exploit.js

"use strict";

(function (root) {
    const MAX_READ = 0x1000;

    function fail(detail) {
        if (typeof root.addExploitStatus === "function") root.addExploitStatus(detail, "bad");
        return { ok: false, detail };
    }

    function numberAddress(value) {
        const address = typeof value === "bigint" ? Number(value) : Number(value);
        if (!Number.isSafeInteger(address) || address <= 0 || address > 0x7ffffffffffff)
            throw new RangeError("address is outside the canonical userland range");
        return address;
    }

    function copyBytes(value) {
        if (value instanceof Uint8Array) return new Uint8Array(value);
        if (value instanceof ArrayBuffer) return new Uint8Array(value.slice(0));
        throw new TypeError("provider read must return Uint8Array or ArrayBuffer");
    }

    function installProvider(provider, options) {
        if (!provider || provider.verified !== true || provider.firmware !== "13.60")
            return fail("provider is not verified for FW 13.60");
        if (typeof provider.read !== "function") return fail("provider has no read function");

        const read = (address, length) => {
            const start = numberAddress(address);
            const count = Number(length);
            if (!Number.isSafeInteger(count) || count < 1 || count > MAX_READ)
                throw new RangeError("aimRead length must be between 1 and 0x1000");
            const bytes = copyBytes(provider.read(start, count));
            if (bytes.length !== count) throw new Error("provider returned the wrong read length");
            return bytes;
        };

        const modules = provider.modules && typeof provider.modules === "object" ? provider.modules : {};
        const moduleNames = Object.keys(modules).filter((name) => /^[A-Za-z0-9_.-]+$/.test(name));
        const registry = {
            verified: true,
            modules: moduleNames.map((name) => ({ name, ...modules[name] })),
            describe(name) {
                const record = modules[name];
                if (!record || !Number.isSafeInteger(Number(record.base))
                    || !Number.isSafeInteger(Number(record.loadBias))
                    || !Number.isSafeInteger(Number(record.programHeaderAddress))) return null;
                return { name, ...record };
            },
            canDescribe(name) { return this.describe(name) !== null; }
        };

        root.aimRead = read;
        // Keep the explicit window name as the page contract for browser tooling.
        window.aimRead = read;
        root.noslopModuleRegistry = registry;
        root.noslopInfo = {
            runtime: "FW 13.60 userland",
            providerVerified: true,
            kernelStage: "disabled",
            elfStage: "disabled",
            modules: modules
        };
        root.NOSLOP_RUNTIME_STATE = Object.freeze({ name: "verified-userland-provider", ready: true });
        root.send_notification = typeof provider.notify === "function"
            ? (message) => provider.notify(String(message))
            : undefined;
        root.runBaselineDiagnostics = typeof provider.baseline === "function"
            ? provider.baseline : () => ({ status: "provider baseline not supplied" });

        if (typeof options.log === "function") {
            options.log("[INFO] REMOTE-JS-DISABLED");
            options.log("[OK] FW 13.60 userland build provider installed");
        }
        return {
            ok: true,
            detail: "Verified FW 13.60 userland provider active",
            provider: { ready: true, read, modules: registry.modules }
        };
    }

    async function start(options) {
        const input = options || {};
        if (input.firmware !== "13.60") return fail("exact FW 13.60 is required");
        if (!root.NOSLOP_PAGE || root.NOSLOP_PAGE.isPs5 !== true)
            return fail("a real PS5 browser is required");
        if (typeof input.log === "function") input.log("[INFO] FW 13.60 userland build preflight");
        if (input.probe) {
            if (typeof input.log === "function") input.log("[OK] preflight complete; no commit requested");
            return { ok: false, detail: "preflight complete; no commit made" };
        }
        return installProvider(root.NOSLOP_USERLAND_PROVIDER, input);
    }

    root.NoslopUserlandRuntime = Object.freeze({ start });
})(window);