Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add js_escape and js_unescape #1979

Merged
merged 7 commits into from
Apr 20, 2022
Merged

Add js_escape and js_unescape #1979

merged 7 commits into from
Apr 20, 2022

Conversation

justinsteven
Copy link
Contributor

This adds util.packing.js_escape() and util.packing.js_unescape()

These are useful for preparing binary data in such a way that it can be placed in memory using a JavaScript engine.

I'm not completely sure that I'm using @LocalNoarchContext correctly, or that my function signatures/docstrings are correct.

Demo

>>> import pwn

>>> pwn.js_escape(pwn.cyclic(64))
'%u6161%u6161%u6162%u6161%u6163%u6161%u6164%u6161%u6165%u6161%u6166%u6161%u6167%u6161%u6168%u6161%u6169%u6161%u616a%u6161%u616b%u6161%u616c%u6161%u616d%u6161%u616e%u6161%u616f%u6161%u6170%u6161'

>>> pwn.js_unescape(pwn.js_escape(pwn.cyclic(64))) == pwn.cyclic(64)
True

Using IE11, this cyclic pattern can be put into memory with:

<html>
<body>
<div id="my_div">
<script>
var data = unescape("%u6161%u6161%u6162%u6161%u6163%u6161%u6164%u6161%u6165%u6161%u6166%u6161%u6167%u6161%u6168%u6161%u6169%u6161%u616a%u6161%u616b%u6161%u616c%u6161%u616d%u6161%u616e%u6161%u616f%u6161%u6170%u6161");
var div_container = document.getElementById("my_div");
div_container.title = data;
</script>
</body>
</html>

WinDbg then says:

0:024> s -a 0 L?80000000 aaaabaaacaaadaaa
0337a940  61 61 61 61 62 61 61 61-63 61 61 61 64 61 61 61  aaaabaaacaaadaaa
09edb960  61 61 61 61 62 61 61 61-63 61 61 61 64 61 61 61  aaaabaaacaaadaaa
09ee1840  61 61 61 61 62 61 61 61-63 61 61 61 64 61 61 61  aaaabaaacaaadaaa
0a24773c  61 61 61 61 62 61 61 61-63 61 61 61 64 61 61 61  aaaabaaacaaadaaa

@justinsteven justinsteven marked this pull request as draft October 8, 2021 04:57
@justinsteven justinsteven marked this pull request as ready for review October 8, 2021 06:01
@justinsteven
Copy link
Contributor Author

I've just realized this could also go in util.fiddling. Thoughts?

@justinsteven
Copy link
Contributor Author

Is there anything I can do to get this across the line? In the meantime can this please be given the label hacktoberfest-accepted

@Arusekk
Copy link
Member

Arusekk commented Oct 31, 2021

Fiddling would be a better place I guess.

Arusekk
Arusekk requested changes Jan 24, 2022
View reviewed changes
Copy link
Member

@Arusekk Arusekk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I finally had time to review this thoroughly. I am now sure I understand (and agree with) everything I haven't mentioned.

pwnlib/util/fiddling.py Outdated Show resolved Hide resolved
pwnlib/util/fiddling.py Outdated Show resolved Hide resolved
pwnlib/util/packing.py Outdated Show resolved Hide resolved
pwnlib/util/fiddling.py Outdated Show resolved Hide resolved
Arusekk
Arusekk reviewed Apr 20, 2022
View reviewed changes
pwnlib/util/packing.py Outdated Show resolved Hide resolved
Arusekk
Arusekk reviewed Apr 20, 2022
View reviewed changes
pwnlib/util/fiddling.py Outdated Show resolved Hide resolved
@Arusekk Arusekk merged commit 0351219 into Gallopsled:dev Apr 20, 2022
gogo2464 pushed a commit to gogo2464/pwntools that referenced this pull request Sep 10, 2023
@justinsteven @Arusekk
Add js_escape and js_unescape (Gallopsled#1979)
6dee997 
* Add js_escape and js_unescape

* Add entry for js packing functions

* Use hardcoded data for doctest

* Fix js_escape data iteration for Python 2

* Move js packing functions to util.fiddling

* Apply suggestions from code review

Co-authored-by: Arusekk <arek_koz@o2.pl>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Arusekk Arusekk Arusekk requested changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@justinsteven @Arusekk