作者：Hcamael@知道创宇404实验室

最近因为某些原因开始学V8的漏洞利用，所以打算写一个系列的文章来记录一下我的学习过程。

概述

在开始研究V8之前肯定得有相应版本的环境，搭建v8环境的教程网上挺多的。在国内搭建环境，因为众所周知的原因，我们会遇到第一个瓶颈，网络瓶颈。不过也挺好解决的，把环境搭在vps上，网速是最快的。不过随后就会遇到第二个瓶颈，性能瓶颈，自用的vps一般性能都是1c1g左右，编译一次将近1h吧。

环境搭建

下面就来详细说明我在WSL编译v8环境的过程：

• 首先装好相关依赖: sudo apt install bison cdbs curl flex g++ git python vim pkg-config

  
  

• 获取depot_tools: git clone https://chromium.googlesource.com/chromium/tools/depot_tools.git

  
  

• 设置depot_tools的环境变量: echo "export PATH=$(pwd)/depot_tools:${PATH}" >> ~/.zshrc

  
  

• 运行fetch v8， 这个命令会把v8克隆下来，v8挺大的，所以这个命令的速度视网络情况而定

  
  

• 安装v8相关的依赖，字体依赖就算用代理也会遇到一些网络问题，但是我目前没有研究字体类的漏洞，我就没有去解决这个问题，所以直接不装字体的依赖：./v8/build/install-build-deps.sh --no-chromeos-fonts

$ cd v8
$ gclient sync
$ gn gen out/x64.release --args='v8_monolithic=true v8_use_external_startup_data=false is_component_build=false is_debug=false target_cpu="x64" use_goma=false goma_dir="None" v8_enable_backtrace=true v8_enable_disassembler=true v8_enable_object_print=true v8_enable_verify_heap=true'
ninja -C out/x64.release d8

$ cat build.sh
#!/bin/bash
VER=$1
if [ -z $2 ];then
        NAME=$VER
else
        NAME=$2
fi
cd v8
git reset --hard $VER
gclient sync -D
gn gen out/x64_$NAME.release --args='v8_monolithic=true v8_use_external_startup_data=false is_component_build=false is_debug=false target_cpu="x64" use_goma=false goma_dir="None" v8_enable_backtrace=true v8_enable_disassembler=true v8_enable_object_print=true v8_enable_verify_heap=true'
ninja -C out/x64_$NAME.release d8

$ time ./build.sh "9.6.180.6"
HEAD is now at 67eacd3dce Version 9.6.180.6
Syncing projects: 100% (29/29), done.
Running hooks: 100% (27/27), done.
Done. Made 178 targets from 98 files in 244ms
ninja: Entering directory `out/x64_9.6.180.6.release'
[1839/1839] LINK ./d8
./build.sh "9.6.180.6"  4581.36s user 691.20s system 1586% cpu 5:32.41 total

$ cat Makefile 
TAG:=$(tag)
IMAGE:=hcamael/v8

default: help

help:
    @echo 'V8/D8 ${TAG} Docker image build file'
    @echo
    @echo 'Usage:'
    @echo '    make clean           Delete dangling images and d8 images'
    @echo '    make build           Build the d8 image using local Dockerfile'
    @echo '    make push            Push an existing image to Docker Hub'
    @echo '    make deploy          Clean, build and push image to Docker Hub'
    @echo '    make github          Tag the project in GitHub'
    @echo

build:
    docker build --build-arg V8_VERSION=${TAG} -t ${IMAGE}:${TAG} .

clean:
    # Remove containers with exited status:
    docker rm `docker ps -a -f status=exited -q` || true
    docker rmi ${IMAGE}:latest || true
    docker rmi ${IMAGE}:${TAG} || true
    # Delete dangling images
    docker rmi `docker images -f dangling=true -q` || true

push:
    docker push docker.io/${IMAGE}:${TAG}
    docker tag ${IMAGE}:${TAG} docker.io/${IMAGE}:latest
    docker push docker.io/${IMAGE}:latest

deploy: clean build push

github:
    git push
    git tag -a ${TAG} -m 'Version ${TAG}'
    git push origin --tags


.PHONY: help build clean push deploy github

$ cat Dockerfile
FROM debian:stable-slim

RUN sed -i 's/deb.debian.org/mirrors.ustc.edu.cn/g' /etc/apt/sources.list
RUN apt-get update && apt-get upgrade -yqq && 
    DEBIAN_FRONTEND=noninteractive apt-get install curl rlwrap vim -yqq gdb && 
    apt-get clean
ARG V8_VERSION=latest
ENV V8_VERSION=$V8_VERSION

LABEL v8.version=$V8_VERSION 
      maintainer="[email protected]"
WORKDIR /v8

COPY /v8_$V8_VERSION/d8 ./

COPY vimrc /root/.vimrc

COPY entrypoint.sh /

RUN chmod +x /entrypoint.sh && 
    mkdir /examples && 
    ln -s /v8/d8 /usr/local/bin/d8

ENTRYPOINT ["/entrypoint.sh"]

参考

往 期 热 门

(点击图片跳转）

原文始发于微信公众号（Seebug漏洞平台）：从 0 开始学 V8 漏洞利用之环境搭建（一）