rapid7/metasploit-framework — pull request #1785 by wchen-r7 (2013-04-30 21:47:33+00:00)
Title: Adds function js_mstime_malloc

This function takes advantage of MSTIME's CTIMEAnimationBase::put_values function that's suitable for a no-spray technique (based on wtfuzz's PoC for MS13-008).

How to test:

Attach windbg, setup this breakpoint (Win XP + IE8):

bu mstime!CTIMEAnimationBase::put_values+0x216 ".printf \"[*] Allocating for pointers: 0x%08x\",eax; .echo ; g"

And then run the JavaScript. The breakpoint should give you an address, do a "dda [address]" to check results.