From 3ac8624bf173be885357de73c3d9ee312d3f7a39 Mon Sep 17 00:00:00 2001 From: ArabPixel Date: Mon, 22 Dec 2025 12:41:12 +0100 Subject: [PATCH 1/4] Add fuse support for 12.50/12.52 --- itemz-daemon/source/fuse.c | 53 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+) diff --git a/itemz-daemon/source/fuse.c b/itemz-daemon/source/fuse.c index cacf6e8..3281c27 100644 --- a/itemz-daemon/source/fuse.c +++ b/itemz-daemon/source/fuse.c @@ -629,6 +629,55 @@ int fuse_kernel_patches_1200(struct thread *td) { return 0; } +int fuse_kernel_patches_1250(struct thread *td) { + + void *kernel_base = &((uint8_t *)kernelRdmsr(0xC0000082))[-0x1C0]; + uint8_t *kernel_ptr = (uint8_t *)kernel_base; + int *ksuser_enabled = (int *)(kernel_base + 0x21AD2AC); + + if (*ksuser_enabled == 1) // kernel already patched + return 0; + + cpu_disable_wp(); + struct vfsconf *p = (struct vfsconf *)(kernel_base + 0x127FA48); + // suser_enabled in priv_check_cred + *ksuser_enabled = 1; + // add jail friendly for fuse file system + p->vfc_flags = 0x00400000 | 0x00080000; + // avoid enforce_dev_perms checks + // default prison_priv_check to 0 + kernel_ptr[0x317866] = 0; + kernel_ptr[0x491404] = 0x84; + // skip devkit/testkit/dipsw check in fuse_loader + kernel_ptr[0x4953CE] = 0xEB; + kernel_ptr[0x4953CF] = 0x1B; + // skip sceSblACMgrIsSyscoreProcess check in fuse_open_device + kernel_ptr[0x48FE05] = 0xEB; + kernel_ptr[0x48FE04] = 0x0; + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_close_device + kernel_ptr[0x48FF18] = 0xEB; + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_poll_device + kernel_ptr[0x490452] = 0x84; + // skip sceSblACMgrIsSyscoreProcess check in fuse_vfsop_mount + kernel_ptr[0x4943B7] = 0x85; + // skip sceSblACMgrIsMinisyscore/unknown check in fuse_vfsop_unmount + kernel_ptr[0x494B0A] = 0x84; + // skip sceSblACMgrIsSystemUcred check in fuse_vfsop_statfs + kernel_ptr[0x494EBD] = 0xEB; + kernel_ptr[0x494EBE] = 0x04; + kernel_ptr[0x48FD0E] = 0xB6; + // patch kernel + cpu_enable_wp(); + + int (*fuse_loader)(void *m, int op, void *arg) = + (void *)(kernel_base + 0x490d10); + fuse_loader(NULL, 0, NULL); + + return 0; +} + bool fuse_fw_supported() { switch (ps4_fw_version()) { case 0x507: @@ -673,6 +722,10 @@ bool fuse_fw_supported() { case 0x1202: syscall(11, fuse_kernel_patches_1200); return true; + case 0x1250: + case 0x1252: + syscall(11, fuse_kernel_patches_1250); + return true; default: { log_info("fuse: Unsupported firmware version, exiting ..."); return false; From ba3f330edf6fed87dc1e08675fbc3d72129ccde0 Mon Sep 17 00:00:00 2001 From: ArabPixel Date: Mon, 22 Dec 2025 23:58:23 +0100 Subject: [PATCH 2/4] fix 12.52 bad offsets --- itemz-daemon/source/fuse.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/itemz-daemon/source/fuse.c b/itemz-daemon/source/fuse.c index 3281c27..1007695 100644 --- a/itemz-daemon/source/fuse.c +++ b/itemz-daemon/source/fuse.c @@ -647,7 +647,7 @@ int fuse_kernel_patches_1250(struct thread *td) { // avoid enforce_dev_perms checks // default prison_priv_check to 0 kernel_ptr[0x317866] = 0; - kernel_ptr[0x491404] = 0x84; + kernel_ptr[0x4913F5] = 0x84; // skip devkit/testkit/dipsw check in fuse_loader kernel_ptr[0x4953CE] = 0xEB; kernel_ptr[0x4953CF] = 0x1B; @@ -656,7 +656,7 @@ int fuse_kernel_patches_1250(struct thread *td) { kernel_ptr[0x48FE04] = 0x0; // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in // fuse_close_device - kernel_ptr[0x48FF18] = 0xEB; + kernel_ptr[0x48FF02] = 0xEB; // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in // fuse_poll_device kernel_ptr[0x490452] = 0x84; @@ -672,7 +672,7 @@ int fuse_kernel_patches_1250(struct thread *td) { cpu_enable_wp(); int (*fuse_loader)(void *m, int op, void *arg) = - (void *)(kernel_base + 0x490d10); + (void *)(kernel_base + 0x4953A0); fuse_loader(NULL, 0, NULL); return 0; From 6440b42a58145eac7dafb4b8050a893821d5523e Mon Sep 17 00:00:00 2001 From: ArabPixel Date: Sun, 28 Dec 2025 13:21:30 +0100 Subject: [PATCH 3/4] Kernel address instead of kernel offset --- itemz-daemon/source/fuse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/itemz-daemon/source/fuse.c b/itemz-daemon/source/fuse.c index 1007695..6dabc2c 100644 --- a/itemz-daemon/source/fuse.c +++ b/itemz-daemon/source/fuse.c @@ -639,7 +639,7 @@ int fuse_kernel_patches_1250(struct thread *td) { return 0; cpu_disable_wp(); - struct vfsconf *p = (struct vfsconf *)(kernel_base + 0x127FA48); + struct vfsconf *p = (struct vfsconf *)(kernel_base + 0x1A7FA48); // suser_enabled in priv_check_cred *ksuser_enabled = 1; // add jail friendly for fuse file system From 4b735764d30042f958d6b9eb62dccb3ab100efc7 Mon Sep 17 00:00:00 2001 From: ArabPixel Date: Fri, 2 Jan 2026 17:09:50 +0100 Subject: [PATCH 4/4] Add fuse support for 13.00/13.02 --- itemz-daemon/source/fuse.c | 124 +++++++++++++++++++++++++++++++++++++ 1 file changed, 124 insertions(+) diff --git a/itemz-daemon/source/fuse.c b/itemz-daemon/source/fuse.c index 6dabc2c..c55ca05 100644 --- a/itemz-daemon/source/fuse.c +++ b/itemz-daemon/source/fuse.c @@ -678,6 +678,124 @@ int fuse_kernel_patches_1250(struct thread *td) { return 0; } +int fuse_kernel_patches_1300(struct thread *td) { + + void *kernel_base = &((uint8_t *)kernelRdmsr(0xC0000082))[-0x1C0]; + uint8_t *kernel_ptr = (uint8_t *)kernel_base; + int *ksuser_enabled = (int *)(kernel_base + 0x21ad2ac); + + if (*ksuser_enabled == 1) // kernel already patched + return 0; + + cpu_disable_wp(); + struct vfsconf *p = (struct vfsconf *)(kernel_base + 0x1A7FA48); + // suser_enabled in priv_check_cred + *ksuser_enabled = 1; + // add jail friendly for fuse file system + p->vfc_flags = 0x00400000 | 0x00080000; + // avoid enforce_dev_perms checks + + // default prison_priv_check to 0 + kernel_ptr[0x317886] = 0; + kernel_ptr[0x491415] = 0x84; + + // skip devkit/testkit/dipsw check in fuse_loader + kernel_ptr[0x4953EE] = 0xEB; + kernel_ptr[0x4953EF] = 0x1B; + + // skip sceSblACMgrIsSyscoreProcess check in fuse_open_device + kernel_ptr[0x48FE24] = 0x0; + kernel_ptr[0x48FE25] = 0xEB; + + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_close_device + kernel_ptr[0x48FF22] = 0xEB; + + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_poll_device + kernel_ptr[0x490472] = 0x84; + + // skip sceSblACMgrIsSyscoreProcess check in fuse_vfsop_mount + kernel_ptr[0x4943D7] = 0x85; + + // skip sceSblACMgrIsMinisyscore/unknown check in fuse_vfsop_unmount + kernel_ptr[0x494B2A] = 0x84; + + // skip sceSblACMgrIsSystemUcred check in fuse_vfsop_statfs + kernel_ptr[0x494EDD] = 0xEB; + kernel_ptr[0x494EDE] = 0x04; + + kernel_ptr[0x48FD2E] = 0xB6; + + // patch kernel + cpu_enable_wp(); + + int (*fuse_loader)(void *m, int op, void *arg) = + (void *)(kernel_base + 0x4953C0); + fuse_loader(NULL, 0, NULL); + + return 0; +} + +int fuse_kernel_patches_1302(struct thread *td) { + + void *kernel_base = &((uint8_t *)kernelRdmsr(0xC0000082))[-0x1C0]; + uint8_t *kernel_ptr = (uint8_t *)kernel_base; + int *ksuser_enabled = (int *)(kernel_base + 0x21ad2ac); + + if (*ksuser_enabled == 1) // kernel already patched + return 0; + + cpu_disable_wp(); + struct vfsconf *p = (struct vfsconf *)(kernel_base + 0x1A7FA48); + // suser_enabled in priv_check_cred + *ksuser_enabled = 1; + // add jail friendly for fuse file system + p->vfc_flags = 0x00400000 | 0x00080000; + // avoid enforce_dev_perms checks + + // default prison_priv_check to 0 + kernel_ptr[0x317896] = 0; + kernel_ptr[0x491425] = 0x84; + + // skip devkit/testkit/dipsw check in fuse_loader + kernel_ptr[0x4953FE] = 0xEB; + kernel_ptr[0x4953FF] = 0x1B; + + // skip sceSblACMgrIsSyscoreProcess check in fuse_open_device + kernel_ptr[0x48FE34] = 0x0; + kernel_ptr[0x48FE35] = 0xEB; + + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_close_device + kernel_ptr[0x48FF32] = 0xEB; + + // skip sceSblACMgrIsDebuggerProcess/sceSblACMgrIsSyscoreProcess check in + // fuse_poll_device + kernel_ptr[0x490482] = 0x84; + + // skip sceSblACMgrIsSyscoreProcess check in fuse_vfsop_mount + kernel_ptr[0x4943E7] = 0x85; + + // skip sceSblACMgrIsMinisyscore/unknown check in fuse_vfsop_unmount + kernel_ptr[0x494B3A] = 0x84; + + // skip sceSblACMgrIsSystemUcred check in fuse_vfsop_statfs + kernel_ptr[0x494EED] = 0xEB; + kernel_ptr[0x494EEE] = 0x04; + + kernel_ptr[0x48FD3E] = 0xB6; + + // patch kernel + cpu_enable_wp(); + + int (*fuse_loader)(void *m, int op, void *arg) = + (void *)(kernel_base + 0x4953D0); + fuse_loader(NULL, 0, NULL); + + return 0; +} + bool fuse_fw_supported() { switch (ps4_fw_version()) { case 0x507: @@ -726,6 +844,12 @@ bool fuse_fw_supported() { case 0x1252: syscall(11, fuse_kernel_patches_1250); return true; + case 0x1300: + syscall(11, fuse_kernel_patches_1300); + return true; + case 0x1302: + syscall(11, fuse_kernel_patches_1302); + return true; default: { log_info("fuse: Unsupported firmware version, exiting ..."); return false;