From 3df21d6c8d6c978cedaac23dbbf4c106dee9120f Mon Sep 17 00:00:00 2001 From: spv420 Date: Wed, 13 Jul 2022 20:32:27 -0400 Subject: lol r3gister --- src/js/primitives/mem.js | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) (limited to 'src/js/primitives/mem.js') diff --git a/src/js/primitives/mem.js b/src/js/primitives/mem.js index 6e21fb0..b5078eb 100644 --- a/src/js/primitives/mem.js +++ b/src/js/primitives/mem.js @@ -257,6 +257,37 @@ function _sptr(s) { return global_sptr_addy - s.length; } + +/* + * _sptr is meant to give you a pointer to a specified string + * remember your nul's! + */ +function shit_heap(v) { + if ((sptr_len + v) >= sptr_size) { + /* + * expand sptr heap if it's too small + * this will technically fail if the string is over 1MB, and will then + * cause a heap overflow, but eh whatever + * + * sometimes it's fun to include esoteric bugs that are unlikely to + * cause real harm, to add an exploitation challenge. :P + */ + var dlsym_addy = read_u32(reserve_addr + 24 + slid); + var shc_slide = read_u32(reserve_addr + 20 + slid); + write_str(0x150000, "realloc\0"); + sptr_size += 0x100000; + var addy = call4arg(dlsym_addy + shc_slide, 0xfffffffe, 0x150000, 0, 0); + global_sptr_addy = call4arg(addy, global_sptr_addy, sptr_size, 0, 0); + } +// write_str(global_sptr_addy, s); + global_sptr_addy += v; + return global_sptr_addy - v; +} + +function shit_heap_free(v) { + return; +} + /* * sptr but with nul */ @@ -310,4 +341,4 @@ function setup_fancy_rw() { fancy_rw = true; printf("%08x\n", u8x4_to_u32([parent[0x5000], parent[0x5001], parent[0x5002], parent[0x5003]])); -} \ No newline at end of file +} -- cgit v1.2.3