I use Adobe Reader XI for a little research project.
I know that Adobe use SpiderMonkey as its JS engine.
When opening a .pdf file that contains JS, the JS code is compiled in runtime in parts (JIT), to bytecode and the bytecode is mapped on the heap in pages with RW access. I try to understand how the bytecode then executes. Where the executable opcodes are located/mapped in runtime?
!address command, I don't see any page with RX access on the heap.
What I try to do is to figure out how the JS engine works, down to the page level. Means, how the engine interprets the bytecode to executable opcodes and where do he map that executable instructions themselves, alongside how he determines where to map each time the next executable code.