cd - Dave's Blog

Search

Data breakpoints in JavaScript

2016 Jun 17, 5:44

The other day I had to debug a JavaScript UWA that was failing when trying to use an undefined property. In a previous OS build this code would run and the property was defined. I wanted something similar to windbg/cdb's ba command that lets me set a breakpoint on read or writes to a memory location so I could see what was creating the object in the previous OS build and what that code was doing now in the current OS build. I couldn't find such a breakpoint mechanism in Visual Studio or F12 so I wrote a little script to approximate JavaScript data breakpoints.

The script creates a stub object with a getter and setter. It actually performs the get or set but also calls debugger; to break in the debugger. In order to handle my case of needing to break when window.object1.object2 was created or accessed, I further had it recursively set up such stub objects for the matching property names.

Its not perfect because it is an enumerable property and shows up in hasOwnProperty and likely other places. But for your average code that checks for the existence of a property via if (object.property) it works well.

PermalinkCommentsdebug debugging javascript

Cdb/Windbg Commands for Runtime Patching

2016 Feb 8, 1:47

You can use conditional breakpoints and debugging commands in windbg and cdb that together can amount to effectively patching a binary at runtime. This can be useful if you have symbols but you can't easily rebuild the binary. Or if the patch is small and the binary requires a great deal of time to rebuild.

Skipping code

If you want to skip a chunk of code you can set a breakpoint at the start address of the code to skip and set the breakpoint's command to change the instruction pointer register to point to the address at the end of the code to skip and go. Voila you're skipping over that code now. For example:

bp 0x6dd6879b "r @eip=0x6dd687c3 ; g"

Changing parameters

You may want to modify parameters or variables and this is simple of course. In the following example a conditional breakpoint ANDs out a bit from dwFlags. Now when we run its as if no one is passing in that flag.

bp wiwi!RelativeCrack "?? dwFlags &= 0xFDFFFFFF;g"

Slightly more difficult is to modify string values. If the new string length is the same size or smaller than the previous, you may be able to modify the string value in place. But if the string is longer or the string memory isn't writable, you'll need a new chunk of memory into which to write your new string. You can use .dvalloc to allocate some memory and ezu to write a string into the newly allocated memory. In the following example I then overwrite the register containing the parameter I want to modify:

.dvalloc 100
ezu 000002a9`d4eb0000 "mfcore.dll"
r rcx = 000002a9`d4eb0000

Calling functions

You can also use .call to actually make new calls to methods or functions. Read more about that on the Old New Thing: Stupid debugger tricks: Calling functions and methods. Again, all of this can be used in a breakpoint command to effectively patch a binary.

PermalinkCommentscdb debug technical windbg

Retweet of mathias

2016 Jan 27, 10:29
Take any Facebook/Instagram photo URL.👉 append `.txt` → ASCII art👉 append `.html` → colored ASCII artE.g. https://scontent-ams3-1.cdninstagram.com/t51.2885-15/e35/11906246_1700002456899911_1391970345_n.jpg.html …
PermalinkComments

JavaScript Types and WinRT Types

2016 Jan 21, 5:35

MSDN covers the topic of JavaScript and WinRT type conversions provided by Chakra (JavaScript Representation of Windows Runtime Types and Considerations when Using the Windows Runtime API), but for the questions I get about it I’ll try to lay out some specifics of that discussion more plainly. I’ve made a TL;DR JavaScript types and WinRT types summary table.

WinRT Conversion JavaScript
Struct ↔️ JavaScript object with matching property names
Class or interface instance JavaScript object with matching property names
Windows.Foundation.Collections.IPropertySet JavaScript object with arbitrary property names
Any DOM object

Chakra, the JavaScript engine powering the Edge browser and JavaScript Windows Store apps, does the work to project WinRT into JavaScript. It is responsible for, among other things, converting back and forth between JavaScript types and WinRT types. Some basics are intuitive, like a JavaScript string is converted back and forth with WinRT’s string representation. For other basic types check out the MSDN links at the top of the page. For structs, interface instances, class instances, and objects things are more complicated.

A struct, class instance, or interface instance in WinRT is projected into JavaScript as a JavaScript object with corresponding property names and values. This JavaScript object representation of a WinRT type can be passed into other WinRT APIs that take the same underlying type as a parameter. This JavaScript object is special in that Chakra keeps a reference to the underlying WinRT object and so it can be reused with other WinRT APIs.

However, if you start with plain JavaScript objects and want to interact with WinRT APIs that take non-basic WinRT types, your options are less plentiful. You can use a plain JavaScript object as a WinRT struct, so long as the property names on the JavaScript object match the WinRT struct’s. Chakra will implicitly create an instance of the WinRT struct for you when you call a WinRT method that takes that WinRT struct as a parameter and fill in the WinRT struct’s values with the values from the corresponding properties on your JavaScript object.

// C# WinRT component
public struct ExampleStruct
{
public string String;
public int Int;
}

public sealed class ExampleStructContainer
{
ExampleStruct value;
public void Set(ExampleStruct value)
{
this.value = value;
}

public ExampleStruct Get()
{
return this.value;
}
}

// JS code
var structContainer = new ExampleWinRTComponent.ExampleNamespace.ExampleStructContainer();
structContainer.set({ string: "abc", int: 123 });
console.log("structContainer.get(): " + JSON.stringify(structContainer.get()));
// structContainer.get(): {"string":"abc","int":123}

You cannot have a plain JavaScript object and use it as a WinRT class instance or WinRT interface instance. Chakra does not provide such a conversion even with ES6 classes.

You cannot take a JavaScript object with arbitrary property names that are unknown at compile time and don’t correspond to a specific WinRT struct and pass that into a WinRT method. If you need to do this, you have to write additional JavaScript code to explicitly convert your arbitrary JavaScript object into an array of property name and value pairs or something else that could be represented in WinRT.

However, the other direction you can do. An instance of a Windows.Foundation.Collections.IPropertySet implementation in WinRT is projected into JavaScript as a JavaScript object with property names and values corresponding to the key and value pairs in the IPropertySet. In this way you can project a WinRT object as a JavaScript object with arbitrary property names and types. But again, the reverse is not possible. Chakra will not convert an arbitrary JavaScript object into an IPropertySet.

// C# WinRT component
public sealed class PropertySetContainer
{
private Windows.Foundation.Collections.IPropertySet otherValue = null;

public Windows.Foundation.Collections.IPropertySet other
{
get
{
return otherValue;
}
set
{
otherValue = value;
}
}
}

public sealed class PropertySet : Windows.Foundation.Collections.IPropertySet
{
private IDictionary map = new Dictionary();

public PropertySet()
{
map.Add("abc", "def");
map.Add("ghi", "jkl");
map.Add("mno", "pqr");
}
// ... rest of PropertySet implementation is simple wrapper around the map member.


// JS code
var propertySet = new ExampleWinRTComponent.ExampleNamespace.PropertySet();
console.log("propertySet: " + JSON.stringify(propertySet));
// propertySet: {"abc":"def","ghi":"jkl","mno":"pqr"}

var propertySetContainer = new ExampleWinRTComponent.ExampleNamespace.PropertySetContainer();
propertySetContainer.other = propertySet;
console.log("propertySetContainer.other: " + JSON.stringify(propertySetContainer.other));
// propertySetContainer.other: {"abc":"def","ghi":"jkl","mno":"pqr"}

try {
propertySetContainer.other = { "123": "456", "789": "012" };
}
catch (e) {
console.error("Error setting propertySetContainer.other: " + e);
// Error setting propertySetContainer.other: TypeError: Type mismatch
}

There’s also no way to implicitly convert a DOM object into a WinRT type. If you want to write third party WinRT code that interacts with the DOM, you must do so indirectly and explicitly in JavaScript code that is interacting with your third party WinRT. You’ll have to extract the information you want from your DOM objects to pass into WinRT methods and similarly have to pass messages out from WinRT that say what actions the JavaScript should perform on the DOM.

PermalinkCommentschakra development javascript winrt

Retweet of eastwes

2015 Dec 8, 7:07
Forget the $2M, this is easily the most interesting part of the whole deal between Wu-Tang and Martin Shkreli. pic.twitter.com/5nSshXhjnJ
PermalinkComments

Retweet of Grathio

2015 Dec 4, 8:02
Good news! the patent on the Space Shuttle has expired. Go and build, royalty free! https://patents.google.com/patent/US3866863A/en … pic.twitter.com/1QliSmbnaM
PermalinkComments

Retweet of lamutsa

2015 Oct 20, 7:36
@USATODAY will you release this cover too? pic.twitter.com/d0VnrrhQzD
PermalinkComments

Retweet of radix42

2015 Aug 9, 8:55
She said "daddy I can't download this" and I looked and said "I'm so sorry we're living in a @doctorow novel" and had to explain :-(
PermalinkComments

Retweet of chockenberry

2015 Jul 27, 9:23
When we can’t even research the problem of gun violence, we’re screwed. http://www.washingtonpost.com/news/storyline/wp/2015/01/14/why-the-cdc-still-isnt-researching-gun-violence-despite-the-ban-being-lifted-two-years-ago/ …
PermalinkComments

Tweet from David_Risney

2015 Apr 12, 10:39
Does 'charset=utf8' work anywhere? Or do other browsers fallback to UTF-8 just giving the appearance? @ericlaw http://wp.me/p60i9o-r 
PermalinkComments

Tweet from David_Risney

2015 Apr 9, 11:21
CSS to render Markdown as unrendered Markdown https://gist.github.com/ImJasonH/c00cdd7aece6945fb8ea …
PermalinkComments

Tweet from David_Risney

2015 Apr 9, 4:34
Scripting in cdb/kd is not pleasant. Using PowerShell to script cdb/kd instead: http://www.leeholmes.com/blog/2009/01/21/scripting-windbg-with-powershell/ … . Any other better ways?
PermalinkComments

Retweet of bfosterjr

2015 Apr 6, 7:17
John Oliver with Snowden - http://www.theverge.com/2015/4/6/8352435/john-oliver-edward-snowden-last-week-tonight …
PermalinkComments

Retweet of anatudor

2015 Mar 22, 10:24
Collection can be found here - over 100 demos showing what can be done with just 1 range input http://codepen.io/collection/DgYaMj/8/ … pic.twitter.com/CAndEDATj9
PermalinkComments

Retweet of dveditz

2015 Mar 19, 6:56
The joys of bug bounty programs: someone reported that port 21 was open on http://ftp.mozilla.org 
PermalinkComments

nickholmes:HOW CAN THERE BE GLOBAL WARMING?!

2015 Feb 24, 3:35


nickholmes:

HOW CAN THERE BE GLOBAL WARMING?!

PermalinkComments

nickholmes:HOW CAN THERE BE GLOBAL WARMING?!

2015 Feb 24, 3:35


nickholmes:

HOW CAN THERE BE GLOBAL WARMING?!

PermalinkComments

Retweet of JustRogDigiTec

2015 Feb 13, 6:54
Still on the fence if this is good for the web. Love the progress!! “@shanselman: Flash isn't dead. It's undead. http://www.hanselman.com/blog/JavaScriptHasWonRunFlashWithMozillaShumwayAndDevelopSilverlightInJSWithFayde.aspx …
PermalinkComments

Retweet of DrPizza

2015 Feb 11, 12:38
btw, @fxshaw, if Microsoft wants to rebrand with my new logo, I'm sure we can come to a suitable arrangement. http://cdn.arstechnica.net/wp-content/uploads/2015/02/cool-microsoft1-300x150.png …
PermalinkComments

newsycombinator: The Hitchhiker's Guide to the Galaxy Game – 30th Anniversary Edition

2015 Jan 27, 8:31
Hacker News @newsycombinator :
The Hitchhiker's Guide to the Galaxy Game – 30th Anniversary Edition http://www.bbc.co.uk/programmes/articles/1g84m0sXpnNCv84GpN2PLZG/the-hitchhikers-guide-to-the-galaxy-game-30th-anniversary-edition …
PermalinkComments
Older Entries Creative Commons License Some rights reserved.