m1n1/proxyclient/chainload.py

#!/usr/bin/python

from setup import *

payload = open(sys.argv[1], "rb").read()

try:
    # Try to use the m1n1 heap to avoid wasting 128MB RAM on every load
    new_base = p.memalign(0x10000, len(payload))
except:
    # Fall back to proxy heap, which will be at the right place in old versions
    new_base = u.memalign(0x10000, len(payload))

# FIXME: this will currently still waste the whole m1n1 size including payload area (64+MB) on each
# chainload. The best way to fix this is to support in-place chainloading, which has other
# advantages.

print("Loading %d bytes to 0x%x" % (len(payload), new_base))

iface.writemem(new_base + 0x4000, payload[0x4000:], True)

entry = new_base + 0x4800

print("Jumping to 0x%x" % entry)

p.reboot(entry, u.ba_addr)

iface.nop()
print("Proxy is alive again")