reswitched / pegaswitch

PegaSwitch is an exploit toolkit for the Nintendo Switch
https://reswitched.team
ISC License
934 stars 107 forks source link

"evalfile usefulscripts/dumpModules.js" unsupported on 1.0.0 #96

Closed edgan closed 6 years ago

edgan commented 6 years ago
switch 'xxxxxxxxxxxx' (1.0.0)> evalfile usefulscripts/dumpModules.js

Switch 'xxxxxxxxxxxx' (1.0.0) disconnected.
switch>
edgan commented 6 years ago

Line 74 causes the disconnect. But I am guessing the memory address, 0x955558, is wrong for 1.0.0, and ultimately that is the problem.

usefulscripts/dumpModules.js:

68 utils.log("stage1, getting webkit ldr:ro handle");
69 //We are reusing WebKit's ldr:ro session
70 var ldrro_mng_ptr = utils.add2(sc.mainaddr, 0x955558);
71 //utils.log('ldr:ro management str base ptr is: ' + utils.paddr(ldrro_mng_ptr));
72 var ldrro_mng = sc.read8(ldrro_mng_ptr);
73 //utils.log('ldr:ro management str base is: ' + utils.paddr(ldrro_mng));
74 var ldrro = sc.read8(utils.add2(ldrro_mng, 0xc));
75 //utils.log('ldr:ro handle is: 0x' + ldrro[0].toString(16))
misson20000 commented 6 years ago

Yeah, that sounds about right.

edgan commented 6 years ago

If people are going to stay on 1.0.0 and not upgrade to 3.0.0, we need more things supported with 1.0.0.

misson20000 commented 6 years ago

Indeed. @GovanifY, how'd you track down that offset originally?

GovanifY commented 6 years ago

Reverse engineering of a webkit dump on 2.0

merryhime commented 6 years ago

Offset for 1.0.0 is 0x95D1E8; script doesn't work as-is.