PS3API

PS3 API for TMAPI and CCAPI in python.

Note

This only works on 32 bit python as TMAPI and CCAPI are 32 bit DLLs.

Installation

pip install ps3api

Examples

Connecting and Attaching

fromps3apiimportPS3APIPS3=PS3API(PS3API.API_TMAPI)
ifPS3.ConnectTarget(PS3.GetDefaultTarget()) ==False:
raiseException("Failed to connect to PS3.")
ifPS3.AttachProcess() ==False:
raiseException("Failed to attach to process.")

Memory

Reading

PS3.ReadMemory(Address, NumBytes)
PS3.ReadInt8(Address)
PS3.ReadInt16(Address)
PS3.ReadInt32(Address)
PS3.ReadInt64(Address)
PS3.ReadFloat(Address)
PS3.ReadDouble(Address)
PS3.ReadString(Address, Encoding="ascii", MaxLength=1024)

Writing

PS3.WriteMemory(Address, Bytes)
PS3.WriteInt8(Address, Value)
PS3.WriteInt16(Address, Value)
PS3.WriteInt32(Address, Value)
PS3.WriteInt64(Address, Value)
PS3.WriteFloat(Address, Value)
PS3.WriteDouble(Address, Value)
PS3.WriteString(Address, Value, Encoding="ascii")

Remote Procedure Call (RPC)

Function

PS3.RPC.Enable(0x02539F8) # MW2 1.14CG_BoldGameMessage=PS3.RPC.Function(0x0005EF68)
CG_BoldGameMessage.argtypes= [ ctypes.c_ulong, ctypes.c_char_p ]
CG_BoldGameMessage(0, "Hello World!")

System Call

# Define your ownsys_process_getpid=PS3.RPC.SystemCall(SyscallIndex.SYS_PROCESS_GETPID)
sys_process_getpid.ReturnType= [ c_ulong ]
print(sys_process_getpid())
# Use builtin definitionsPS3.RPC.Syscalls.sys_process_getpid()

Interacting With C API

>>>PS3.API.NativeAPI.SNPS3InitTargetComms()
<SNReturnCode.SN_S_OK: 0>

Alternatively

>>>fromps3apiimportTMAPIExports>>>C_API=TMAPIExports()
>>>C_API.SNPS3InitTargetComms()
<SNReturnCode.SN_S_OK: 0>

Useful Scripts

Assembler

>>>fromkeystoneimport*>>>frompwnimport*# for hex dump>>>Keystone=Ks(KS_ARCH_PPC, KS_MODE_64|KS_MODE_BIG_ENDIAN)
>>>Encoding, Count=Keystone.asm("li %r3, 0x1234\nblr")
>>>print(hexdump(bytes(Encoding)))
00000000386012344e800020 │8`·4│N·· │
00000008

Disassembler

>>>fromcapstoneimport*>>>Capstone=Cs(CS_ARCH_PPC, CS_MODE_64|CS_MODE_BIG_ENDIAN)
>>>foriinCapstone.disasm(PS3.ReadMemory(0x10000, 0xE0), 0x10000):
... print("0x%x:\t%s\t%s"%(i.address, i.mnemonic, i.op_str))
...
0x10000: mflrr00x10004: stdr0, -8(r1)
0x10008: stdr30, -0x18(r1)
0x1000c: stdr31, -0x10(r1)
0x10010: stdur1, -0x200(r1)
0x10014: lisr31, 0x10050x10018: orir31, r31, 0x10000x1001c: lwzr30, 0x70(r31)
0x10020: cmpwir30, 00x10024: beq0x101180x10028: stfsf1, 0x178(r1)
....