MCPcopy Create free account

hub / github.com/ChendoChap/PS5-Webkit-Execution / functions

Functions50 in github.com/ChendoChap/PS5-Webkit-Execution

↓ 78 callersMethodpush
* performs `*rsp = value; rsp += 8;`
rop.js:66
↓ 18 callersFunctionptrToString
(p)
webkit.js:50
↓ 12 callersFunctionmkString
(l, head)
webkit.js:70
↓ 12 callersFunctionset_offset_for_platform
(ps5_offset, ps4_offset)
exploit.js:13
↓ 7 callersMethodpush_write8
* performs `*dest = value;` in chain
rop.js:73
↓ 6 callersFunctionstringToPtr
(p, o)
webkit.js:59
↓ 5 callersMethodget_rsp
* returns the current stack pointer.
rop.js:150
↓ 4 callersFunctionmakeReader
(read_addr, ffs_name)
webkit.js:149
↓ 3 callersFunctionboot_addrof
(obj)
webkit.js:271
↓ 3 callersMethodcall
(rip, rdi, rsi, rdx, rcx, r8, r9)
rop.js:273
↓ 3 callersMethodfcall
* helper function to add a standard sysv call to the chain.
rop.js:139
↓ 3 callersMethodincrement_stack
()
rop.js:44
↓ 2 callersFunctioni48_put
(x, a)
webkit.js:305
↓ 2 callersMethodpush_sysv
* pushes rdi-r9 args on the stack for sysv calls
rop.js:102
↓ 2 callersFunctionread_mem_setup
(p, sz)
webkit.js:324
↓ 2 callersMethodrun
()
rop.js:284
↓ 2 callersMethodset_entry
(index, value)
rop.js:48
↓ 1 callersFunctionboot_fakeobj
(addr)
webkit.js:277
↓ 1 callersMethodclear
()
rop.js:36
↓ 1 callersMethodclear
()
rop.js:268
↓ 1 callersMethodcreate_branch
* prepares a branch in the rop chain, for 32b comparisons on [addr] <-> compare value * use branch_types.XXXXX as type argument. * returns
rop.js:199
↓ 1 callersFunctionfind_worker
()
exploit.js:448
↓ 1 callersMethodget_branch
* returns the next available branch
rop.js:189
↓ 1 callersFunctioni48_get
(a)
webkit.js:310
↓ 1 callersMethodincrement_dword
* performs (*address)++; in chain
rop.js:253
↓ 1 callersMethodjmp_to_rsp
* performs `rsp = dest;` in chain. * can be used to 'jump' to different parts of a rop chain
rop.js:158
↓ 1 callersFunctionrun_hax
()
exploit.js:688
↓ 1 callersMethodself_healing_syscall
* function intended to build a reusable 'syscall' chain. * Having a syscall return an error makes the stub perform a push rax, a call and a push
rop.js:167
↓ 1 callersMethodset_branch_points
* finalizes a branch by setting the destination stack pointers. * swap met and not met args if trying for an inverted jmp type.
rop.js:245
↓ 1 callersMethodset_initial_count
(count)
rop.js:29
↓ 1 callersMethodspawn_thread
* returns created pthread_t as int64
rop.js:314
↓ 1 callersMethodsyscall
(sysc, rdi, rsi, rdx, rcx, r8, r9)
rop.js:280
↓ 1 callersFunctionuserland
()
exploit.js:464
↓ 1 callersFunctionwait_for_worker
()
exploit.js:436
↓ 1 callersMethodwrite_result
* performs `*dest = rax;` in chain
rop.js:84
↓ 1 callersMethodwrite_result4
* performs `*dest = eax;` in chain
rop.js:93
↓ 1 callersFunctionzeroFill
(number, width)
int64.js:78
Functionarray_from_address
(addr, size)
exploit.js:513
Methodconstructor
(stack_size = 0x40000, reserved_stack = 0x10000)
rop.js:3
Methodconstructor
(stack_size, reserved_stack)
rop.js:263
Methodconstructor
(name = "rop_thread", stack_size, reserved_stack)
rop.js:291
Functionhex
(n)
webkit.js:12
Functionint64
(low, hi)
int64.js:1
Functionlaunch_chain
(chain)
exploit.js:578
Functionmalloc
(sz, type = 4)
exploit.js:498
Functionpoc
()
webkit.js:18
Functionpre_chain
(chain)
exploit.js:571
Functionreadstr
(addr)
exploit.js:534
Functionstringify
(str)
exploit.js:525
Functionwritestr
(addr, str)
exploit.js:547