From 8619b2c680aa115ce86a6266d2e1a147460449d8 Mon Sep 17 00:00:00 2001 From: orboditilt <45944072+orboditilt@users.noreply.github.com> Date: Sun, 6 Jan 2019 18:10:45 +0100 Subject: [PATCH] The makefile now grabs the coreinit.rpl and converts it to an elf. --- .gitignore | 7 +++++ Makefile | 56 ++++++++++++++++++++++++++++++++---- README.md | 21 ++++++++++++++ wiiuhaxx_buildropversions.sh | 3 -- wiiuhaxx_locaterop.sh | 14 +++++---- wiiuhaxx_rop_sysver_532.php | 29 ------------------- wiiuhaxx_rop_sysver_550.php | 29 ------------------- 7 files changed, 87 insertions(+), 72 deletions(-) create mode 100644 .gitignore delete mode 100755 wiiuhaxx_buildropversions.sh delete mode 100644 wiiuhaxx_rop_sysver_532.php delete mode 100644 wiiuhaxx_rop_sysver_550.php diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3fb494e --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +common.key +bin/ +*.zip +wiiuhaxx_loader.elf +wiiuhaxx_loader.bin +tmp/ +wiiuhaxx_rop_sysver_* diff --git a/Makefile b/Makefile index 5f32cdd..381c658 100644 --- a/Makefile +++ b/Makefile @@ -1,10 +1,56 @@ +#--------------------------------------------------------------------------------- +# Clear the implicit built in rules +#--------------------------------------------------------------------------------- +.SUFFIXES: +#--------------------------------------------------------------------------------- +ifeq ($(strip $(DEVKITPPC)),) +$(error "Please set DEVKITPPC in your environment. export DEVKITPPC=devkitPPC") +endif +ifeq ($(strip $(DEVKITPRO)),) +$(error "Please set DEVKITPRO in your environment. export DEVKITPRO=devkitPRO") +endif + +export PATH := $(DEVKITPPC)/bin:$(PORTLIBS)/bin:$(PATH) + +PREFIX := powerpc-eabi- + +export AS := $(PREFIX)as +export CC := $(PREFIX)gcc +export CXX := $(PREFIX)g++ +export AR := $(PREFIX)ar +export READELF := $(PREFIX)readelf +export OBJCOPY := $(PREFIX)objcopy DEFINES := -all: - powerpc-eabi-gcc -x assembler-with-cpp -nostartfiles -nostdlib $(DEFINES) -o wiiuhaxx_loader.elf wiiuhaxx_loader.s - powerpc-eabi-objcopy -O binary wiiuhaxx_loader.elf wiiuhaxx_loader.bin - cp wiiuhaxx_loader.bin $(OUTPATH) +COREINIT_PATH := tmp/$(FIRMWARE)/000500101000400A/code/coreinit.rpl +COREINIT_PATH_ELF := $(COREINIT_PATH).elf + +ifeq ($(OS),Windows_NT) + exe_ext := .exe +else + exe_ext := +endif + +all: loader locateall + +loader: + $(CC) -x assembler-with-cpp -nostartfiles -nostdlib $(DEFINES) -o wiiuhaxx_loader.elf wiiuhaxx_loader.s + $(OBJCOPY) -O binary wiiuhaxx_loader.elf wiiuhaxx_loader.bin + +locateall: locate532 locate550 + +locate532: + java -jar bin/FileDownloader.jar -titleID 000500101000400A -file '.*coreinit.rpl' -version 11464 -out tmp/532 + make locatespecific FIRMWARE=532 TEXTADDRESS=0x0101c400 + +locate550: + java -jar bin/FileDownloader.jar -titleID 000500101000400A -file '.*coreinit.rpl' -version 15702 -out tmp/550 + make locatespecific FIRMWARE=550 TEXTADDRESS=0x0101c400 + +locatespecific: + ./bin/rpl2elf$(exe_ext) $(COREINIT_PATH) $(COREINIT_PATH_ELF) > /dev/null + sh ./wiiuhaxx_locaterop.sh $(COREINIT_PATH) $(TEXTADDRESS) $(exe_ext) > wiiuhaxx_rop_sysver_$(FIRMWARE).php clean: - rm -f wiiuhaxx_loader.elf wiiuhaxx_loader.bin + rm -rf wiiuhaxx_loader.elf wiiuhaxx_loader.bin wiiuhaxx_rop_sysver_* tmp diff --git a/README.md b/README.md index 7b56e9a..86ccfb9 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,24 @@ +# README + +This fork is supposed a common base for Wii U ROP-chains. + +# Building +Before using the ROP-chain, some files need to be compiled/generated, you can do it with `make`. + +The makefile expects some binaries/files. +- `bin/ropgadget_patternfinder(.exe)` [Download](https://github.com/wiiu-env/ropgadget_patternfinder/releases) +- `bin/rpl2elf(.exe)` [Download](https://github.com/wiiu-env/rpl2elf/releases) +- `bin/FileDownloader.jar` [Download] (https://github.com/wiiu-env/NUSFileDownloader/releases). +- `common.key` containing the reatil wii u common key (in binary form, 16 bytes). + +When you have all needed files, you can use `make`. + +On success, you can now find the following files: + - `wiiuhaxx_rop_sysver_*.php` one for each supported firmware. + - `wiiuhaxx_loader.bin` + +# Original README + This is a common codebase for generating ROP-chains/etc for *seperate* Wii U PowerPC-userland exploits. This uses addresses auto-located from coreinit, with .php for each sysver that was pre-generated. This is basically a Wii U version of this: https://github.com/yellows8/3ds_browserhax_common Currently only binary ROP-chains are supported, hence no support for using this easily with WebKit exploits. The core1-switch ROP here doesn't work correctly currently, hence this codebase isn't usable as-is unless the current core is already core1(which isn't the case for WebKit exploits it seems). In other words, this codebase is currently only usable with non-WebKit exploits. Hence the use of php, this is intended for running under browser-based titles, but could be used with others as well if the ROP-chain(s) are usable with them. diff --git a/wiiuhaxx_buildropversions.sh b/wiiuhaxx_buildropversions.sh deleted file mode 100755 index 7c6a913..0000000 --- a/wiiuhaxx_buildropversions.sh +++ /dev/null @@ -1,3 +0,0 @@ -./wiiuhaxx_locaterop.sh $1/v11464 0x0101c400 > wiiuhaxx_rop_sysver_532.php -./wiiuhaxx_locaterop.sh $1/v15702 0x0101c400 > wiiuhaxx_rop_sysver_550.php - diff --git a/wiiuhaxx_locaterop.sh b/wiiuhaxx_locaterop.sh index 20ce25d..a9e52e8 100755 --- a/wiiuhaxx_locaterop.sh +++ b/wiiuhaxx_locaterop.sh @@ -1,16 +1,18 @@ ospath=$1 coreinit_textaddr=$2 +extension=$3 -powerpc-eabi-objcopy --change-section-address .text=$coreinit_textaddr $ospath/coreinit.elf $ospath/coreinit_reloc.elf +reloc=$((0x02000000-$coreinit_textaddr)) -function getcoreinit_symboladdr + +getcoreinit_symboladdr() { - val=`powerpc-eabi-readelf -a $ospath/coreinit_reloc.elf | grep "$1" | head -n 1 | cut -d: -f2 | cut "-d " -f2` - echo "$2 = 0x$val;" + val=`powerpc-eabi-readelf -a "$PWD/$ospath.elf" | grep "$1" | head -n 1 | cut -d: -f2 | cut "-d " -f2` + printf "$2 = 0x%X;\n" $((0x$val-$reloc)) } -echo " diff --git a/wiiuhaxx_rop_sysver_550.php b/wiiuhaxx_rop_sysver_550.php deleted file mode 100644 index 30ca5c7..0000000 --- a/wiiuhaxx_rop_sysver_550.php +++ /dev/null @@ -1,29 +0,0 @@ -