Game save dumper

DumpSave.js

var tid = '0000000000000000'; //Set appropriate game TID; Need to find a way to get TID automatically...

utils.log("stage1, hijack fsppr and set perms");

sc.getFSPPR();
sc.ipcMsg(1).sendPid().data(0).sendTo('fsp-srv').assertOk();
var pid = sc.read4(sc.ipcBufAddr, 0xC >> 2);
utils.log('Got process PID: '+pid.toString(16));

var buf1_sz = 0x1C;
var buf2_sz = 0x2C;
var buf = sc.malloc(buf1_sz + buf2_sz);
var buf2 = utils.add2(buf, buf1_sz);

//buffer init
sc.write4(1, buf, 0x0>>2);
sc.write8([0xFFFFFFFF, 0xFFFFFFFF], buf, 0x4 >> 2); //This is the permissions value.
sc.write4(buf1_sz, buf, 0xC >> 2);
sc.write4(buf1_sz, buf, 0x14 >> 2);

sc.write4(1, buf2, 0x0 >> 2);
sc.write8([0xFFFFFFFF, 0xFFFFFFFF], buf2, 0x4 >> 2); //This is the permissions value -- actual perms = buf2_val & buf1_val
sc.write4(0xFFFFFFFF, buf2, 0x14 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x18 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x24 >> 2);
sc.write4(0xFFFFFFFF, buf2, 0x28 >> 2);

sc.ipcMsg(256).data(0).sendTo('fsp-pr').assertOk().show();
sc.ipcMsg(1).data(pid).sendTo('fsp-pr').assertOk().show();
sc.ipcMsg(0).data(2, [pid,0], utils.parseAddr(tid), buf1_sz, buf2_sz, pid, pid, 0, 0, 0, 0, 0).aDescriptor(buf, buf1_sz).aDescriptor(buf2, buf2_sz).sendTo('fsp-pr').assertOk().show();
sc.free(buf);
sc.free(buf2);

utils.log("stage2, open save data");

utils.log("GetLastUserProfile");
res = sc.ipcMsg(4).sendTo('acc:u1').assertOk();
var userID = res.data;

utils.log('MountSaveData');
res = sc.ipcMsg(51).datau64(1, utils.parseAddr(tid), [userID[0], userID[1]], [userID[2], userID[3]], [0,0], 1, 0, 0, 0).sendTo('fsp-srv').assertOk();
sc.withHandle(res.movedHandles[0], (ifile) => {             
    utils.log('Got IFileSystem handle: 0x'+ ifile.toString(16));
    var fs = new sc.IFileSystem(sc, ifile);
    var path = utils.str2ab('/');
    var res = sc.ipcMsg(9).datau64(3).xDescriptor(path, path.byteLength, 0).sendTo(ifile);	
    var dir = new sc.IDirectory(sc, '/', res.movedHandles[0], fs);
    dir.DirDump('SaveData');
});