Re: Trying to crack the Firefox crashing issue
On 11/5/25 1:20 am, Damien Stewart wrote:
Comparing with var_p0=var_p0@entry=262000 and var_p1=2016478208 p1
looks corrupted. There could some possibility of endian corruption. I
reversed it and got $41578 or 267640 which is within range of 262000
in p0. Why p0 looks fine only p1 doesn't I don't know. Being register
based means PPC has less chance of endian errors if registers are used
to pass parameters. So if a code block could pass all generic data in
registers, process it natively, then return result in registers, there
would be less chance of endian errors. I've also read originally WASM
was endian agnostic or processed in the native endian of host CPU, and
was designed that way, but later they decided to change it to be non
portable and hack it to be little endian only because that's defacto
standard endian now days. Or something like that.
Quoting myself here. I got it! I've got evidence it's endian corruption. :-)
I tried reversing 2016478208 bytes and it worked! My numbers were off
from above, which I suspected were, but the right one works. So this
2016478208 or $78310400 reverses to 274808 or $43178. I figured out what
command to set a register and plugged it into r5. It performed the load!
It's the static const char *const encodingNames[] array that's messed
up. Or in reality the pointer offset reference. However it's coded it
in. It's grabbed it from a data array off r30 at some point prior and
going by the numbers stored the offsets are already corrupt. So whatever
code is setting the box offset for that string has managed to byte swap
it. This would easily run deep. What ever codes those offsets, it could
be anywhere, with some being fine and others like this one being backwards.
The source string reference being corrupted:
https://salsa.debian.org/search?search=KW_ISO_8859_1&nav_source=navbar&project_id=21123&group_id=2641&search_code=true&repository_ref=release%2Fmaster
I took a screen shot but not sure of the rules about attachments.
--
My regards,
Damien Stewart.
Reply to: