Push updates...
1. Cleanup/Linting/Tweaks/Fixes/etc - Default Prettier config w/ 999 line length - Default eslint config "problems" list trimmed down 2. Fixed corrupt pointer cleanup by abc 3. Fixed `ip6po_rthdr` offset for PS5 by abc 4. Verified the number of blocking requests needed to be two by abc 5. Only run kernel exploit once by checking setuid by @JTAG7371 6. Kernel patches from pOOBs4 by @ChendoChap (Ported for 8.00-9.60) 7. Payload loader from pOOBs4 by @ChendoChap 8. Restore syscall 661 (`sys_aio_submit()`) after patching by @janisslsm 9. Add `PROT_READ`, `PROT_WRITE`, `PROT_EXEC` constants for payload loader by @janisslsm The ONLY things that should need changes are the `/rop/ps4/*.mjs` files (850, 900, and 950). Firmware 8.00 appears to be stable/have a good success rate now.
This commit is contained in:
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 8.00, 8.01, 8.03
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0x25610,
|
||||
'pthread_join' : 0x27c60,
|
||||
'pthread_barrier_init' : 0xa0e0,
|
||||
'pthread_barrier_wait' : 0x1ee00,
|
||||
'pthread_barrier_destroy' : 0xe180,
|
||||
'pthread_exit' : 0x19eb0,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0x25610,
|
||||
pthread_join: 0x27c60,
|
||||
pthread_barrier_init: 0xa0e0,
|
||||
pthread_barrier_wait: 0x1ee00,
|
||||
pthread_barrier_destroy: 0xe180,
|
||||
pthread_exit: 0x19eb0,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x7edcff;
|
||||
export const off_cpuid_to_pcpu = 0x228e6b0;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x228e6b0;
|
||||
export const off_sysent_661 = 0x11040c0;
|
||||
export const jmp_rsi = 0xe629c;
|
||||
|
||||
export const patch_elf_loc = './kpatch/800.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/800.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 8.50
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0xebb0,
|
||||
'pthread_join' : 0x29d50,
|
||||
'pthread_barrier_init' : 0x283c0,
|
||||
'pthread_barrier_wait' : 0xb8c0,
|
||||
'pthread_barrier_destroy' : 0x9c10,
|
||||
'pthread_exit' : 0x25310,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0xebb0,
|
||||
pthread_join: 0x29d50,
|
||||
pthread_barrier_init: 0x283c0,
|
||||
pthread_barrier_wait: 0xb8c0,
|
||||
pthread_barrier_destroy: 0x9c10,
|
||||
pthread_exit: 0x25310,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x7da91c;
|
||||
export const off_cpuid_to_pcpu = 0x1cfc240;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x1cfc240;
|
||||
export const off_sysent_661 = 0x11041b0;
|
||||
export const jmp_rsi = 0xc810d;
|
||||
|
||||
export const patch_elf_loc = './kpatch/850.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/850.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 8.52
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0xebb0,
|
||||
'pthread_join' : 0x29d60,
|
||||
'pthread_barrier_init' : 0x283d0,
|
||||
'pthread_barrier_wait' : 0xb8c0,
|
||||
'pthread_barrier_destroy' : 0x9c10,
|
||||
'pthread_exit' : 0x25320,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0xebb0,
|
||||
pthread_join: 0x29d60,
|
||||
pthread_barrier_init: 0x283d0,
|
||||
pthread_barrier_wait: 0xb8c0,
|
||||
pthread_barrier_destroy: 0x9c10,
|
||||
pthread_exit: 0x25320,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x7da91c;
|
||||
export const off_cpuid_to_pcpu = 0x1cfc240;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x1cfc240;
|
||||
export const off_sysent_661 = 0x11041b0;
|
||||
export const jmp_rsi = 0xc810d;
|
||||
|
||||
export const patch_elf_loc = './kpatch/850.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/850.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 9.00
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0x25510,
|
||||
'pthread_join' : 0xafa0,
|
||||
'pthread_barrier_init' : 0x273d0,
|
||||
'pthread_barrier_wait' : 0xa320,
|
||||
'pthread_barrier_destroy' : 0xfea0,
|
||||
'pthread_exit' : 0x77a0,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0x25510,
|
||||
pthread_join: 0xafa0,
|
||||
pthread_barrier_init: 0x273d0,
|
||||
pthread_barrier_wait: 0xa320,
|
||||
pthread_barrier_destroy: 0xfea0,
|
||||
pthread_exit: 0x77a0,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x7f6f27;
|
||||
export const off_cpuid_to_pcpu = 0x21ef2a0;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21ef2a0;
|
||||
export const off_sysent_661 = 0x1107f00;
|
||||
export const jmp_rsi = 0x4c7ad;
|
||||
|
||||
export const patch_elf_loc = './kpatch/900.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/900.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 9.03, 9.04
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0x25510,
|
||||
'pthread_join' : 0xafa0,
|
||||
'pthread_barrier_init' : 0x273d0,
|
||||
'pthread_barrier_wait' : 0xa320,
|
||||
'pthread_barrier_destroy' : 0xfea0,
|
||||
'pthread_exit' : 0x77a0,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0x25510,
|
||||
pthread_join: 0xafa0,
|
||||
pthread_barrier_init: 0x273d0,
|
||||
pthread_barrier_wait: 0xa320,
|
||||
pthread_barrier_destroy: 0xfea0,
|
||||
pthread_exit: 0x77a0,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x7f4ce7;
|
||||
export const off_cpuid_to_pcpu = 0x21eb2a0;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21eb2a0;
|
||||
export const off_sysent_661 = 0x1103f00;
|
||||
export const jmp_rsi = 0x5325b;
|
||||
|
||||
export const patch_elf_loc = './kpatch/903.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/903.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
@@ -17,14 +17,16 @@ along with this program. If not, see <https://www.gnu.org/licenses/>. */
|
||||
|
||||
// 9.50, 9.51, 9.60
|
||||
|
||||
export const pthread_offsets = new Map(Object.entries({
|
||||
'pthread_create' : 0x1c540,
|
||||
'pthread_join' : 0x9560,
|
||||
'pthread_barrier_init' : 0x24200,
|
||||
'pthread_barrier_wait' : 0x1efb0,
|
||||
'pthread_barrier_destroy' : 0x19450,
|
||||
'pthread_exit' : 0x28ca0,
|
||||
}));
|
||||
export const pthread_offsets = new Map(
|
||||
Object.entries({
|
||||
pthread_create: 0x1c540,
|
||||
pthread_join: 0x9560,
|
||||
pthread_barrier_init: 0x24200,
|
||||
pthread_barrier_wait: 0x1efb0,
|
||||
pthread_barrier_destroy: 0x19450,
|
||||
pthread_exit: 0x28ca0,
|
||||
}),
|
||||
);
|
||||
|
||||
export const off_kstr = 0x769a88;
|
||||
export const off_cpuid_to_pcpu = 0x21a66c0;
|
||||
@@ -32,4 +34,4 @@ export const off_cpuid_to_pcpu = 0x21a66c0;
|
||||
export const off_sysent_661 = 0x1100ee0;
|
||||
export const jmp_rsi = 0x15a6d;
|
||||
|
||||
export const patch_elf_loc = './kpatch/950.bin'; // Relative to `../../lapse.mjs`
|
||||
export const patch_elf_loc = "./kpatch/950.bin"; // Relative to `../../lapse.mjs`
|
||||
|
||||
Reference in New Issue
Block a user