#vitadev

[19:42] <yifanlu> good news: you can do ROP. bad news: I suck at ROP and keep crashing the vita
[19:43] <freddy156> yifanlu what are you trying to do?
[19:43] <yifanlu> right now, just a test to see if my modifications work right
[19:43] <yifanlu> so there's a function that checks if C# assemblies have full permissions
[19:43] <yifanlu> and I'm trying to patch it to always say yes
[19:43] <yifanlu> in theory, it should be as simple as finding a single BX LR
[19:44] <yifanlu> because R0 contains the pointer of the name to check
[19:44] <yifanlu> but R0 is also the return value where > 0 is full permissions
[19:44] == Demon|K [~Demon@pool-173-79-253-36.washdc.fios.verizon.net] has joined #vitadev
[19:44] == Proxima [droopy@stoneage.back-in.biz] has joined #vitadev
[19:47] <freddy156> yifanlu but can you overwrite code?
[19:47] <some1> no
[19:47] <freddy156> some1 that's why i'm asking, i thought he already tried and couldn't
[19:47] <some1> sony isn't dumb lol
[19:48] == ManOfIce [mirc@d150-220-8.cust.tele12.it] has joined #vitadev
[19:48] <some1> *that dumb
[19:49] <Proxima> W^X
[19:50] <some1> mhmm
[19:53] <Proxima> hmm? :)
[20:03] == ManOfIce [mirc@d150-220-8.cust.tele12.it] has left #vitadev []
[20:05] == n00b210 [webchat@del63-1-82-243-92-30.fbx.proxad.net] has joined #vitadev
[20:27] <yifanlu> ugh, arm asm
[20:27] <yifanlu> http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.dui0068b/CIHFJFDG.html
[20:27] <yifanlu> so if I get this right
[20:27] <yifanlu> BLX R1
[20:27] <yifanlu> will first look at the value of R1 and if bit 0 is set
[20:27] <yifanlu> thumb mode
[20:28] <Proxima> yep, a ton of the vita code is in thumb mode
[20:28] <yifanlu> doesn't that mean we only have 31 bits for the address
[20:28] <Proxima> yes, the lsb is used to flag the mode
[20:29] <yifanlu> ugh, this always confuses me. in arm, is the lsb on the left or right?
[20:30] <yifanlu> nvm
[20:30] <yifanlu> I get it
[20:30] <yifanlu> because an address + 1 means thumb mode
[20:30] <Proxima> yes
[20:30] <yifanlu> and this works because
[20:31] == Davee [~Davee@02ddc1d7.bb.sky.com] has joined #vitadev
[20:31] <yifanlu> instructions are aligned
[20:31] <Proxima> yep
[20:31] <Proxima> 2 bytes
[20:32] <yifanlu> ok, so note to self, always add a one when ROPing
[20:32] <Proxima> or 4 bytes, so +1 is never a valid location
[20:32] <yifanlu> wait. unless the code isn't BLX
[20:32] <yifanlu> ugh.
[20:32] <Proxima> :)
[20:32] <yifanlu> BL, no +1, BLX +1. thanks sony
[20:32] <Felix91> Shouldn't the LSB always be on the right site?
[20:33] <Proxima> little endian
[20:33] <yifanlu> well doesn't it depend on the endianess?
[20:33] <Proxima> 01000081 would be 81000000 in thumb mode
[20:33] <yifanlu> yea storage of bits is confusing
[20:35] <yifanlu> so the code I'm using to inject stuff takes signed 64 bit integers. which is then converted to 32 bit unsigned integers on the vita. which is in little endian (while I'm sending in big endian). now I have to worry about LSB.
[20:35] <Felix91> Why should it depend on the endian? If I have a word, then isn't the LSB always the rightmost bit?
[20:35] <Davee> yes, always
[20:35] <Felix91> The endian says what byte is stored at the lowest address.
[20:36] <Davee> yifanlu, you doing rop?
[20:36] <Proxima> depends on how are you manipulating the data
[20:37] <Proxima> if you are operating bytes or words
[20:37] <Davee> yes, exactly
[20:37] <yifanlu> about to
[20:37] <Felix91> big endian: The most significant byte is stored at the lowest address. Little Endian: The least significant byte is stored at the lowest address. In a 32-Bit word, bit 0 is the least significant bit.
[20:37] <Davee> mind if I pm?
[20:37] <yifanlu> me? sure
[20:45] == n00b210 [webchat@del63-1-82-243-92-30.fbx.proxad.net] has quit [Ping timeout: 260 seconds]
[21:18] == Demon|K [~Demon@pool-173-79-253-36.washdc.fios.verizon.net] has quit [Ping timeout: 492 seconds]
[21:34] == tidalwave [tidalwave@170-201.82-139.bia.tkbb.net.pl] has joined #vitadev
[21:48] == tidalwave [tidalwave@170-201.82-139.bia.tkbb.net.pl] has left #vitadev []
[21:50] == n00b210 [webchat@del63-1-82-243-92-30.fbx.proxad.net] has joined #vitadev
[21:51] == Felix91 [~Chatzilla@pdbn-4d089e8d.pool.mediaWays.net] has quit [Ping timeout: 258 seconds]
[21:51] == n00b210 [webchat@del63-1-82-243-92-30.fbx.proxad.net] has quit [Client Quit]
[21:54] == Felix91 [~Chatzilla@pdbn-4d089e8d.pool.mediaWays.net] has joined #vitadev
[22:25] == Proxima [droopy@stoneage.back-in.biz] has left #vitadev []
[22:38] <yifanlu> write to executable memory… done
[22:38] <yifanlu> execute memory… done
[22:38] <yifanlu> now for a payload that does something...
[22:38] <freddy156> yifanlu awesome!
[22:41] <yifanlu> well, good news is that we're out of the PSM sandbox. bad news is we are now in the Vita app sandbox. We can run native code, but still need to find a way to launch unsigned executables
[22:41] <freddy156> mind if i ask you how did you write to executable memory?
[22:41] <yifanlu> sony has, loaded in memory, two nice functions
[22:42] <yifanlu> pss_code_mem_alloc and pss_code_mem_unlock
[22:42] <yifanlu> which does exactly what they say
[22:42] <yifanlu> allocate some heap with execute permission
[22:42] <yifanlu> and then set it to be writable
[22:44] <yifanlu> so here's the situation now. I can run native code (no ROP, dodged a bullet there). However, right now I'm stuck to using whatever functions PSM has loaded
[22:44] <yifanlu> which mind you, isn't so bad
[22:44] <freddy156> well, it's still a good point
[22:45] <yifanlu> but I want more. like dumping the flash
[22:45] <yifanlu> getting keys
[22:45] <yifanlu> or writing cfw
[22:45] <freddy156> next step is breaking out of the psv sandbox? :p
[22:45] <yifanlu> yes
[22:46] <freddy156> that's good news
[22:50] <yifanlu> now if sony did things right, any sys call that launches processes should only load signed/encrypted binaries
[22:51] <yifanlu> but then again… code_mem_unlock
[22:51] <yifanlu> who knows what else sony left for us
[22:53] <freddy156> i don't think they're _that_ dumb
[22:54] <freddy156> i think they didn't expect you being able to call that function in the first place
[22:54] <Felix91> Still, who knows, Sony already proved in the past to make weird mistakes.
[22:55] <freddy156> Felix91 i hope they learned from the past
[22:55] <freddy156> for them, i mean
[22:55] <Felix91> Indeed.
[22:55] <some1> they just rendered NX pointless
[22:55] <freddy156> but well yifanlu what do you plan on doing now? dumping more memory to see if there's anything interesting?
[22:55] <some1> they are _that_ dumb
[22:55] <some1> before now I wouldn't have called them dumb
[22:55] <some1> now they are lol
[22:55] <freddy156> some1 well, NX still works, they made W^X pointless :p
[22:56] <some1> right
[22:56] <yifanlu> my immediate plan is to write an application that allows me and other developers to quickly inject code or dump the memory
[22:56] <yifanlu> then I want to find all the sys calls and see what they do
[22:56] <yifanlu> then move from there