Skip to content

Instantly share code, notes, and snippets.

@snoopysecurity

snoopysecurity/Building_v8_Windows.md

Forked from jhalon/Building_v8_Windows.md
Created February 13, 2023 17:25
Show Gist options
  • Save snoopysecurity/605e5c04529752afc8d766f785076201 to your computer and use it in GitHub Desktop.
Save snoopysecurity/605e5c04529752afc8d766f785076201 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Building_v8_Windows.md

Building Chrome V8 on Windows

In order to be able to build v8 from scratch on Windows for x64, please follow the following steps.

NOTE: While the Chrome team does provide decent documentation, there are some nuances and other additional steps that must be done for v8 to compile on Windows.

Documentation:

Some Nuances:

  • Visual Studio 2017 (>=15.7.2) is required to build v8, but Visual Studio 2019 (>=16.0.0) is preferred.
  • Apparently, as of January 2022, the upstream package (google/v8) doesn't support Visual Studio 2022.
  • For debugging (that will be us) Visual Studio 2019 is needed. Anything below that will result in a build failure, as shown below:
See //BUILD.gn:1195:1: which caused the file to be included.
action("postmortem-metadata") {
^------------------------------
  • Desktop development with C++ components and the MFC/ATL support modules must be installed in Visual Studio.
  • Building v8 in Debug mode with ASan on Windows is not supported, as it's not yet implemented in LLVM.
    • If you need this functionality, build v8 on Linux or macOS.

Get a Fresh Dev VM (Optional):

If you want to start on a fresh Windows 10 Development VM with Visual Studio 2019 then download one of the last W10 Dev VM's from Microsoft:

Setting Up Windows:

Once you have Visual Studio 2019 installed, you will need to install the following additional components:

  • Desktop Development with C++
  • Python Development
  • C++ ATL for Latest v142 Build Tools (x86 & x64)
  • C++ MFC for Latest v142 Build Tools (x86 & x64)
  • C++ Clang for v142 Build Tools (x64-x86)
  • C++ CMake tools for Windows
  • Windows 10 SDK (10.0.20348.0)

Next, we need to install the "SDK Debugging Tools" to be able to build and debug v8.

To do that, either download the Windows 10 SDK version 2104 (10.0.20348.0) or do the following if you installed the SDK via Visual Studio:

  1. Open up Control Panel
  2. Click Program
  3. Click "Programs and Features"
  4. Select the "Windows Software Development Kit"
  5. Click "Change"
  6. In the new Window, select "Change"
  7. Click "Change"
  8. Check the "Debugging Tools For Windows" Option
  9. Click "Change"
  10. Let the Debugging Tools Install

Download Chrome Tools and V8

First, start by creating a folder where you will be storing Google's tools and v8. In my case I made a new directory called dev in my C:\ drive.

Download the depot_tools and extract it to your previously created folder. In my case it will be extracted to C:\dev\depot_tools.

⚠️ Warning ⚠️ DO NOT use drag-n-drop or copy-n-paste extract from Explorer, this will not extract the hidden “.git” folder which is necessary for depot_tools to auto update itself. You can use “Extract all…” from the context menu though.

Assuming that you unzipped the budle to C:\dev\depot_tools, we now need to add the following Environmental Variables:

  • Modify the PATH System Variable and put C:\dev\depot_tools at the front.
  • Add the DEPOT_TOOLS_WIN_TOOLCHAIN User Variable and set it to 0.
    • This tells depot_tools to use your locally installed version of Visual Studio
  • Add the vs2019_install User Variable and set it to your installation path of Visual Studio.
    • For 2019 Community it would be set to => C:\Program Files (x86)\Microsoft Visual Studio\2019\Community

Once done, open up cmd.exe, cd to your depot_tools directory and then run the following command:

> gclient

On the first run, gclient will install all the Windows-specific bits needed to work with the code, including msysgit and python.

  • If you run gclient from a non-cmd shell (e.g., cygwin, PowerShell), it may appear to run properly, but msysgit, python, and other tools may not get installed correctly.
  • If you see strange errors with the file system on the first run of gclient, you may want to disable Windows Indexing.

After running gclient open a command prompt and type where python and confirm that the depot_tools python.bat comes ahead of any copies of python.exe, like so:

C:\dev\depot_tools>where python
C:\dev\depot_tools\python.bat
C:\Users\User\AppData\Local\Microsoft\WindowsApps\python.exe

Create a v8 directory within your C:\dev folder (assuming that's what you created) for the checkout and change to it:

> mkdir v8 && cd v8

Run the fetch tool from depot_tools to check out the v8 code and its dependencies:

> fetch v8

Once the command has completed (~15-30 minutes), we now need to change to the v8 directory and sync the dependencies by running the following command:

> cd v8
> git fetch
> gclient sync

⚡ NOTE ⚡ Usually, you can update your current v8 branch with git pull. Note that if you’re not on a branch, git pull won’t work, and you’ll need to use git fetch instead.

Building V8

Now that we have all our tools installed, and dependencies synced, it's time to build v8.

All of your commands should be executed using Windows Command Shell inside the v8 source directory. We will be executing python scripts as part of the build process and we need to ensure that the python executable from build_tools is used.

⚠️ WARNING ⚠️ Take note, that there is a problem in the way Windows can associate python files with other versions of python installed on your PC. v8 relies on certain older Python v2 scripts, so always execute commands in the python path/to/script params syntax!

So, once we're in the v8 folder, we can execute the following command to build the debug version of v8:

> python tools/dev/gm.py x64.debug

If you want the release version, just change x64.debug to x64.release in the command.

Let this command run, and go get a coffee ☕ as this will take ~2-3 hours to build.

If the compile is successful your console output should be pretty similar to mines, as shown below:

C:\dev\v8\v8>python tools/dev/gm.py x64.debug
# mkdir -p out\x64.debug
# echo > out\x64.debug\args.gn << EOF
is_component_build = true
is_debug = true
symbol_level = 2
target_cpu = "x64"
v8_enable_sandbox = true
use_goma = false
v8_enable_backtrace = true
v8_enable_fast_mksnapshot = true
v8_enable_slow_dchecks = true
v8_optimized_debug = false
EOF
# gn gen out\x64.debug
Done. Made 188 targets from 100 files in 27164ms
# autoninja -C out\x64.debug d8
"C:\dev\depot_tools\ninja.exe" -C out\x64.debug d8 -j 5
ninja: Entering directory `out\x64.debug'
[2063/2063] LINK d8.exe d8.exe.pdb
Done! - V8 compilation finished successfully.

Testing d8

Alright! So, we just successfully compiled v8, nice! If you haven't already noticed, gm also built d8 for us, which is v8's developer shell.

d8 is useful for running some JavaScript locally or debugging changes you have made to V8. This will be useful for us in better understanding v8 and writing exploits.

To test if d8 was successfully built, let's execute it with the --print-bytecode command, like so:

> out\x64.debug\d8 --print-bytecode
V8 version 10.8.0 (candidate)
d8>

From here, to make sure that we can see the bytecode, let's execute a simple function like Array.from(String('12345')) which simply creates an array with each number in the index of the string.

Your output should be similar to mines:

d8> Array.from(String('12345'))
[generated bytecode for function:  (0x02330025a8c9 <SharedFunctionInfo>)]
Bytecode length: 28
Parameter count 1
Register count 5
Frame size 40
Bytecode age: 0
         000002330025A94A @    0 : 21 00 00          LdaGlobal [0], [0]
         000002330025A94D @    3 : c3                Star2
         000002330025A94E @    4 : 2d f8 01 02       GetNamedProperty r2, [1], [2]
         000002330025A952 @    8 : c4                Star1
         000002330025A953 @    9 : 21 02 04          LdaGlobal [2], [4]
         000002330025A956 @   12 : c2                Star3
         000002330025A957 @   13 : 13 03             LdaConstant [3]
         000002330025A959 @   15 : c1                Star4
         000002330025A95A @   16 : 63 f7 f6 06       CallUndefinedReceiver1 r3, r4, [6]
         000002330025A95E @   20 : c2                Star3
         000002330025A95F @   21 : 5f f9 f8 f7 08    CallProperty1 r1, r2, r3, [8]
         000002330025A964 @   26 : c5                Star0
         000002330025A965 @   27 : aa                Return
Constant pool (size = 4)
000002330025A911: [FixedArray] in OldSpace
 - map: 0x023300002231 <Map(FIXED_ARRAY_TYPE)>
 - length: 4
           0: 0x0233000058e5 <String[5]: #Array>
           1: 0x0233000060a1 <String[4]: #from>
           2: 0x023300006dfd <String[6]: #String>
           3: 0x02330025a8a9 <String[5]: #12345>
Handler Table (size = 0)
Source Position Table (size = 0)
["1", "2", "3", "4", "5"]

Congratulations, you built v8 and d8!

Downloading Pre-Built Binaries

In case you don't want to compile V8, you can just grab fresh Chrome binaries built with ASan from here. Additionally, you can use OmahaProxy CSV Viewer to look for specific branch base positions by specifying a version of Chrome you want to target, and then just downloading the appropriate build from the chromium browser list.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment