使用 JavaScript 格式化硬盘
不久前，我的一位同事说了一件令我惊讶的话：他说可以使用javascript格式化硬盘！我只是回答“不，这是不可能的”。不过他似乎非常有信心，尽管他也提到这仅适用于Windows...从那时起我就无法放弃对它的思考，但我还没有找到任何执行此类黑客的机会..我倾向于认为他只是在开玩笑，我想证明这一点。但我仍然无法放弃这个“如果会怎样？”我的脑海中浮现出一些问题…… 有人有什么想法吗？
A while ago a colleague of mine said something astonishing to me: he said that one can format a hard drive using javascript! I just replied 'no, this is impossible'. He seemed to be very confident however, although he also mentioned that this is possible for windows only... Since then I can't give up thinking on it, but I haven't found any opportunity of performing such kind of hack... I tend to think that he was just kidding, and I want to prove this. But still, I can't give up this 'what if?' questions emerging in my head...
Does anyone have any ideas?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
给定 JScript，在 WSH 下运行，并具有足够的权限，IIRC，您可以调用几乎任何您喜欢的函数。
但你不能从浏览器内部执行此操作，它们会将所有 JavaScript 沙箱化。
Given JScript, running under WSH, with sufficient rights, you can, IIRC, call just about any function you like.
You can't do that from inside a browser though, they sandbox all the JavaScript.
一般来说，这在网页上是不可能的，因为有适当的安全预防措施来防止来自不受信任来源的脚本进行不适当的访问。然而，Javascript JIT 编译器（如 Chrome/Chromium 和 Opera）和解释器（如 Firefox 和 IE）是非常复杂的软件。其中许多都有缺陷。首先了解具体缺陷：http://en.wikipedia.org/wiki/Buffer_overflow < a href="http://en.wikipedia.org/wiki/Cross-site_scripting" rel="nofollow noreferrer">http://en.wikipedia.org/wiki/Cross-site_scripting
当然，如果您发现任何内容都应该负责任地向软件供应商披露。谷歌和 Mozilla 基金会都对此类发现给予奖励。
Generally this would not be possible from a web page because there are security precautions in place to prevent scripts from untrusted sources having inappropriate access. However Javascript JIT compilers (like in Chrome/Chromium and Opera), and interpreters (like in Firefox and IE) are very complex pieces of software. Many of them have flaws. Start by understanding specific flaws: http://en.wikipedia.org/wiki/Buffer_overflow http://en.wikipedia.org/wiki/Cross-site_scripting
Of course, if you find any you should responsibly disclose them to the software vendor. Google and the Mozilla foundation both give out rewards for such finds.