Skip to content

Instantly share code, notes, and snippets.

@dwendt
Last active August 29, 2015 14:24
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save dwendt/5cc5223d4686d0e33209 to your computer and use it in GitHub Desktop.
Save dwendt/5cc5223d4686d0e33209 to your computer and use it in GitHub Desktop.
memoArr = {};
var charset = "A%sB$nC-(D;)Ea0Fb1Gc2Hd3Ie4Jf5Kg6Lh7Mi8Nj9OkPlQmRnSoTpUqVrWsXtYuZvwxyz"; // default gdb-peda charset
function deBruijn (charset, maxlen, n) {
var k = charset.length;
var a = [];
for (var i = 0; i < k * n; i++) a.push(0);
if (maxlen.toString() in memoArr)
return memoArr[maxlen.toString()];
for (var k in memoArr) {
if (memoArr[k].length >= maxlen)
return memoArr[k].substr(0,maxlen);
}
var sequence = [];
(function db (t, p) {
if (sequence.length > maxlen) return;
if (t > n) {
if (n % p !== 0) return;
for (var j = 1; j <= p; j++) {
sequence.push(charset[a[j]]);
}
return;
}
a[t] = a[t-p];
db(t + 1, p);
for (var j = a[t-p] + 1; j < k; j++) {
a[t] = j;
db(t + 1, t);
}
})(1,1);
memoArr[maxlen.toString()] = sequence.join('');
return memoArr[maxlen.toString()];
};
var last_searched_val = "";
var max_search_len = 0x9000;
function findOccurrence(n, val) {
var len = 0x3000; // this value works quick enough on my galaxy s5
while (true) {
len += 0x2000;
var pat = deBruijn(charset,len,3);
var pos = pat.indexOf(val);
if (pos !== -1) return pos;
if (len >= max_search_len) return -1;
}
};
// http://stackoverflow.com/a/2838358/436914
function selectElementText(el, win) {
win = win || window;
var doc = win.document, sel, range;
if (win.getSelection && doc.createRange) {
sel = win.getSelection();
range = doc.createRange();
range.selectNodeContents(el);
sel.removeAllRanges();
sel.addRange(range);
} else if (doc.body.createTextRange) {
range = doc.body.createTextRange();
range.moveToElementText(el);
range.select();
}
}
function getPattern() {
var k = document.getElementById('patlen').value;
k = parseInt(k, 10)
if (isNaN(k)) k = parseInt(k, 16);
if (isNaN(k)) k = 0x8000;
var patBox = document.getElementById('pattern');
patBox.innerHTML = deBruijn(charset,k,3);
selectElementText(patBox);
}
function goSearch() {
var k = document.getElementById('searchval').value;
if (k.substr(0,2) === "0x") {
// assume they're pasting a 32bit hex value out of GDB or something
var hexVal = k.substr(2);
if (hexVal.length % 4 !== 0) {
alert("hey it looks like you gave us a hex value \"0x01234ABCD...\" but for that to remotely work we recommend you make it four bytes long.");
return;
}
// convert it to chars, swap the order.
var bytes = x.match(/../g).reverse();
var buildStr = "";
for (var v in bytes) {
try {
buildStr += parseInt(v,16);
} catch(e) {
alert("tried to treat your input as 32bit little endian integer and convert to chars, but it wasn't valid.");
return;
}
}
k = buildStr;
}
// we'll let them enter 8/16/32 anyways...
if ((k.length%4 != 0)) {
alert("you should probably be searching for 4 ascii chars at a time. try again.");
return;
}
if (k === last_searched_val) {
max_search_len += 0x10000;
}
last_searched_val = k;
var found = findOccurrence(3, k);
if (found === -1) {
alert("couldn't find your input. hitting find again with the same input will search harder but make your browser chug.");
return;
}
document.getElementById('searchresult').innerHTML = "Found value at offset " + found;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment