launderrvictim state

Immutable

Immutable is /r/-declared (the key difference from /r/laundervictim, which uses /p/launderpkg.Immutable).

gImm

init.2

GetImm

GetImm hands out a pointer to gImm. Standard "victim exposes a pointer to its state" antipattern — but with /r/-declared data, the attacker should still be unable to write through it.

ReadImm

ReadImm reads the current field for after-attack verification.

UseAnyMutator

UseAnyMutator boxes gImm as any and dispatches a /p/-declared AnyMutator. This is the dangerous shape from Attack L: victim boxes its own /r/-declared data through a /p/-defined interface that the attacker can implement.

ApplyHook

ApplyHook dispatches a caller-supplied callback on gImm. The callback's parameter type is /r/launderrvictim-declared, so /p/ packages can't supply this hook — only /r/ realms can.

WithEmbed

WithEmbed embeds launderpkg.Immutable by VALUE (method promotion gives WithEmbed an .Apply method).

WithPtr

WithPtr has a POINTER FIELD to launderpkg.Immutable.

WithVal

WithVal has a VALUE FIELD of launderpkg.Immutable (not embedded; the field is named, no method promotion — but the value is still addressable through c.Inner).

gWithEmbed

gWithPtr

gWithVal

init.13

GetWithEmbed

GetWithPtr

GetWithVal

ReadEmbed

ReadPtr

ReadVal

WithBareEmbed

WithBarePtr

WithBareVal

gWithBareEmbed

gWithBarePtr

gWithBareVal

init.26

GetWithBareEmbed

GetWithBarePtr

GetWithBareVal

ReadBareEmbed

ReadBarePtr

ReadBareVal

gBareSlice

gBarePtrSlice

gBareArr

gBarePtrArr

gBareMap

gBarePtrMap

init.39

GetBareSlice

GetBarePtrSlice

GetBareArr

GetBarePtrArr

GetBareMap

GetBarePtrMap

ReadBareSlice0

ReadBareSlice0Then1

ReadBarePtrSlice0

ReadBareArr0

ReadBarePtrArr0

ReadBareMapA

ReadBarePtrMapA

DeferCallback

DeferCallback installs h as a defer inside an /r/launderrvictim frame, then returns. h runs at frame pop. The question: at the time h is invoked, m.Realm has just been restored to caller's realm by PopFrameAndReturn — but wait, defers run BEFORE PopFrameAndReturn. So m.Realm should still be victim's. Does the deferred h then run under victim authority?

PanicAfterPushDefer

PanicAfterPushDefer pushes a defer and then panics, so the defer runs as part of panic unwinding. Tests that m.Realm is correctly borrowed when the defer body invokes a foreign function.

DeferApplyHook

DeferApplyHook defers an ApplyHook call. The deferred ApplyHook itself runs borrow rule #1 to /r/launderrvictim, and inside the callback runs as borrow rule #1 of the attacker's realm — the standard known-open Apply pattern, but now triggered via defer.

RecoverAndRetry

RecoverAndRetry: inside a victim method, defer a recover, write something to gImm, then panic. After the recover, the function returns normally. Tests that internal panic/recover doesn't leak state.

CallThenPanic

CallThenPanic invokes h synchronously and then panics. If h is attacker-supplied and writes via captured pointer, this is just a re-shape of ApplyHook.

CallPDeferApply

CallPDeferApply: multi-level defer chain. Victim invokes a /p/-method (DeferApply) on a victim-owned \*launderpkg.Immutable; the /p/-method defers the attacker callback. Three frames at callback time: attacker.main → victim.CallPDeferApply → /p/.DeferApply (deferred fn dispatches here).

ImmHook

gHooks

RegisterHook

RunHooks

PlainHook

gPlainHooks

RegisterPlainHook

RunPlainHooks

ClearHooks

MakeWriterClosure

MakeWriterClosure constructs a /r/-victim-declared closure that captures gImm and writes through it. The closure body is /r/-victim- declared, so borrow rule #1 fires at invocation → m.Realm = /r/-victim → write commits with victim authority. Returning this closure to an attacker is "consenting to write" by the victim.

MakeApplyTrampoline

MakeApplyTrampoline returns a closure that captures &gImm.Field indirectly: it captures \*Immutable, and dispatches a caller-supplied callback fn on it. /r/-victim-declared body → borrow rule #1 → m.Realm = /r/-victim. If \`fn\` is /p/-declared (e.g. EvilWrite), it inherits victim authority. This is "victim returns a closure that's itself an Apply-style trampoline" — a packaged Apply.