23 Use after free (On demand [function] ptrs | vtables) Requirement: Control the freed chunk via a JS readable string Strategy:  Find a non virtual f
{"Image DocumentName": "Use after free (On demand [function] ptrs | vtables)", "Image ImageDescription": "Requirement: Control the freed chunk via a JS readable string. Strategy: Find a non virtual function, exercisable via your primitives, that will write to a member variable a function pointer, an on demand vtable (or still interesting a heap address) Read ptr back from JS string that got the object chunk. Object. Memory chunk claimed by a string. class cyberpompeii { private: void   ptr; public: void f() { HMODULE dll=LoadLibrary( kernel32.dll ); ptr=GetProcAddress(dll, WinExec ); } }; AAAAAAAAAAAAAA. [\u2026] AAAAA. 0x7F AAAAAAAAAAAA. uint32_ptr Vtable_ptr. [\u2026] void   ptr. AAAAAAAAAAAAAA. [\u2026] AAAAAAAAAAAAA.", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}