unsafe void IMarshal.MarshalInterface(Windows.Win32.System.Com.IStream pStm, Guid* riid, void* pv, uint dwDestContext, void* pvDestContext, uint mshlflags)
{
uint written;
| <!DOCTYPE html> | |
| <html lang="en"> | |
| <head> | |
| <script src="https://cdnjs.cloudflare.com/ajax/libs/pdf.js/4.1.392/pdf.min.mjs" type="module"></script> | |
| </head> | |
| <body> | |
| <h1>CVE-2024-4367</h1> | |
| <div id="pdf-viewer"></div> |
| Java.perform(() => { | |
| // Register a new WebAppInterface Javascript environment | |
| const WebView = Java.use('android.webkit.WebView'); | |
| const WebAppInterface = Java.registerClass({ | |
| name: 'com.evil.WebAppInterface', | |
| fields: { | |
| mContext: 'android.content.Context', | |
| }, | |
| methods: { | |
| $init: [{ |
| # From the current working directory... | |
| mkdir -p app/src/main/res/values | |
| mkdir -p app/src/main/res/layout | |
| mkdir -p app/src/main/java/com/example/helloworld | |
| cat > app/src/main/AndroidManifest.xml << _EOF | |
| <?xml version="1.0" encoding="utf-8"?> | |
| <manifest xmlns:android="http://schemas.android.com/apk/res/android" | |
| package="com.example.helloworld"> |
| for app in /var/containers/Bundle/Application/*; do | |
| guid=$(basename "$app") | |
| name=$(plutil $app/*.app/Info.plist | grep CFBundleIdentifier) | |
| echo "$name => $guid" | |
| done |
| Java.perform(function() { | |
| var TextView = Java.use("android.widget.TextView"); | |
| // Constants for InputType flags | |
| var TYPE_CLASS_TEXT = 0x00000001; | |
| var TYPE_CLASS_NUMBER = 0x00000002; | |
| var TYPE_CLASS_PHONE = 0x00000003; | |
| var TYPE_CLASS_DATETIME = 0x00000004; | |
| var TYPE_TEXT_VARIATION_PASSWORD = 0x00000080; |
| function demangle(mangledName, options = {}) { | |
| const { nameOnly = false } = options; | |
| let index = 0; | |
| function parseNumber() { | |
| let num = ''; | |
| while (index < mangledName.length && /\d/.test(mangledName[index])) { | |
| num += mangledName[index++]; | |
| } | |
| return parseInt(num, 10); |
| // Thanks @dzonerzy/aesinfo | |
| Java.perform(function() { | |
| var use_single_byte = false; | |
| var complete_bytes = new Array(); | |
| var index = 0; | |
| var secretKeySpecDef = Java.use('javax.crypto.spec.SecretKeySpec'); |
| const fieldTypes = { | |
| int8: { size: 1, read: 'readS8', write: 'writeS8', align: 1 }, | |
| uint8: { size: 1, read: 'readU8', write: 'writeU8', align: 1 }, | |
| int16: { size: 2, read: 'readS16', write: 'writeS16', align: 2 }, | |
| uint16: { size: 2, read: 'readU16', write: 'writeU16', align: 2 }, | |
| int32: { size: 4, read: 'readS32', write: 'writeS32', align: 4 }, | |
| uint32: { size: 4, read: 'readU32', write: 'writeU32', align: 4 }, | |
| int64: { size: 8, read: 'readS64', write: 'writeS64', align: 8 }, | |
| uint64: { size: 8, read: 'readU64', write: 'writeU64', align: 8 }, | |
| float: { size: 4, read: 'readFloat', write: 'writeFloat', align: 4 }, |