Amy B

Cultist Simulator on Steam Seize forbidden treasures. Summon alien gods. Feed on your disciples. Cultist Simulator is a game of apocalypse and yearning. Play as a seeker after unholy mysteries, in a 1920s-themed setting of hidd...

I also recommend the game Cultist Simulator, from which this post draws most of its Lore and Secret Histories

store.steampowered.com/app/718670/C...

Performing A Ritual To Hack MicroQuickJS When a new JavaScript Engine is published, those versed in Knock will find Loopholes within. I document my Exploit summoning ritual which was performed in under 9 hours.

The final invocation is made and the Shell is summoned from the Exploit.

The final time is 8:37 from Repo Clone to Shell

The tome contains other details which are worth a look, such as illustrating the Transmutations of the JSValue:

stackchk.fail/blog/mquickj...

Rite Of The Smashing Stack This Terminale Rite brings about a Change in Control., What was once a path home is now bound by a chain of Gadgets. Each Return advances towards the final System state. If aligned properly a Shell may be summoned.

Employing the Rite Of The Smashing Stack:
We locate the Stack Address and a few Gadgets from the LIBC Library

Then we overwrite the Stack with our terminale Gadget Chain. Returning To System.

A diagram showing how to construct a Forged ArrayBuffer to read and write to any location in memory.

With this Leak in hand I Forged an ArrayBuffer pointing to any Memory Address I knew the Name of.

With this we can now manipulate the entire Memory Space at will.

This makes the final Rite possible...

A diagram showing how heap chunks can have sections of uninitialized padding. Showing how a 41 byte buffer can partially overwrite this padding. A pointer corrupted by this can be confused as a floating point

Leaking a Memory Address was the most difficult part!

Eventually I realized I could read the Uninitialized padding inside heap allocations. Through heap manipulation this value could be a Pointer

By overwriting the lowest byte with 00000101 the Pointer would be read as a Float

Rite Of The Type Forgery card. Through the Wrong perception of a Memory, Transmutations are achieved. Data which is viewed must be shaped in accordance to the Type's Structure, lest it shall crash and burn. A successful Forgery may insite Cursed-Workings within the ENgine for a greater purpose.

We can place Controlled-Data after the Array, which Splice will read Out-Of-Bounds

This gives us the Rite Of The Type Forgery, allowing us to Forge an arbitrary Object if we know a Memory Address (to bypass ASLR)

A diagram showing how the Array.splice function will ignore changes to the Array Length during a ValueOf callback. This leads to an Out-Of-Bounds access

The Fault derives from a "Time-of-Check Time-of-Use" in the Array.splice invocation.

Splice checks bounds with the initial array Length (Time Of Check)

In a Callback we can shrink the Array's Length.

Then Splice uses the Cached Length, ignoring changes (Time Of Use)

Performing A Ritual To Hack MicroQuickJS When a new JavaScript Engine is published, those versed in Knock will find Loopholes within. I document my Exploit summoning ritual which was performed in under 9 hours.

The following will be based on excerpts from my first edition print of "Performing A Ritual To Hack MicroQuickJS":

stackchk.fail/blog/mquickj...

A modified version of Cultist Simulator showing cards: Micro Quickjs, Fault in the Work, Loophole, Exploit, and Summoned Shell

When MicroQuickJS released, I spent 8.5 hours to summon an Exploit for it. Here is the Fault:

var arr = new Array(30)
var attack = {
valueOf: function() {
arr.length = 0
arr.length = 3
return 10
}
}
arr.splice(attack, 30)

I document the full Ritual Process below