Level 1 of PwnCollegeV8Exploitation
This commit is contained in:
20
JavaScript/PwnCollegeV8Exploitation/Level1/README.md
Normal file
20
JavaScript/PwnCollegeV8Exploitation/Level1/README.md
Normal file
@@ -0,0 +1,20 @@
|
||||
# Level 1
|
||||
|
||||
## Problem
|
||||
|
||||
Directly execute amd64 machine code by calling `run()` on an array receiver.
|
||||
|
||||
The array should have elements kind `PACKED_DOUBLE_ELEMENTS`.
|
||||
|
||||
The `run()` is installed on `Array.prototype`.
|
||||
|
||||
## Key Knowledge
|
||||
|
||||
- [Inheritance and the prototype chain in JavaScript](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Inheritance_and_the_prototype_chain)
|
||||
- `Receiver` Object
|
||||
- [How to understand sender and receiver in Ruby?](https://stackoverflow.com/questions/15592268/how-to-understand-sender-and-receiver-in-ruby)
|
||||
- [Could you explain sender and receiver in OOP and give examples?](https://stackoverflow.com/questions/45474802/could-you-explain-sender-and-receiver-in-oop-and-give-examples)
|
||||
- [Elements Kinds in V8](https://v8.dev/blog/elements-kinds)
|
||||
- IEEE754 Standard
|
||||
- Conversion between double & int64 representation using IEEE754
|
||||
- ShellCode
|
||||
Reference in New Issue
Block a user