FILE *payload = search_file("payload.bin");
FILE *patch = search_file("patch.txt");
if (payload)
do {
PRINTF("reading payload...\n");
if (fread
((void *)payload_bin, sizeof(payload_bin), 1,
payload) != 1) {
PRINTF("invalid payload.\n");
fclose(payload);
payload = NULL;
break;
}
fclose(payload);
PRINTF("installing memcpy...\n");
/* install memcpy */
lv2_poke(NEW_POKE_SYSCALL_ADDR, 0x4800000428250000ULL);
lv2_poke(NEW_POKE_SYSCALL_ADDR + 8,
0x4182001438a5ffffULL);
lv2_poke(NEW_POKE_SYSCALL_ADDR + 16,
0x7cc428ae7cc329aeULL);
lv2_poke(NEW_POKE_SYSCALL_ADDR + 24,
0x4bffffec4e800020ULL);
/* copy the payload */
PRINTF("copying the payload...\n");
Lv2Syscall3(NEW_POKE_SYSCALL, 0x800000000000ef48ULL,
(unsigned long long)payload_bin,
sizeof(payload_bin));
PRINTF("uninstalling memcpy...\n");
/* restore syscall */
remove_new_poke();
lv2_poke(NEW_POKE_SYSCALL_ADDR + 16,
0xebc2fe287c7f1b78);
lv2_poke(NEW_POKE_SYSCALL_ADDR + 24,
0x3860032dfba100e8);
PRINTF("done.\n");
}
while (0);