Skip to content

Harden memory-safety and RPC boundary handling in core C paths (excluding workflow @latest) #303

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
AKuHAK merged 2 commits into from
May 17, 2026
Merged

Harden memory-safety and RPC boundary handling in core C paths (excluding workflow @latest) #303

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83a2779
Fix memory safety and unsafe formatting issues (excluding workflow la…
Copilot May 17, 2026
5a0fd45
Address validation feedback for RPC/output safety and cleanup paths
Copilot May 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions irx/source/mechaproxy/src/mechaproxy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,15 @@ static unsigned char SifServerBuffer[0x1000];

static void *MechaScmdHeader(int function, void *buffer, int nbytes)
{
if (buffer == NULL || nbytes < (int)sizeof(struct MechaScmdParams))
return buffer;

struct MechaScmdParams *params = (struct MechaScmdParams *)buffer;
if (params->inputlength > sizeof(params->input))
{
params->result = 0;
return buffer;
}

params->result = sceCdApplySCmd(params->cmd, params->input, params->inputlength, params->output);

Expand Down
91 changes: 48 additions & 43 deletions main.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -465,32 +465,34 @@ void selectRegion(char isDex, uint8_t **region_params, uint8_t **region_cipherte
int fd;
if ((fd = open("rom0:ROMVER", O_RDONLY)) >= 0)
{
char romver[16];
read(fd, romver, sizeof(romver));
char romver[17] = {0};
int romver_size = read(fd, romver, 16);
close(fd);

// ckeck romver 5th letter: JAEHC, compare with version[0] & 7
// J - 0
// A - 1, 7
// E - 2, 3, 5
// H - 4
// C - 6
if (romver[4] == 'J')
*region_ciphertext = isDex ? region_ciphertext_japan_dex : region_ciphertext_japan_cex;
else if (romver[4] == 'C')
*region_ciphertext = isDex ? region_ciphertext_china_dex : region_ciphertext_china_cex;
else if ((romver[4] == 'E') && ((version[0] & 7) == 3))
*region_ciphertext = isDex ? region_ciphertext_oceania_dex : region_ciphertext_oceania_cex;
else if ((romver[4] == 'E') && ((version[0] & 7) == 5))
*region_ciphertext = isDex ? region_ciphertext_russia_dex : region_ciphertext_russia_cex;
else if (romver[4] == 'E')
*region_ciphertext = isDex ? region_ciphertext_europe_dex : region_ciphertext_europe_cex;
else if ((romver[4] == 'A') && ((version[0] & 7) == 7))
*region_ciphertext = isDex ? region_ciphertext_mexico_dex : region_ciphertext_mexico_cex;
else if (romver[4] == 'A')
*region_ciphertext = isDex ? region_ciphertext_usa_dex : region_ciphertext_usa_cex;
else if (romver[4] == 'H')
*region_ciphertext = isDex ? region_ciphertext_asia_dex : region_ciphertext_asia_cex;
if (romver_size >= 5)
{
// ckeck romver 5th letter: JAEHC, compare with version[0] & 7
// J - 0
// A - 1, 7
// E - 2, 3, 5
// H - 4
// C - 6
if (romver[4] == 'J')
*region_ciphertext = isDex ? region_ciphertext_japan_dex : region_ciphertext_japan_cex;
else if (romver[4] == 'C')
*region_ciphertext = isDex ? region_ciphertext_china_dex : region_ciphertext_china_cex;
else if ((romver[4] == 'E') && ((version[0] & 7) == 3))
*region_ciphertext = isDex ? region_ciphertext_oceania_dex : region_ciphertext_oceania_cex;
else if ((romver[4] == 'E') && ((version[0] & 7) == 5))
*region_ciphertext = isDex ? region_ciphertext_russia_dex : region_ciphertext_russia_cex;
else if (romver[4] == 'E')
*region_ciphertext = isDex ? region_ciphertext_europe_dex : region_ciphertext_europe_cex;
else if ((romver[4] == 'A') && ((version[0] & 7) == 7))
*region_ciphertext = isDex ? region_ciphertext_mexico_dex : region_ciphertext_mexico_cex;
else if (romver[4] == 'A')
*region_ciphertext = isDex ? region_ciphertext_usa_dex : region_ciphertext_usa_cex;
else if (romver[4] == 'H')
*region_ciphertext = isDex ? region_ciphertext_asia_dex : region_ciphertext_asia_cex;
}
}
}
}
Expand Down Expand Up @@ -578,7 +580,7 @@ char backupNVM()
getMechaVersion(version);

char nvm_path[256];
sprintf(nvm_path, "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);
snprintf(nvm_path, sizeof(nvm_path), "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);

FILE *f = fopen(nvm_path, "rb");
if (f)
Expand Down Expand Up @@ -722,7 +724,7 @@ char applyPatches(char isDex)
getMechaVersion(version);

char nvm_path[256];
sprintf(nvm_path, "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);
snprintf(nvm_path, sizeof(nvm_path), "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);
FILE *f = fopen(nvm_path, "rb");
if (!f)
{
Expand Down Expand Up @@ -943,16 +945,17 @@ void checkUnsupportedVersion()
char RealModelName[20];
char color[20];
struct GSTEXTURE_holder *versionTextures;
struct GSTEXTURE_holder *romverTextures;
struct GSTEXTURE_holder *buildTextures;
struct GSTEXTURE_holder *romverTextures = NULL;
struct GSTEXTURE_holder *buildTextures = NULL;
struct GSTEXTURE_holder *serialTextures;
struct GSTEXTURE_holder *ModelIDTextures;
struct GSTEXTURE_holder *modelnameTextures;
struct GSTEXTURE_holder *colorTextures;
// struct GSTEXTURE_holder *warnTextures1;
// struct GSTEXTURE_holder *warnTextures2;

struct GSTEXTURE_holder *errorTextures;
struct GSTEXTURE_holder *errorTextures = NULL;
struct GSTEXTURE_holder *modelIdUnknownTextures = NULL;

backupNVM();
gsKit_clear(gsGlobal, Black);
Expand All @@ -969,8 +972,8 @@ void checkUnsupportedVersion()

if ((fd = open("rom0:ROMVER", O_RDONLY)) >= 0)
{
char romver[16];
read(fd, romver, sizeof(romver));
char romver[17] = {0};
read(fd, romver, 16);
close(fd);

romverTextures = ui_printf(8, 8 + big_size + big_size / 2 + 4 * (reg_size + 4), reg_size, 0xFFFFFF, "Romver: %s\n", romver);
Expand All @@ -989,22 +992,23 @@ void checkUnsupportedVersion()

// ModelID whitelist
IsKnownconsole = 1;
sprintf(RealModelName, "???");
snprintf(RealModelName, sizeof(RealModelName), "???");
console_record_t* T = ConsoleModel_GetDataByID(ModelId);
if (!T)
{
errorTextures = ui_printf(8, 8 + big_size + big_size / 2 + 5 * (reg_size + 4), reg_size, 0xFFFFFF, "Model ID unknown, please report!\n");
modelIdUnknownTextures = ui_printf(8, 8 + big_size + big_size / 2 + 5 * (reg_size + 4), reg_size, 0xFFFFFF, "Model ID unknown, please report!\n");
IsKnownconsole = 0;
} else {
sprintf(RealModelName, T->name);
snprintf(RealModelName, sizeof(RealModelName), "%s", T->name);
}
modelnameTextures = ui_printf(8, 8 + big_size + big_size / 2 + 2 * (reg_size + 4), reg_size, 0xFFFFFF, "Real Model Name: %s\n", RealModelName);

sprintf(color, ConsoleModel_GetColorName((T) ? T->color : UNKNOWN));
snprintf(color, sizeof(color), "%s", ConsoleModel_GetColorName((T) ? T->color : UNKNOWN));

colorTextures = ui_printf(8, 8 + big_size + big_size / 2 + 3 * (reg_size + 4), reg_size, 0xFFFFFF, "Console color: %s\n", color);

if (getMechaBuildDate(build_date))
char hasBuildDate = getMechaBuildDate(build_date);
if (hasBuildDate)
{
buildTextures = ui_printf(8, 8 + big_size + big_size / 2 + 1 * (reg_size + 4), reg_size, 0xFFFFFF, "Mecha build date: 20%02x/%02x/%02x %02x:%02x\n", build_date[0], build_date[1], build_date[2], build_date[3], build_date[4]);

Expand All @@ -1015,16 +1019,17 @@ void checkUnsupportedVersion()
drawFrame();

if (!(IsKnownconsole))
freeGSTEXTURE_holder(errorTextures);
freeGSTEXTURE_holder(modelIdUnknownTextures);
freeGSTEXTURE_holder(romverTextures);
freeGSTEXTURE_holder(colorTextures);
freeGSTEXTURE_holder(modelnameTextures);
freeGSTEXTURE_holder(ModelIDTextures);
freeGSTEXTURE_holder(serialTextures);
if (getMechaBuildDate(build_date))
if (hasBuildDate)
freeGSTEXTURE_holder(buildTextures);
freeGSTEXTURE_holder(versionTextures);
freeGSTEXTURE_holder(errorTextures);
if (errorTextures)
freeGSTEXTURE_holder(errorTextures);

SleepThread();
return;
Expand Down Expand Up @@ -1061,13 +1066,13 @@ void checkUnsupportedVersion()
drawFrame();

if (!(IsKnownconsole))
freeGSTEXTURE_holder(errorTextures);
freeGSTEXTURE_holder(modelIdUnknownTextures);
freeGSTEXTURE_holder(exitTextures);
freeGSTEXTURE_holder(colorTextures);
freeGSTEXTURE_holder(modelnameTextures);
freeGSTEXTURE_holder(ModelIDTextures);
freeGSTEXTURE_holder(serialTextures);
if (getMechaBuildDate(build_date))
if (hasBuildDate)
freeGSTEXTURE_holder(buildTextures);
freeGSTEXTURE_holder(versionTextures);
freeGSTEXTURE_holder(romverTextures);
Expand Down Expand Up @@ -1109,7 +1114,7 @@ char restoreBackup()
getMechaVersion(version);

char nvm_path[256];
sprintf(nvm_path, "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);
snprintf(nvm_path, sizeof(nvm_path), "mass:/nvm_%d.%02d_%07ld.bin", version[1], (version[2] | 1) - 1, serial[0]);

FILE *f = fopen(nvm_path, "rb");
if (!f)
Expand Down
28 changes: 16 additions & 12 deletions mecha.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,21 +47,25 @@ void MechaDeinit()
memset(&SifRpcClientMechaScmd, 0, sizeof(SifRpcClientData_t));
}

int MechaScmd(u8 cmd, void *input, u8 inputlength, void *output)
int MechaScmd(u8 cmd, void *input, u8 inputlength, void *output, u8 outputlength)
{
struct MechaScmdParams *params = (struct MechaScmdParams *)RpcBuffer;
if (inputlength > sizeof(params->input) || outputlength > sizeof(params->output) || (inputlength > 0 && input == NULL))
return 0;

params->cmd = cmd;
params->inputlength = inputlength;
memcpy(params->input, input, inputlength);
if (inputlength > 0)
memcpy(params->input, input, inputlength);

if (SifCallRpc(&SifRpcClientMechaScmd, 1, 0, RpcBuffer, sizeof(RpcBuffer), RpcBuffer, sizeof(RpcBuffer), NULL, NULL) < 0)
{
_printf("MechaScmd: rpc error\n");
return 0;
}

memcpy(output, params->output, 16);
if (output && outputlength > 0)
memcpy(output, params->output, outputlength);

return params->result;
}
Expand All @@ -72,7 +76,7 @@ char getMechaVersion(uint8_t *data)
u8 output[16];
input[0] = 0x00;

if (MechaScmd(0x03, input, sizeof(input), output) != 1)
if (MechaScmd(0x03, input, sizeof(input), output, sizeof(output)) != 1)
{
return 0;
}
Expand All @@ -87,7 +91,7 @@ char getMechaBuildDate(uint8_t *data)
u8 input[1];
u8 output[16];
input[0] = 0xfd;
if (MechaScmd(0x03, input, sizeof(input), output) != 1 || output[0] != 0)
if (MechaScmd(0x03, input, sizeof(input), output, sizeof(output)) != 1 || output[0] != 0)
{
_printf("Failed to read the build date!\n");
return 0;
Expand All @@ -107,13 +111,13 @@ char OpenConfig(uint8_t id, char write, uint8_t blocks)
input[1] = id; // id
input[2] = blocks; // blocks

if (MechaScmd(0x40, input, sizeof(input), output) != 1)
if (MechaScmd(0x40, input, sizeof(input), output, sizeof(output)) != 1)
{
if (output[0] != 0)
{
CloseConfig();

if (MechaScmd(0x40, input, sizeof(input), output) != 1 || output[0] != 0)
if (MechaScmd(0x40, input, sizeof(input), output, sizeof(output)) != 1 || output[0] != 0)
{
_printf("Failed to cmd OpenConfig!\n");
return 0;
Expand All @@ -129,7 +133,7 @@ char ReadConfig(uint8_t *data)
u8 input[0];
u8 output[16];

if (MechaScmd(0x41, input, sizeof(input), output) != 1)
if (MechaScmd(0x41, input, sizeof(input), output, sizeof(output)) != 1)
{
_printf("Failed to cmd ReadConfig!\n");
return 0;
Expand All @@ -147,7 +151,7 @@ char WriteConfig(const uint8_t *data)

memcpy(input, data, 16);

if (MechaScmd(0x42, input, sizeof(input), output) != 1 || output[0] != 0)
if (MechaScmd(0x42, input, sizeof(input), output, sizeof(output)) != 1 || output[0] != 0)
{
_printf("Failed to cmd WriteConfig!\n");
return 0;
Expand All @@ -164,7 +168,7 @@ char CloseConfig()

while (output[0])
{
if (MechaScmd(0x43, input, sizeof(input), output) != 1 || (output[0] != 0 && output[0] != 1))
if (MechaScmd(0x43, input, sizeof(input), output, sizeof(output)) != 1 || (output[0] != 0 && output[0] != 1))
{
_printf("Failed to cmd CloseConfig!\n");
return 0;
Expand All @@ -180,7 +184,7 @@ char ReadNVM(uint16_t offset, uint16_t *data)
u8 output[16];
input[0] = offset >> 8;
input[1] = offset;
if (MechaScmd(0x0A, input, sizeof(input), output) != 1 || output[0] != 0)
if (MechaScmd(0x0A, input, sizeof(input), output, sizeof(output)) != 1 || output[0] != 0)
{
_printf("Failed to cmd 0x0A!\n");
return 0;
Expand All @@ -205,7 +209,7 @@ char WriteNVM(uint16_t offset, uint16_t data)

while (output[0])
{
if (MechaScmd(0x0B, input, sizeof(input), output) != 1 || (output[0] != 0 && output[0] != 1))
if (MechaScmd(0x0B, input, sizeof(input), output, sizeof(output)) != 1 || (output[0] != 0 && output[0] != 1))
{
_printf("Failed to cmd WriteNVM! (%d)\n", offset);
return 0;
Expand Down
19 changes: 18 additions & 1 deletion ui.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@

#include <ft2build.h>
#include FT_FREETYPE_H
#include <stdarg.h>
#include <stdio.h>
#include <string.h>

#include "ui.h"
#include "binaries.h"
Expand All @@ -39,6 +42,8 @@ void draw_bitmap(int x, int y, FT_Bitmap *bitmap, GSTEXTURE *Texture, u32 color)
Texture->Height = bitmap->rows;
u32 TextureSize = gsKit_texture_size_ee(Texture->Width, Texture->Height, Texture->PSM);
Texture->Mem = memalign(128, TextureSize);
if (!Texture->Mem)
return;

u32 *buff = (u32 *)Texture->Mem;

Expand Down Expand Up @@ -66,6 +71,8 @@ void draw_bitmap(int x, int y, FT_Bitmap *bitmap, GSTEXTURE *Texture, u32 color)
struct GSTEXTURE_holder *drawImage(int x, int y, int width, int height, const u8 *texture)
{
struct GSTEXTURE_holder *TextureHolder = malloc(sizeof(struct GSTEXTURE_holder));
if (!TextureHolder)
return NULL;
memset(TextureHolder, 0, sizeof(struct GSTEXTURE_holder));
GSTEXTURE *Texture = &TextureHolder->curr;

Expand All @@ -81,6 +88,11 @@ struct GSTEXTURE_holder *drawImage(int x, int y, int width, int height, const u8
Texture->Height = height;
u32 TextureSize = gsKit_texture_size_ee(Texture->Width, Texture->Height, Texture->PSM);
Texture->Mem = memalign(128, TextureSize);
if (!Texture->Mem)
{
free(TextureHolder);
return NULL;
}

uint32_t pos = 0;
uint32_t tx = 0;
Expand Down Expand Up @@ -173,6 +185,11 @@ struct GSTEXTURE_holder *draw_text(int x, int y, int size, u32 color, const char
continue;

struct GSTEXTURE_holder *Texture = malloc(sizeof(struct GSTEXTURE_holder));
if (!Texture)
{
freeGSTEXTURE_holder(Textures);
return NULL;
}
memset(Texture, 0, sizeof(struct GSTEXTURE_holder));
draw_bitmap(x + slot->bitmap_left, y - slot->bitmap_top, &slot->bitmap, &Texture->curr, color);

Expand All @@ -191,7 +208,7 @@ struct GSTEXTURE_holder *ui_printf(int x, int y, int size, u32 color, const char
char buffer[256];
va_list args;
va_start(args, format);
vsprintf(buffer, format, args);
vsnprintf(buffer, sizeof(buffer), format, args);
struct GSTEXTURE_holder *Textures = draw_text(x, y, size, color, buffer);
va_end(args);
return Textures;
Expand Down
Loading