[PS3] Zecoxao met à jour un exploit RSX sur firmware 4.21 à 4.45

 

/*

* lv2 SysCall 670 (0x29E): sys_rsx_context_allocate

* @param context_id (OUT): RSX context, E.g. 0x55555555 (in vsh.self)

* @param lpar_dma_control (OUT): Control register area. E.g. 0x60100000 (in vsh.self)

* @param lpar_driver_info (OUT): RSX data like frequencies, sizes, version... E.g. 0x60200000 (in vsh.self)

* @param lpar_reports (OUT): Report data area. E.g. 0x60300000 (in vsh.self)

* @param mem_ctx (IN): mem_ctx given by sys_rsx_memory_allocate

* @param system_mode (IN):

*/

 

/*

After some verification it turns out that 4 pointers aren't checked

They are:

context_id

lpar_dma_control

lpar_driver_info

lpar_reports

 

we can write values at:

rsx_context + 0x04 (4Bytes) - context_id

rsx_context + 0x20 (8Bytes) - lpar_dma_control

rsx_context + 0x30 (8Bytes) - lpar_driver_info

rsx_context + 0x40 (8Bytes) - lpar_reports

 

to properly specify a kernel address use ULL for big numbers

*/