# turbofan

Published articles for turbofan.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Modern attacks on the Chrome browser : optimizations and deoptimizations

DevFeed: [Modern attacks on the Chrome browser : optimizations and deoptimizations](<https://devfeed.tech/articles/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations-39711.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2020/11/17/modern-attacks-on-the-chrome-browser-optimizations-and-deoptimizations/>)

Author: Jeremy "@\_\_x86" Fetiveau

Published: 2020-11-17T08:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [Chrome](<https://devfeed.tech/topics/chrome.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [V8](<https://devfeed.tech/topics/v8.md>), [Hacking](<https://devfeed.tech/topics/hacking.md>)

Tags: [chrome](<https://devfeed.tech/tags/chrome.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [hacking](<https://devfeed.tech/tags/hacking.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [turbofan](<https://devfeed.tech/tags/turbofan.md>), [v8](<https://devfeed.tech/tags/v8.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

This article analyzes a security vulnerability in Chrome's V8 JavaScript engine, focusing on how TurboFan's simplified lowering phase mishandles deoptimization-related nodes. The bug can cause incorrect deoptimization data, allowing a fake object to be materialized and execution to continue with an arbitrary object pointer in an accumulator register.

### Source excerpt

Introduction Late 2019, I presented at an internal Azimuth Security conference some work on hacking Chrome through it's JavaScript engine. One of the topics I've been playing with at that time was deoptimization and so I discussed, among others, vulnerabilities in the deoptimizer. For my talk at InfiltrateCon 2020 in ...

## Circumventing Chrome's hardening of typer bugs

DevFeed: [Circumventing Chrome's hardening of typer bugs](<https://devfeed.tech/articles/circumventing-chrome-s-hardening-of-typer-bugs-39709.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2019/05/09/circumventing-chromes-hardening-of-typer-bugs/>)

Author: Jeremy "\_\_x86" Fetiveau

Published: 2019-05-09T15:00:00Z

Content type: article

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [bug](<https://devfeed.tech/topics/bug.md>), [Chrome](<https://devfeed.tech/topics/chrome.md>), [V8](<https://devfeed.tech/topics/v8.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [Optimization](<https://devfeed.tech/topics/optimization.md>)

Tags: [bugs](<https://devfeed.tech/tags/bugs.md>), [chrome](<https://devfeed.tech/tags/chrome.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [hardening](<https://devfeed.tech/tags/hardening.md>), [optimization](<https://devfeed.tech/tags/optimization.md>), [turbofan](<https://devfeed.tech/tags/turbofan.md>), [v8](<https://devfeed.tech/tags/v8.md>)

### AI overview

This technical article explains how Chrome's TurboFan engine hardened bounds checks against typer bugs and discusses how those bugs can still be exploited in recent V8 versions. It examines the relevant lowering and linearization changes and presents a sample exploit for V8 7.5.0.

### Source excerpt

Introduction Some recent Chrome exploits were taking advantage of Bounds-Check-Elimination in order to get a R/W primitive from a TurboFan's typer bug (a bug that incorrectly computes type information during code optimization). Indeed during the simplified lowering phase when visiting a CheckBounds node if the engine can guarantee that ...

## Introduction to TurboFan

DevFeed: [Introduction to TurboFan](<https://devfeed.tech/articles/introduction-to-turbofan-39708.md>)

Original publisher: [Read original article](<https://doar-e.github.io/blog/2019/01/28/introduction-to-turbofan/>)

Author: Jeremy "\_\_x86" Fetiveau

Published: 2019-01-28T16:00:00Z

Content type: tutorial

Language: en

Sources: [Diary of a reverse-engineer](<https://devfeed.tech/sources/diary-of-a-reverse-engineer.md>)

Topics: [JavaScript](<https://devfeed.tech/topics/javascript.md>), [V8](<https://devfeed.tech/topics/v8.md>), [JIT](<https://devfeed.tech/topics/jit.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [compilers](<https://devfeed.tech/topics/compilers.md>), [debug](<https://devfeed.tech/topics/debug.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [browser](<https://devfeed.tech/tags/browser.md>), [bytecode](<https://devfeed.tech/tags/bytecode.md>), [chromium](<https://devfeed.tech/tags/chromium.md>), [compilers](<https://devfeed.tech/tags/compilers.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploitation](<https://devfeed.tech/tags/exploitation.md>), [introduction](<https://devfeed.tech/tags/introduction.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [jit](<https://devfeed.tech/tags/jit.md>), [turbofan](<https://devfeed.tech/tags/turbofan.md>), [v8](<https://devfeed.tech/tags/v8.md>)

### AI overview

A tutorial on V8's TurboFan optimizing JIT compiler. It explains the sea-of-nodes structure, shows how to build V8 and use its d8 shell and Turbolizer, and examines a vulnerable optimization pass from Google's CTF 2018 before developing an exploit.

### Source excerpt

Introduction Ages ago I wrote a blog post here called first dip in the kernel pool, this year we're going to swim in a sea of nodes! The current trend is to attack JavaScript engines and more specifically, optimizing JIT compilers such as V8's TurboFan, SpiderMonkey's IonMonkey, JavaScriptCore's Data ...