3 ms·
I managed to run sample app on linux box. Observations: - I am not sure this is 'full' javascript engine. I am thinking more inline with static-eval [0] Exam
by bluesign 7y ago
I managed to run sample app on linux box.
Observations:
- I am not sure this is 'full' javascript engine. I am thinking more inline with static-eval [0]
Example 1:
Date.now()
returns 'Exception: undefined'
Example 2:
console.log([1, 2, 3].map(function(x) { return x; }))
returns 'Exception: function(x) { return x; }'
- I couldn't manage to access DOM
document.write("<h1 id='x'>html</h1><script>console.log(document.getElementById('x'));</script>");
returns empty
- After reversing DLL little bit, seems like it is used as unpacker ( also it has VBA support )
Still can be some vulnerabilities, but saying running full Javascript/DOM implementation is 100% wrong
[0] https://github.com/browserify/static-eval https://github.com/browserify/static-eval
- saagarjha 7y agoIt doesn't have a bunch of standard functions (or they're not hooked up correctly?) but it is very much evaluating input.
- convivialdingo 7y agoThanks for bringing some facts to the discussion.
- minitech 7y agoMy first assumption on seeing Date.now() throw would be that it’s implementing an older standard. new Date().getTime() would be the ES3 equivalent.