Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add v8-dereference command #31

Merged
merged 1 commit into from
Feb 16, 2021
Merged

Add v8-dereference command #31

merged 1 commit into from
Feb 16, 2021

Conversation

lordidiot
Copy link
Contributor

v8-dereference command

A new command meant to aid with debugging the v8 javascript engine that now uses pointer compression

Usage

Use just as you would with dereference (https://gef.readthedocs.io/en/master/commands/dereference/)
but s/deref/veref/g

d8> let a = {};                                                                                                                                                                                                                        
undefined                                                                                                                                                                                                                              
d8> %DebugPrint(a);                                                                                                                                                                                                                    
DebugPrint: 0x2ce608084a1d: [JS_OBJECT_TYPE]                                                                                                                                                                                           
...

gef➤  veref 0x2ce608084a1d
0x00002ce608084a1c│+0x0000: 0x00002ce6082422cd
                  │+0x0004: 0x00002ce6080426dd
0x00002ce608084a24│+0x0008: 0x00002ce6080426dd
                  │+0x000c: 0x00002ce608042301
0x00002ce608084a2c│+0x0010: 0x00002ce608042301
                  │+0x0014: 0x00002ce608042301
0x00002ce608084a34│+0x0018: 0x00002ce608042301
                  │+0x001c: 0x00002ce608042545
0x00002ce608084a3c│+0x0020: 0x00000adc9a4f2b76
0x00002ce608084a44│+0x0028: "(function() {\n"use strict";\n\n// A more universa[...]"
0x00002ce608084a4c│+0x0030: "on() {\n"use strict";\n\n// A more universal strin[...]"
0x00002ce608084a54│+0x0038: "use strict";\n\n// A more universal stringify that[...]"
0x00002ce608084a5c│+0x0040: "ct";\n\n// A more universal stringify that support[...]"
0x00002ce608084a64│+0x0048: "A more universal stringify that supports more type"
gef➤  veref 0x00002ce608042301
0x00002ce608042300│+0x0000: 0x00002ce60804231d
                  │+0x0004:         0x00000000 (SMI: 0x0)
0x00002ce608042308│+0x0008:         0x7ff80000 (SMI: 0x3ffc0000)
                  │+0x000c: 0x00002ce6080422e9
0x00002ce608042310│+0x0010: 0x00002ce608042345
                  │+0x0014: 0x00002ce6080422e9
0x00002ce608042318│+0x0018:         0x0000000a (SMI: 0x5)
                  │+0x001c: 0x00002ce60804213d
0x00002ce608042320│+0x0020: 0x181000431f000007
0x00002ce608042328│+0x0028:         0x004003ff
                  │+0x002c: 0x00002ce608042165
0x00002ce608042330│+0x0030: 0x00002ce608042165
                  │+0x0034: 0x00002ce6080421a9
0x00002ce608042338│+0x0038: 0x00002ce6080421e1
                  │+0x003c:         0x00000000 (SMI: 0x0)
0x00002ce608042340│+0x0040:         0x00000000 (SMI: 0x0)
                  │+0x0044: 0x00002ce608042351
0x00002ce608042348│+0x0048: 0x7ff8000000000000

Issues

  1. Doesn't check for v8 version (Older versions don't use compressed pointers)
    • There may be some flags / easy indications in memory that we can parse and detect
  2. Currently uses a primitive check to differentiate between compressed pointers and
    random values in memory that happen to hit the compressed pointer range
  3. Doesn't even check if v8/d8 is running
  4. Doesn't dereference tagged ptrs more than 1 level, although I don't see a purpose for this

Sorry to make a PR with quite incomplete code, but I thought maybe the general idea would be useful

@hugsy hugsy merged commit 31b5e77 into hugsy:master Feb 16, 2021
@hugsy
Copy link
Owner

hugsy commented Feb 16, 2021

Sorry to make a PR with quite incomplete code, but I thought maybe the general idea would be useful

It's already a great start! Thanks for the PR!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants