payload args: optional pre-resolved API table (v2 extension)

Launchers that cannot rely on the payload's own dlsym resolver
(syscall 0x24f is refused for a WebProcess, kexp would trap) now pass
a table of pre-resolved libkernel/libc addresses via a trailing
extension of payload_args_t: api_magic ('KXP2'), api_count (12) and
api_entries[]. When present, init_libkernel_api/init_libc_api assign
every import from the table and perform zero dlsym calls; getpid is
exported as lk_getpid and consumed by the loader. Launchers passing
the legacy 0x28-byte block are unaffected: the extension is validated
(magic, count, pointer) before use and otherwise the internal dlsym
resolver runs exactly as before.

Author: najdek

include/api.h

@@ -12,7 +12,15 @@
 #include "libkernel-imports.h"
 #undef API
 
-void init_libkernel_api();
-void init_libc_api();
+/* Both take the payload args: when a valid KEXP_API table is present the
+ * function pointers are taken from it (zero dlsym calls), otherwise each
+ * import is resolved through syscall 0x24f as before. */
+void init_libkernel_api(payload_args_t *args);
+void init_libc_api(payload_args_t *args);
+
+/* libkernel getpid, resolved either from the API table or via dlsym in
+ * init_libkernel_api(). Named lk_getpid because `getpid` collides with the
+ * raw syscall stub generated from syscalls-imports.h. */
+extern int (*lk_getpid)(void);
 
 #endif

include/types.h

@@ -2,6 +2,7 @@
 #define TYPES_H
 
 #include <stdarg.h>
+#include <stddef.h>
 #include <stdint.h>
 #include <sys/types.h>
 
@@ -47,14 +48,76 @@ typedef struct {
   char unk[0x400];
 } NotificationRequest;
 
+/* ---------------------------------------------------------------------------
+ * Optional pre-resolved API table (v2 args extension).
+ *
+ * Some launchers cannot let the payload resolve its own imports: syscall 0x24f
+ * (dlsym) is refused for a WebProcess, so a kexp spawned from the PS5 browser
+ * would hit __builtin_trap() in resolve_symbol(). Such launchers instead fill
+ * api_entries[] with the runtime addresses of every imported function and set
+ * api_magic/api_count; kexp then performs zero dlsym calls. Launchers that do
+ * not know these addresses simply leave the extension zeroed (legacy 0x28
+ * block) and kexp falls back to its internal resolver as before.
+ *
+ * Table layout is a fixed contract (index -> function), matching the order of
+ * libkernel-imports.h + libc-imports.h below:
+ *   [0] sceKernelSendNotificationRequest   (libkernel)
+ *   [1] sysctlbyname                       (libkernel)
+ *   [2] pthread_create                     (libkernel)
+ *   [3] pthread_join                       (libkernel)
+ *   [4] getpid                             (libkernel)
+ *   [5] malloc                             (libSceLibcInternal)
+ *   [6] free                               (libSceLibcInternal)
+ *   [7] memcpy                             (libSceLibcInternal)
+ *   [8] memset                             (libSceLibcInternal)
+ *   [9] strcmp                             (libSceLibcInternal)
+ *   [10] memcmp                            (libSceLibcInternal)
+ *   [11] vsnprintf                         (libSceLibcInternal)
+ * ------------------------------------------------------------------------- */
+#define KEXP_API_MAGIC 0x4B585032U /* 'KXP2' */
+#define KEXP_API_COUNT 12
+
+enum {
+  KEXP_API_NOTIFY = 0,
+  KEXP_API_SYSCTLBYNAME,
+  KEXP_API_PTHREAD_CREATE,
+  KEXP_API_PTHREAD_JOIN,
+  KEXP_API_GETPID,
+  KEXP_API_MALLOC,
+  KEXP_API_FREE,
+  KEXP_API_MEMCPY,
+  KEXP_API_MEMSET,
+  KEXP_API_STRCMP,
+  KEXP_API_MEMCMP,
+  KEXP_API_VSNPRINTF,
+};
+
 typedef struct {
   int master_pipe[2];
   int victim_pipe[2];
   uintptr_t allproc;
   char *elfldr_ptr;
   size_t elfldr_size;
+  /* v2 extension: optional pre-resolved API table (see above). Legacy
+   * launchers pass only the 0x28-byte prefix; reading past it is safe on the
+   * heap and misinterpretation is ruled out by validating magic, count and
+   * pointer before use. */
+  uint32_t api_magic;
+  uint32_t api_count;
+  void **api_entries;
 } payload_args_t;
 
+_Static_assert(offsetof(payload_args_t, elfldr_size) == 0x20,
+               "legacy prefix must stay 0x28 bytes");
+_Static_assert(offsetof(payload_args_t, api_magic) == 0x28,
+               "api_magic offset broke the v2 args contract");
+_Static_assert(offsetof(payload_args_t, api_count) == 0x2C,
+               "api_count offset broke the v2 args contract");
+_Static_assert(offsetof(payload_args_t, api_entries) == 0x30,
+               "api_entries offset broke the v2 args contract");
+_Static_assert(sizeof(payload_args_t) == 0x38,
+               "payload_args_t size broke the v2 args contract");
+
 typedef struct {
   uint32_t cnt;
   uint32_t in;

src/api.c

@@ -5,27 +5,75 @@
 #include "libkernel-imports.h"
 #undef API
 
+int (*lk_getpid)(void) = 0;
+
 static inline void *resolve_symbol(SceKernelModule handle, const char *name) {
   void *addrp;
   if (dlsym(handle, name, &addrp))
     __builtin_trap();
   return addrp;
 }
 
-void init_libkernel_api() {
+/* Fill every import from the launcher-provided table. Returns 0 when the
+ * extension is present and valid (and everything was assigned), -1 when the
+ * caller must fall back to the dlsym resolver. Idempotent: once the table has
+ * been applied, later calls report success without touching anything. */
+static int api_try_table(payload_args_t *args) {
+  static int table_applied = 0;
+
+  if (table_applied)
+    return 0;
+
+  if (args == 0 || args->api_entries == 0 ||
+      args->api_magic != KEXP_API_MAGIC || args->api_count != KEXP_API_COUNT)
+    return -1;
+
+  if (((uintptr_t)args->api_entries & (sizeof(void *) - 1)) != 0)
+    return -1;
+
+  void **table = args->api_entries;
+
+  sceKernelSendNotificationRequest =
+      (typeof(sceKernelSendNotificationRequest))table[KEXP_API_NOTIFY];
+  sysctlbyname = (typeof(sysctlbyname))table[KEXP_API_SYSCTLBYNAME];
+  pthread_create = (typeof(pthread_create))table[KEXP_API_PTHREAD_CREATE];
+  pthread_join = (typeof(pthread_join))table[KEXP_API_PTHREAD_JOIN];
+  lk_getpid = (typeof(lk_getpid))table[KEXP_API_GETPID];
+
+  malloc = (typeof(malloc))table[KEXP_API_MALLOC];
+  free = (typeof(free))table[KEXP_API_FREE];
+  memcpy = (typeof(memcpy))table[KEXP_API_MEMCPY];
+  memset = (typeof(memset))table[KEXP_API_MEMSET];
+  strcmp = (typeof(strcmp))table[KEXP_API_STRCMP];
+  memcmp = (typeof(memcmp))table[KEXP_API_MEMCMP];
+  vsnprintf = (typeof(vsnprintf))table[KEXP_API_VSNPRINTF];
+
+  table_applied = 1;
+  return 0;
+}
+
+void init_libkernel_api(payload_args_t *args) {
+  if (api_try_table(args) == 0)
+    return;
+
 #define API(ret, name, args)                                                   \
   name = (ret(*) args)resolve_symbol(LIBKERNEL_HANDLE, #name);
 
 #include "libkernel-imports.h"
 
 #undef API
+
+  lk_getpid = (int (*)(void))resolve_symbol(LIBKERNEL_HANDLE, "getpid");
 }
 
-void init_libc_api() {
+void init_libc_api(payload_args_t *args) {
+  if (api_try_table(args) == 0)
+    return;
+
 #define API(ret, name, args)                                                   \
   name = (ret(*) args)resolve_symbol(LIBC_HANDLE, #name);
 
 #include "libc-imports.h"
 
 #undef API
-}
+}

src/loader.c

@@ -220,9 +220,8 @@ int init_loader_args() {
 
   kread(&rpipe_f_data, rpipe_fp, sizeof(rpipe_f_data));
 
-  void *kernel_getpid;
-  if (dlsym(LIBKERNEL_HANDLE, "getpid", &kernel_getpid) == -1) {
-    log("unable to dlsym getpid !!");
+  if (lk_getpid == 0) {
+    log("getpid was not resolved !!");
     return -1;
   }
 
@@ -232,7 +231,7 @@ int init_loader_args() {
     return -1;
   }
 
-  loader_ctx.args.syscall_wrapper = kernel_getpid;
+  loader_ctx.args.syscall_wrapper = (void *)lk_getpid;
   loader_ctx.args.rwpipe = rwpipe;
   loader_ctx.args.rwpair = rwpair;
   loader_ctx.args.pipe_f_data = rpipe_f_data;

src/main.c

@@ -8,8 +8,8 @@ __attribute__((section(".entry"))) int main(payload_args_t *args) {
   if (args == 0)
     return -1;
 
-  init_libkernel_api();
-  init_libc_api();
+  init_libkernel_api(args);
+  init_libc_api(args);
 
   if (logger_init() != 0) {
     notify("unable to init logger !!");