This is a PoC for launching a ROP chain on 6.72 firmware using Fire30's bad_hoist WebKit exploit.

Developed over the course of several livestreams in https://discord.gg/reversing with the help of Specter.

bad_hoist provides utilities for arbitrary memory access in the WebKit process. This PoC uses these utilities to pivot from a JOP chain into a ROP chain. More details can be found in dist/bad_hoist.js.