Given a relative rw from an array's contents in v8 (I patched v8 to let me to do this) , I turned that into an arbitrary rw. And given the address of the rwx page I created, I can pop calc. Still trying to figure out how to leak the rwx page address.
-
-
Ah thank you! Btw, I've been reading one of the other doar_e blog posts for my experimentation with spidermonkey exploitation :)
-
But the blaze is an interesting challenge :)
- 2 more replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.