In memory of Ben “bushing” Byer, who passed away on Monday, February 8th, 2016.

IOS/Syscalls

From WiiBrew
< IOS
Jump to navigation Jump to search

Internally, IOS uses a syscall table that is stored toward the end of the binary. The exact address varies with version of IOS, but there are two methods to locate it:

ELF header:

The second-to-last program header is the syscall table. For example: 

$ arm-eabi-readelf -l ~/wii/system_updates/boot2.elf  | tail -2
 LOAD           0x0230d5 0xffff7f60 0xffff7f60 0x00a88 0x00a88 RW  0x10
 LOAD           0x023b5d 0xffff8a00 0xffff8a00 0x00000 0x071e8 RW  0x20

or 

elf_header:134C01A0 elf32_phdr < 1, 0x230D5, syscall_base, syscall_base, 0xA88, 0xA88,  6, 0x10>
elf_header:134C01C0 elf32_phdr < 1, 0x23B5D, current_thread_context, current_thread_context, 0, 0x71E8,  6, 0x20>

Syscall Handler: The second vector is the invalid instruction handler, which is used to implement syscalls: 

kernel:FFFF0000               LDR     PC, =_reset
kernel:FFFF0004               LDR     PC, =starlet_syscall_handler

kernel:FFFF1894             starlet_syscall_handler                 ; CODE XREF: start�j
kernel:FFFF1894 E9 CD 7F FF                 STMFA   SP, {R0-LR}^
kernel:FFFF1898 E1 4F 80 00                 MRS     R8, SPSR
kernel:FFFF189C E5 8D 80 00                 STR     R8, [SP,#arg_0]
kernel:FFFF18A0 E5 8D E0 40                 STR     LR, [SP,#arg_40]
kernel:FFFF18A4 E5 1E A0 04                 LDR     R10, [LR,#-4]
kernel:FFFF18A8 E3 CA 9D 7F                 BIC     R9, R10, #0x1FC0
kernel:FFFF18AC E5 9F 84 9C                 LDR     R8, =0xE6000010
kernel:FFFF18B0 E3 C9 90 20                 BIC     R9, R9, #0x20
kernel:FFFF18B4 E1 59 00 08                 CMP     R9, R8
kernel:FFFF18B8 1A 00 00 1F                 BNE     loc_FFFF193C
kernel:FFFF18BC E1 A0 A2 CA                 MOV     R10, R10,ASR#5
kernel:FFFF18C0 E2 0A A0 FF                 AND     R10, R10, #0xFF
kernel:FFFF18C4 E3 5A 00 75                 CMP     R10, #0x75 ; 'u'
kernel:FFFF18C8 CA 00 00 11                 BGT     loc_FFFF1914
kernel:FFFF18CC E1 A0 80 0D                 MOV     R8, SP
kernel:FFFF18D0 E3 A0 B0 1F                 MOV     R11, #0x1F
kernel:FFFF18D4 E1 21 F0 0B                 MSR     CPSR_c, R11
kernel:FFFF18D8 E5 98 80 44                 LDR     R8, [R8,#arg_44]
kernel:FFFF18DC E5 9F B4 70                 LDR     R11, =syscall_flags_maybe
kernel:FFFF18E0 E7 9B B1 0A                 LDR     R11, [R11,R10,LSL#2]
kernel:FFFF18E4 E0 8D D1 0B                 ADD     SP, SP, R11,LSL#2
kernel:FFFF18E8
kernel:FFFF18E8             loc_FFFF18E8                            ; CODE XREF: starlet_syscall_handler+68�j
kernel:FFFF18E8 E3 5B 00 00                 CMP     R11, #0
kernel:FFFF18EC 0A 00 00 03                 BEQ     loc_FFFF1900
kernel:FFFF18F0 E5 3D 90 04                 LDR     R9, [SP,#var_4]!
kernel:FFFF18F4 E5 28 90 04                 STR     R9, [R8,#-4]!
kernel:FFFF18F8 E2 4B B0 01                 SUB     R11, R11, #1
kernel:FFFF18FC EA FF FF F9                 B       loc_FFFF18E8
kernel:FFFF1900             loc_FFFF1900                            ; CODE XREF: starlet_syscall_handler+58�j
kernel:FFFF1900 E1 A0 D0 08                 MOV     SP, R8
kernel:FFFF1904 E5 9F B4 4C                 LDR     R11, =syscall_base
kernel:FFFF1908 E7 9B B1 0A                 LDR     R11, [R11,R10,LSL#2]
kernel:FFFF190C E1 A0 E0 0F                 MOV     LR, PC
kernel:FFFF1910 E1 2F FF 1B                 BX      R11
kernel:FFFF1914             loc_FFFF1914                            ; CODE XREF: starlet_syscall_handler+34�j
kernel:FFFF1914 E3 A0 B0 DB                 MOV     R11, #0xDB ; '¦'
kernel:FFFF1918 E1 21 F0 0B                 MSR     CPSR_c, R11
kernel:FFFF191C E5 9D B0 00                 LDR     R11, [SP,#arg_0]
kernel:FFFF1920 E1 6F F0 0B                 MSR     SPSR_cxsf, R11
kernel:FFFF1924 E1 A0 E0 00                 MOV     LR, R0
kernel:FFFF1928 E9 DD 7F FF                 LDMED   SP, {R0-LR}^
kernel:FFFF192C E1 A0 00 00                 NOP
kernel:FFFF1930 E1 A0 00 0E                 MOV     R0, LR
kernel:FFFF1934 E5 9D E0 40                 LDR     LR, [SP,#arg_40]
kernel:FFFF1938 E1 B0 F0 0E                 MOVS    PC, LR
kernel:FFFF193C             loc_FFFF193C                            ; CODE XREF: starlet_syscall_handler+24�j
kernel:FFFF193C E5 9F D4 18                 LDR     SP, =current_thread_context
kernel:FFFF1940 E5 9D D0 00                 LDR     SP, [SP,#arg_0]
kernel:FFFF1944 E5 8D E0 40                 STR     LR, [SP,#arg_40]
kernel:FFFF1948 E3 A0 E0 06                 MOV     LR, #6
kernel:FFFF194C E5 8D E0 50                 STR     LR, [SP,#arg_50]
kernel:FFFF1950 E2 8D D0 04                 ADD     SP, SP, #4
kernel:FFFF1954 E9 4D 7F FF                 STMFD   SP, {R0-LR}^
kernel:FFFF1958 E1 4F B0 00                 MRS     R11, SPSR
kernel:FFFF195C E5 0D B0 04                 STR     R11, [SP,#-4+arg_0]
kernel:FFFF1960 EA 00 00 C9                 B       schedule
kernel:FFFF1960             ; End of function starlet_syscall_handler

Syscalls are invoked by way of the invalid instruction handler; syscalls take the form 0xE6000010 | (syscall_num << 5). (E.g. E6000010 is syscall 0, E60006D0 is syscall 0x36, etc.)

tmbinc has written an IDAPython script which can take a database that has "syscall_base" defined, and transform the references to it into more meaningful things -- it is available here: IOS/Syscall_IDAPython

(please feel free to contribute your own findings!)

ID # Internal name Description Return value
0 u32 thread_create( u32 (*proc)(void* arg), u8 priority, u32* stack, u32 stacksize, void* arg, BOOL autostart) Creates a thread Returns threadid
1 thread_join
2 thread_cancel
3 get_tid
4 get_pid
5 thread_continue
6 thread_stop
7 thread_yield
8 thread_get_priority
9 thread_set_priority
a message_queue_create
b message_queue_destroy
c message_queue_send
d message_queue_send_now
e message_queue_receive
f RegisterEventHandler
10 UnregisterEventHandler
11 timer_create
12 timer_restart
13 timer_stop
14 timer_destroy
15 timer_now
16 heap_create
17 heap_destroy
18 heap_alloc
19 heap_alloc_aligned
1a heap_free
1b BOOL device_register(char* device, u32 messagequeue) Registers device to the device tree, so it can be opened (from Starlet and PPC) Returns 0 on success, else error
1c u32 device_open(char* device, int mode) Similar to IOS_Open on PPC, except now internal to the IOS system Returns an fd
1d device_close
1e device_read
1f device_write
20 device_seek
21 device_ioctl
22 device_ioctlv
23 device_open_async
24 device_close_async
25 device_read_async
26 device_write_async
27 device_seek_async
28 device_ioctl_async
29 device_ioctlv_async
2a syscall_2a seems to set the return value of a received message
2b SetUID
2c get_hmac_queue_for_pid
2d SetGID
2e lookup_GID_maybe
2f cc_ahbMemFlush
30 syscall_ahbMemFlush_wrapper
31 software_IRQ_31 seems to enable hardware interrupts for device nr 31
32 software_irq_18 seems to enable hardware interrupts for device nr 18
33 software_IRQ_7_or_8(id) seems to enable hardware interrupts for device nr 7 if id==0, else device nr 8
34 software_IRQ(id) seems to enable hardware interrupts for device nr. id
35 _return_0
36 syscall_36
37 syscall_37
38 iobuf_log_header_info
39 iobuf_log_buffer_info
3a syscall_3a
3b syscall_3b
3c syscall_3c
3d syscall_3d
3e syscall_3e
3f void sync_before_read(u32 address, u32 size) Invalidates dcache, and something (probably related to flushing memory)
40 sync_after_write
41 ppc_boot
42 ios_boot
43 syscall_43
44 int syscall_assert_di_reset Clears bit 10 of 0xD800194 Returns 0 on success, -1 on error
45 int syscall_deassert_di_reset Enables bit 10 of 0xD800194 Returns 0 on success, -1 on error
46 BOOL syscall_check_di_reset Checks bit 10 of 0xD800194 Returns 1 on reset asserted, 0 on (deasserted or error)
47 zero_r0_r1
48 set_r0_1_r1_0
49 get_boot_vector
4a syscall_4a
4b kernel_debug_print
4c kernel_set_version
4d kernel_get_version
4e poke_E0_1
4f virt_to_phys
50 syscall_50
51 syscall_51
52 syscall_52
53 syscall_53
54 syscall_54
55 get_bc_flag
56 poke_gpios
57 syscall_57
58 call_poke_debug_port
59 create_key
5a destroy_key
5b es_syscall_5b
5c es_syscall_5c
5d set_public_key
5e es_syscall_5e
5f es_syscall_5f
60 es_syscall_60
61 get_keyid
62 es_syscall_62
63 es_syscall_63
64 sha_async
65 sha
66 aes_async
67 aes
68 es_syscall_68
69 es_syscall_69
6a es_syscall_6a
6b hmac
6c hmac_async
6d es_syscall_6d
6e get_ng_cert
6f key_set_permission_mask
70 es_syscall_70
71 es_syscall_71
72 es_syscall_72
73 es_syscall_73
74 es_syscall_74
75 ??
76 ??
Retrieved from "https://wiibrew.org/w/index.php?title=IOS/Syscalls&oldid=22540"