(name)
| 284 | var ex_info; |
| 285 | |
| 286 | function load_prx(name) { |
| 287 | //sys_dynlib_load_prx |
| 288 | var res = chain.syscall(594, p.stringify(`/${random_path}/common/lib/${name}`), 0x0, handle, 0x0); |
| 289 | if (res.low != 0x0) { |
| 290 | alert("failed to load prx/get handle " + name); |
| 291 | } |
| 292 | //sys_dynlib_get_info_ex |
| 293 | p.write8(ex_info, 0x1A8); |
| 294 | res = chain.syscall(608, p.read4(handle), 0x0, ex_info); |
| 295 | if (res.low != 0x0) { |
| 296 | alert("failed to get module info from handle"); |
| 297 | } |
| 298 | var tlsinit = p.read8(ex_info.add32(0x110)); |
| 299 | var tlssize = p.read4(ex_info.add32(0x11C)); |
| 300 | |
| 301 | if (tlssize != 0) { |
| 302 | if (name == "libSceWebKit2.sprx") { |
| 303 | tlsinit.sub32inplace(OFFSET_WK2_TLS_IMAGE); |
| 304 | } else { |
| 305 | alert(`${name}, tlssize is non zero. this usually indicates that this module has a tls phdr with real data. You can hardcode the imgage to base offset here if you really wish to use one of these.`); |
| 306 | } |
| 307 | } |
| 308 | return tlsinit; |
| 309 | } |
| 310 | |
| 311 | //Obtain extra gadgets through module loading |
| 312 | function extra_gadgets() { |
no test coverage detected