(name)
| 276 | var ex_info; |
| 277 | |
| 278 | function load_prx(name) { |
| 279 | //sys_dynlib_load_prx |
| 280 | var res = chain.syscall(594, p.stringify(`/${random_path}/common/lib/${name}`), 0x0, handle, 0x0); |
| 281 | if (res.low != 0x0) { |
| 282 | alert("failed to load prx/get handle " + name); |
| 283 | } |
| 284 | //sys_dynlib_get_info_ex |
| 285 | p.write8(ex_info, 0x1A8); |
| 286 | res = chain.syscall(608, p.read4(handle), 0x0, ex_info); |
| 287 | if (res.low != 0x0) { |
| 288 | alert("failed to get module info from handle"); |
| 289 | } |
| 290 | var tlsinit = p.read8(ex_info.add32(0x110)); |
| 291 | var tlssize = p.read4(ex_info.add32(0x11C)); |
| 292 | |
| 293 | if (tlssize != 0) { |
| 294 | if (name == "libSceWebKit2.sprx") { |
| 295 | tlsinit.sub32inplace(OFFSET_WK2_TLS_IMAGE); |
| 296 | } else { |
| 297 | alert(`${name}, tlssize is non zero. this usually indicates that this module has a tls phdr with real data. You can hardcode the imgage to base offset here if you really wish to use one of these.`); |
| 298 | } |
| 299 | } |
| 300 | return tlsinit; |
| 301 | } |
| 302 | |
| 303 | //Obtain extra gadgets through module loading |
| 304 | function extra_gadgets() { |
no test coverage detected