From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from out.smtp-auth.no-ip.com (smtp-auth.no-ip.com [8.23.224.61]) by hurricane.the-brannons.com (Postfix) with ESMTPS id 2875F7962B for ; Wed, 15 Jun 2016 18:44:31 -0700 (PDT) X-No-IP: carhart.net@noip-smtp X-Report-Spam-To: abuse@no-ip.com Received: from carhart.net (unknown [99.52.200.227]) (Authenticated sender: carhart.net@noip-smtp) by smtp-auth.no-ip.com (Postfix) with ESMTPA id 24124400662 for ; Wed, 15 Jun 2016 18:45:52 -0700 (PDT) Received: from carhart.net (localhost [127.0.0.1]) by carhart.net (8.13.8/8.13.8) with ESMTP id u5G1jppM013057 for ; Wed, 15 Jun 2016 18:45:51 -0700 Received: from localhost (kevin@localhost) by carhart.net (8.13.8/8.13.8/Submit) with ESMTP id u5G1jphc013054 for ; Wed, 15 Jun 2016 18:45:51 -0700 Date: Wed, 15 Jun 2016 18:45:51 -0700 (PDT) From: Kevin Carhart To: edbrowse-dev@lists.the-brannons.com Message-ID: User-Agent: Alpine 2.03 (LRH 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII Subject: [Edbrowse-dev] a technique for the find-and-fix X-BeenThere: edbrowse-dev@lists.the-brannons.com X-Mailman-Version: 2.1.21 Precedence: list List-Id: Edbrowse Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jun 2016 01:44:31 -0000 I'm excited to share a discovery about one way to go about tackling a big and arcane site. When I'm sitting in jdb, the JS routines that have been digested into memory can be echoed: * ok(window) a,b,c,d,e,f,blah * blah * function blah (a) { b = arcaneMethod(a) } So then simple code injection is possible, so that the arguments to blah can become less opaque. Just overwrite blah from the jdb command line: * function blah (a) { exportable_a = a; b = arcaneMethod(a) } Now I can find out about the arguments to blah: * exportable_a * [Object object] And it will also be legal to pipe this argument back in: * blah(exportable_a) And it will also be legal to try things from that function step by step like: * b=arcaneMethod(exportable_a) In case I know blah produces a runtime error but I don't know which of its six subsidiary calls raises the error, now I can try each one and get down to the root cause more quickly! Kevin