MechaResearch / MechaPwn

GNU General Public License v3.0
382 stars 25 forks source link

[ISSUE]: Hang on wait for USB drive #223

Closed lina-bh closed 1 month ago

lina-bh commented 1 month ago

Checks

Console model

SCPH-90004

Describe the issue

I ran MechaPwn commit 303a7e7 and got an NVM backup, the next time I ran it I backed out of the options to patch for DEX and I reset the console. Now the executable hangs at waiting for USB drive, with whatever drive I try. PAL PS2 discs still boot. I dumped the NVRAM again with PS2Ident and I can see the MechaPwn payload in the hexdump

/Volumes/PS2 % diff -u <(xxd nvm_6.12_8630988.bin) <(xxd SCPH-90004_8630988/SCPH-90004_NVM.bin)
--- /dev/fd/11  2024-07-17 16:53:07
+++ /dev/fd/12  2024-07-17 16:53:07
@@ -22,12 +22,12 @@
 00000150: 1c00 9542 2c00 261f 2500 c334 3300 834a  ...B,.&.%..43..J
 00000160: 3300 1008 e9e9 cece ce00 1818 0303 2d00  3.............-.
 00000170: 2b03 480b 1818 2018 4f4f 2c00 ffff ffff  +.H... .OO,.....
-00000180: 4545 656e 6745 4500 0000 0000 ffff ffff  EEengEE.........
+00000180: 4145 656e 6741 4500 0000 0000 ffff ffff  AEengAE.........
 00000190: ffff ffff ffff ffff 001f a787 3252 d9f8  ............2R..
 000001a0: ffff ffff ffff ffff ffff ffff ffff ff07  ................
 000001b0: 5343 5048 2d39 3030 3034 0000 0000 0000  SCPH-90004......
-000001c0: 00a7 ffff ffff d519 c7f2 2819 8706 368a  ..........(...6.
-000001d0: 7147 ab1d 92e4 d575 36bf ffff ffff ffff  qG.....u6.......
+000001c0: 00a7 ffff ffff 4d65 6368 6150 776e 00ec  ......MechaPwn..
+000001d0: 1df2 b631 21ce 9c2f 004f ffff ffff ffff  ...1!../.O......
 000001e0: 2184 d420 334d 7c80 00ea fcc7 5000 00ec  !.. 3M|.....P...
 000001f0: 83d4 1101 ccb2 8321 0074 2005 0808 00ca  .......!.t .....
 00000200: 0000 0000 0000 0000 0000 0000 0000 0000  ................
@@ -48,17 +48,17 @@
 000002f0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000300: 0000 0000 0000 0000 0000 0000 0000 0000  ................
 00000310: 0000 0000 0000 0000 0000 0000 0000 0000  ................
-00000320: 03dc cd7d d383 ff90 03dc cd7d d383 ff90  ...}.......}....
-00000330: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000340: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000350: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000360: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000370: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000380: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-00000390: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003a0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003b0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003c0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003d0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003e0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
-000003f0: ffff ffff ffff ffff ffff ffff ffff ffff  ................
+00000320: 5435 a0ab 8e5e f93e 0000 0000 0000 00f7  T5...^.>........
+00000330: 38e1 42f1 8604 3cb4 0000 0000 0000 00c6  8.B...<.........
+00000340: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+00000350: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+00000360: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+00000370: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+00000380: 0000 0000 0000 0000 0000 0000 0000 8585  ................
+00000390: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003d0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003e0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
+000003f0: 0000 0000 0000 0000 0000 e0fc 39a0 954a  ............9..J

Ideally I'd like to ask if there is just a quick way to write the NVRAM backup back to the flash so I can get back to a known good state if possible. IMG_20240717_164726_799 Large nvm_6.12_8630988.bin.zip

lina-bh commented 1 month ago

Building my own MechaPwn.elf commenting out the logo stuff in drawLogoFrame() allowed me to get past the USB wait screen. (By the way, is the build usually non-working? I had to fix the bin2s stuff and some of the -l flags to get it to build and I ended up with a 5mb executable instead of a 700kb one.)

lina-bh commented 1 month ago

My working branch on this console is at lina-bh/MechaPwn@noimg. Just realised I was working on master instead of LangPwn but oh well

AKuHAK commented 1 month ago

commenting out the logo stuff in drawLogoFrame()

doh, you just disabled the USB support totally. This sounds like very weird issue, ill take a look at it later.

lina-bh commented 1 month ago

not MassCheck, I only put that on a button for testing. It's the graphics calls for drawing the map that I think is where it crashes.

AKuHAK commented 1 month ago

@lina-bh can you check LangPwn branch instead ?

AKuHAK commented 1 month ago

@lina-bh can you test this build ?

AKuHAK commented 1 month ago

@lina-bh I checked on my side and didnt face any issues, last build should be ok.

lina-bh commented 1 month ago

Hey, sorry for the delay, I was away for a bit. Same deal as before on my console, I just pulled LangPwn and built it and had the same black screen. Commented out the map screen drawing lines, it runs properly.

diff --git a/main.c b/main.c
index 15eca25..0e90365 100644
--- a/main.c
+++ b/main.c
@@ -521,7 +521,7 @@ void drawLogoFrame(uint8_t frame, char *text2)
 {
     gsKit_clear(gsGlobal, Black);

-    struct GSTEXTURE_holder *logoTextures = drawImage((gsGlobal->Width - 480) / 2, (gsGlobal->Height - 270) / 2, 480, 270, frames[frame]);
+    /* struct GSTEXTURE_holder *logoTextures = drawImage((gsGlobal->Width - 480) / 2, (gsGlobal->Height - 270) / 2, 480, 270, frames[frame]); */

     char text[]                           = "MechaPwn";
     int x, y;
@@ -538,7 +538,7 @@ void drawLogoFrame(uint8_t frame, char *text2)

     freeGSTEXTURE_holder(text2Textures);
     freeGSTEXTURE_holder(textTextures);
-    freeGSTEXTURE_holder(logoTextures);
+    /* freeGSTEXTURE_holder(logoTextures); */
 }

 void drawLogo()
lina-bh commented 1 month ago

I won't be able to test on this console anymore since I'm going to return it to the place I got it from