anvbis

Pwntools Cheatsheet

1. Program Interaction
2. Environment and Contexts
3. Logging and Output
4. Encoding, Packing and Utility
5. Assembly and Shellcraft
6. ELFs, Strings and Symbols
7. Return Oriented Programming
8. SROP and Sigreturn Frames

anvbis

CVE-2023-2033
CVE-2023-1214
CVE-2023-0696
CVE-2022-4262
CVE-2022-4174
CVE-2022-3889
CVE-2022-3885
CVE-2022-3723
CVE-2022-3652
CVE-2022-3045

anvbis

Fundamentals:
-------------
https://jayconrod.com/posts/51/a-tour-of-v8--full-compiler
https://jayconrod.com/posts/52/a-tour-of-v8--object-representation
https://jayconrod.com/posts/54/a-tour-of-v8--crankshaft--the-optimizing-compiler
https://jayconrod.com/posts/55/a-tour-of-v8--garbage-collection
https://v8.dev/blog/fast-properties
https://developpaper.com/how-does-v8-run-object-representation-in-v8/
https://medium.com/@stankoja/v8-bug-hunting-part-2-memory-representation-of-js-types-ea37571276b8
https://jayconrod.com/posts/44/polymorphic-inline-caches-explained

anvbis

let _buf = new ArrayBuffer(8);
let _flt = new Float64Array(_buf);
let _int = new BigUint64Array(_buf);

const itof = x => {
  _int[0] = x;
  return _flt[0];
};

const pwn = () => {

anvbis

let _buf = new ArrayBuffer(8);
let _flt = new Float64Array(_buf);
let _int = new BigUint64Array(_buf);

const ftoi = x => {
  _flt[0] = x;
  return _int[0];
};

const itof = x => {

anvbis

filetype plugin indent on
set tabstop=2
set shiftwidth=2
set expandtab

set number
set termguicolors


" https://github.com/junegunn/vim-plug

anvbis

/*
HEAD @ b5fa92428c9d4516ebdc72643ea980d8bde8f987
*/

let buf = new ArrayBuffer(8);
let f64 = new Float64Array(buf);
let i64 = new BigUint64Array(buf);

const ftoi = x => {
  f64[0] = x;

anvbis

source 'https://rubygems.org' do
  gem 'seccomp-tools'
end

anvbis

diff --git a/js/src/builtin/Array.cpp b/js/src/builtin/Array.cpp
index 2b6d8953c523..fa60ef14f1ec 100644
--- a/js/src/builtin/Array.cpp
+++ b/js/src/builtin/Array.cpp
@@ -206,6 +206,20 @@ bool js::GetLengthProperty(JSContext* cx, HandleObject obj, uint64_t* lengthp) {
   return ToLength(cx, value, lengthp);
 }
 
+static MOZ_ALWAYS_INLINE bool BlazeSetLengthProperty(JSContext* cx,
+                                                     HandleObject obj,

anvbis

var buf = new ArrayBuffer(8);
var f64 = new Float64Array(buf);
var i64 = new BigUint64Array(buf);

const ftoi = x => {
  f64[0] = x;
  return i64[0];
};

const itof = x => {