PS4-3.55-Code-Execution-PoC
PS4-3.55-Code-Execution-PoC copied to clipboard
Module Information is wrong
Edit: I forgot this issue was discussed in a previously opened issue :p point still stands that it should be reverted as it isn't functional anyway
After going back to some PS4 work, I noticed the newer changes to the PoC, particularly the module information printing. The merge from @Thunder07's branch broke module information printing completely as sys_dynlib_get_info only gives null bytes for every module at the offsets he's provided. The only way to get the base address is from sys_dynlib_get_info_ex, which was the system call used in the official PoC.
Because Sony stripped the system call, every piece of information returned by the PoC about a given module is wrong, as it just returns null.
$ python server.py
Modified arr length = 0x80000000
Modified arr length = 0x80000000
Found ArrayBufferView in memory!
Modified index is 51
Found modified ArrayBufferView!
Found modified ArrayBuffer!
vtable = 0x81ebf0d80
webkit_base_addr = 0x81c5f0000
buffer addr = 0x201fa1000
Starting ROP...
Printing module information...
Module name: libkernel.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceLibcInternal.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceSysmodule.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceNet.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceNetCtl.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceIpmi.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceMbus.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceRegMgr.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceRtc.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libScePad.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceVideoOut.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceOrbisCompat.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceWebKit2.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceSysCore.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceSystemService.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceSsl.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceVideoCoreServerInterface.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Module name: libSceWebBrowserInjectedBundle.sprx
Module Base: 0x0
Module size: 0x0
Module Unknown Data Base: 0x0
Module Unknown Data size: 0x0
Module Data Base: 0x0
Module Data size: 0x0
===============
Latest commit d79db657b5e54d25f1d7217133a259fe96d8a55a should be reverted.