Handler for key press events.
+ *
+ * @param userEvent Event associated with user pressing/de-pressing the controller buttons.
+ */
+ @Override
+ public void userEventReceived(UserEvent userEvent) {
+ if (userEvent.getFamily() == UserEvent.UEF_KEY_EVENT) {
+ if (userEvent.getType() == HRcEvent.KEY_PRESSED) {
+ switch (userEvent.getCode()) {
+ case HRcEvent.VK_LEFT:
+ rxa = -(RACQUET_WIDTH / RAQUET_SPEED);
+ break;
+ case HRcEvent.VK_RIGHT:
+ rxa = (RACQUET_WIDTH / RAQUET_SPEED);
+ break;
+ }
+ } else if (userEvent.getType() == HRcEvent.KEY_RELEASED) {
+ switch (userEvent.getCode()) {
+ case HRcEvent.VK_LEFT:
+ case HRcEvent.VK_RIGHT:
+ rxa = 0;
+ break;
+ case HRcEvent.VK_COLORED_KEY_0:
+ terminated = true;
+ break;
+ }
+ }
+ }
+ }
+}
diff --git a/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpServer.java b/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpServer.java
index e781ec0..ad9b28a 100644
--- a/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpServer.java
+++ b/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpServer.java
@@ -24,8 +24,10 @@ of this software and associated documentation files (the "Software"), to deal
package org.ps5jb.client.payloads.ftp;
import java.io.IOException;
+import java.lang.reflect.Field;
import java.net.Socket;
import java.net.SocketException;
+import java.security.PrivilegedActionException;
import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;
@@ -37,13 +39,13 @@ of this software and associated documentation files (the "Software"), to deal
import org.havi.ui.event.HRcEvent;
import org.ps5jb.loader.SocketListener;
import org.ps5jb.loader.Status;
+import org.ps5jb.sdk.core.OpenModuleAction;
/**
* A very simple FTP Server class. On receiving a new connection it creates a
* new worker thread.
*
* @author Moritz Stueckler
- *
*/
public class FtpServer extends SocketListener implements UserEventListener {
private List workers;
@@ -85,8 +87,42 @@ public void acceptClient(Socket clientSocket) throws Exception {
w.start();
}
+ /**
+ * PS5 BDJ runtime includes a mechanism to proxy all instances of key I/O classes
+ * such as {@link java.io.File} to restrict access to sensitive information.
+ * This method disables the proxying.
+ *
+ * @author astrelsky
+ */
+ protected void disableIOProxyFactory() {
+ final String BDJ_FACTORY_CLASS_NAME = "com.oracle.orbis.io.BDJFactory";
+
+ try {
+ OpenModuleAction.execute(BDJ_FACTORY_CLASS_NAME);
+ } catch (PrivilegedActionException e) {
+ Status.println("Error while opening PS5-specific com.oracle.orbis.io package. " +
+ "Assuming this package does not exist in the current execution environment. " +
+ "Error: " + e.getException().getClass() + "; " +
+ "Message: " + e.getException().getMessage());
+ return;
+ }
+
+ try {
+ Class bdjFactoryClass = Class.forName(BDJ_FACTORY_CLASS_NAME);
+ Field bdjFactoryInstance = bdjFactoryClass.getDeclaredField("instance");
+ bdjFactoryInstance.setAccessible(true);
+ bdjFactoryInstance.set(null, null);
+ } catch (Throwable e) {
+ handleException(e);
+ }
+ }
+
@Override
public void run() {
+ // Disable I/O proxies
+ disableIOProxyFactory();
+
+ // Execute the socket listener
super.run();
// Unsubscribe from events
diff --git a/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpWorker.java b/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpWorker.java
index 8fafab1..de917dd 100644
--- a/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpWorker.java
+++ b/xploit/src/main/java/org/ps5jb/client/payloads/ftp/FtpWorker.java
@@ -125,6 +125,7 @@ private static final class userStatus {
* @param server The server instance.
* @param client The socket for the current client.
* @param dataPort The port for the data connection.
+ * @param name Name of the worker thread.
* @throws IOException If any I/O errors occur.
*/
public FtpWorker(FtpServer server, Socket client, int dataPort, String name) throws IOException {