SIF WW Get Token Lua Script

sif_gettoken.lua

-- sif_gettoken.lua
-- Get SIF token from memory (for SIF W v4.0.2)
-- Run under LuaJIT and as root

-- These 2 variables can be edited
local PACKAGE = "klb.android.lovelive_en"
local POINTER_ADDRESS = 0x46E438

-- Check if it's running as root
if os.getenv("USER") ~= "root" then
	error("Run as root!")
end

-- Check if io.popen works
do
	if not(io.popen) then
		error("This lua interpreter does not support io.popen")
	end
	
	local x, a = pcall(io.popen, "id")
	
	if x == false then
		error("This lua interpreter does not support io.popen")
	else
		a:close()
	end
end

-- Function to convert 4-byte string into number
function str2dword_le(str)
	return str:sub(1,1):byte() + str:sub(2,2):byte() * 256 + str:sub(3,3):byte() * 65536 + str:sub(4,4):byte() * 16777216
end

-- Function to get SIF PID
local function get_sif_pid()
	local a = io.popen("ps | grep "..PACKAGE)
	local b = a:read("*l")
	
	a:close()
	if b then
		return tonumber(b:match("u0_a%d+%s+(%d+)"))
	else
		return 0
	end
end

-- Function to get libGame.so base address
local function get_base_libGame(sif_pid)
	local a = io.open("/proc/"..sif_pid.."/maps", "rb")
	
	for line in a:lines() do
		if line:find("libGame.so") then
			a:close()
			
			return tonumber(line:match("%x+"), 16)
		end
	end
	
	a:close()
	return 0
end

-- Function to read null-terminated string
local function read_null(file)
	local a = {}
	
	while true do
		local b = file:read(1)
		
		if b == "\0" then
			break
		end
		
		a[#a + 1] = b
	end
	
	return table.concat(a)
end

-- Main program
function main()
	-- Get SIF PID
	local sif = get_sif_pid()
	
	if sif == 0 then
		print("SIF must be running")
		return 1
	end
	
	-- Get libGame.so base address
	local libGame = get_base_libGame(sif)
	
	if libGame == 0 then
		print("Unable to find libGame.so address")
		return 1
	end
	
	-- Open memory
	local mem = io.open("/proc/"..sif.."/mem", "rb")
	
	if not(mem) then
		error("Cannot open SIF memory")
	end
	
	-- Read token memory
	mem:seek("set", libGame + POINTER_ADDRESS)
	local token_address = str2dword_le(mem:read(4))
	
	if token_address == 0 then
		-- Token is still null (still in title screen perhaps?)
		mem:close()
		print("Token: NULL")
		
		return 0
	end
	
	-- Read token
	mem:seek("set", token_address)
	local token_data = read_null(mem)
	
	mem:close()
	print("Token: "..token_data)
	
	return 0
end

os.exit(main({...}) or 0)