TI System V/68 kernel patching guide

[johnsonjh]

TI System V/68 kernel patching guide

The following documents the TI System V/68 kernel patch (currently, versions "R0.8" and "R0.9").

• RELATED: SPA password bypass for TI System V/68 using `kdb` #6

Overview

• Patch R0.9 has been extensively tested and works well enough to allow for normal, error-free, multi-user operation of the TI System V/68 operating system and SPA-protected licensed software products,

  1. without requiring an SPA password,
  2. without requiring the SPA hardware to be installed,
  3. without requiring valid software license keys,
  4. and transparently appearing as a valid (512-user) installation.

Roadmap

Patch R1.0

• An R1.0 version of this patch is planned that will ensure that the gspaid() function will always return a positive integer, even when no SPA is installed.
  • With patch R0.9 applied and no SPA installed, gspaid() returns -1, but does not set errno.
  • On a stock system, if any error is encountered, gspaid() returns -1 and does sets errno.
• Patch R0.9 has been tested successfully against all software thus far, however, ensuring the gspaid() function always returns a positive integer is necessary for complete transparency and compatibility.

Post-R1.0

• Xdelta3 VCDIFF patch
• gbsed patch
• GDOS-restorable pre-patched installation.

Documentation

• This is an initial version of this documentation and describes only the patches to the kernel.
• Future documentation should include additional details and enough context to allow an average user to patch the kernel and any necessary library and object files required for the patch to survive kernel re-linking.

Patches for 3.2.2 (JDIS image) kernel

IDA disassembly comparison

The following is an IDA disassembly comparison with control flow visualization of patch version R0.8.

(The rules below aren't perfectly adhered to, but, if you need to review them, surely you'll figure it out.)

• When more than one change is present in an image pair, the changed lines are highlighted in red.
• When only one change is present, the changed line is (usually) highlighted in light grey.
• This is an earlier version of the patch, and will be updated soon.

spaopen()

original	patched

spaioctl()

original	patched

coca_cola()

original	patched

pfault()

original	patched

spathere()

original	patched

exece()

original	patched

radiff2 diff

The following is an r2 diff of patch R0.9 produced by radiff2 -r unix.orig unix.patched and can be applied with radare2.

wx 602a @ 0x00013bd4
wx 4e714e714e714e714e714e71 @ 0x00013fb8
wx 4e714e714e714e71 @ 0x0001406c
wx 4e71 @ 0x0001422e
wx 60 @ 0x00014242
wx 6032 @ 0x0001476c
wx 23fc @ 0x000147ac
wx 000200000acc2c @ 0x000147af
wx 00 @ 0x000147cb
wx 60 @ 0x000147d2
wx 4e71 @ 0x00014818
wx 60 @ 0x00014822
wx 00 @ 0x00014825
wx 60 @ 0x0001482c
wx 00 @ 0x0001484b
wx 600e @ 0x000148aa
wx 60 @ 0x000148ba
wx 4e714e71 @ 0x000148d6
wx 00 @ 0x00014afd
wx 60 @ 0x0004c024
wx 60 @ 0x0004c03c

radiff2 delta comparison

The following is an r2 delta comparison of patch R0.9 produced by radiff2 -q -d unix.orig unix.patched | awk '{ printf("\n## "$1"\n- " $2"\n+ "$4"\n"); }'.

• Each hex string is unique (within the kernel file) for easy patching using a hex editor.

## 0x00013bc5
- 642f0361ff0002c7aadefc00184a80660a0cae00ffaa55fffc67202f2efffc487800012f3c4120000161ff0002b6f613fc000600fff09ddefc000c4879000a
+ 642f0361ff0002c7aadefc00184a80602a0cae00ffaa55fffc67202f2efffc487800012f3c4120000161ff0002b6f613fc000600fff09ddefc000c4879000a

## 0x00013f88
- 600004aa20790008ecc41028001049c02d40fe80362efe822f0048680014486efe9461000656defc000cb66effec671413fc000d00fff09d48780001610007926000046e48c32f03486efe94260e0683fffffe8a2f037890d88e2f04487800014879000847dc326effec2f09486eff3c61ff0003cca6defc00202f032f0445f900050b0c4e92486effee260e0683fffffee82f034e92306efe8a4230e890204ed0eeffee4228fee82f032f3900084798610005a0defc00184a80670001382f042f390008479861000458504f4a8066142f042f39000847a861000516504f4a80670001124ab9000acc3067140c8500007305660c486effe461000b20600003b27c0123c6000a
+ 600004aa20790008ecc41028001049c02d40fe80362efe822f0048680014486efe9461000656defc000cb66effec67144e714e714e714e714e714e71610007926000046e48c32f03486efe94260e0683fffffe8a2f037890d88e2f04487800014879000847dc326effec2f09486eff3c61ff0003cca6defc00202f032f0445f900050b0c4e92486effee260e0683fffffee82f034e92306efe8a4230e890204ed0eeffee4228fee82f032f3900084798610005a0defc00184a80670001382f042f390008479861000458504f4a8066142f042f39000847a861000516504f4a80670001124e714e714e714e710c8500007305660c486effe461000b20600003b27c0123c6000a

## 0x00014160
- 202efe807cff25860c0052aefe807c0fbcaefe806c00ff7a600002c045f900fff09d4a12660002b40c850000730666000096260e0683fffffee82f0361ff00011a2c2f002f03486eff9061ff00051474defc00104a8056c17c01c2862d41fe80671014bc000d487800036100058c60000268306efe8a41f6888f0c10002f6f0c0c1000396e060c20002f6ef44868000161ff0004e9a22d40fe8048780004486efe802f2effe461ff0004ae7cdefc00104a806700022613fc000e00fff09d48780011600002103c2effeebc6efe8a6614486efee8486eff906100024c2d40fe80504f671413fc000d00fff09d4878000261000506600001e20c8500007305660001da486effe46100093a600001cc0cb90000270f000a
+ 202efe807cff25860c0052aefe807c0fbcaefe806c00ff7a600002c045f900fff09d4a12660002b40c850000730666000096260e0683fffffee82f0361ff00011a2c2f002f03486eff9061ff00051474defc00104a8056c17c01c2862d41fe80671014bc000d487800036100058c60000268306efe8a41f6888f0c10002f6f0c0c1000396e060c20002f6ef44868000161ff0004e9a22d40fe8048780004486efe802f2effe461ff0004ae7cdefc00104a806700022613fc000e00fff09d48780011600002103c2effeebc6efe8a4e71486efee8486eff906100024c2d40fe80504f601413fc000d00fff09d4878000261000506600001e20c8500007305660001da486effe46100093a600001cc0cb90000270f000a

## 0x000145c8
- 13fc006300fff09d4280246efffc4e5e4e754e560000226e0008206e000c101167065249b01867f64a1166084a1066047001600242804e5e4e754e560000226e0008206e000c222e0010600820187418e4a012c0200153814a806ef04e5e4e754e56000048e71820246e0008282e000c262e00106014200458842f0061ff00050d667218e2a014c0584f200353834a806ee44cee0418fff44e5e4e754e56000048e710204282207900ffc14810bc0001226e0008206e000c2028000c764cd083760fc08341f90008474c221126300c00b7812281226e0008246e000c346a0018344a7034d08a760fc083221126300c00b7812281202e000c761ad6802043301053504a406f3445f90008474c206e0008226e001010312800760fc083221026320c00b78120815282202e000c761ad6802043301053504a406ed24cee0408fff84e5e4e754e560000202e0008207900fff0a8206800844a8867202068001a2f2800402f2800242f00487800032f3c4129002061ff0002abaa60122f00487800012f3c4129002261ff0002ab964e5e4e754e560000202e0008207900fff0a8206800844a8867202068001a2f2800402f2800242f00487800032f3c4129002161ff0002ab5e60122f00487800012f3c4129002361ff0002ab4a4e5e4e754e56fffc48e718004ab90008ecc4670000b24879000acc1861ff00051260584f4a806700009e7202b2b9000847c4660e4879000847f361ff00032a8e584f40c4007c270061ff0002bbd426004878000422390008ecc40681000001c02f01486efffc6100fe202f0361ff0002bb66defc00104a80660a0cae00ffaa55fffc67307201b2b9000847c4660e4879000847ff61ff00032a34584f42a72f3c412f000161ff0002aaa0720123c1000847c4504f40c046c44879000a
+ 13fc006300fff09d4280246efffc4e5e4e754e560000226e0008206e000c101167065249b01867f64a1166084a1066047001600242804e5e4e754e560000226e0008206e000c222e0010600820187418e4a012c0200153814a806ef04e5e4e754e56000048e71820246e0008282e000c262e00106014200458842f0061ff00050d667218e2a014c0584f200353834a806ee44cee0418fff44e5e4e754e56000048e710204282207900ffc14810bc0001226e0008206e000c2028000c764cd083760fc08341f90008474c221126300c00b7812281226e0008246e000c346a0018344a7034d08a760fc083221126300c00b7812281202e000c761ad6802043301053504a406f3445f90008474c206e0008226e001010312800760fc083221026320c00b78120815282202e000c761ad6802043301053504a406ed24cee0408fff84e5e4e754e560000202e0008207900fff0a8206800844a8867202068001a2f2800402f2800242f00487800032f3c4129002061ff0002abaa60122f00487800012f3c4129002261ff0002ab964e5e4e754e560000202e0008207900fff0a8206800844a8860322068001a2f2800402f2800242f00487800032f3c4129002161ff0002ab5e60122f00487800012f3c4129002361ff0002ab4a4e5e4e754e56fffc48e7180023fc00000200000acc2c4879000acc1861ff00051260584f4a806700009e7200b2b9000847c4600e4879000847f361ff00032a8e584f40c4007c270061ff0002bbd426004878000422390008ecc40681000001c02f01486efffc6100fe202f0361ff0002bb66defc00104a804e710cae00ffaa55fffc60307200b2b9000847c4600e4879000847ff61ff00032a34584f42a72f3c412f000161ff0002aaa0720023c1000847c4504f40c046c44879000a

## 0x000148a8
- dc98661253b9000a
+ dc98600e53b9000a

## 0x000148b8
- dc9c660002e24ab90008ecc4670002d242a76100fed8584f4ab9000847c4660002c04879000a
+ dc9c600002e24ab90008ecc4670002d242a76100fed8584f4ab9000847c44e714e714879000a

## 0x00014ad8
- dc98672a202effe0222effdcb3800c8024000000671842a72f3c412f000261ff0002a7ee740223c2000847c4504f2f2efff84878400061ff0002ea04504f4ab9000a
+ dc98672a202effe0222effdcb3800c8024000000671842a72f3c412f000261ff0002a7ee740023c2000847c4504f2f2efff84878400061ff0002ea04504f4ab9000a

## 0x0004c022
- cc306622206dfae2306800143039000acc2848c0e3805880b0886c0a
+ cc306022206dfae2306800143039000acc2848c0e3805880b088600a

radiff2 delta

The following is an r2 delta of patch R0.9 produced by radiff2 -r -d unix.orig unix.patched and can be applied with radare2.

wx 642f0361ff0002c7aadefc00184a80602a0cae00ffaa55fffc67202f2efffc487800012f3c4120000161ff0002b6f613fc000600fff09ddefc000c4879000a @ 0x00013bc5
wx 600004aa20790008ecc41028001049c02d40fe80362efe822f0048680014486efe9461000656defc000cb66effec67144e714e714e714e714e714e71610007926000046e48c32f03486efe94260e0683fffffe8a2f037890d88e2f04487800014879000847dc326effec2f09486eff3c61ff0003cca6defc00202f032f0445f900050b0c4e92486effee260e0683fffffee82f034e92306efe8a4230e890204ed0eeffee4228fee82f032f3900084798610005a0defc00184a80670001382f042f390008479861000458504f4a8066142f042f39000847a861000516504f4a80670001124e714e714e714e710c8500007305660c486effe461000b20600003b27c0123c6000a @ 0x00013f88
wx 202efe807cff25860c0052aefe807c0fbcaefe806c00ff7a600002c045f900fff09d4a12660002b40c850000730666000096260e0683fffffee82f0361ff00011a2c2f002f03486eff9061ff00051474defc00104a8056c17c01c2862d41fe80671014bc000d487800036100058c60000268306efe8a41f6888f0c10002f6f0c0c1000396e060c20002f6ef44868000161ff0004e9a22d40fe8048780004486efe802f2effe461ff0004ae7cdefc00104a806700022613fc000e00fff09d48780011600002103c2effeebc6efe8a4e71486efee8486eff906100024c2d40fe80504f601413fc000d00fff09d4878000261000506600001e20c8500007305660001da486effe46100093a600001cc0cb90000270f000a @ 0x00014160
wx 13fc006300fff09d4280246efffc4e5e4e754e560000226e0008206e000c101167065249b01867f64a1166084a1066047001600242804e5e4e754e560000226e0008206e000c222e0010600820187418e4a012c0200153814a806ef04e5e4e754e56000048e71820246e0008282e000c262e00106014200458842f0061ff00050d667218e2a014c0584f200353834a806ee44cee0418fff44e5e4e754e56000048e710204282207900ffc14810bc0001226e0008206e000c2028000c764cd083760fc08341f90008474c221126300c00b7812281226e0008246e000c346a0018344a7034d08a760fc083221126300c00b7812281202e000c761ad6802043301053504a406f3445f90008474c206e0008226e001010312800760fc083221026320c00b78120815282202e000c761ad6802043301053504a406ed24cee0408fff84e5e4e754e560000202e0008207900fff0a8206800844a8867202068001a2f2800402f2800242f00487800032f3c4129002061ff0002abaa60122f00487800012f3c4129002261ff0002ab964e5e4e754e560000202e0008207900fff0a8206800844a8860322068001a2f2800402f2800242f00487800032f3c4129002161ff0002ab5e60122f00487800012f3c4129002361ff0002ab4a4e5e4e754e56fffc48e7180023fc00000200000acc2c4879000acc1861ff00051260584f4a806700009e7200b2b9000847c4600e4879000847f361ff00032a8e584f40c4007c270061ff0002bbd426004878000422390008ecc40681000001c02f01486efffc6100fe202f0361ff0002bb66defc00104a804e710cae00ffaa55fffc60307200b2b9000847c4600e4879000847ff61ff00032a34584f42a72f3c412f000161ff0002aaa0720023c1000847c4504f40c046c44879000a @ 0x000145c8
wx dc98600e53b9000a @ 0x000148a8
wx dc9c600002e24ab90008ecc4670002d242a76100fed8584f4ab9000847c44e714e714879000a @ 0x000148b8
wx dc98672a202effe0222effdcb3800c8024000000671842a72f3c412f000261ff0002a7ee740023c2000847c4504f2f2efff84878400061ff0002ea04504f4ab9000a @ 0x00014ad8
wx cc306022206dfae2306800143039000acc2848c0e3805880b088600a @ 0x0004c022

radiff2 asm diff

The following is an r2 asm diff (assembly annotated diff) of patch R0.9 produced by lightly post-processing the output of radiff2 -q -a m68k -D unix.orig unix.patched.

The changed bytes are authoritative, not the disassembly.

--- 0x00013bd4  660a
  - bne.b 0xc
+++ 0x00013bd4  602a
  + bra.b 0x2e

--- 0x00013fb8  13fc000d00fff09d48780001
  - move.b 0xd, 0xfff09d.l
  - pea.l 0x1.w   
+++ 0x00013fb8  4e714e714e714e714e714e71
  + nop
  + nop
  + nop
  + nop
  + nop
  + nop

--- 0x0001406c  4ab9000acc306714
  - tst.l 0xacc30.l
  - beq.b 0x32
+++ 0x0001406c  4e714e714e714e71
  + nop
  + nop
  + nop
  + nop

--- 0x0001422e  6614
  - bne.b 0x38
  - pea.l -0x5556(a6)
+++ 0x0001422e  4e71
  + nop

--- 0x00014242  67
  - beq.b 0x3c
+++ 0x00014242  60
  + bra.b 0x3e

--- 0x0001476c  6720
  - beq.b 0x4c
+++ 0x0001476c  6032
  + bra.b 0x60

--- 0x000147ac  4ab9
+++ 0x000147ac  23fc

--- 0x000147af  08ecc4670000b2
+++ 0x000147af  000200000acc2c

--- 0x000147cb  02
+++ 0x000147cb  00

--- 0x000147d2  66
  - bne.b 0x48
+++ 0x000147d2  60
  + bra.b 0x4a

--- 0x00014818  660a
  - bne.b 0x48
+++ 0x00014818  4e71
  + nop

--- 0x00014822  67
  - beq.b 0x72
+++ 0x00014822  60
  + bra.b 0x74

--- 0x00014825  01
+++ 0x00014825  00

--- 0x0001482c  66
  - bne.b 0x54
+++ 0x0001482c  60
  + bra.b 0x56

--- 0x0001484b  01
+++ 0x0001484b  00

--- 0x000148aa  6612
  - bne.b 0x5e
+++ 0x000148aa  600e
  + bra.b 0x5c

--- 0x000148ba  66
  - bne.w 0x332
+++ 0x000148ba  60
  + bra.w 0x332

--- 0x000148d6  660002c0
  - bne.w 0x310
+++ 0x000148d6  4e714e71
  + nop
  + nop

--- 0x00014afd  02
+++ 0x00014afd  00

--- 0x0004c024  66
  - bne.b 0x74
+++ 0x0004c024  60
  + bra.b 0x76

--- 0x0004c03c  6c
  - bge.b 0x60
+++ 0x0004c03c  60
  + bra.b 0x62