Skip to content
This repository was archived by the owner on Sep 21, 2021. It is now read-only.

Commit 7ccbb7a

Browse files
committed
Change how arguments are sent to the start method
1 parent 8d36825 commit 7ccbb7a

File tree

2 files changed

+18
-1
lines changed

2 files changed

+18
-1
lines changed

exploit/runNro.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ module.exports = (res, args) => {
106106
utils.log("closing sm and jumping...");
107107
sc.svcCloseHandle(sc.smHandle).assertOk();
108108
sc.smHandle = undefined;
109-
utils.log("returned " + utils.paddr(sc.call(utils.add2(sc.svcNroBase, 0x80), [libtransistorContext])));
109+
utils.log("returned " + utils.paddr(sc.call(utils.add2(sc.svcNroBase, 0x80), [0, 0, libtransistorContext])));
110110

111111
var logBufferAddr = [libtransistorContext[6], libtransistorContext[7]];
112112
var logLengthAddr = [libtransistorContext[8], libtransistorContext[9]];

exploit/svc.js

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,23 @@ svcMixin.svcCreateSharedMemory = function (size, permission1, permission2) {
103103
return this.svcWithResult(0x50, [handleBuffer, size, permission1, permission2]).replaceValue(handleBuffer[0]);
104104
};
105105

106+
/*
107+
Usages:
108+
svcGetThreadId()
109+
svcGetThreadId(tid)
110+
*/
111+
svcMixin.svcGetThreadId = function (tid) {
112+
if (tid === undefined) {
113+
tid = 0xffff8000;
114+
}
115+
116+
if (typeof (tid) === 'number') { tid = [tid, 0]; }
117+
if (!Array.isArray(tid)) { throw new Error('invalid tid type'); }
118+
119+
var handleBuffer = new Uint32Array(2);
120+
return this.svcWithResult(0x25, [handleBuffer, tid]).replaceValue([handleBuffer[0], handleBuffer[1]]);
121+
};
122+
106123
/*
107124
Usages:
108125
svcMapSharedMemory(handle, size)

0 commit comments

Comments
 (0)