// https://syzkaller.appspot.com/bug?id=912f70e859dfffd2533b7cfcd2c71e0dd6f71e9d // autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include __attribute__((noreturn)) static void doexit(int status) { volatile unsigned i; syscall(__NR_exit_group, status); for (i = 0;; i++) { } } #include #include const int kFailStatus = 67; const int kRetryStatus = 69; static void fail(const char* msg, ...) { int e = errno; va_list args; va_start(args, msg); vfprintf(stderr, msg, args); va_end(args); fprintf(stderr, " (errno %d)\n", e); doexit((e == ENOMEM || e == EAGAIN) ? kRetryStatus : kFailStatus); } #define BITMASK_LEN(type, bf_len) (type)((1ull << (bf_len)) - 1) #define BITMASK_LEN_OFF(type, bf_off, bf_len) \ (type)(BITMASK_LEN(type, (bf_len)) << (bf_off)) #define STORE_BY_BITMASK(type, addr, val, bf_off, bf_len) \ if ((bf_off) == 0 && (bf_len) == 0) { \ *(type*)(addr) = (type)(val); \ } else { \ type new_val = *(type*)(addr); \ new_val &= ~BITMASK_LEN_OFF(type, (bf_off), (bf_len)); \ new_val |= ((type)(val)&BITMASK_LEN(type, (bf_len))) << (bf_off); \ *(type*)(addr) = new_val; \ } struct csum_inet { uint32_t acc; }; static void csum_inet_init(struct csum_inet* csum) { csum->acc = 0; } static void csum_inet_update(struct csum_inet* csum, const uint8_t* data, size_t length) { if (length == 0) return; size_t i; for (i = 0; i < length - 1; i += 2) csum->acc += *(uint16_t*)&data[i]; if (length & 1) csum->acc += (uint16_t)data[length - 1]; while (csum->acc > 0xffff) csum->acc = (csum->acc & 0xffff) + (csum->acc >> 16); } static uint16_t csum_inet_digest(struct csum_inet* csum) { return ~csum->acc; } static uint64_t current_time_ms() { struct timespec ts; if (clock_gettime(CLOCK_MONOTONIC, &ts)) fail("clock_gettime failed"); return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000; } static void vsnprintf_check(char* str, size_t size, const char* format, va_list args) { int rv; rv = vsnprintf(str, size, format, args); if (rv < 0) fail("tun: snprintf failed"); if ((size_t)rv >= size) fail("tun: string '%s...' doesn't fit into buffer", str); } static void snprintf_check(char* str, size_t size, const char* format, ...) { va_list args; va_start(args, format); vsnprintf_check(str, size, format, args); va_end(args); } #define COMMAND_MAX_LEN 128 #define PATH_PREFIX \ "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin " #define PATH_PREFIX_LEN (sizeof(PATH_PREFIX) - 1) static void execute_command(bool panic, const char* format, ...) { va_list args; char command[PATH_PREFIX_LEN + COMMAND_MAX_LEN]; int rv; va_start(args, format); memcpy(command, PATH_PREFIX, PATH_PREFIX_LEN); vsnprintf_check(command + PATH_PREFIX_LEN, COMMAND_MAX_LEN, format, args); rv = system(command); if (panic && rv != 0) fail("tun: command \"%s\" failed with code %d", &command[0], rv); va_end(args); } static int tunfd = -1; static int tun_frags_enabled; #define SYZ_TUN_MAX_PACKET_SIZE 1000 #define MAX_PIDS 32 #define ADDR_MAX_LEN 32 #define LOCAL_MAC "aa:aa:aa:aa:%02hx:aa" #define REMOTE_MAC "aa:aa:aa:aa:%02hx:bb" #define LOCAL_IPV4 "172.20.%d.170" #define REMOTE_IPV4 "172.20.%d.187" #define LOCAL_IPV6 "fe80::%02hx:aa" #define REMOTE_IPV6 "fe80::%02hx:bb" #define IFF_NAPI 0x0010 #define IFF_NAPI_FRAGS 0x0020 static void initialize_tun(int id) { if (id >= MAX_PIDS) fail("tun: no more than %d executors", MAX_PIDS); tunfd = open("/dev/net/tun", O_RDWR | O_NONBLOCK); if (tunfd == -1) { printf("tun: can't open /dev/net/tun: please enable CONFIG_TUN=y\n"); printf("otherwise fuzzing or reproducing might not work as intended\n"); return; } char iface[IFNAMSIZ]; snprintf_check(iface, sizeof(iface), "syz%d", id); struct ifreq ifr; memset(&ifr, 0, sizeof(ifr)); strncpy(ifr.ifr_name, iface, IFNAMSIZ); ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_NAPI | IFF_NAPI_FRAGS; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) { ifr.ifr_flags = IFF_TAP | IFF_NO_PI; if (ioctl(tunfd, TUNSETIFF, (void*)&ifr) < 0) fail("tun: ioctl(TUNSETIFF) failed"); } if (ioctl(tunfd, TUNGETIFF, (void*)&ifr) < 0) fail("tun: ioctl(TUNGETIFF) failed"); tun_frags_enabled = (ifr.ifr_flags & IFF_NAPI_FRAGS) != 0; char local_mac[ADDR_MAX_LEN]; snprintf_check(local_mac, sizeof(local_mac), LOCAL_MAC, id); char remote_mac[ADDR_MAX_LEN]; snprintf_check(remote_mac, sizeof(remote_mac), REMOTE_MAC, id); char local_ipv4[ADDR_MAX_LEN]; snprintf_check(local_ipv4, sizeof(local_ipv4), LOCAL_IPV4, id); char remote_ipv4[ADDR_MAX_LEN]; snprintf_check(remote_ipv4, sizeof(remote_ipv4), REMOTE_IPV4, id); char local_ipv6[ADDR_MAX_LEN]; snprintf_check(local_ipv6, sizeof(local_ipv6), LOCAL_IPV6, id); char remote_ipv6[ADDR_MAX_LEN]; snprintf_check(remote_ipv6, sizeof(remote_ipv6), REMOTE_IPV6, id); execute_command(1, "sysctl -w net.ipv6.conf.%s.accept_dad=0", iface); execute_command(1, "sysctl -w net.ipv6.conf.%s.router_solicitations=0", iface); execute_command(1, "ip link set dev %s address %s", iface, local_mac); execute_command(1, "ip addr add %s/24 dev %s", local_ipv4, iface); execute_command(1, "ip -6 addr add %s/120 dev %s", local_ipv6, iface); execute_command(1, "ip neigh add %s lladdr %s dev %s nud permanent", remote_ipv4, remote_mac, iface); execute_command(1, "ip -6 neigh add %s lladdr %s dev %s nud permanent", remote_ipv6, remote_mac, iface); execute_command(1, "ip link set dev %s up", iface); } #define DEV_IPV4 "172.20.%d.%d" #define DEV_IPV6 "fe80::%02hx:%02hx" #define DEV_MAC "aa:aa:aa:aa:%02hx:%02hx" static void initialize_netdevices(int id) { unsigned i; const char* devtypes[] = {"ip6gretap", "bridge", "vcan"}; const char* devnames[] = {"lo", "sit0", "bridge0", "vcan0", "tunl0", "gre0", "gretap0", "ip_vti0", "ip6_vti0", "ip6tnl0", "ip6gre0", "ip6gretap0", "erspan0"}; for (i = 0; i < sizeof(devtypes) / (sizeof(devtypes[0])); i++) execute_command(0, "ip link add dev %s0 type %s", devtypes[i], devtypes[i]); for (i = 0; i < sizeof(devnames) / (sizeof(devnames[0])); i++) { char addr[ADDR_MAX_LEN]; snprintf_check(addr, sizeof(addr), DEV_IPV4, id, id + 10); execute_command(0, "ip -4 addr add %s/24 dev %s", addr, devnames[i]); snprintf_check(addr, sizeof(addr), DEV_IPV6, id, id + 10); execute_command(0, "ip -6 addr add %s/120 dev %s", addr, devnames[i]); snprintf_check(addr, sizeof(addr), DEV_MAC, id, id + 10); execute_command(0, "ip link set dev %s address %s", devnames[i], addr); execute_command(0, "ip link set dev %s up", devnames[i]); } } static void setup_tun(uint64_t pid, bool enable_tun) { if (enable_tun) { initialize_tun(pid); initialize_netdevices(pid); } } static int read_tun(char* data, int size) { if (tunfd < 0) return -1; int rv = read(tunfd, data, size); if (rv < 0) { if (errno == EAGAIN) return -1; if (errno == EBADFD) return -1; fail("tun: read failed with %d", rv); } return rv; } #define MAX_FRAGS 4 struct vnet_fragmentation { uint32_t full; uint32_t count; uint32_t frags[MAX_FRAGS]; }; static uintptr_t syz_emit_ethernet(uintptr_t a0, uintptr_t a1, uintptr_t a2) { if (tunfd < 0) return (uintptr_t)-1; uint32_t length = a0; char* data = (char*)a1; struct vnet_fragmentation* frags = (struct vnet_fragmentation*)a2; struct iovec vecs[MAX_FRAGS + 1]; uint32_t nfrags = 0; if (!tun_frags_enabled || frags == NULL) { vecs[nfrags].iov_base = data; vecs[nfrags].iov_len = length; nfrags++; } else { bool full = true; uint32_t i, count = 0; full = frags->full; count = frags->count; if (count > MAX_FRAGS) count = MAX_FRAGS; for (i = 0; i < count && length != 0; i++) { uint32_t size = 0; size = frags->frags[i]; if (size > length) size = length; vecs[nfrags].iov_base = data; vecs[nfrags].iov_len = size; nfrags++; data += size; length -= size; } if (length != 0 && (full || nfrags == 0)) { vecs[nfrags].iov_base = data; vecs[nfrags].iov_len = length; nfrags++; } } return writev(tunfd, vecs, nfrags); } static void flush_tun() { char data[SYZ_TUN_MAX_PACKET_SIZE]; while (read_tun(&data[0], sizeof(data)) != -1) ; } struct ipt_getinfo { char name[32]; unsigned int valid_hooks; unsigned int hook_entry[5]; unsigned int underflow[5]; unsigned int num_entries; unsigned int size; }; struct ipt_get_entries { char name[32]; unsigned int size; unsigned int pad; char entrytable[1024]; }; struct xt_counters { uint64_t pcnt, bcnt; }; struct ipt_replace { char name[32]; unsigned int valid_hooks; unsigned int num_entries; unsigned int size; unsigned int hook_entry[5]; unsigned int underflow[5]; unsigned int num_counters; struct xt_counters* counters; char entrytable[1024]; }; struct ipt_table_desc { const char* name; struct ipt_getinfo info; struct ipt_get_entries entries; struct ipt_replace replace; struct xt_counters counters[10]; }; static struct ipt_table_desc ipv4_tables[] = { {.name = "filter"}, {.name = "nat"}, {.name = "mangle"}, {.name = "raw"}, {.name = "security"}, }; #define IPT_BASE_CTL 64 #define IPT_SO_SET_REPLACE (IPT_BASE_CTL) #define IPT_SO_GET_INFO (IPT_BASE_CTL) #define IPT_SO_GET_ENTRIES (IPT_BASE_CTL + 1) static void checkpoint_net_namespace(void) { socklen_t optlen; unsigned i; int fd; fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)"); for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) { struct ipt_table_desc* table = &ipv4_tables[i]; strcpy(table->info.name, table->name); strcpy(table->entries.name, table->name); strcpy(table->replace.name, table->name); optlen = sizeof(table->info); if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &table->info, &optlen)) { switch (errno) { case EPERM: case ENOENT: case ENOPROTOOPT: continue; } fail("getsockopt(IPT_SO_GET_INFO)"); } if (table->info.size > sizeof(table->entries.entrytable)) fail("table size is too large: %u", table->info.size); if (table->info.num_entries > sizeof(table->counters) / sizeof(table->counters[0])) fail("too many counters: %u", table->info.num_entries); table->entries.size = table->info.size; optlen = sizeof(table->entries) - sizeof(table->entries.entrytable) + table->info.size; if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &table->entries, &optlen)) fail("getsockopt(IPT_SO_GET_ENTRIES)"); table->replace.valid_hooks = table->info.valid_hooks; table->replace.num_entries = table->info.num_entries; table->replace.counters = table->counters; table->replace.size = table->info.size; memcpy(table->replace.hook_entry, table->info.hook_entry, sizeof(table->replace.hook_entry)); memcpy(table->replace.underflow, table->info.underflow, sizeof(table->replace.underflow)); memcpy(table->replace.entrytable, table->entries.entrytable, table->info.size); } close(fd); } static void reset_net_namespace(void) { struct ipt_get_entries entries; struct ipt_getinfo info; socklen_t optlen; unsigned i; int fd; memset(&info, 0, sizeof(info)); memset(&entries, 0, sizeof(entries)); fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); if (fd == -1) fail("socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)"); for (i = 0; i < sizeof(ipv4_tables) / sizeof(ipv4_tables[0]); i++) { struct ipt_table_desc* table = &ipv4_tables[i]; if (table->info.valid_hooks == 0) continue; strcpy(info.name, table->name); optlen = sizeof(info); if (getsockopt(fd, SOL_IP, IPT_SO_GET_INFO, &info, &optlen)) fail("getsockopt(IPT_SO_GET_INFO)"); if (memcmp(&table->info, &info, sizeof(table->info)) == 0) { strcpy(entries.name, table->name); entries.size = table->info.size; optlen = sizeof(entries) - sizeof(entries.entrytable) + entries.size; if (getsockopt(fd, SOL_IP, IPT_SO_GET_ENTRIES, &entries, &optlen)) fail("getsockopt(IPT_SO_GET_ENTRIES)"); if (memcmp(&table->entries, &entries, optlen) == 0) continue; } table->replace.num_counters = info.num_entries; optlen = sizeof(table->replace) - sizeof(table->replace.entrytable) + table->replace.size; if (setsockopt(fd, SOL_IP, IPT_SO_SET_REPLACE, &table->replace, optlen)) fail("setsockopt(IPT_SO_SET_REPLACE)"); } close(fd); } static void test(); void loop() { int iter; checkpoint_net_namespace(); for (iter = 0;; iter++) { int pid = fork(); if (pid < 0) fail("loop fork failed"); if (pid == 0) { prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0); setpgrp(); flush_tun(); test(); doexit(0); } int status = 0; uint64_t start = current_time_ms(); for (;;) { int res = waitpid(-1, &status, __WALL | WNOHANG); if (res == pid) break; usleep(1000); if (current_time_ms() - start > 5 * 1000) { kill(-pid, SIGKILL); kill(pid, SIGKILL); while (waitpid(-1, &status, __WALL) != pid) { } break; } } reset_net_namespace(); } } long r[3]; void test() { memset(r, -1, sizeof(r)); syscall(__NR_mmap, 0x20000000, 0xfff000, 3, 0x32, -1, 0); r[0] = syscall(__NR_socket, 0xa, 0x801, 0); memcpy((void*)0x20002000, "\x72\x61\x77\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x20002020 = 9; *(uint32_t*)0x20002024 = 4; *(uint32_t*)0x20002028 = 0x380; *(uint32_t*)0x2000202c = 0; *(uint32_t*)0x20002030 = -1; *(uint32_t*)0x20002034 = -1; *(uint32_t*)0x20002038 = 0; *(uint32_t*)0x2000203c = -1; *(uint32_t*)0x20002040 = 0; *(uint32_t*)0x20002044 = -1; *(uint32_t*)0x20002048 = -1; *(uint32_t*)0x2000204c = 0; *(uint32_t*)0x20002050 = -1; *(uint32_t*)0x20002054 = 4; *(uint64_t*)0x20002058 = 0x20004000; *(uint8_t*)0x20002060 = 0; *(uint8_t*)0x20002061 = 0; *(uint8_t*)0x20002062 = 0; *(uint8_t*)0x20002063 = 0; *(uint8_t*)0x20002064 = 0; *(uint8_t*)0x20002065 = 0; *(uint8_t*)0x20002066 = 0; *(uint8_t*)0x20002067 = 0; *(uint8_t*)0x20002068 = 0; *(uint8_t*)0x20002069 = 0; *(uint8_t*)0x2000206a = 0; *(uint8_t*)0x2000206b = 0; *(uint8_t*)0x2000206c = 0; *(uint8_t*)0x2000206d = 0; *(uint8_t*)0x2000206e = 0; *(uint8_t*)0x2000206f = 0; *(uint8_t*)0x20002070 = 0; *(uint8_t*)0x20002071 = 0; *(uint8_t*)0x20002072 = 0; *(uint8_t*)0x20002073 = 0; *(uint8_t*)0x20002074 = 0; *(uint8_t*)0x20002075 = 0; *(uint8_t*)0x20002076 = 0; *(uint8_t*)0x20002077 = 0; *(uint8_t*)0x20002078 = 0; *(uint8_t*)0x20002079 = 0; *(uint8_t*)0x2000207a = 0; *(uint8_t*)0x2000207b = 0; *(uint8_t*)0x2000207c = 0; *(uint8_t*)0x2000207d = 0; *(uint8_t*)0x2000207e = 0; *(uint8_t*)0x2000207f = 0; *(uint8_t*)0x20002080 = 0; *(uint8_t*)0x20002081 = 0; *(uint8_t*)0x20002082 = 0; *(uint8_t*)0x20002083 = 0; *(uint8_t*)0x20002084 = 0; *(uint8_t*)0x20002085 = 0; *(uint8_t*)0x20002086 = 0; *(uint8_t*)0x20002087 = 0; *(uint8_t*)0x20002088 = 0; *(uint8_t*)0x20002089 = 0; *(uint8_t*)0x2000208a = 0; *(uint8_t*)0x2000208b = 0; *(uint8_t*)0x2000208c = 0; *(uint8_t*)0x2000208d = 0; *(uint8_t*)0x2000208e = 0; *(uint8_t*)0x2000208f = 0; *(uint8_t*)0x20002090 = 0; *(uint8_t*)0x20002091 = 0; *(uint8_t*)0x20002092 = 0; *(uint8_t*)0x20002093 = 0; *(uint8_t*)0x20002094 = 0; *(uint8_t*)0x20002095 = 0; *(uint8_t*)0x20002096 = 0; *(uint8_t*)0x20002097 = 0; *(uint8_t*)0x20002098 = 0; *(uint8_t*)0x20002099 = 0; *(uint8_t*)0x2000209a = 0; *(uint8_t*)0x2000209b = 0; *(uint8_t*)0x2000209c = 0; *(uint8_t*)0x2000209d = 0; *(uint8_t*)0x2000209e = 0; *(uint8_t*)0x2000209f = 0; *(uint8_t*)0x200020a0 = 0; *(uint8_t*)0x200020a1 = 0; *(uint8_t*)0x200020a2 = 0; *(uint8_t*)0x200020a3 = 0; *(uint8_t*)0x200020a4 = 0; *(uint8_t*)0x200020a5 = 0; *(uint8_t*)0x200020a6 = 0; *(uint8_t*)0x200020a7 = 0; *(uint8_t*)0x200020a8 = 0; *(uint8_t*)0x200020a9 = 0; *(uint8_t*)0x200020aa = 0; *(uint8_t*)0x200020ab = 0; *(uint8_t*)0x200020ac = 0; *(uint8_t*)0x200020ad = 0; *(uint8_t*)0x200020ae = 0; *(uint8_t*)0x200020af = 0; *(uint8_t*)0x200020b0 = 0; *(uint8_t*)0x200020b1 = 0; *(uint8_t*)0x200020b2 = 0; *(uint8_t*)0x200020b3 = 0; *(uint8_t*)0x200020b4 = 0; *(uint8_t*)0x200020b5 = 0; *(uint8_t*)0x200020b6 = 0; *(uint8_t*)0x200020b7 = 0; *(uint8_t*)0x200020b8 = 0; *(uint8_t*)0x200020b9 = 0; *(uint8_t*)0x200020ba = 0; *(uint8_t*)0x200020bb = 0; *(uint8_t*)0x200020bc = 0; *(uint8_t*)0x200020bd = 0; *(uint8_t*)0x200020be = 0; *(uint8_t*)0x200020bf = 0; *(uint8_t*)0x200020c0 = 0; *(uint8_t*)0x200020c1 = 0; *(uint8_t*)0x200020c2 = 0; *(uint8_t*)0x200020c3 = 0; *(uint8_t*)0x200020c4 = 0; *(uint8_t*)0x200020c5 = 0; *(uint8_t*)0x200020c6 = 0; *(uint8_t*)0x200020c7 = 0; *(uint8_t*)0x200020c8 = 0; *(uint8_t*)0x200020c9 = 0; *(uint8_t*)0x200020ca = 0; *(uint8_t*)0x200020cb = 0; *(uint8_t*)0x200020cc = 0; *(uint8_t*)0x200020cd = 0; *(uint8_t*)0x200020ce = 0; *(uint8_t*)0x200020cf = 0; *(uint8_t*)0x200020d0 = 0; *(uint8_t*)0x200020d1 = 0; *(uint8_t*)0x200020d2 = 0; *(uint8_t*)0x200020d3 = 0; *(uint8_t*)0x200020d4 = 0; *(uint8_t*)0x200020d5 = 0; *(uint8_t*)0x200020d6 = 0; *(uint8_t*)0x200020d7 = 0; *(uint8_t*)0x200020d8 = 0; *(uint8_t*)0x200020d9 = 0; *(uint8_t*)0x200020da = 0; *(uint8_t*)0x200020db = 0; *(uint8_t*)0x200020dc = 0; *(uint8_t*)0x200020dd = 0; *(uint8_t*)0x200020de = 0; *(uint8_t*)0x200020df = 0; *(uint8_t*)0x200020e0 = 0; *(uint8_t*)0x200020e1 = 0; *(uint8_t*)0x200020e2 = 0; *(uint8_t*)0x200020e3 = 0; *(uint8_t*)0x200020e4 = 0; *(uint8_t*)0x200020e5 = 0; *(uint8_t*)0x200020e6 = 0; *(uint8_t*)0x200020e7 = 0; *(uint32_t*)0x200020e8 = 0; *(uint16_t*)0x200020ec = 0xa8; *(uint16_t*)0x200020ee = 0xd0; *(uint32_t*)0x200020f0 = 0; *(uint64_t*)0x200020f8 = 0; *(uint64_t*)0x20002100 = 0; *(uint16_t*)0x20002108 = 0x28; memcpy((void*)0x2000210a, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20002127 = 0; *(uint32_t*)0x20002128 = 0xfffffffe; *(uint8_t*)0x20002130 = 0xfe; *(uint8_t*)0x20002131 = 0x80; *(uint8_t*)0x20002132 = 0; *(uint8_t*)0x20002133 = 0; *(uint8_t*)0x20002134 = 0; *(uint8_t*)0x20002135 = 0; *(uint8_t*)0x20002136 = 0; *(uint8_t*)0x20002137 = 0; *(uint8_t*)0x20002138 = 0; *(uint8_t*)0x20002139 = 0; *(uint8_t*)0x2000213a = 0; *(uint8_t*)0x2000213b = 0; *(uint8_t*)0x2000213c = 0; *(uint8_t*)0x2000213d = 0; *(uint8_t*)0x2000213e = 0; *(uint8_t*)0x2000213f = 0xaa; *(uint8_t*)0x20002140 = -1; *(uint8_t*)0x20002141 = 1; *(uint8_t*)0x20002142 = 0; *(uint8_t*)0x20002143 = 0; *(uint8_t*)0x20002144 = 0; *(uint8_t*)0x20002145 = 0; *(uint8_t*)0x20002146 = 0; *(uint8_t*)0x20002147 = 0; *(uint8_t*)0x20002148 = 0; *(uint8_t*)0x20002149 = 0; *(uint8_t*)0x2000214a = 0; *(uint8_t*)0x2000214b = 0; *(uint8_t*)0x2000214c = 0; *(uint8_t*)0x2000214d = 0; *(uint8_t*)0x2000214e = 0; *(uint8_t*)0x2000214f = 1; *(uint32_t*)0x20002150 = htobe32(0); *(uint32_t*)0x20002154 = htobe32(0); *(uint32_t*)0x20002158 = htobe32(0); *(uint32_t*)0x2000215c = htobe32(0); *(uint32_t*)0x20002160 = htobe32(0); *(uint32_t*)0x20002164 = htobe32(0); *(uint32_t*)0x20002168 = htobe32(0); *(uint32_t*)0x2000216c = htobe32(0); *(uint8_t*)0x20002170 = 0x73; *(uint8_t*)0x20002171 = 0x79; *(uint8_t*)0x20002172 = 0x7a; *(uint8_t*)0x20002173 = 0; *(uint8_t*)0x20002174 = 0; memcpy((void*)0x20002180, "\x69\x66\x62\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x20002190 = 0; *(uint8_t*)0x20002191 = 0; *(uint8_t*)0x20002192 = 0; *(uint8_t*)0x20002193 = 0; *(uint8_t*)0x20002194 = 0; *(uint8_t*)0x20002195 = 0; *(uint8_t*)0x20002196 = 0; *(uint8_t*)0x20002197 = 0; *(uint8_t*)0x20002198 = 0; *(uint8_t*)0x20002199 = 0; *(uint8_t*)0x2000219a = 0; *(uint8_t*)0x2000219b = 0; *(uint8_t*)0x2000219c = 0; *(uint8_t*)0x2000219d = 0; *(uint8_t*)0x2000219e = 0; *(uint8_t*)0x2000219f = 0; *(uint8_t*)0x200021a0 = 0; *(uint8_t*)0x200021a1 = 0; *(uint8_t*)0x200021a2 = 0; *(uint8_t*)0x200021a3 = 0; *(uint8_t*)0x200021a4 = 0; *(uint8_t*)0x200021a5 = 0; *(uint8_t*)0x200021a6 = 0; *(uint8_t*)0x200021a7 = 0; *(uint8_t*)0x200021a8 = 0; *(uint8_t*)0x200021a9 = 0; *(uint8_t*)0x200021aa = 0; *(uint8_t*)0x200021ab = 0; *(uint8_t*)0x200021ac = 0; *(uint8_t*)0x200021ad = 0; *(uint8_t*)0x200021ae = 0; *(uint8_t*)0x200021af = 0; *(uint16_t*)0x200021b0 = 0; *(uint8_t*)0x200021b2 = 0; *(uint8_t*)0x200021b3 = 0; *(uint8_t*)0x200021b4 = 0; *(uint32_t*)0x200021b8 = 0; *(uint16_t*)0x200021bc = 0xa8; *(uint16_t*)0x200021be = 0xd8; *(uint32_t*)0x200021c0 = 0; *(uint64_t*)0x200021c4 = 0; *(uint64_t*)0x200021cc = 0; *(uint16_t*)0x200021d8 = 0x30; memcpy((void*)0x200021da, "\x43\x4f\x4e\x4e\x4d\x41\x52\x4b\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x200021f7 = 1; *(uint32_t*)0x200021f8 = 0; *(uint32_t*)0x200021fc = 0; *(uint32_t*)0x20002200 = 0; *(uint8_t*)0x20002204 = 0; *(uint8_t*)0x20002208 = 0; *(uint8_t*)0x20002209 = 0; *(uint8_t*)0x2000220a = 0; *(uint8_t*)0x2000220b = 0; *(uint8_t*)0x2000220c = 0; *(uint8_t*)0x2000220d = 0; *(uint8_t*)0x2000220e = 0; *(uint8_t*)0x2000220f = 0; *(uint8_t*)0x20002210 = 0; *(uint8_t*)0x20002211 = 0; *(uint8_t*)0x20002212 = 0; *(uint8_t*)0x20002213 = 0; *(uint8_t*)0x20002214 = 0; *(uint8_t*)0x20002215 = 0; *(uint8_t*)0x20002216 = 0; *(uint8_t*)0x20002217 = 0; *(uint8_t*)0x20002218 = 0; *(uint8_t*)0x20002219 = 0; *(uint8_t*)0x2000221a = 0; *(uint8_t*)0x2000221b = 0; *(uint8_t*)0x2000221c = 0; *(uint8_t*)0x2000221d = 0; *(uint8_t*)0x2000221e = 0; *(uint8_t*)0x2000221f = 0; *(uint8_t*)0x20002220 = 0; *(uint8_t*)0x20002221 = 0; *(uint8_t*)0x20002222 = 0; *(uint8_t*)0x20002223 = 0; *(uint8_t*)0x20002224 = 0; *(uint8_t*)0x20002225 = 0; *(uint8_t*)0x20002226 = 0; *(uint8_t*)0x20002227 = 0; *(uint8_t*)0x20002228 = 0; *(uint8_t*)0x20002229 = 0; *(uint8_t*)0x2000222a = 0; *(uint8_t*)0x2000222b = 0; *(uint8_t*)0x2000222c = 0; *(uint8_t*)0x2000222d = 0; *(uint8_t*)0x2000222e = 0; *(uint8_t*)0x2000222f = 0; *(uint8_t*)0x20002230 = 0; *(uint8_t*)0x20002231 = 0; *(uint8_t*)0x20002232 = 0; *(uint8_t*)0x20002233 = 0; *(uint8_t*)0x20002234 = 0; *(uint8_t*)0x20002235 = 0; *(uint8_t*)0x20002236 = 0; *(uint8_t*)0x20002237 = 0; *(uint8_t*)0x20002238 = 0; *(uint8_t*)0x20002239 = 0; *(uint8_t*)0x2000223a = 0; *(uint8_t*)0x2000223b = 0; *(uint8_t*)0x2000223c = 0; *(uint8_t*)0x2000223d = 0; *(uint8_t*)0x2000223e = 0; *(uint8_t*)0x2000223f = 0; *(uint8_t*)0x20002240 = 0; *(uint8_t*)0x20002241 = 0; *(uint8_t*)0x20002242 = 0; *(uint8_t*)0x20002243 = 0; *(uint8_t*)0x20002244 = 0; *(uint8_t*)0x20002245 = 0; *(uint8_t*)0x20002246 = 0; *(uint8_t*)0x20002247 = 0; *(uint8_t*)0x20002248 = 0; *(uint8_t*)0x20002249 = 0; *(uint8_t*)0x2000224a = 0; *(uint8_t*)0x2000224b = 0; *(uint8_t*)0x2000224c = 0; *(uint8_t*)0x2000224d = 0; *(uint8_t*)0x2000224e = 0; *(uint8_t*)0x2000224f = 0; *(uint8_t*)0x20002250 = 0; *(uint8_t*)0x20002251 = 0; *(uint8_t*)0x20002252 = 0; *(uint8_t*)0x20002253 = 0; *(uint8_t*)0x20002254 = 0; *(uint8_t*)0x20002255 = 0; *(uint8_t*)0x20002256 = 0; *(uint8_t*)0x20002257 = 0; *(uint8_t*)0x20002258 = 0; *(uint8_t*)0x20002259 = 0; *(uint8_t*)0x2000225a = 0; *(uint8_t*)0x2000225b = 0; *(uint8_t*)0x2000225c = 0; *(uint8_t*)0x2000225d = 0; *(uint8_t*)0x2000225e = 0; *(uint8_t*)0x2000225f = 0; *(uint8_t*)0x20002260 = 0; *(uint8_t*)0x20002261 = 0; *(uint8_t*)0x20002262 = 0; *(uint8_t*)0x20002263 = 0; *(uint8_t*)0x20002264 = 0; *(uint8_t*)0x20002265 = 0; *(uint8_t*)0x20002266 = 0; *(uint8_t*)0x20002267 = 0; *(uint8_t*)0x20002268 = 0; *(uint8_t*)0x20002269 = 0; *(uint8_t*)0x2000226a = 0; *(uint8_t*)0x2000226b = 0; *(uint8_t*)0x2000226c = 0; *(uint8_t*)0x2000226d = 0; *(uint8_t*)0x2000226e = 0; *(uint8_t*)0x2000226f = 0; *(uint8_t*)0x20002270 = 0; *(uint8_t*)0x20002271 = 0; *(uint8_t*)0x20002272 = 0; *(uint8_t*)0x20002273 = 0; *(uint8_t*)0x20002274 = 0; *(uint8_t*)0x20002275 = 0; *(uint8_t*)0x20002276 = 0; *(uint8_t*)0x20002277 = 0; *(uint8_t*)0x20002278 = 0; *(uint8_t*)0x20002279 = 0; *(uint8_t*)0x2000227a = 0; *(uint8_t*)0x2000227b = 0; *(uint8_t*)0x2000227c = 0; *(uint8_t*)0x2000227d = 0; *(uint8_t*)0x2000227e = 0; *(uint8_t*)0x2000227f = 0; *(uint8_t*)0x20002280 = 0; *(uint8_t*)0x20002281 = 0; *(uint8_t*)0x20002282 = 0; *(uint8_t*)0x20002283 = 0; *(uint8_t*)0x20002284 = 0; *(uint8_t*)0x20002285 = 0; *(uint8_t*)0x20002286 = 0; *(uint8_t*)0x20002287 = 0; *(uint8_t*)0x20002288 = 0; *(uint8_t*)0x20002289 = 0; *(uint8_t*)0x2000228a = 0; *(uint8_t*)0x2000228b = 0; *(uint8_t*)0x2000228c = 0; *(uint8_t*)0x2000228d = 0; *(uint8_t*)0x2000228e = 0; *(uint8_t*)0x2000228f = 0; *(uint32_t*)0x20002290 = 0; *(uint16_t*)0x20002294 = 0xa8; *(uint16_t*)0x20002296 = 0xc8; *(uint32_t*)0x20002298 = 0; *(uint64_t*)0x2000229c = 0; *(uint64_t*)0x200022a4 = 0; *(uint16_t*)0x200022b0 = 0x20; memcpy((void*)0x200022b2, "\x4e\x4f\x54\x52\x41\x43\x4b\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x200022cf = 0; *(uint8_t*)0x200022d0 = 0xfe; *(uint8_t*)0x200022d1 = 0x80; *(uint8_t*)0x200022d2 = 0; *(uint8_t*)0x200022d3 = 0; *(uint8_t*)0x200022d4 = 0; *(uint8_t*)0x200022d5 = 0; *(uint8_t*)0x200022d6 = 0; *(uint8_t*)0x200022d7 = 0; *(uint8_t*)0x200022d8 = 0; *(uint8_t*)0x200022d9 = 0; *(uint8_t*)0x200022da = 0; *(uint8_t*)0x200022db = 0; *(uint8_t*)0x200022dc = 0; *(uint8_t*)0x200022dd = 0; *(uint8_t*)0x200022de = 0; *(uint8_t*)0x200022df = 0xbb; *(uint8_t*)0x200022e0 = 0; *(uint8_t*)0x200022e1 = 0; *(uint8_t*)0x200022e2 = 0; *(uint8_t*)0x200022e3 = 0; *(uint8_t*)0x200022e4 = 0; *(uint8_t*)0x200022e5 = 0; *(uint8_t*)0x200022e6 = 0; *(uint8_t*)0x200022e7 = 0; *(uint8_t*)0x200022e8 = 0; *(uint8_t*)0x200022e9 = 0; *(uint8_t*)0x200022ea = -1; *(uint8_t*)0x200022eb = -1; *(uint8_t*)0x200022ec = 0xac; *(uint8_t*)0x200022ed = 0x14; *(uint8_t*)0x200022ee = 0; *(uint8_t*)0x200022ef = 0; *(uint32_t*)0x200022f0 = htobe32(0); *(uint32_t*)0x200022f4 = htobe32(0); *(uint32_t*)0x200022f8 = htobe32(0); *(uint32_t*)0x200022fc = htobe32(0); *(uint32_t*)0x20002300 = htobe32(0); *(uint32_t*)0x20002304 = htobe32(0); *(uint32_t*)0x20002308 = htobe32(0); *(uint32_t*)0x2000230c = htobe32(0); memcpy((void*)0x20002310, "\x74\x75\x6e\x6c\x30\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x20002320 = 0x73; *(uint8_t*)0x20002321 = 0x79; *(uint8_t*)0x20002322 = 0x7a; *(uint8_t*)0x20002323 = 0; *(uint8_t*)0x20002324 = 0; *(uint8_t*)0x20002330 = 0; *(uint8_t*)0x20002331 = 0; *(uint8_t*)0x20002332 = 0; *(uint8_t*)0x20002333 = 0; *(uint8_t*)0x20002334 = 0; *(uint8_t*)0x20002335 = 0; *(uint8_t*)0x20002336 = 0; *(uint8_t*)0x20002337 = 0; *(uint8_t*)0x20002338 = 0; *(uint8_t*)0x20002339 = 0; *(uint8_t*)0x2000233a = 0; *(uint8_t*)0x2000233b = 0; *(uint8_t*)0x2000233c = 0; *(uint8_t*)0x2000233d = 0; *(uint8_t*)0x2000233e = 0; *(uint8_t*)0x2000233f = 0; *(uint8_t*)0x20002340 = 0; *(uint8_t*)0x20002341 = 0; *(uint8_t*)0x20002342 = 0; *(uint8_t*)0x20002343 = 0; *(uint8_t*)0x20002344 = 0; *(uint8_t*)0x20002345 = 0; *(uint8_t*)0x20002346 = 0; *(uint8_t*)0x20002347 = 0; *(uint8_t*)0x20002348 = 0; *(uint8_t*)0x20002349 = 0; *(uint8_t*)0x2000234a = 0; *(uint8_t*)0x2000234b = 0; *(uint8_t*)0x2000234c = 0; *(uint8_t*)0x2000234d = 0; *(uint8_t*)0x2000234e = 0; *(uint8_t*)0x2000234f = 0; *(uint16_t*)0x20002350 = 0x87; *(uint8_t*)0x20002352 = 0; *(uint8_t*)0x20002353 = 0; *(uint8_t*)0x20002354 = 0; *(uint32_t*)0x20002358 = 0; *(uint16_t*)0x2000235c = 0xa8; *(uint16_t*)0x2000235e = 0x110; *(uint32_t*)0x20002360 = 0; *(uint64_t*)0x20002364 = 0; *(uint64_t*)0x2000236c = 0; *(uint16_t*)0x20002378 = 0x68; memcpy((void*)0x2000237a, "\x43\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20002397 = 1; *(uint16_t*)0x20002398 = 0; *(uint16_t*)0x2000239a = 0; *(uint32_t*)0x2000239c = 0; *(uint32_t*)0x200023a0 = 0x40000; memcpy((void*)0x200023a4, "\x73\x6e\x6d\x70\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); memcpy((void*)0x200023b4, "\x73\x79\x7a\x31\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint64_t*)0x200023d8 = 0; *(uint64_t*)0x20004000 = 0; *(uint64_t*)0x20004008 = 0; *(uint64_t*)0x20004010 = 0; *(uint64_t*)0x20004018 = 0; *(uint64_t*)0x20004020 = 0; *(uint64_t*)0x20004028 = 0; *(uint64_t*)0x20004030 = 0; *(uint64_t*)0x20004038 = 0; syscall(__NR_setsockopt, r[0], 0x29, 0x40, 0x20002000, 0x3e0); r[1] = syscall(__NR_socket, 2, 3, 0x81); memcpy((void*)0x20397cd8, "\x66\x69\x6c\x74\x65\x72\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00", 32); *(uint32_t*)0x20397cf8 = 0xe; *(uint32_t*)0x20397cfc = 4; *(uint32_t*)0x20397d00 = 0x2c8; *(uint32_t*)0x20397d04 = -1; *(uint32_t*)0x20397d08 = 0; *(uint32_t*)0x20397d0c = 0; *(uint32_t*)0x20397d10 = 0; *(uint32_t*)0x20397d14 = -1; *(uint32_t*)0x20397d18 = -1; *(uint32_t*)0x20397d1c = 0; *(uint32_t*)0x20397d20 = 0; *(uint32_t*)0x20397d24 = 0; *(uint32_t*)0x20397d28 = -1; *(uint32_t*)0x20397d2c = 4; *(uint64_t*)0x20397d30 = 0x20012fc0; *(uint8_t*)0x20397d38 = 0; *(uint8_t*)0x20397d39 = 0; *(uint8_t*)0x20397d3a = 0; *(uint8_t*)0x20397d3b = 0; *(uint8_t*)0x20397d3c = 0; *(uint8_t*)0x20397d3d = 0; *(uint8_t*)0x20397d3e = 0; *(uint8_t*)0x20397d3f = 0; *(uint8_t*)0x20397d40 = 0; *(uint8_t*)0x20397d41 = 0; *(uint8_t*)0x20397d42 = 0; *(uint8_t*)0x20397d43 = 0; *(uint8_t*)0x20397d44 = 0; *(uint8_t*)0x20397d45 = 0; *(uint8_t*)0x20397d46 = 0; *(uint8_t*)0x20397d47 = 0; *(uint8_t*)0x20397d48 = 0; *(uint8_t*)0x20397d49 = 0; *(uint8_t*)0x20397d4a = 0; *(uint8_t*)0x20397d4b = 0; *(uint8_t*)0x20397d4c = 0; *(uint8_t*)0x20397d4d = 0; *(uint8_t*)0x20397d4e = 0; *(uint8_t*)0x20397d4f = 0; *(uint8_t*)0x20397d50 = 0; *(uint8_t*)0x20397d51 = 0; *(uint8_t*)0x20397d52 = 0; *(uint8_t*)0x20397d53 = 0; *(uint8_t*)0x20397d54 = 0; *(uint8_t*)0x20397d55 = 0; *(uint8_t*)0x20397d56 = 0; *(uint8_t*)0x20397d57 = 0; *(uint8_t*)0x20397d58 = 0; *(uint8_t*)0x20397d59 = 0; *(uint8_t*)0x20397d5a = 0; *(uint8_t*)0x20397d5b = 0; *(uint8_t*)0x20397d5c = 0; *(uint8_t*)0x20397d5d = 0; *(uint8_t*)0x20397d5e = 0; *(uint8_t*)0x20397d5f = 0; *(uint8_t*)0x20397d60 = 0; *(uint8_t*)0x20397d61 = 0; *(uint8_t*)0x20397d62 = 0; *(uint8_t*)0x20397d63 = 0; *(uint8_t*)0x20397d64 = 0; *(uint8_t*)0x20397d65 = 0; *(uint8_t*)0x20397d66 = 0; *(uint8_t*)0x20397d67 = 0; *(uint8_t*)0x20397d68 = 0; *(uint8_t*)0x20397d69 = 0; *(uint8_t*)0x20397d6a = 0; *(uint8_t*)0x20397d6b = 0; *(uint8_t*)0x20397d6c = 0; *(uint8_t*)0x20397d6d = 0; *(uint8_t*)0x20397d6e = 0; *(uint8_t*)0x20397d6f = 0; *(uint8_t*)0x20397d70 = 0; *(uint8_t*)0x20397d71 = 0; *(uint8_t*)0x20397d72 = 0; *(uint8_t*)0x20397d73 = 0; *(uint8_t*)0x20397d74 = 0; *(uint8_t*)0x20397d75 = 0; *(uint8_t*)0x20397d76 = 0; *(uint8_t*)0x20397d77 = 0; *(uint8_t*)0x20397d78 = 0; *(uint8_t*)0x20397d79 = 0; *(uint8_t*)0x20397d7a = 0; *(uint8_t*)0x20397d7b = 0; *(uint8_t*)0x20397d7c = 0; *(uint8_t*)0x20397d7d = 0; *(uint8_t*)0x20397d7e = 0; *(uint8_t*)0x20397d7f = 0; *(uint8_t*)0x20397d80 = 0; *(uint8_t*)0x20397d81 = 0; *(uint8_t*)0x20397d82 = 0; *(uint8_t*)0x20397d83 = 0; *(uint8_t*)0x20397d84 = 0; *(uint8_t*)0x20397d85 = 0; *(uint8_t*)0x20397d86 = 0; *(uint8_t*)0x20397d87 = 0; *(uint8_t*)0x20397d88 = 0; *(uint8_t*)0x20397d89 = 0; *(uint8_t*)0x20397d8a = 0; *(uint8_t*)0x20397d8b = 0; *(uint32_t*)0x20397d8c = 0; *(uint16_t*)0x20397d90 = 0x70; *(uint16_t*)0x20397d92 = 0x98; *(uint32_t*)0x20397d94 = 0; *(uint64_t*)0x20397d98 = 0; *(uint64_t*)0x20397da0 = 0; *(uint16_t*)0x20397da8 = 0x28; memcpy((void*)0x20397daa, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20397dc7 = 0; *(uint32_t*)0x20397dc8 = 0xfffffffe; *(uint32_t*)0x20397dd0 = htobe32(0); *(uint8_t*)0x20397dd4 = 0xac; *(uint8_t*)0x20397dd5 = 0x14; *(uint8_t*)0x20397dd6 = 0; *(uint8_t*)0x20397dd7 = 0; *(uint32_t*)0x20397dd8 = htobe32(0); *(uint32_t*)0x20397ddc = htobe32(0); *(uint8_t*)0x20397de0 = 0x73; *(uint8_t*)0x20397de1 = 0x79; *(uint8_t*)0x20397de2 = 0x7a; *(uint8_t*)0x20397de3 = 0; *(uint8_t*)0x20397de4 = 0; *(uint8_t*)0x20397df0 = 0x73; *(uint8_t*)0x20397df1 = 0x79; *(uint8_t*)0x20397df2 = 0x7a; *(uint8_t*)0x20397df3 = 0; *(uint8_t*)0x20397df4 = 0; *(uint8_t*)0x20397e00 = 0; *(uint8_t*)0x20397e01 = 0; *(uint8_t*)0x20397e02 = 0; *(uint8_t*)0x20397e03 = 0; *(uint8_t*)0x20397e04 = 0; *(uint8_t*)0x20397e05 = 0; *(uint8_t*)0x20397e06 = 0; *(uint8_t*)0x20397e07 = 0; *(uint8_t*)0x20397e08 = 0; *(uint8_t*)0x20397e09 = 0; *(uint8_t*)0x20397e0a = 0; *(uint8_t*)0x20397e0b = 0; *(uint8_t*)0x20397e0c = 0; *(uint8_t*)0x20397e0d = 0; *(uint8_t*)0x20397e0e = 0; *(uint8_t*)0x20397e0f = 0; *(uint8_t*)0x20397e10 = 0; *(uint8_t*)0x20397e11 = 0; *(uint8_t*)0x20397e12 = 0; *(uint8_t*)0x20397e13 = 0; *(uint8_t*)0x20397e14 = 0; *(uint8_t*)0x20397e15 = 0; *(uint8_t*)0x20397e16 = 0; *(uint8_t*)0x20397e17 = 0; *(uint8_t*)0x20397e18 = 0; *(uint8_t*)0x20397e19 = 0; *(uint8_t*)0x20397e1a = 0; *(uint8_t*)0x20397e1b = 0; *(uint8_t*)0x20397e1c = 0; *(uint8_t*)0x20397e1d = 0; *(uint8_t*)0x20397e1e = 0; *(uint8_t*)0x20397e1f = 0; *(uint16_t*)0x20397e20 = 0; *(uint8_t*)0x20397e22 = 0; *(uint8_t*)0x20397e23 = 0; *(uint32_t*)0x20397e24 = 0; *(uint16_t*)0x20397e28 = 0x70; *(uint16_t*)0x20397e2a = 0x98; *(uint32_t*)0x20397e2c = 0; *(uint64_t*)0x20397e30 = 0; *(uint64_t*)0x20397e38 = 0; *(uint16_t*)0x20397e40 = 0x28; memcpy((void*)0x20397e42, "\x43\x4c\x41\x53\x53\x49\x46\x59\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20397e5f = 0; *(uint32_t*)0x20397e60 = 0; *(uint32_t*)0x20397e68 = htobe32(0); *(uint32_t*)0x20397e6c = htobe32(0xe0000002); *(uint32_t*)0x20397e70 = htobe32(0); *(uint32_t*)0x20397e74 = htobe32(0); *(uint8_t*)0x20397e78 = 0x73; *(uint8_t*)0x20397e79 = 0x79; *(uint8_t*)0x20397e7a = 0x7a; *(uint8_t*)0x20397e7b = 0; *(uint8_t*)0x20397e7c = 0; memcpy((void*)0x20397e88, "\x6c\x6f\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00", 16); *(uint8_t*)0x20397e98 = 0; *(uint8_t*)0x20397e99 = 0; *(uint8_t*)0x20397e9a = 0; *(uint8_t*)0x20397e9b = 0; *(uint8_t*)0x20397e9c = 0; *(uint8_t*)0x20397e9d = 0; *(uint8_t*)0x20397e9e = 0; *(uint8_t*)0x20397e9f = 0; *(uint8_t*)0x20397ea0 = 0; *(uint8_t*)0x20397ea1 = 0; *(uint8_t*)0x20397ea2 = 0; *(uint8_t*)0x20397ea3 = 0; *(uint8_t*)0x20397ea4 = 0; *(uint8_t*)0x20397ea5 = 0; *(uint8_t*)0x20397ea6 = 0; *(uint8_t*)0x20397ea7 = 0; *(uint8_t*)0x20397ea8 = 0; *(uint8_t*)0x20397ea9 = 0; *(uint8_t*)0x20397eaa = 0; *(uint8_t*)0x20397eab = 0; *(uint8_t*)0x20397eac = 0; *(uint8_t*)0x20397ead = 0; *(uint8_t*)0x20397eae = 0; *(uint8_t*)0x20397eaf = 0; *(uint8_t*)0x20397eb0 = 0; *(uint8_t*)0x20397eb1 = 0; *(uint8_t*)0x20397eb2 = 0; *(uint8_t*)0x20397eb3 = 0; *(uint8_t*)0x20397eb4 = 0; *(uint8_t*)0x20397eb5 = 0; *(uint8_t*)0x20397eb6 = 0; *(uint8_t*)0x20397eb7 = 0; *(uint16_t*)0x20397eb8 = 0; *(uint8_t*)0x20397eba = 0; *(uint8_t*)0x20397ebb = 0; *(uint32_t*)0x20397ebc = 0; *(uint16_t*)0x20397ec0 = 0xa0; *(uint16_t*)0x20397ec2 = 0xc8; *(uint32_t*)0x20397ec4 = 0; *(uint64_t*)0x20397ec8 = 0; *(uint64_t*)0x20397ed0 = 0; *(uint16_t*)0x20397ed8 = 0x30; memcpy((void*)0x20397eda, "\x63\x6f\x6e\x6e\x6d\x61\x72\x6b\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20397ef7 = 1; *(uint32_t*)0x20397ef8 = 0; *(uint32_t*)0x20397efc = 0; *(uint32_t*)0x20397f00 = 0; *(uint16_t*)0x20397f08 = 0x28; memcpy((void*)0x20397f0a, "\x52\x45\x4a\x45\x43\x54\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20397f27 = 0; *(uint32_t*)0x20397f28 = 0; *(uint32_t*)0x20397f30 = htobe32(0); *(uint32_t*)0x20397f34 = htobe32(0xe0000002); *(uint32_t*)0x20397f38 = htobe32(0); *(uint32_t*)0x20397f3c = htobe32(-1); *(uint8_t*)0x20397f40 = 0x73; *(uint8_t*)0x20397f41 = 0x79; *(uint8_t*)0x20397f42 = 0x7a; *(uint8_t*)0x20397f43 = 0x30; *(uint8_t*)0x20397f44 = 0; memcpy((void*)0x20397f50, "\x86\xd3\xd6\x53\xc2\x5e\xa8\xd7\x4a\x86\xad\xd0\x35\xad\xfd\xcf", 16); *(uint8_t*)0x20397f60 = 0; *(uint8_t*)0x20397f61 = 0; *(uint8_t*)0x20397f62 = 0; *(uint8_t*)0x20397f63 = 0; *(uint8_t*)0x20397f64 = 0; *(uint8_t*)0x20397f65 = 0; *(uint8_t*)0x20397f66 = 0; *(uint8_t*)0x20397f67 = 0; *(uint8_t*)0x20397f68 = 0; *(uint8_t*)0x20397f69 = 0; *(uint8_t*)0x20397f6a = 0; *(uint8_t*)0x20397f6b = 0; *(uint8_t*)0x20397f6c = 0; *(uint8_t*)0x20397f6d = 0; *(uint8_t*)0x20397f6e = 0; *(uint8_t*)0x20397f6f = 0; *(uint8_t*)0x20397f70 = 0; *(uint8_t*)0x20397f71 = 0; *(uint8_t*)0x20397f72 = 0; *(uint8_t*)0x20397f73 = 0; *(uint8_t*)0x20397f74 = 0; *(uint8_t*)0x20397f75 = 0; *(uint8_t*)0x20397f76 = 0; *(uint8_t*)0x20397f77 = 0; *(uint8_t*)0x20397f78 = 0; *(uint8_t*)0x20397f79 = 0; *(uint8_t*)0x20397f7a = 0; *(uint8_t*)0x20397f7b = 0; *(uint8_t*)0x20397f7c = 0; *(uint8_t*)0x20397f7d = 0; *(uint8_t*)0x20397f7e = 0; *(uint8_t*)0x20397f7f = 0; *(uint16_t*)0x20397f80 = 0; *(uint8_t*)0x20397f82 = 0; *(uint8_t*)0x20397f83 = 0; *(uint32_t*)0x20397f84 = 0; *(uint16_t*)0x20397f88 = 0x70; *(uint16_t*)0x20397f8a = 0xd0; *(uint32_t*)0x20397f8c = 0; *(uint64_t*)0x20397f90 = 0; *(uint64_t*)0x20397f98 = 0; *(uint16_t*)0x20397fa0 = 0x60; memcpy((void*)0x20397fa2, "\x43\x4c\x55\x53\x54\x45\x52\x49\x50\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x00", 29); *(uint8_t*)0x20397fbf = 0; *(uint32_t*)0x20397fc0 = 1; *(uint8_t*)0x20397fc4 = 0; *(uint8_t*)0x20397fc5 = 0; *(uint8_t*)0x20397fc6 = 0; *(uint8_t*)0x20397fc7 = 0; *(uint8_t*)0x20397fc8 = 0; *(uint8_t*)0x20397fc9 = 0; *(uint16_t*)0x20397fca = 0; *(uint16_t*)0x20397fcc = 0; *(uint16_t*)0x20397fce = 0; *(uint16_t*)0x20397fd0 = 0; *(uint16_t*)0x20397fd2 = 0; *(uint16_t*)0x20397fd4 = 0; *(uint16_t*)0x20397fd6 = 0; *(uint16_t*)0x20397fd8 = 0; *(uint16_t*)0x20397fda = 0; *(uint16_t*)0x20397fdc = 0; *(uint16_t*)0x20397fde = 0; *(uint16_t*)0x20397fe0 = 0; *(uint16_t*)0x20397fe2 = 0; *(uint16_t*)0x20397fe4 = 0; *(uint16_t*)0x20397fe6 = 0; *(uint16_t*)0x20397fe8 = 0; *(uint16_t*)0x20397fea = 0; *(uint16_t*)0x20397fec = 0; *(uint32_t*)0x20397ff0 = 0; *(uint32_t*)0x20397ff4 = 0; *(uint64_t*)0x20397ff8 = 0; *(uint64_t*)0x20012fc0 = 0; *(uint64_t*)0x20012fc8 = 0; *(uint64_t*)0x20012fd0 = 0; *(uint64_t*)0x20012fd8 = 0; *(uint64_t*)0x20012fe0 = 0; *(uint64_t*)0x20012fe8 = 0; *(uint64_t*)0x20012ff0 = 0; *(uint64_t*)0x20012ff8 = 0; syscall(__NR_setsockopt, r[1], 0, 0x40, 0x20397cd8, 0x328); r[2] = syscall(__NR_socket, 0xa, 1, 0); *(uint32_t*)0x207e9ef8 = 1; *(uint16_t*)0x207e9f00 = 0xa; *(uint16_t*)0x207e9f02 = htobe16(0x4e22); *(uint32_t*)0x207e9f04 = 9; *(uint8_t*)0x207e9f08 = 0; *(uint8_t*)0x207e9f09 = 0; *(uint8_t*)0x207e9f0a = 0; *(uint8_t*)0x207e9f0b = 0; *(uint8_t*)0x207e9f0c = 0; *(uint8_t*)0x207e9f0d = 0; *(uint8_t*)0x207e9f0e = 0; *(uint8_t*)0x207e9f0f = 0; *(uint8_t*)0x207e9f10 = 0; *(uint8_t*)0x207e9f11 = 0; *(uint8_t*)0x207e9f12 = 0; *(uint8_t*)0x207e9f13 = 0; *(uint8_t*)0x207e9f14 = 0; *(uint8_t*)0x207e9f15 = 0; *(uint8_t*)0x207e9f16 = 0; *(uint8_t*)0x207e9f17 = 0; *(uint32_t*)0x207e9f18 = 9; *(uint64_t*)0x207e9f20 = 0; *(uint64_t*)0x207e9f28 = 0; *(uint64_t*)0x207e9f30 = 0; *(uint64_t*)0x207e9f38 = 0; *(uint64_t*)0x207e9f40 = 0; *(uint64_t*)0x207e9f48 = 0; *(uint64_t*)0x207e9f50 = 0; *(uint64_t*)0x207e9f58 = 0; *(uint64_t*)0x207e9f60 = 0; *(uint64_t*)0x207e9f68 = 0; *(uint64_t*)0x207e9f70 = 0; *(uint64_t*)0x207e9f78 = 0; *(uint16_t*)0x207e9f80 = 0xa; *(uint16_t*)0x207e9f82 = htobe16(0x4e22); *(uint32_t*)0x207e9f84 = 9; *(uint8_t*)0x207e9f88 = 0xfe; *(uint8_t*)0x207e9f89 = 0x80; *(uint8_t*)0x207e9f8a = 0; *(uint8_t*)0x207e9f8b = 0; *(uint8_t*)0x207e9f8c = 0; *(uint8_t*)0x207e9f8d = 0; *(uint8_t*)0x207e9f8e = 0; *(uint8_t*)0x207e9f8f = 0; *(uint8_t*)0x207e9f90 = 0; *(uint8_t*)0x207e9f91 = 0; *(uint8_t*)0x207e9f92 = 0; *(uint8_t*)0x207e9f93 = 0; *(uint8_t*)0x207e9f94 = 0; *(uint8_t*)0x207e9f95 = 0; *(uint8_t*)0x207e9f96 = 0; *(uint8_t*)0x207e9f97 = 0xf; *(uint32_t*)0x207e9f98 = 4; *(uint64_t*)0x207e9fa0 = 0; *(uint64_t*)0x207e9fa8 = 0; *(uint64_t*)0x207e9fb0 = 0; *(uint64_t*)0x207e9fb8 = 0; *(uint64_t*)0x207e9fc0 = 0; *(uint64_t*)0x207e9fc8 = 0; *(uint64_t*)0x207e9fd0 = 0; *(uint64_t*)0x207e9fd8 = 0; *(uint64_t*)0x207e9fe0 = 0; *(uint64_t*)0x207e9fe8 = 0; *(uint64_t*)0x207e9ff0 = 0; *(uint64_t*)0x207e9ff8 = 0; syscall(__NR_setsockopt, r[2], 0x29, 0x2c, 0x207e9ef8, 0x108); *(uint8_t*)0x200f2f0b = 0xaa; *(uint8_t*)0x200f2f0c = 0xaa; *(uint8_t*)0x200f2f0d = 0xaa; *(uint8_t*)0x200f2f0e = 0xaa; *(uint8_t*)0x200f2f0f = 0; *(uint8_t*)0x200f2f10 = 0xaa; *(uint8_t*)0x200f2f11 = 0xaa; *(uint8_t*)0x200f2f12 = 0xaa; *(uint8_t*)0x200f2f13 = 0xaa; *(uint8_t*)0x200f2f14 = 0xaa; *(uint8_t*)0x200f2f15 = 0; *(uint8_t*)0x200f2f16 = 0; *(uint16_t*)0x200f2f17 = htobe16(0x86dd); STORE_BY_BITMASK(uint8_t, 0x200f2f19, 0, 0, 4); STORE_BY_BITMASK(uint8_t, 0x200f2f19, 6, 4, 4); memcpy((void*)0x200f2f1a, "\x01\xff\x00", 3); *(uint16_t*)0x200f2f1d = htobe16(0x14); *(uint8_t*)0x200f2f1f = 6; *(uint8_t*)0x200f2f20 = 0; *(uint8_t*)0x200f2f21 = 0xfe; *(uint8_t*)0x200f2f22 = 0x80; *(uint8_t*)0x200f2f23 = 0; *(uint8_t*)0x200f2f24 = 0; *(uint8_t*)0x200f2f25 = 0; *(uint8_t*)0x200f2f26 = 0; *(uint8_t*)0x200f2f27 = 0; *(uint8_t*)0x200f2f28 = 0; *(uint8_t*)0x200f2f29 = 0; *(uint8_t*)0x200f2f2a = 0; *(uint8_t*)0x200f2f2b = 0; *(uint8_t*)0x200f2f2c = 0; *(uint8_t*)0x200f2f2d = 0; *(uint8_t*)0x200f2f2e = 0; *(uint8_t*)0x200f2f2f = 0; *(uint8_t*)0x200f2f30 = 0xbb; *(uint8_t*)0x200f2f31 = -1; *(uint8_t*)0x200f2f32 = 2; *(uint8_t*)0x200f2f33 = 0; *(uint8_t*)0x200f2f34 = 0; *(uint8_t*)0x200f2f35 = 0; *(uint8_t*)0x200f2f36 = 0; *(uint8_t*)0x200f2f37 = 0; *(uint8_t*)0x200f2f38 = 0; *(uint8_t*)0x200f2f39 = 0; *(uint8_t*)0x200f2f3a = 0; *(uint8_t*)0x200f2f3b = 0; *(uint8_t*)0x200f2f3c = 0; *(uint8_t*)0x200f2f3d = 0; *(uint8_t*)0x200f2f3e = 0; *(uint8_t*)0x200f2f3f = 0; *(uint8_t*)0x200f2f40 = 1; *(uint16_t*)0x200f2f41 = 0; *(uint16_t*)0x200f2f43 = htobe16(0x4e22); *(uint32_t*)0x200f2f45 = 0x42424242; *(uint32_t*)0x200f2f49 = 0x42424242; STORE_BY_BITMASK(uint8_t, 0x200f2f4d, 0, 0, 1); STORE_BY_BITMASK(uint8_t, 0x200f2f4d, 0, 1, 3); STORE_BY_BITMASK(uint8_t, 0x200f2f4d, 5, 4, 4); *(uint8_t*)0x200f2f4e = 0; *(uint16_t*)0x200f2f4f = htobe16(0); *(uint16_t*)0x200f2f51 = 0; *(uint16_t*)0x200f2f53 = htobe16(0); struct csum_inet csum_1; csum_inet_init(&csum_1); csum_inet_update(&csum_1, (const uint8_t*)0x200f2f21, 16); csum_inet_update(&csum_1, (const uint8_t*)0x200f2f31, 16); uint32_t csum_1_chunk_2 = 0x14000000; csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_2, 4); uint32_t csum_1_chunk_3 = 0x6000000; csum_inet_update(&csum_1, (const uint8_t*)&csum_1_chunk_3, 4); csum_inet_update(&csum_1, (const uint8_t*)0x200f2f41, 20); *(uint16_t*)0x200f2f51 = csum_inet_digest(&csum_1); syz_emit_ethernet(0x4a, 0x200f2f0b, 0x20000000); } int main() { for (;;) { setup_tun(0, true); loop(); } }