MochaPayload/source/main.cpp

39 lines
1019 B
C++
Raw Normal View History

2021-09-23 18:52:20 +02:00
#include <cstring>
2020-04-28 15:07:52 +02:00
#include <coreinit/cache.h>
#include <coreinit/ios.h>
2021-04-04 23:51:23 +02:00
#include <sysapp/title.h>
2021-04-04 23:51:23 +02:00
#include <whb/log.h>
#include <whb/log_udp.h>
2020-04-28 15:07:52 +02:00
2021-04-04 23:51:23 +02:00
#include "common/ipc_defs.h"
2020-04-28 15:07:52 +02:00
#include "ios_exploit.h"
int main(int argc, char **argv) {
WHBLogUdpInit();
WHBLogPrintf("Hello from mocha");
2021-09-23 18:52:20 +02:00
2021-04-04 23:51:23 +02:00
uint64_t sysmenuIdUll = _SYSGetSystemApplicationTitleId(SYSTEM_APP_ID_HOME_MENU);
2020-06-20 23:43:44 +02:00
memcpy((void *) 0xF417FFF0, &sysmenuIdUll, 8);
DCStoreRange((void *) 0xF417FFF0, 0x8);
2020-04-28 15:07:52 +02:00
ExecuteIOSExploit();
// When the kernel exploit is set up successfully, we signal the ios to move on.
int mcpFd = IOS_Open("/dev/mcp", (IOSOpenMode) 0);
if (mcpFd >= 0) {
2021-04-04 23:51:23 +02:00
int in = IPC_CUSTOM_MEN_RPX_HOOK_COMPLETED;
int out = 0;
IOS_Ioctl(mcpFd, 100, &in, sizeof(in), &out, sizeof(out));
2021-04-04 23:51:23 +02:00
in = IPC_CUSTOM_START_MCP_THREAD;
out = 0;
IOS_Ioctl(mcpFd, 100, &in, sizeof(in), &out, sizeof(out));
IOS_Close(mcpFd);
}
2020-04-28 15:07:52 +02:00
WHBLogPrintf("Bye from mocha");
return 0;
}