Page 1 of 5
PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 7:49 pm
by nas
hi,
i finally got around to do some cleanup and...
here you are:
https://www.sendspace.com/file/mdunzp
this package contains:
- ROP POC
- Module Dumpers
- helper script for creating rop chains
- other stuff
thanks a lot to Proxima for helping me!
Re: PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 8:31 pm
by Belmondo
thanks nas! nice work mate!
Re: PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 9:38 pm
by josh_axey
nas wrote:...
Always interested to see how other people are doing theirs.
Thanks for sharing nas and Proxima.
Re: PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 10:01 pm
by yifanlu
That one WebKit bug is the gift that keeps on giving.
Re: PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 10:59 pm
by anhell28
so i take it that this is a port of the vita webkit but for PS4.
is it safe to say i should NOT update my PS4's fw to 2.00 when it is released?
just looking forward to some cool homebrew and hacks for my psvita and PS4.
Re: PS4 1.76 Webkit ROP POC
Posted: Thu Oct 23, 2014 11:41 pm
by josh_axey
anhell28 wrote:so i take it that this is a port of the vita webkit but for PS4.
I don't believe so, no. This was done in tandem, separately.
We're referring to the same bug in WebKit itself that is being used by different people in different ways.
Re: PS4 1.76 Webkit ROP POC
Posted: Fri Oct 24, 2014 12:11 am
by Proxima
The 64bit version is a bit different. It is the same heap corruption via the sort() bug, but from there its different. On 32bit you can set the Uint32Array to 0x40000000 size and access any memory. On 64bit, you have to carefully change the base address since the 0x40000000 trick doesn't work for a 64bit address space.
Re: PS4 1.76 Webkit ROP POC
Posted: Fri Oct 24, 2014 12:29 am
by ninjadudexp
How does a average joe like me, test this POC with the download files given
Re: PS4 1.76 Webkit ROP POC
Posted: Fri Oct 24, 2014 1:26 am
by josh_axey
Proxima wrote:The 64bit version is a bit different. It is the same heap corruption via the sort() bug, but from there its different. On 32bit you can set the Uint32Array to 0x40000000 size and access any memory. On 64bit, you have to carefully change the base address since the 0x40000000 trick doesn't work for a 64bit address space.
Yeah, I noticed that when having a look through. Nice, by the way.
Re: PS4 1.76 Webkit ROP POC
Posted: Fri Oct 24, 2014 2:14 am
by anhell28
thank you guy's for all your work so far...keep it up.