Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
Game save dumper
var tid = '0000000000000000'; //Set appropriate game TID; Need to find a way to get TID automatically...
utils.log("stage1, hijack fsppr and set perms");
sc.getFSPPR();
sc.ipcMsg(1).sendPid().data(0).sendTo('fsp-srv').assertOk();
var pid = sc.read4(sc.ipcBufAddr, 0xC >> 2);
utils.log('Got process PID: '+pid.toString(16));
var buf1_sz = 0x1C;
var buf2_sz = 0x2C;
var buf = sc.malloc(buf1_sz + buf2_sz);
var buf2 = utils.add2(buf, buf1_sz);
//buffer init
sc.write4(1, buf, 0x0>>2);
sc.write8([0xFFFFFFFF, 0xFFFFFFFF], buf, 0x4 >> 2); //This is the permissions value.
sc.write4(buf1_sz, buf, 0xC >> 2);
sc.write4(buf1_sz, buf, 0x14 >> 2);
sc.write4(1, buf2, 0x0 >> 2);
sc.write8([0xFFFFFFFF, 0xFFFFFFFF], buf2, 0x4 >> 2); //This is the permissions value -- actual perms = buf2_val & buf1_val
sc.write4(0xFFFFFFFF, buf2, 0x14 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x18 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x24 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x28 >> 2);
sc.ipcMsg(256).data(0).sendTo('fsp-pr').assertOk().show();
sc.ipcMsg(1).data(pid).sendTo('fsp-pr').assertOk().show();
sc.ipcMsg(0).data(2, [pid,0], utils.parseAddr(tid), buf1_sz, buf2_sz, pid, pid, 0, 0, 0, 0, 0).aDescriptor(buf, buf1_sz).aDescriptor(buf2, buf2_sz).sendTo('fsp-pr').assertOk().show();
sc.free(buf);
sc.free(buf2);
utils.log("stage2, open save data");
utils.log("GetLastUserProfile");
res = sc.ipcMsg(4).sendTo('acc:u1').assertOk();
var userID = res.data;
utils.log('MountSaveData');
res = sc.ipcMsg(51).datau64(1, utils.parseAddr(tid), [userID[0], userID[1]], [userID[2], userID[3]], [0,0], 1, 0, 0, 0).sendTo('fsp-srv').assertOk();
sc.withHandle(res.movedHandles[0], (ifile) => {
utils.log('Got IFileSystem handle: 0x'+ ifile.toString(16));
var fs = new sc.IFileSystem(sc, ifile);
var path = utils.str2ab('/');
var res = sc.ipcMsg(9).datau64(3).xDescriptor(path, path.byteLength, 0).sendTo(ifile);
var dir = new sc.IDirectory(sc, '/', res.movedHandles[0], fs);
dir.DirDump('SaveData');
});
@pplatoon
Copy link

pplatoon commented Mar 13, 2018

Good Job!!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment