hexkyz

/*
    nvhax exploit
*/
// Global nvservices exploit context
sploitcore.prototype.nvdrv_exp_ctx = {};

sploitcore.prototype.spawn_nvdrv_srv = function(sm_handle, transf_mem_addr, transf_mem_size) {
    // Forge a new service handle for NVDRV
    var srv_handle = this.forge_handle(sm_handle, "nvdrv:t");
    

hexkyz

sploitcore.prototype.break_nvdrv = function(sm_handle) {
    var meminfo = this.malloc(0x20);
    var pageinfo = this.malloc(0x8);
    
    // Leak nvservices base address
    var nvdrv_base = this.get_nvdrv_base(sm_handle);
    
    // Forge a new service handle for NVDRV
    var srv_handle = this.forge_handle(sm_handle, "nvdrv:t");
    

hexkyz

sploitcore.prototype.nvdrv_sharedmem_leak = function(nvdrv_buf, dev_handle) {
    var temp_buf = this.malloc(0x1000);
    var nvdrv_ioctl = this.bridge(0x1A247C, types.int, types.void_p, types.int, types.int, types.void_p, types.void_p, types.void_p);
    
    // Setup buffers
    var in_buf_ioctl = utils.add2(temp_buf, 0x000);
    var out_buf_ioctl = utils.add2(temp_buf, 0x100);
    var out_buf_status = utils.add2(temp_buf, 0x200);
    var in_buf = utils.add2(temp_buf, 0x800);
    var out_buf = utils.add2(temp_buf, 0x900);

hexkyz

sploitcore.prototype.send_request = function(srv_handle, type, domain_id, cmd_id, params, dump_reply, show_log) {
    var req_buf = this.malloc(0x1000);
    
    if (show_log)
        utils.log('Request buf: ' + utils.paddr(req_buf));
    
    var request_reply = [0, 0];
    var err_code = [0, 0];

    // One handle and 2 words input type

hexkyz

# The following is adapted from https://github.com/reswitched/loaders/blob/master/nxo64.py
#
# ===========================================================================================
#
# Copyright 2017 Reswitched Team
#
# Permission to use, copy, modify, and/or distribute this software for any purpose with or
# without fee is hereby granted, provided that the above copyright notice and this permission
# notice appear in all copies.
#

hexkyz

###############################################
# TX SX OS unpacker - by hexkyz and naehrwert #
###############################################

from Crypto.Cipher import AES
from Crypto.Util import Counter
import os
import struct

"""

hexkyz

0D40AC6C  20 00 BC 0E 46 93 46 9D 47 08 00 00

hexkyz

0D40AC6C                 MOVS            R0, #0
0D40AC6E                 POP             {R1-R3}
0D40AC70                 MOV             R11, R2
0D40AC72                 MOV             SP, R3
0D40AC74                 BX              R1

hexkyz

// Do some boring stuff
...

// Decrypt PRSH/PRST with Starbuck ancast key
sub_D400320(0x10000400, 0x7C00, iv);
	
// Parse PRSH/PRST
sub_D40B030(0x10000400, 0x7C00);
	
// Locate or create new "boot_info"

hexkyz

0x00000000: 0x00000001	// Always 1 (set by boot1 on coldboot)
0x00000004: 0xA6000000	// Boot flags (0x80 means data is set)
0x00000008: 0x00000000	// Boot state
0x0000000C: 0x00000001	// Boot count (increased by boot1 on reset)
0x00000010: 0x00100000	// Set to 0 by boot1 on coldboot
0x00000014: 0x00000000	// Set to 0 by boot1 on coldboot
0x00000018: 0xFFFFFFFF	// Set to -1 by boot1 on coldboot
0x0000001C: 0xFFFFFFFF	// Set to -1 by boot1 on coldboot
0x00000020: 0xFFFFFFFF	// Set to -1 by boot1 on coldboot
0x00000024: 0xFFFFFFFF	// Set to -1 by boot1 on coldboot