Function stage2_

restore/505goldhen/exploit.js:665–1032

()

 }
};
function stage2_() {
 p = window.prim;
 p.read2 = function (addr) {
  return p.read4(addr) & 0xFFFF;
 };
 p.read1 = function (addr) {
  return p.read4(addr) & 0xFF;
 };
 p.read_data8 = function (addr, size) {
  var v = new Uint8Array(size);
  for (var i = 0; i < size; i++)
   v[i] = p.read1(addr + i);
  return v;
 };
 p.writestr = function (addr, str) {
  for (var i = 0; i < str.length; i++) {
   var byte_ = p.read4(addr.add32(i));
   byte_ &= 0xFFFF0000;
   byte_ |= str.charCodeAt(i);
   p.write4(addr.add32(i), byte_);
  }
 };
 p.readstr = function (addr) {
  var addr_ = addr.add32(0);
  var rd = p.read4(addr_);
  var buf = "";
  while (rd & 0xFF) {
   buf += String.fromCharCode(rd & 0xFF);
   addr_.add32inplace(1);
   rd = p.read4(addr_);
  }
  return buf;
 };
 p.array_to_string = function (array) {
  var str = "";
  for (var i = 0; i < array.length; i++)
   str += String.fromCharCode(array[i]);
  return str;
 };
 p.stringify = function (str) {
  var bufView = new Uint8Array(str.length + 1);
  for (var i = 0; i < str.length; i++)
   bufView[i] = str.charCodeAt(i) & 0xFF;
  window.nogc.push(bufView);
  return p.read8(p.leakval(bufView).add32(0x10));
 };
 p.malloc = function malloc(sz) {
  var backing = new Uint8Array(0x10000 + sz);
  window.nogc.push(backing);
  var ptr = p.read8(p.leakval(backing).add32(0x10));
  ptr.backing = backing;
  return ptr;
 };
 p.malloc32 = function malloc32(sz) {
  var backing = new Uint8Array(0x10000 + sz * 4);
  window.nogc.push(backing);
  var ptr = p.read8(p.leakval(backing).add32(0x10));
  ptr.backing = new Uint32Array(backing.buffer);