{"title":" WebKit::JSC Exploitation: StructureID Leak","blog_url":"https://goyotan.hateblo.jp/","author_name":"Goyotan","categories":[],"width":"100%","height":"190","type":"rich","published":"2020-03-28 00:29:06","version":"1.0","image_url":null,"blog_title":"\u904b\u52d5\u3092\u3057\u3066\u3044\u307e\u3059","author_url":"https://blog.hatena.ne.jp/Goyotan/","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fgoyotan.hateblo.jp%2Fentry%2F2020%2F03%2F28%2F002906\" title=\" WebKit::JSC Exploitation: StructureID Leak - \u904b\u52d5\u3092\u3057\u3066\u3044\u307e\u3059\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","description":"Versus: StructureID randomization \u81ea\u5206\u7528\u306e\u30e1\u30e2\u66f8\u304d\u3067\u3059\uff0e\u9069\u5f53\u306b\u307e\u3068\u3081\u3066\u3044\u308b\u306e\u3067\u304a\u304b\u3057\u306a\u3068\u3053\u308d\u304c\u3042\u3063\u305f\u3089\u6559\u3048\u3066\u304f\u3060\u3055\u3044\uff0e \u77e5\u3063\u3066\u308b\u4eba\u306b\u3068\u3063\u3066\u306f\u5f53\u305f\u308a\u524d\u306e\u5185\u5bb9\u304b\u3082\u3057\u308c\u307e\u305b\u3093\uff0e\u8a31\u3057\u3066\uff0e \u3061\u3087\u3063\u3068\u524d\u306e\u6d41\u308c spraying array for guessing StructureID StructureID guessing\u306e\u305f\u3081\u306bArray\u3092spray\u3057\u3066\u304a\u304f fakeobj\u306f\u4f5c\u6210\u3057\u305f\u3060\u3051\u3067\u306f\u30c0\u30e1 -> (fakeobj instanceof Float64Array) == True \u306b\u306a\u308b\u3088\u3046\u306b\u3059\u308b (fakeobj instanceof Float64Arra\u2026","provider_name":"Hatena Blog","url":"https://goyotan.hateblo.jp/entry/2020/03/28/002906","provider_url":"https://hatena.blog"}