svanheulen wrote:the game has a stub for functions and the kernel points them to the correct functions
Right, except it has a stub for each imported function (functions used from the firmware, every sceWhatever()). When kernel loads the ELF, it resolves those stubs with correct call, be it a J (user-mode call) or a SYSCALL (kernel-mode call).
svanheulen wrote:So you just point it to your own function after the kernel does it's thing?
That's it. You overwrite the kernel resolved call. This way every time the game calls that function, your function will execute instead. Of course you can still call the original function after you're done with your own processing. You have to wait for this since otherwise the kernel will overwrite your hook. But this way you also overwrite the kernel call. This shouldn't be a problem if the same function is included on your plugin's stubs (supposing you want to call the kernel service).
svanheulen wrote:How do you find the stub address?
Run prxtool on the ELF. However having the stubs addresses hardcoded will make it work only on that specific game. Best option for what you want to do is coding your plugin so it searches for the stubs section, or at least the stubs you want to hook. This can be done quite easily parsing the memory for the name of the library, then finding pointers to it. Most likely there will be only one pointer, and included on the library stub descriptor, which also points to the stubs themselves. You can look how this is done in detail by checking my Game Dump Processor (aka moskitool). It's written to be run on PC, but it can easily be ported to run on PSP. Feel free to reuse the code.