IOS/Syscalls
From WiiBrew
< IOS
Internally, IOS uses a syscall table that is stored toward the end of the binary. The exact address varies with version of IOS, but there are two methods to locate it:
ELF header:
The second-to-last program header is the syscall table. For example:
$ arm-eabi-readelf -l ~/wii/system_updates/boot2.elf | tail -2 LOAD 0x0230d5 0xffff7f60 0xffff7f60 0x00a88 0x00a88 RW 0x10 LOAD 0x023b5d 0xffff8a00 0xffff8a00 0x00000 0x071e8 RW 0x20
or
elf_header:134C01A0 elf32_phdr < 1, 0x230D5, syscall_base, syscall_base, 0xA88, 0xA88, 6, 0x10> elf_header:134C01C0 elf32_phdr < 1, 0x23B5D, current_thread_context, current_thread_context, 0, 0x71E8, 6, 0x20>
Syscall Handler: The second vector is the invalid instruction handler, which is used to implement syscalls:
kernel:FFFF0000 LDR PC, =_reset
kernel:FFFF0004 LDR PC, =starlet_syscall_handler
kernel:FFFF1894 starlet_syscall_handler ; CODE XREF: start�j
kernel:FFFF1894 E9 CD 7F FF STMFA SP, {R0-LR}^
kernel:FFFF1898 E1 4F 80 00 MRS R8, SPSR
kernel:FFFF189C E5 8D 80 00 STR R8, [SP,#arg_0]
kernel:FFFF18A0 E5 8D E0 40 STR LR, [SP,#arg_40]
kernel:FFFF18A4 E5 1E A0 04 LDR R10, [LR,#-4]
kernel:FFFF18A8 E3 CA 9D 7F BIC R9, R10, #0x1FC0
kernel:FFFF18AC E5 9F 84 9C LDR R8, =0xE6000010
kernel:FFFF18B0 E3 C9 90 20 BIC R9, R9, #0x20
kernel:FFFF18B4 E1 59 00 08 CMP R9, R8
kernel:FFFF18B8 1A 00 00 1F BNE loc_FFFF193C
kernel:FFFF18BC E1 A0 A2 CA MOV R10, R10,ASR#5
kernel:FFFF18C0 E2 0A A0 FF AND R10, R10, #0xFF
kernel:FFFF18C4 E3 5A 00 75 CMP R10, #0x75 ; 'u'
kernel:FFFF18C8 CA 00 00 11 BGT loc_FFFF1914
kernel:FFFF18CC E1 A0 80 0D MOV R8, SP
kernel:FFFF18D0 E3 A0 B0 1F MOV R11, #0x1F
kernel:FFFF18D4 E1 21 F0 0B MSR CPSR_c, R11
kernel:FFFF18D8 E5 98 80 44 LDR R8, [R8,#arg_44]
kernel:FFFF18DC E5 9F B4 70 LDR R11, =syscall_flags_maybe
kernel:FFFF18E0 E7 9B B1 0A LDR R11, [R11,R10,LSL#2]
kernel:FFFF18E4 E0 8D D1 0B ADD SP, SP, R11,LSL#2
kernel:FFFF18E8
kernel:FFFF18E8 loc_FFFF18E8 ; CODE XREF: starlet_syscall_handler+68�j
kernel:FFFF18E8 E3 5B 00 00 CMP R11, #0
kernel:FFFF18EC 0A 00 00 03 BEQ loc_FFFF1900
kernel:FFFF18F0 E5 3D 90 04 LDR R9, [SP,#var_4]!
kernel:FFFF18F4 E5 28 90 04 STR R9, [R8,#-4]!
kernel:FFFF18F8 E2 4B B0 01 SUB R11, R11, #1
kernel:FFFF18FC EA FF FF F9 B loc_FFFF18E8
kernel:FFFF1900 loc_FFFF1900 ; CODE XREF: starlet_syscall_handler+58�j
kernel:FFFF1900 E1 A0 D0 08 MOV SP, R8
kernel:FFFF1904 E5 9F B4 4C LDR R11, =syscall_base
kernel:FFFF1908 E7 9B B1 0A LDR R11, [R11,R10,LSL#2]
kernel:FFFF190C E1 A0 E0 0F MOV LR, PC
kernel:FFFF1910 E1 2F FF 1B BX R11
kernel:FFFF1914 loc_FFFF1914 ; CODE XREF: starlet_syscall_handler+34�j
kernel:FFFF1914 E3 A0 B0 DB MOV R11, #0xDB ; '¦'
kernel:FFFF1918 E1 21 F0 0B MSR CPSR_c, R11
kernel:FFFF191C E5 9D B0 00 LDR R11, [SP,#arg_0]
kernel:FFFF1920 E1 6F F0 0B MSR SPSR_cxsf, R11
kernel:FFFF1924 E1 A0 E0 00 MOV LR, R0
kernel:FFFF1928 E9 DD 7F FF LDMED SP, {R0-LR}^
kernel:FFFF192C E1 A0 00 00 NOP
kernel:FFFF1930 E1 A0 00 0E MOV R0, LR
kernel:FFFF1934 E5 9D E0 40 LDR LR, [SP,#arg_40]
kernel:FFFF1938 E1 B0 F0 0E MOVS PC, LR
kernel:FFFF193C loc_FFFF193C ; CODE XREF: starlet_syscall_handler+24�j
kernel:FFFF193C E5 9F D4 18 LDR SP, =current_thread_context
kernel:FFFF1940 E5 9D D0 00 LDR SP, [SP,#arg_0]
kernel:FFFF1944 E5 8D E0 40 STR LR, [SP,#arg_40]
kernel:FFFF1948 E3 A0 E0 06 MOV LR, #6
kernel:FFFF194C E5 8D E0 50 STR LR, [SP,#arg_50]
kernel:FFFF1950 E2 8D D0 04 ADD SP, SP, #4
kernel:FFFF1954 E9 4D 7F FF STMFD SP, {R0-LR}^
kernel:FFFF1958 E1 4F B0 00 MRS R11, SPSR
kernel:FFFF195C E5 0D B0 04 STR R11, [SP,#-4+arg_0]
kernel:FFFF1960 EA 00 00 C9 B schedule
kernel:FFFF1960 ; End of function starlet_syscall_handler
Syscalls are invoked by way of the invalid instruction handler; syscalls take the form 0xE6000010 | (syscall_num << 5). (E.g. E6000010 is syscall 0, E60006D0 is syscall 0x36, etc.)
tmbinc has written an IDAPython script which can take a database that has "syscall_base" defined, and transform the references to it into more meaningful things -- it is available here: IOS/Syscall_IDAPython
(please feel free to contribute your own findings!)
| ID # | Internal name | Description | Return value |
|---|---|---|---|
| 0 | u32 thread_create( u32 (*proc)(void* arg), u8 priority, u32* stack, u32 stacksize, void* arg, BOOL autostart) | Creates a thread | Returns threadid |
| 1 | thread_join | ||
| 2 | thread_cancel | ||
| 3 | get_tid | ||
| 4 | get_pid | ||
| 5 | thread_continue | ||
| 6 | thread_stop | ||
| 7 | thread_yield | ||
| 8 | thread_get_priority | ||
| 9 | thread_set_priority | ||
| a | message_queue_create | ||
| b | message_queue_destroy | ||
| c | message_queue_send | ||
| d | message_queue_send_now | ||
| e | message_queue_receive | ||
| f | RegisterEventHandler | ||
| 10 | UnregisterEventHandler | ||
| 11 | timer_create | ||
| 12 | timer_restart | ||
| 13 | timer_stop | ||
| 14 | timer_destroy | ||
| 15 | timer_now | ||
| 16 | heap_create | ||
| 17 | heap_destroy | ||
| 18 | heap_alloc | ||
| 19 | heap_alloc_aligned | ||
| 1a | heap_free | ||
| 1b | BOOL device_register(char* device, u32 messagequeue) | Registers device to the device tree, so it can be opened (from Starlet and PPC) | Returns 0 on success, else error |
| 1c | u32 device_open(char* device, int mode) | Similar to IOS_Open on PPC, except now internal to the IOS system | Returns an fd |
| 1d | device_close | ||
| 1e | device_read | ||
| 1f | device_write | ||
| 20 | device_seek | ||
| 21 | device_ioctl | ||
| 22 | device_ioctlv | ||
| 23 | device_open_async | ||
| 24 | device_close_async | ||
| 25 | device_read_async | ||
| 26 | device_write_async | ||
| 27 | device_seek_async | ||
| 28 | device_ioctl_async | ||
| 29 | device_ioctlv_async | ||
| 2a | syscall_2a | seems to set the return value of a received message | |
| 2b | SetUID | ||
| 2c | get_hmac_queue_for_pid | ||
| 2d | SetGID | ||
| 2e | lookup_GID_maybe | ||
| 2f | cc_ahbMemFlush | ||
| 30 | syscall_ahbMemFlush_wrapper | ||
| 31 | software_IRQ_31 | seems to enable hardware interrupts for device nr 31 | |
| 32 | software_irq_18 | seems to enable hardware interrupts for device nr 18 | |
| 33 | software_IRQ_7_or_8(id) | seems to enable hardware interrupts for device nr 7 if id==0, else device nr 8 | |
| 34 | software_IRQ(id) | seems to enable hardware interrupts for device nr. id | |
| 35 | _return_0 | ||
| 36 | syscall_36 | ||
| 37 | syscall_37 | ||
| 38 | iobuf_log_header_info | ||
| 39 | iobuf_log_buffer_info | ||
| 3a | syscall_3a | ||
| 3b | syscall_3b | ||
| 3c | syscall_3c | ||
| 3d | syscall_3d | ||
| 3e | syscall_3e | ||
| 3f | void sync_before_read(u32 address, u32 size) | Invalidates dcache, and something (probably related to flushing memory) | |
| 40 | sync_after_write | ||
| 41 | ppc_boot | ||
| 42 | ios_boot | ||
| 43 | syscall_43 | ||
| 44 | int syscall_assert_di_reset | Clears bit 10 of 0xD800194 | Returns 0 on success, -1 on error |
| 45 | int syscall_deassert_di_reset | Enables bit 10 of 0xD800194 | Returns 0 on success, -1 on error |
| 46 | BOOL syscall_check_di_reset | Checks bit 10 of 0xD800194 | Returns 1 on reset asserted, 0 on (deasserted or error) |
| 47 | zero_r0_r1 | ||
| 48 | set_r0_1_r1_0 | ||
| 49 | get_boot_vector | ||
| 4a | syscall_4a | ||
| 4b | kernel_debug_print | ||
| 4c | kernel_set_version | ||
| 4d | kernel_get_version | ||
| 4e | poke_E0_1 | ||
| 4f | virt_to_phys | ||
| 50 | syscall_50 | ||
| 51 | syscall_51 | ||
| 52 | syscall_52 | ||
| 53 | syscall_53 | ||
| 54 | syscall_54 | ||
| 55 | get_bc_flag | ||
| 56 | poke_gpios | ||
| 57 | syscall_57 | ||
| 58 | call_poke_debug_port | ||
| 59 | create_key | ||
| 5a | destroy_key | ||
| 5b | es_syscall_5b | ||
| 5c | es_syscall_5c | ||
| 5d | set_public_key | ||
| 5e | es_syscall_5e | ||
| 5f | es_syscall_5f | ||
| 60 | es_syscall_60 | ||
| 61 | get_keyid | ||
| 62 | es_syscall_62 | ||
| 63 | es_syscall_63 | ||
| 64 | sha_async | ||
| 65 | sha | ||
| 66 | aes_async | ||
| 67 | aes | ||
| 68 | es_syscall_68 | ||
| 69 | es_syscall_69 | ||
| 6a | es_syscall_6a | ||
| 6b | hmac | ||
| 6c | hmac_async | ||
| 6d | es_syscall_6d | ||
| 6e | get_ng_cert | ||
| 6f | key_set_permission_mask | ||
| 70 | es_syscall_70 | ||
| 71 | es_syscall_71 | ||
| 72 | es_syscall_72 | ||
| 73 | es_syscall_73 | ||
| 74 | es_syscall_74 | ||
| 75 | ?? | ||
| 76 | ?? |
