basically, ye, need to find a function where the binary loads itself in which is normally done by boot1 but you have to mount an external media device, load in modded code, and clean up, smea suggested loading up system settings after pwning cause it does a full os reset, all done in 0x5D0 bytes according to Hillary, have to basically make IOSU work for you
; nop out memcmp hash checks
.org 0x040017E0
mov r0, #0
.org 0x040019C4
mov r0, #0
.org 0x04001BB0
mov r0, #0
.org 0x04001D40
mov r0, #0int second_chain[] = {
0x10123a9f, // 0x00 POP {R0,R1,R4,PC}
CHAIN_START + 0x14 + 0x4 + 0x20 - 0xF000, // 0x04 destination
0x0, // 0x08
0x0, // 0x0C
0x101063db, // 0x10 POP {R1,R2,R5,PC}
0x00130000, // 0x14 source
sizeof(final_chain), // 0x18 length
0x0, // 0x1C
0x10106D4C, // 0x20 BL MEMCPY; MOV R0, #0; LDMFD SP!, {R4,R5,PC}
0x0, // 0x24
0x0, // 0x28
0x101236f3, // 0x2C POP {R1-R7,PC}
0x0, // 0x30 arg
0x101001DC, // 0x34 stackptr
0x68, // 0x38 stacksize
0x10101634, // 0x3C proc: ADD SP, SP, #8; LDMFD SP!, {R4,R5,PC}
0x0, // 0x40
0x0, // 0x44
0x0, // 0x48
0x1010388C, // 0x4C CMP R3, #0; MOV R0, R4; LDMNEFD SP!, {R4,R5,PC}
0x0, // 0x50
0x0, // 0x54
0x1012CFEC, // 0x58 MOV LR, R0; MOV R0, LR; ADD SP, SP, #8; LDMFD SP!, {PC}
0x0, // 0x5C
0x0, // 0x60
IOS_CREATETHREAD, // 0x64
0x1, // 0x68 priority
0x2, // 0x6C flags
0x0, // 0x70
0x0, // 0x74
0x101063db, // 0x78 POP {R1,R2,R5,PC}
0x0, // 0x7C
-(0x240 + 0xF000), // 0x80 stack offset
0x0, // 0x84
0x1011D424, // 0x88 LDMFD SP!, {R4-R11,PC}
0x0, // 0x8C
0x0, // 0x90
0x0, // 0x94
0x0, // 0x98
0x0, // 0x9C
0x0, // 0xA0
0x0, // 0xA4
0x4, // 0xA8 R11 must equal 4 in order to pivot the stack
0x1012EA68, // 0xAC stack pivot
};int second_chain[] = {
.org 0x040017E0
mov r0, #0
.org 0x040019C4
mov r0, #0
.org 0x04001BB0
mov r0, #0
.org 0x04001D40
mov r0, #0
};
If a IOSU exploit comes to browserhax you would just run the .elf and it will gain the permissions by itself. In order to use the fw.img you need to already have an IOSU exploit or some other wizardry.
what about taking that Hillary thing where it says 'insert rop chain here' in the main.c and take the main.c from compiled wupserver and pasting that in there? would that do something?
ROP!=Compiled code
The thing trump made, in the source I think used hillarys main.c so he put his 'rop chain' stuff where it said to.ROP!=Compiled code
Also, I guess you can't just paste any code and hope it runs
sadly
He presumibly have a boot1 vulnerability that let him get full control early on boot; then he make boot1 skip signature checks (or patch mcp and reload it from there?) and he has rednand. BTW, he didn't install channels to sysnand
in the video didn't he first boot into sysNAND and there was a red channel that said redNAND? or did he boot straight into redNAND in the beginning of the video?
No. He booted straight into redNAND.
in the video didn't he first boot into sysNAND and there was a red channel that said redNAND? or did he boot straight into redNAND in the beginning of the video?
No. He booted straight into redNAND.
So the iosuhax generated fw.img is intended to be written to the SD card and loaded from right? It also has the patch to redirect anything from sysNAND's fw to itself. Now before that's booted from automatically on boot he had a boot1 command to boot from SD? and that part he didn't make public? With the iosu kernel exploit that is public now, does it have the ability to access that early in the boot chain?
There still aren't any public boot exploit.
)
to boot the dumper? was it in the GitHub?There still aren't any public boot exploit.
To boot that thing you'll need to manuay trigger the exploit I guess (browserhax again
Here:
def encrypt(self, file, offset):
file.seek(0x497DC3)
file.write('02'.decode('hex')) def encrypt(self, file, offset):
file.seek(0x497DC3)
file.write('\x02') def encrypt(self, file, offset):
value = '02' # So it would be changeable in an easy way
file.seek(0x497DC3)
file.write(value.decode('hex'))
