HENkaku reverse engineering

[dimy93]

I was wondering if somebody could help me understand better the partially reversed HENkaku code shared here .
First, what command corresponds to 0x05 cmd code in the sceIoDevctl call and what does the argument supplied as input to the command mean? I tried searching for documentation of these without much success.
Second, how does the sceIoDevctl call leak kernel pointers and what do those pointers point to in the kernel? What bothers me most about the kernel pointer leak is that there doesn't seem to be anything wrong with the sceIoDevctl call - all parameters seem to be reasonable. Is it possible that the leak is connected to the unidentified sceLibKernel call just before that? According to this pastebin it might be unassign call ?

Code: Select all

        // Mount path?
        sceLibKernel_A4AD("molecule0:");
 
        // Send devctl 0x05
        sceIoDevctl_syscall("sdstor0:", 0x00000005, "xmc-lp-ign-userext", 0x00000014, x_stack + 0x00006F34, 0x000003FF);

Advertising

[St4rkDev]

sceLibKernel_A4AD is not unassign call, it's a sceIoOpen, about the *kernel ptr leak*, I written a homebrew and I tried the code, but the buffer keep without values after exec, now I'm reading again the rop and trying to find something, let's see heh :p

Advertising