1. The threshold to trigger MAGLEV compilation is different when gdb is attached to d8 or not.
- When gdb attached to d8, the training loop count to trigger MAGLEV is 100,000.
- But when the standalone d8 running, the training loop count to trigger MAGLEV is only 10,000. If you still use 100,000, it will trigger TURBOFAN then code data structure will change and shellcode execution fails.
2. Fixed other miscellaneous minor mistakes.
V8 Exploitation of pwn.college
There stores materials for V8 Exploitation in pwn.college.
Setup
pip3 install pipenv
pipenv install