fix为插件
eboot注入插件目的是实现自定义编码转换为ucs2编码



修改 0017D588 启动线程到自己的接口
新启动入口 0x00006838 = 0x0880A838


$a1 = 启动线程的回调
修改a1的数值为 0x00006838 = 0x08804000 + 0x6838

loc_0017D580:		; Refs: 0x0017D56C 
	0x0017D580: 0x3C110000 '...<' - lui        $s1, 0x0
	0x0017D584: 0x26256838 '8h%&' - addiu      $a1, $s1, 26680
	0x0017D588: 0x0C07E6F9 '....' - jal        sceKernelCreateThread

清理掉原有函数代码 6828开始 大小260字节
修改为默认直接返回

sub_00006828:		; Refs: 0x00006680 
	0x00006828: 0x03E00008 '....' - jr         $ra
	0x0000682C: 0x00000000 '....' - nop        
	0x00006830: 0x00000000 '....' - nop        
	0x00006834: 0x00000000 '....' - nop    

这是新的主线程入口
先加载插件，然后调用旧的线程入口
6828原来存在2个重定位。正好给下面2个sub使用了
重定位表内，将原地址改为 6848,6858

sub_00006838:		; Refs: 0x0017D584 
	0x00006838: 0x27BDFFF0 '...'' - addiu      $sp, $sp, -16
	0x0000683C: 0xAFBF0004 '....' - sw         $ra, 4($sp)
	0x00006840: 0xAFA40008 '....' - sw         $a0, 8($sp)
	0x00006844: 0xAFA5000C '....' - sw         $a1, 12($sp)
	0x00006848: 0x0C001A1C '....' - jal        sub_00006870
	0x0000684C: 0x00000000 '....' - nop        
	0x00006850: 0x8FA5000C '....' - lw         $a1, 12($sp)
	0x00006854: 0x8FA40008 '....' - lw         $a0, 8($sp)
	0x00006858: 0x0C05F576 'v...' - jal        sub_0017D5D8
	0x0000685C: 0x00000000 '....' - nop        
	0x00006860: 0x8FBF0004 '....' - lw         $ra, 4($sp)
	0x00006864: 0x03E00008 '....' - jr         $ra
	0x00006868: 0x27BD0010 '...'' - addiu      $sp, $sp, 16
	0x0000686C: 0x00000000 '....' - nop       


这里为载入插件的代码
$a0 = 插件路径
$s1 = sceKernelLoadModule
$s2 = sceKernelStartModule
$s0 = 0x00006850

sub_00006870:		; Refs: 0x00006848 
	0x00006870: 0x03E08021 '!...' - move       $s0, $ra
	0x00006874: 0x3C02001F '...<' - lui        $v0, 0x1F
	0x00006878: 0x344234AC '.4B4' - ori        $v0, $v0, 0x34AC
	0x0000687C: 0x02028821 '!...' - addu       $s1, $s0, $v0
	0x00006880: 0x3C02001F '...<' - lui        $v0, 0x1F
	0x00006884: 0x3442349C '.4B4' - ori        $v0, $v0, 0x349C
	0x00006888: 0x02029021 '!...' - addu       $s2, $s0, $v0
	0x0000688C: 0x27BDFFF8 '...'' - addiu      $sp, $sp, -8
	0x00006890: 0xAFBF0004 '....' - sw         $ra, 4($sp)
	0x00006894: 0x26040078 'x..&' - addiu      $a0, $s0, 120
	0x00006898: 0x00002821 '!(..' - move       $a1, $zr
	0x0000689C: 0x0220F809 '.. .' - jalr       $s1
	0x000068A0: 0x00003021 '!0..' - move       $a2, $zr
	0x000068A4: 0x00402021 '! @.' - move       $a0, $v0
	0x000068A8: 0x8FBF0004 '....' - lw         $ra, 4($sp)
	0x000068AC: 0x00002821 '!(..' - move       $a1, $zr
	0x000068B0: 0x00003021 '!0..' - move       $a2, $zr
	0x000068B4: 0x00003821 '!8..' - move       $a3, $zr
	0x000068B8: 0x00004021 '!@..' - move       $t0, $zr
	0x000068BC: 0x02400008 '..@.' - jr         $s2
	0x000068C0: 0x27BD0008 '...'' - addiu      $sp, $sp, 8
	0x000068C4: 0x00000000 '....' - nop        
	0x000068C8: 0x63736964 'disc' - Unknown    
	0x000068CC: 0x502F3A30 '0:/P' - beql       $at, $t7, loc_00015190
	0x000068D0: 0x475F5053 'SP_G' - Unknown    
	0x000068D4: 0x2F454D41 'AME/' - sltiu      $a1, $k0, 19777
	0x000068D8: 0x44535953 'SYSD' - Unknown    
	0x000068DC: 0x462F5249 'IR/F' - Unknown    
	0x000068E0: 0x502E5849 'IX.P' - beql       $at, $t6, loc_0001CA08
	0x000068E4: 0x00005852 'RX..' - Unknown    
	0x000068E8: 0x00000000 '....' - nop        
	0x000068EC: 0x00000000 '....' - nop        
	0x000068F0: 0x00000000 '....' - nop        
	0x000068F4: 0x00000000 '....' - nop        
	0x000068F8: 0x00000000 '....' - nop        
	0x000068FC: 0x00000000 '....' - nop        
	0x00006900: 0x00000000 '....' - nop        
	0x00006904: 0x00000000 '....' - nop        
	0x00006908: 0x00000000 '....' - nop        
	0x0000690C: 0x00000000 '....' - nop        
	0x00006910: 0x00000000 '....' - nop        
	0x00006914: 0x00000000 '....' - nop        
	0x00006918: 0x00000000 '....' - nop        
	0x0000691C: 0x00000000 '....' - nop        
	0x00006920: 0x00000000 '....' - nop        
	0x00006924: 0x00000000 '....' - nop        
	0x00006928: 0x00000000 '....' - nop