Niklas Therning ntherning

This code and

  <forceLinkClasses>
    <pattern>com.android.org.conscrypt.**</pattern>
    <pattern>com.android.org.bouncycastle.**</pattern>
    <pattern>org.apache.harmony.security.provider.**</pattern>
  </forceLinkClasses>

Exploiting Lua 5.1 on 32-bit Windows

The following Lua program generates a Lua bytecode program called ignore-unsigned-sga.fnt, which in turn loads a DLL from within an extremely locked down Lua 5.1 sandbox in a program called RelicCOH2.exe. The remainder of this document attempts to explain how this program works by a whirlwind tour of relevent bits of the Lua 5.1 virtual machine.

if string.dump(function()end):sub(1, 12) ~= "\27Lua\81\0\1\4\4\4\8\0" then
  error("This generator requires a 32-bit version of Lua 5.1")
end

local function outer()
  local magic -- In bytecode, the stack slot corresponding to this local is changed

	mkdir open-jfx
	cd open-jfx
	hg clone http://hg.openjdk.java.net/openjfx/8/master
	cd master
	hg clone ssh://hg@bitbucket.org/ntherning/jfx78 rt
	mkdir lib
	cd lib
	curl -O 'http://repo1.maven.org/maven2/org/threeten/threetenbp/0.8.1/threetenbp-0.8.1.jar'
	curl -O 'http://www.antlr3.org/download/antlr-3.1.3.tar.gz'
	tar xvfz antlr-3.1.3.tar.gz

	# You can skip these lines if you'd prefer to work with s3sh
	require 'rubygems'
	require 'aws/s3'
	include AWS::S3

	AWS::S3::DEFAULT_HOST.replace "s3-eu-west-1.amazonaws.com"

	AWS::S3::Base.establish_connection!(
	:access_key_id => 'abc',
	:secret_access_key => '123'

	import kotlinx.coroutines.delay
	import kotlinx.coroutines.launch
	import kotlinx.coroutines.newSingleThreadContext
	import kotlinx.coroutines.runBlocking
	import kotlinx.coroutines.sync.Mutex
	import kotlinx.coroutines.sync.withLock
	import kotlin.native.concurrent.ensureNeverFrozen
	import kotlin.test.Test

	class MutexInvalidMutabilityTest {

	kotlin {
	val isIosDevice = getenv("PLATFORM_NAME")?.startsWith("iphoneos") == true
	val iosTarget: (String, KotlinNativeTarget.() -> Unit) -> KotlinNativeTarget = if (isIosDevice) ::iosArm64 else ::iosX64
	fun iosBuildDir(isDebug: Boolean, isDevice: Boolean): File {
	return project.buildDir.resolve(buildString {
	append("bin/ios/")
	append(if (isDebug) "Debug" else "Release")
	append("-")
	append(if (isDevice) "iphoneos" else "iphonesimulator")
	})