isfshax

=======
isfshax
=======

Boot1 stack:
0x0D40EDB0 <-- stack base
0x0D40FADC <-- stack ptr on the second ISFS_ProcessSuperblock call
0x0D40FB18 <-- stack ptr on the first ISFS_ProcessSuperblock call
0x0D40FDB0 <-- stack top

ISFS_ProcessSuperblock is at 0x0d402e70. The recursive call happens at 0x0d402ff6 for FST directory entries.
Each recursive call decrements sp by 0x3C

0x6A directory entries (FST root entry included) will overflow the stack up to 0x0d40e240

Original data                       Overwritten by
--------------------------------------------------
0d40e240 gAncastKey            <<   000000000000000301f8000000000000
0d40e250 gAncastKeyAddr        <<   00000000
0d40e254 gAncastModuloAddr     <<   00000001
0d40e258 ndevStatus            <<   0000XXXX
0d40e25c pFsDeviceFLA          <<   01f80000
0d40e260 flaDevice.field_0x0   <<   01f8000c
0d40e264 flaDevice.instance    <<   000XXXX0
0d40e268 flaDevice.init        <<   YYYYYYYY
0d40e26c flaDevice.read        <<   WWWWWWWW
0d40e270 flaDevice.field_0x10  <<   ZZZZZZZZ
0d40e274 flaDevice.shutdown    <<   YYYYYYYY
0d40e278 flaDevice.field_0x18  <<   0d402e7c

pFsDeviceFLA will points to the superblock load address (0x01f80000).

An FS device has the following structure:
struct FS_Device {
/* 0x00 */ int field_0x0;
/* 0x04 */ u32 instance;
/* 0x08 */ int (* init)(struct FS_Device *);
/* 0x0C */ int (* read)(struct FS_Device *, u64, uint, void *, u8 *);
/* 0x10 */ int (* write)(struct FS_Device *, u64, uint, void *, u8 *);
/* 0x14 */ int (* shutdown)(struct FS_Device *);
    ...
}

The read field will correspond to the first two cluster entries in the FAT of the superblock.
Since AHMN is not yet enabled, it's possible to redirect execution to the superblock data.

The read() field will be called (at 0x0d40135a) when boot1 attempts to read
/sys/config/system.xml. As such said entries must be present in the superblock.
The system.xml FST entry should point to a valid and terminated cluster in the FAT
to prevent a crash when boot1 gets file's stats.

A payload can be saved in the FAT or FST area. FAT entries of value 0xffff will
be corrected to 0xfffe, while the first bit of the size field in FST entries with
(fst->mode & 3) != 0 will be cleared, so payloads should be written with precautions
in place to avoid being corrupted by those operations.

- rw-r-r-0644