corpus.blog
42,805 blogs · 5,350,595 posts Claim your blog
Record · corpus.blog/posts/01a0878d-be1a-728d-b309-350831ef58d4

Chrome Browser Exploitation, Part 2: Introduction to Ignition, Sparkplug and JIT Compilation via TurboFan

jhalon.github.io · published 16 November 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jhalon.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
133
Words captured
16,381

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://en.wikipedia.org/wiki/Language_binding
en.wikipedia.org
https://www.chromium.org/developers/design-documents/multi-process-architecture/
chromium.org
https://www.chromium.org/blink/
chromium.org
https://skia.org/
skia.org
https://source.chromium.org/chromium/chromium/+/trunk:content/public/browser/render_process_host.h
source.chromium.org
https://www.chromium.org/developers/design-documents/inter-process-communication/
chromium.org
https://chromium.googlesource.com/chromium/src/+/HEAD/mojo/README.md
chromium.googlesource.com
https://www.chromium.org/developers/design-documents/multi-process-architecture/arch.png
chromium.org
https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md
chromium.googlesource.com
https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
learn.microsoft.com
https://source.chromium.org/chromium/chromium/src/+/main:v8/include/v8-isolate.h;l=866?q=GetCurrentContext(
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/include/v8-isolate.h;l=203
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/include/v8-context.h;l=45
source.chromium.org
https://chromium.googlesource.com/chromium/src/+/master/third_party/blink/renderer/bindings/core/v8/V8BindingDesign.md
chromium.googlesource.com
https://v8.dev/docs/embed
v8.dev
https://en.wikipedia.org/wiki/Register_file
en.wikipedia.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/codegen/code-stub-assembler.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/interpreter-generator.cc
source.chromium.org
https://en.cppreference.com/w/cpp/language/enum
en.cppreference.com
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/bytecode-generator.h;l=32
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/bytecode-generator.cc;l=1366;drc=8f243f4c58be1a3ffdfd378978d8f26f5d7ca997
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/js-function.h;l=86
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/shared-function-info.h;l=186?q=SharedFunctionInfo&sq=&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/js-function.h;l=131
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/interpreter.cc;l=344?q=InterpreterEntryTrampoline&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/builtins/x64/builtins-x64.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/builtins/x64/builtins-x64.cc;l=1255
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/builtins/x64/builtins-x64.cc;l=1320
source.chromium.org
https://docs.google.com/document/d/11T2CRex9hXxoJwbYqVQ32yIPMh0uouUZLdyrtmMoL44/edit
docs.google.com
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/feedback-vector.h;l=197
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/code.h;l=1227?q=BytecodeArray&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/interpreter.cc;l=120;bpv=0;bpt=1?q=SetBytecodeHandler&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/codegen/x64/register-x64.h;l=254
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/bytecodes.h
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/interpreter/bytecode-operands.h
source.chromium.org
https://www.alibabacloud.com/blog/javascript-bytecode-v8-ignition-instructions_599188
alibabacloud.com
https://v8.dev/blog/sparkplug
v8.dev
https://en.wikipedia.org/wiki/Source-to-source_compiler
en.wikipedia.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/baseline/baseline-compiler.cc
source.chromium.org
https://v8.dev/blog/short-builtin-calls
v8.dev
https://wingolog.org/archives/2011/06/20/on-stack-replacement-in-v8
wingolog.org
https://bugs.chromium.org/p/chromium/issues/detail?id=1179595
bugs.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/codegen/macro-assembler.h
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:base/profiler/
source.chromium.org
JavaScript engine fundamentals: Shapes and Inline Caches Read at the source ↗
mathiasbynens.be
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/feedback-vector.h
source.chromium.org
https://tc39.es/ecma262/
tc39.es
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/feedback-vector.h;l=62
source.chromium.org
https://www.youtube.com/watch?v=mjHtadilm00
youtube.com
What's up with monomorphism? Read at the source ↗
mrale.ph
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/use-info.h;l=122
source.chromium.org
https://www.youtube.com/watch?v=u7zRSm8jzvA
youtube.com
https://en.wikipedia.org/wiki/Static_single-assignment_form
en.wikipedia.org
https://en.wikipedia.org/wiki/Partial-redundancy_elimination
en.wikipedia.org
https://en.wikipedia.org/wiki/Control-flow_graph
en.wikipedia.org
https://v8.github.io/tools/head/turbolizer/index.html
v8.github.io
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/pipeline.cc;l=1475
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/pipeline.cc;l=2904
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/typer.cc;l=455
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/typer.cc;l=58
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/typer.cc;l=880
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/types.cc;l=870
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/operation-typer.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/operation-typer.cc;l=680
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/typer.cc;l=903
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/operation-typer.cc;l=170
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/operation-typer.cc;l=1335
source.chromium.org
https://bugs.chromium.org/p/v8/issues/detail?id=8806
bugs.chromium.org
https://doar-e.github.io/blog/2019/05/09/circumventing-chromes-hardening-of-typer-bugs/
doar-e.github.io
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/simplified-lowering.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/simplified-lowering.cc;l=1867
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/simplified-lowering.cc;l=4334?q=DeferReplacement&sq=&ss=chromium%2Fchromium%2Fsrc
source.chromium.org
https://crrev.com/7bb6dc0e06fa158df508bc8997f0fce4e33512a5
crrev.com
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/redundancy-elimination.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/graph-reducer.h
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/constant-folding-reducer.cc
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/js-operator.cc;l=739
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/compiler/control-flow-optimizer.cc
source.chromium.org
https://docs.google.com/presentation/d/1sOEF4MlF7LeO7uq-uThJSulJlTh--wgLeaVibsbb3tc/htmlpresent
docs.google.com
https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/
doar-e.github.io
https://www.youtube.com/watch?v=xp1YDOtWohw
youtube.com
https://www.youtube.com/watch?v=sheeWKC6CuM
youtube.com
https://bugs.chromium.org/p/chromium/issues/detail?id=765433
bugs.chromium.org
https://ssd-disclosure.com/ssd-advisory-chrome-turbofan-remote-code-execution/
ssd-disclosure.com
https://bugzilla.mozilla.org/show_bug.cgi?id=1145255
bugzilla.mozilla.org
https://bugs.chromium.org/p/chromium/issues/detail?id=606115
bugs.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=602970
bugs.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=620553
bugs.chromium.org
https://www.zerodayinitiative.com/blog/2017/8/24/deconstructing-a-winning-webkit-pwn2own-entry
zerodayinitiative.com
https://bugs.chromium.org/p/chromium/issues/detail?id=691323
bugs.chromium.org
https://bugs.chromium.org/p/project-zero/issues/detail?id=1380
bugs.chromium.org
https://bugs.chromium.org/p/project-zero/issues/detail?id=1390
bugs.chromium.org
http://blog.ret2.io/2018/06/05/pwn2own-2018-exploit-development/
blog.ret2.io
https://bugs.chromium.org/p/chromium/issues/detail?id=808192
bugs.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=805729
bugs.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=831943
bugs.chromium.org
https://bugs.chromium.org/p/chromium/issues/detail?id=837939
bugs.chromium.org
https://github.com/vngkv123/aSiagaming/blob/master/Chrome-v8-906043/Chrome%20V8%20-%20-CVE-2019-5782%20Tianfu%20Cup%20Qihoo%20360%20S0rrymybad-%20-ENG-.pdf
github.com
https://googleprojectzero.blogspot.com/2021/01/in-wild-series-chrome-exploits.html
googleprojectzero.blogspot.com
https://www.zerodayinitiative.com/blog/2021/12/8/understanding-the-root-cause-of-cve-2021-21220-a-chrome-bug-from-pwn2own-2021
zerodayinitiative.com
https://www.jaybosamiya.com/blog/2019/01/02/krautflare/
jaybosamiya.com
https://abiondo.me/2019/01/02/exploiting-math-expm1-v8/
abiondo.me
https://gts3.org/2019/turbofan-BCE-exploit.html
gts3.org
https://bugs.chromium.org/p/chromium/issues/detail?id=762874
bugs.chromium.org
https://blog.exodusintel.com/2019/09/09/patch-gapping-chrome/
blog.exodusintel.com
https://github.com/tunz/js-vuln-db
github.com
https://www.zerodayinitiative.com/advisories/published/
zerodayinitiative.com
https://twitter.com/maxpl0it
twitter.com
https://twitter.com/33y0re
twitter.com
https://twitter.com/v3ded
twitter.com
https://twitter.com/__x86
twitter.com
https://doar-e.github.io/author/jeremy-__x86-fetiveau.html
doar-e.github.io
An Introduction to Speculative Optimization in V8 Read at the source ↗
benediktmeurer.de
https://www.cs.cmu.edu/~aplatzer/course/Compilers/11-ssa.pdf
cs.cmu.edu
https://docs.google.com/presentation/d/1Z6oCocRASCfTqGq1GCo1jbULDGS-w-nzxkbVF7Up0u0/edit
docs.google.com
https://v8.dev/blog/turbofan-jit
v8.dev
https://v8.dev/blog/ignition-interpreter
v8.dev
https://www.youtube.com/watch?v=p-iiEDtpy6I
youtube.com
https://www.chromium.org/developers/how-tos/getting-around-the-chrome-source-code/
chromium.org
How to start JIT-ting Read at the source ↗
darksi.de
https://github.com/thlorenz/v8-perf/blob/master/compiler.md
github.com
https://docs.google.com/document/d/1wW_VkkIwhAAgAxLYM0wvoTEkq8XykibDIikGpWH7l1I/edit
docs.google.com
Intro to Chrome’s V8 from an exploit development angle Read at the source ↗
sensepost.com
JavaScript engine fundamentals: optimizing prototypes Read at the source ↗
benediktmeurer.de
https://doar-e.github.io/blog/2020/11/17/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations/
doar-e.github.io
Sea of Nodes Read at the source ↗
darksi.de
https://docs.google.com/document/d/13c-xXmFOMcpUQNqo66XWQt3u46TsBjXrHrh4c045l-A
docs.google.com
https://github.blog/2022-06-29-the-chromium-super-inline-cache-type-confusion/
github.blog
https://docs.google.com/presentation/d/1Z9iIHojKDrXvZ27gRX51UxHD-bKf1QcPzSijntpMJBM/edit
docs.google.com
https://docs.google.com/presentation/d/1sOEF4MlF7LeO7uq-uThJSulJlTh--wgLeaVibsbb3tc/edit
docs.google.com
https://medium.com/dailyjs/understanding-v8s-bytecode-317d46c94775
medium.com
https://v8.dev/blog/v8-release-68
v8.dev
https://docs.google.com/presentation/d/1chhN90uB8yPaIhx_h2M3lPyxPgdPmkADqSNAoXYQiVE/edit
docs.google.com
Elsewhere on jhalon.github.io (1)