Closed CrazyVoidProgrammer closed 4 years ago
// patch mprotect to allow RWX mapping 4.55
kmem = (uint8_t *)&gKernelBase[0x00396A58];
kmem[0] = 0x90;
kmem[1] = 0x90;
kmem[2] = 0x90;
kmem[3] = 0x90;
kmem[4] = 0x90;
kmem[5] = 0x90;
// patch mprotect to allow RWX mapping 4.74
kmem = (uint8_t *)&gKernelBase[0x00397878];
kmem[0] = 0x90;
kmem[1] = 0x90;
kmem[2] = 0x90;
kmem[3] = 0x90;
kmem[4] = 0x90;
kmem[5] = 0x90;
// patch mprotect to allow RWX mapping 5.01
kmem = (uint8_t *)&gKernelBase[0x001A3AF8];
kmem[0] = 0x90;
kmem[1] = 0x90;
kmem[2] = 0x90;
kmem[3] = 0x90;
kmem[4] = 0x90;
kmem[5] = 0x90;
// patch mprotect to allow RWX mapping 5.05
kmem = (uint8_t *)&gKernelBase[0x001A3C08];
kmem[0] = 0x90;
kmem[1] = 0x90;
kmem[2] = 0x90;
kmem[3] = 0x90;
kmem[4] = 0x90;
kmem[5] = 0x90;
Sorry, no 4.05 kern here.
// patch mprotect to allow RWX mapping 4.05 kmem = (uint8_t *)&gKernelBase[0x004423E9]; kmem[0] = 0x90; kmem[1] = 0x90; kmem[2] = 0x90; kmem[3] = 0x90; kmem[4] = 0x90; kmem[5] = 0x90;
Took some time, but here it is. Also here is 1.76 if ever needed.
// patch mprotect to allow RWX mapping 1.76 kmem = (uint8_t *)&gKernelBase[0x003AFB9D]; kmem[0] = 0x90; kmem[1] = 0x90; kmem[2] = 0x90; kmem[3] = 0x90; kmem[4] = 0x90; kmem[5] = 0x90;
isn't this patch applied in kexploit kROP ?
unsure, it wont hurt applying it twice just in case though.
Thank you @kozarovv
At request of kiwi, we need to add mprotect patches to all firmwares in oni boot/patches