qwokka / wail Goto Github PK

Hello, been having an issue

let parser = new WailParser(binary);
parser.getGlobalIndex(0); //just so the import section gets parsed
parser.parse();
let output = parser.write(); //this produces the corrupt output

It seems to output 2 bytes short at the end of the table omitting the kind and type byte of the last entry (shifting the next section into the 2 bytes).
Happened on quite a big binary but was able to reproduce on a small demo one

data.zip

Hey,
I've just noticed that OP_BLOCK in wail reads a single byte ahead, which is supposed to be the block's return type, but in fact it should be a varuint read, because whatever type follows OP_BLOCK is allowed to be one of the module type definitions. I was just working on a WASM module that had a hand-crafted block like this:

    block  ;; label = @1
      f32.const 0x1.fffe1cp-96 (;=2.52432e-29;)
      drop
    end)

That translates to [2, 128, 4, 67, 14, 255, 255, 15, 26, 11, 11]. As you can see, once WAIL reads 128, it then thinks the next opcode is 4 (OP_IF), once again it reads one byte, then the opcode it encounters is 14 (OP_BR_TABLE), and then it reads the varuint value of 245888 or so. But of course that isn't the end of problems, because then it reads 245888 more varuints, which all end up outside of the memory bounds so it keeps growing the memory and reading zeroes constantly. All this is handled by the browser perfectly, since the browser reads a varuint. It would be cool to see WAIL fix this bug to read a varuint too :)
I would assume that OP_LOOP and OP_IF have the same vulnerability.

First I would like to thank you immensely for this tool, and second I would like to ask if you have any example of game modifications made by unity. I have a problem because 90% of games are using RSA or AES to protect requests, is there any way to hook these functions?

When the example edit function example runs it creates an unreachable statement within the wasm.

WAIL edited wasm below.
(module (func $changeMe (;0;) (export "changeMe") (result i32) unreachable i32.const 1337 return ) )
Is this intentional?

(Awesome tool first of all) I want to be able to edit/call a function without knowing originally what the target method looks like. Like the title says, is there a way I get the params/return type from a function index to help with this?
Something like?

const funcIndex = wail.getFunctionIndex(0);
const functionParams = wail.getFunctionParams(funcIndex);
const functionReturnType = wail.getFunctionReturnType(funcIndex);

Not sure if I'm making a lot of sense