Push updates...

1. Cleanup/Linting/Tweaks/Fixes/etc
  - Default Prettier config w/ 999 line length
  - Default eslint config "problems" list trimmed down
2. Fixed corrupt pointer cleanup by abc
3. Fixed `ip6po_rthdr` offset for PS5 by abc
4. Verified the number of blocking requests needed to be two by abc
5. Only run kernel exploit once by checking setuid by @JTAG7371
6. Kernel patches from pOOBs4 by @ChendoChap (Ported for 8.00-9.60)
7. Payload loader from pOOBs4 by @ChendoChap
8. Restore syscall 661 (`sys_aio_submit()`) after patching by @janisslsm
9. Add `PROT_READ`, `PROT_WRITE`, `PROT_EXEC` constants for payload loader by @janisslsm

The ONLY things that should need changes are the `/rop/ps4/*.mjs` files (850, 900, and 950).
Firmware 8.00 appears to be stable/have a good success rate now.
This commit is contained in:
Al Azif
2025-06-01 03:46:23 -07:00
parent 23d3e70647
commit 3ab19c3a0b
29 changed files with 4082 additions and 4105 deletions

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 8.00, 8.01, 8.03
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0x25610,
'pthread_join' : 0x27c60,
'pthread_barrier_init' : 0xa0e0,
'pthread_barrier_wait' : 0x1ee00,
'pthread_barrier_destroy' : 0xe180,
'pthread_exit' : 0x19eb0,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0x25610,
pthread_join: 0x27c60,
pthread_barrier_init: 0xa0e0,
pthread_barrier_wait: 0x1ee00,
pthread_barrier_destroy: 0xe180,
pthread_exit: 0x19eb0,
}),
);
export const off_kstr = 0x7edcff;
export const off_cpuid_to_pcpu = 0x228e6b0;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x228e6b0;
export const off_sysent_661 = 0x11040c0;
export const jmp_rsi = 0xe629c;
export const patch_elf_loc = './kpatch/800.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/800.bin"; // Relative to `../../lapse.mjs`

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 8.50
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0xebb0,
'pthread_join' : 0x29d50,
'pthread_barrier_init' : 0x283c0,
'pthread_barrier_wait' : 0xb8c0,
'pthread_barrier_destroy' : 0x9c10,
'pthread_exit' : 0x25310,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0xebb0,
pthread_join: 0x29d50,
pthread_barrier_init: 0x283c0,
pthread_barrier_wait: 0xb8c0,
pthread_barrier_destroy: 0x9c10,
pthread_exit: 0x25310,
}),
);
export const off_kstr = 0x7da91c;
export const off_cpuid_to_pcpu = 0x1cfc240;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x1cfc240;
export const off_sysent_661 = 0x11041b0;
export const jmp_rsi = 0xc810d;
export const patch_elf_loc = './kpatch/850.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/850.bin"; // Relative to `../../lapse.mjs`

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 8.52
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0xebb0,
'pthread_join' : 0x29d60,
'pthread_barrier_init' : 0x283d0,
'pthread_barrier_wait' : 0xb8c0,
'pthread_barrier_destroy' : 0x9c10,
'pthread_exit' : 0x25320,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0xebb0,
pthread_join: 0x29d60,
pthread_barrier_init: 0x283d0,
pthread_barrier_wait: 0xb8c0,
pthread_barrier_destroy: 0x9c10,
pthread_exit: 0x25320,
}),
);
export const off_kstr = 0x7da91c;
export const off_cpuid_to_pcpu = 0x1cfc240;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x1cfc240;
export const off_sysent_661 = 0x11041b0;
export const jmp_rsi = 0xc810d;
export const patch_elf_loc = './kpatch/850.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/850.bin"; // Relative to `../../lapse.mjs`

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 9.00
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0x25510,
'pthread_join' : 0xafa0,
'pthread_barrier_init' : 0x273d0,
'pthread_barrier_wait' : 0xa320,
'pthread_barrier_destroy' : 0xfea0,
'pthread_exit' : 0x77a0,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0x25510,
pthread_join: 0xafa0,
pthread_barrier_init: 0x273d0,
pthread_barrier_wait: 0xa320,
pthread_barrier_destroy: 0xfea0,
pthread_exit: 0x77a0,
}),
);
export const off_kstr = 0x7f6f27;
export const off_cpuid_to_pcpu = 0x21ef2a0;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21ef2a0;
export const off_sysent_661 = 0x1107f00;
export const jmp_rsi = 0x4c7ad;
export const patch_elf_loc = './kpatch/900.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/900.bin"; // Relative to `../../lapse.mjs`

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 9.03, 9.04
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0x25510,
'pthread_join' : 0xafa0,
'pthread_barrier_init' : 0x273d0,
'pthread_barrier_wait' : 0xa320,
'pthread_barrier_destroy' : 0xfea0,
'pthread_exit' : 0x77a0,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0x25510,
pthread_join: 0xafa0,
pthread_barrier_init: 0x273d0,
pthread_barrier_wait: 0xa320,
pthread_barrier_destroy: 0xfea0,
pthread_exit: 0x77a0,
}),
);
export const off_kstr = 0x7f4ce7;
export const off_cpuid_to_pcpu = 0x21eb2a0;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21eb2a0;
export const off_sysent_661 = 0x1103f00;
export const jmp_rsi = 0x5325b;
export const patch_elf_loc = './kpatch/903.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/903.bin"; // Relative to `../../lapse.mjs`

View File

@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
// 9.50, 9.51, 9.60
export const pthread_offsets = new Map(Object.entries({
'pthread_create' : 0x1c540,
'pthread_join' : 0x9560,
'pthread_barrier_init' : 0x24200,
'pthread_barrier_wait' : 0x1efb0,
'pthread_barrier_destroy' : 0x19450,
'pthread_exit' : 0x28ca0,
}));
export const pthread_offsets = new Map(
Object.entries({
pthread_create: 0x1c540,
pthread_join: 0x9560,
pthread_barrier_init: 0x24200,
pthread_barrier_wait: 0x1efb0,
pthread_barrier_destroy: 0x19450,
pthread_exit: 0x28ca0,
}),
);
export const off_kstr = 0x769a88;
export const off_cpuid_to_pcpu = 0x21a66c0;
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21a66c0;
export const off_sysent_661 = 0x1100ee0;
export const jmp_rsi = 0x15a6d;
export const patch_elf_loc = './kpatch/950.bin'; // Relative to `../../lapse.mjs`
export const patch_elf_loc = "./kpatch/950.bin"; // Relative to `../../lapse.mjs`