corpus.blog
41,832 blogs · 5,239,565 posts Claim your blog
Record · corpus.blog/posts/01a0878d-be1a-728d-b309-350831f799cd

Chrome Browser Exploitation, Part 1: Introduction to V8 and JavaScript Internals

jhalon.github.io · published 22 October 2022

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jhalon.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
62
Words captured
9,251

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://threatpost.com/google-chrome-bug-actively-exploited-zero-day/179161/
threatpost.com
https://www.forbes.com/sites/gordonkelly/2022/07/06/google-chrome-browser-zero-day-hack-new-threat-exploit-upda-chrome/?sh=12daf8a5185f
forbes.com
https://www.cvedetails.com/cve/CVE-1999-0280/
cvedetails.com
https://www.youtube.com/watch?v=przDcQe6n5o
youtube.com
https://twitter.com/BouncyHat
twitter.com
http://www.irongeek.com/i.php?page=videos/derbycon8/track-4-02-offensive-browser-extension-development-michael-weber
irongeek.com
https://twitter.com/maxpl0it
twitter.com
https://www.blackhat.com/us-22/training/schedule/
blackhat.com
https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html
chromereleases.googleblog.com
https://twitter.com/5aelo
twitter.com
https://gist.github.com/jhalon/5cbaab99dccadbf8e783921358020159
gist.github.com
https://v8.dev/
v8.dev
https://spidermonkey.dev/
spidermonkey.dev
https://github.com/chakra-core/ChakraCore
github.com
https://developer.apple.com/documentation/javascriptcore
developer.apple.com
https://tc39.es/ecma262/
tc39.es
https://github.com/v8/v8/blob/main/src/interpreter/bytecodes.h
github.com
https://www.youtube.com/watch?v=5nmpokoRaZI
youtube.com
https://en.wikipedia.org/wiki/Stack_machine
en.wikipedia.org
https://medium.com/dailyjs/understanding-v8s-bytecode-317d46c94775
medium.com
https://v8.dev/blog/ignition-interpreter
v8.dev
https://262.ecma-international.org/6.0/
262.ecma-international.org
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/typeof
developer.mozilla.org
http://www.ecma-international.org/ecma-262/6.0/
ecma-international.org
https://tc39.github.io/ecma262/
tc39.github.io
https://benediktmeurer.de/images/2018/object-model-20180614.svg
benediktmeurer.de
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/js-objects.h;l=327?q=JSObject&ss=chromium%2Fchromium%2Fsrc:v8%2F
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/fixed-array.h;l=101?q=FixedArray&sq=&ss=chromium%2Fchromium%2Fsrc:v8%2F
source.chromium.org
https://v8.dev/docs/torque
v8.dev
https://source.chromium.org/chromium/chromium/src/+/main:out/win-Debug/gen/v8/torque-generated/src/objects/
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/objects.h;l=37;bpv=0;bpt=1
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/map.h;l=122-201
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/descriptor-array.h
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/transitions.h?q=TransitionsAccessor&ss=chromium%2Fchromium%2Fsrc:v8%2F
source.chromium.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/transitions.h?q=TransitionArray&ss=chromium%2Fchromium%2Fsrc:v8%2F
source.chromium.org
https://v8.dev/blog/system-analyzer
v8.dev
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/objects/elements-kind.h;l=78
source.chromium.org
https://www.youtube.com/watch?v=m9cTaYI95Zc
youtube.com
https://v8.dev/_img/elements-kinds/lattice.svg
v8.dev
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windbg
learn.microsoft.com
https://blog.mattjustice.com/2018/08/24/gdb-for-windbg-users/
blog.mattjustice.com
https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/d--da--db--dc--dd--dd--df--dp--dq--du--dw--dw--dyb--dyd--display-memor
learn.microsoft.com
https://en.wikipedia.org/wiki/Tagged_pointer
en.wikipedia.org
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/common/ptr-compr-inl.h
source.chromium.org
https://twitter.com/gymR4T
twitter.com
http://www.phrack.org/issues/70/3.html
phrack.org
https://www.youtube.com/watch?v=IFWulQnM5E0
youtube.com
https://jayconrod.com/posts/52/a-tour-of-V8--object-representation
jayconrod.com
http://phrack.org/issues/70/9.html
phrack.org
https://v8.dev/blog/fast-properties
v8.dev
https://blog.dashlane.com/how-is-data-stored-in-v8-js-engine-memory/
blog.dashlane.com
JavaScript engine fundamentals: Shapes and Inline Caches Read at the source ↗
benediktmeurer.de
https://draft.li/blog/2016/12/22/javascript-engines-hidden-classes/
draft.li
http://richardartoul.github.io/jekyll/update/2015/04/26/hidden-classes.html
richardartoul.github.io
https://www.sciencedirect.com/science/article/pii/S2666281722000816
sciencedirect.com
https://github.com/danbev/learning-v8
github.com
https://v8.dev/blog/pointer-compression
v8.dev
SMIs and Doubles Read at the source ↗
darksi.de
https://zon8.re/posts/v8-chrome-architecture-reading-list-for-vulnerability-researchers/
zon8.re
https://v8.dev/blog
v8.dev
https://medium.com/@bpmxmqd/v8-engine-jsobject-structure-analysis-and-memory-optimization-ideas-be30cfcdcd16
medium.com
https://engineering.linecorp.com/en/blog/v8-hidden-class/
engineering.linecorp.com