Function build_rthdr_msg

document/en/ps5/exploit.js:324–338

(buf, size)

    // Helper functions
    function build_rthdr_msg(buf, size) {
        let rthdr_len  = ((size / 0x8) - 1) & ~1;
        let rthdr_size = (rthdr_len + 1) * 0x8;

        for (let i = 0; i < size / 0x4; i++) {
            p.write4(buf.add32(i * 0x4), 0);
        }

        p.write1(buf.add32(0x00), 0);             // ip6r_nxt
        p.write1(buf.add32(0x01), rthdr_len);     // ip6r_len
        p.write1(buf.add32(0x02), 0);             // ip6r_type
        p.write1(buf.add32(0x03), rthdr_len / 2); // ip6r_segleft

        return rthdr_size;
    }

    function build_addr(buf, family, port, addr) {
        p.write1(buf.add32(0x00), 0x10);