ntherning

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

ntherning

kotlin {
    val isIosDevice = getenv("PLATFORM_NAME")?.startsWith("iphoneos") == true
    val iosTarget: (String, KotlinNativeTarget.() -> Unit) -> KotlinNativeTarget = if (isIosDevice) ::iosArm64 else ::iosX64
    fun iosBuildDir(isDebug: Boolean, isDevice: Boolean): File {
        return project.buildDir.resolve(buildString {
            append("bin/ios/")
            append(if (isDebug) "Debug" else "Release")
            append("-")
            append(if (isDevice) "iphoneos" else "iphonesimulator")
        })

ntherning

import kotlinx.coroutines.delay
import kotlinx.coroutines.launch
import kotlinx.coroutines.newSingleThreadContext
import kotlinx.coroutines.runBlocking
import kotlinx.coroutines.sync.Mutex
import kotlinx.coroutines.sync.withLock
import kotlin.native.concurrent.ensureNeverFrozen
import kotlin.test.Test

class MutexInvalidMutabilityTest {

ntherning

This code and

  <forceLinkClasses>
    <pattern>com.android.org.conscrypt.**</pattern>
    <pattern>com.android.org.bouncycastle.**</pattern>
    <pattern>org.apache.harmony.security.provider.**</pattern>
  </forceLinkClasses>

ntherning

# You can skip these lines if you'd prefer to work with s3sh
require 'rubygems'
require 'aws/s3'
include AWS::S3

AWS::S3::DEFAULT_HOST.replace "s3-eu-west-1.amazonaws.com"

AWS::S3::Base.establish_connection!(
   :access_key_id     => 'abc', 
   :secret_access_key => '123'

ntherning

mkdir open-jfx
cd open-jfx
hg clone http://hg.openjdk.java.net/openjfx/8/master
cd master
hg clone ssh://hg@bitbucket.org/ntherning/jfx78 rt
mkdir lib
cd lib
curl -O 'http://repo1.maven.org/maven2/org/threeten/threetenbp/0.8.1/threetenbp-0.8.1.jar'
curl -O 'http://www.antlr3.org/download/antlr-3.1.3.tar.gz'
tar xvfz antlr-3.1.3.tar.gz