// https://syzkaller.appspot.com/bug?id=87459036a653a6a462fcf7f80c3c038f85462ffc // autogenerated by syzkaller (https://github.com/google/syzkaller) #define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #define BITMASK(bf_off, bf_len) (((1ull << (bf_len)) - 1) << (bf_off)) #define STORE_BY_BITMASK(type, htobe, addr, val, bf_off, bf_len) \ *(type*)(addr) = \ htobe((htobe(*(type*)(addr)) & ~BITMASK((bf_off), (bf_len))) | \ (((type)(val) << (bf_off)) & BITMASK((bf_off), (bf_len)))) uint64_t r[2] = {0xffffffffffffffff, 0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffffffff000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200000000000ul, /*len=*/0x1000000, /*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x200001000000ul, /*len=*/0x1000, /*prot=*/0ul, /*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/(intptr_t)-1, /*offset=*/0ul); const char* reason; (void)reason; intptr_t res = 0; if (write(1, "executing program\n", sizeof("executing program\n") - 1)) { } // socket$nl_netfilter arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0xc (4 bytes) // ] // returns sock_nl_netfilter res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc); if (res != -1) r[0] = res; // sendmsg$NFT_BATCH arguments: [ // fd: sock_nl_netfilter (resource) // msg: ptr[in, msghdr_netlink[nft_batch_msg]] { // msghdr_netlink[nft_batch_msg] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, nft_batch_msg]] { // iovec[in, nft_batch_msg] { // addr: ptr[in, nft_batch_msg] { // nft_batch_msg { // begin: nft_nlmsghdr[NFNL_MSG_BATCH_BEGIN] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x10 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // msgs: array[nft_batch_message] { // union nft_batch_message { // NFT_MSG_NEWTABLE: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWTABLE, array[nft_table_policy]] { // len: len = 0x20 (4 bytes) // type: const = 0x0 (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x301 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0x0 (2 bytes) // } // attrs: array[nft_table_policy] { // union nft_table_policy { // NFTA_TABLE_NAME: nlattr_t[const[NFTA_TABLE_NAME, // int16], string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // } // } // } // union nft_batch_message { // NFT_MSG_NEWSET: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWSET, array[nft_set_policy]] { // len: len = 0x64 (4 bytes) // type: const = 0x9 (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x401 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0xfffc (2 bytes) // } // attrs: array[nft_set_policy] { // union nft_set_policy { // NFTA_SET_ID: nlattr_tt[const[NFTA_SET_ID, // int16:14], 1, 0, nft_set_id] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0xa (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: int32be = 0x1 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_NAME: nlattr_t[const[NFTA_SET_NAME, // int16], string[nft_set_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: buffer: {73 79 7a 31 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_policy { // NFTA_SET_TABLE: nlattr_t[const[NFTA_SET_TABLE, // int16], string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_policy { // NFTA_SET_KEY_LEN: // nlattr_tt[const[NFTA_SET_KEY_LEN, int16:14], 1, 0, // int32be[1:NFT_DATA_VALUE_MAXLEN]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x5 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: int32be = 0x8 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_FLAGS: nlattr_tt[const[NFTA_SET_FLAGS, // int16:14], 1, 0, flags[nft_set_flags, int32be]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 bytes) // payload: nft_set_flags = 0x94 (4 bytes) // size: buffer: {} (length 0x0) // } // } // union nft_set_policy { // NFTA_SET_DESC: nlattr_tt[const[NFTA_SET_DESC, // int16:14], 0, 1, array[nft_set_desc_policy]] { // nla_len: offsetof = 0x20 (2 bytes) // nla_type: const = 0x9 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nft_set_desc_policy] { // union nft_set_desc_policy { // NFTA_SET_DESC_CONCAT: // nlattr_tt[const[NFTA_SET_DESC_CONCAT, // int16:14], 0, 1, // array[nlnest[NFTA_LIST_ELEM, // array[nft_concat_policy]]]] { // nla_len: offsetof = 0x1c (2 bytes) // nla_type: const = 0x2 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: // array[nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]]] { // nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x1 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[nft_concat_policy] { // union nft_concat_policy { // NFTA_SET_FIELD_LEN: // nlattr_tt[const[NFTA_SET_FIELD_LEN, // int16:14], 1, 0, int32be] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = 0x1 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 // bytes) payload: int32be = 0x4 (4 // bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // nlattr_tt[const[NFTA_LIST_ELEM, // int16:14], 0, 1, // array[nft_concat_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x1 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 // bytes) NLA_F_NESTED: const = 0x1 (1 // bytes) payload: // array[nft_concat_policy] { // union nft_concat_policy { // NFTA_SET_FIELD_LEN: // nlattr_tt[const[NFTA_SET_FIELD_LEN, // int16:14], 1, 0, int32be] { // nla_len: offsetof = 0x8 (2 // bytes) nla_type: const = 0x1 (1 // bytes) NLA_F_NET_BYTEORDER: // const = 0x1 (0 bytes) // NLA_F_NESTED: const = 0x0 (1 // bytes) payload: int32be = 0x4 (4 // bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // union nft_batch_message { // NFT_MSG_NEWSETELEM: // netlink_msg_netfilter_tt[NFNL_SUBSYS_NFTABLES, // NFT_MSG_NEWSETELEM, array[nft_set_elem_list_policy]] { // len: len = 0x3c (4 bytes) // type: const = 0xc (1 bytes) // subsys: const = 0xa (1 bytes) // flags: netlink_netfilter_msg_flags = 0x101 (2 bytes) // seq: const = 0x0 (4 bytes) // pid: const = 0x0 (4 bytes) // hdr: nfgenmsg { // nfgen_family: nfproto = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: int16be = 0x0 (2 bytes) // } // attrs: array[nft_set_elem_list_policy] { // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_SET: // nlattr_t[const[NFTA_SET_ELEM_LIST_SET, int16], // string[nft_set_elem_list_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x2 (2 bytes) // payload: buffer: {73 79 7a 31 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_TABLE: // nlattr_t[const[NFTA_SET_ELEM_LIST_TABLE, int16], // string[nft_table_name]] { // nla_len: offsetof = 0x9 (2 bytes) // nla_type: const = 0x1 (2 bytes) // payload: buffer: {73 79 7a 30 00} (length 0x5) // size: buffer: {} (length 0x0) // pad = 0x0 (3 bytes) // } // } // union nft_set_elem_list_policy { // NFTA_SET_ELEM_LIST_ELEMENTS: // nlattr_tt[const[NFTA_SET_ELEM_LIST_ELEMENTS, // int16:14], 0, 1, array[nlnest[0, // array[nft_set_elem_policy]]]] { // nla_len: offsetof = 0x10 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nlattr_tt[const[0, int16:14], 0, // 1, array[nft_set_elem_policy]]] { // nlattr_tt[const[0, int16:14], 0, 1, // array[nft_set_elem_policy]] { // nla_len: offsetof = 0xc (2 bytes) // nla_type: const = 0x0 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x0 (0 bytes) // NLA_F_NESTED: const = 0x1 (1 bytes) // payload: array[nft_set_elem_policy] { // union nft_set_elem_policy { // NFTA_SET_ELEM_FLAGS: // nlattr_tt[const[NFTA_SET_ELEM_FLAGS, // int16:14], 1, 0, // flags[nft_set_elem_flags, int32be]] { // nla_len: offsetof = 0x8 (2 bytes) // nla_type: const = 0x3 (1 bytes) // NLA_F_NET_BYTEORDER: const = 0x1 (0 // bytes) NLA_F_NESTED: const = 0x0 (1 // bytes) payload: nft_set_elem_flags = // 0x2 (4 bytes) size: buffer: {} (length // 0x0) // } // } // } // size: buffer: {} (length 0x0) // } // } // size: buffer: {} (length 0x0) // } // } // } // } // } // } // end: nft_nlmsghdr[NFNL_MSG_BATCH_END] { // nlmsg_len: len = 0x14 (4 bytes) // nlmsg_type: const = 0x11 (2 bytes) // nlmsg_flags: const = 0x1 (2 bytes) // nlmsg_seq: const = 0x0 (4 bytes) // nlmsg_pid: const = 0x0 (4 bytes) // hdr: nfgenmsg_nft { // nfgen_family: families = 0x2 (1 bytes) // version: const = 0x0 (1 bytes) // res_id: const = 0xa (2 bytes) // } // } // } // } // len: len = 0xe8 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000400 = 0; *(uint32_t*)0x200000000408 = 0; *(uint64_t*)0x200000000410 = 0x200000000000; *(uint64_t*)0x200000000000 = 0x200000000a00; *(uint32_t*)0x200000000a00 = 0x14; *(uint16_t*)0x200000000a04 = 0x10; *(uint16_t*)0x200000000a06 = 1; *(uint32_t*)0x200000000a08 = 0; *(uint32_t*)0x200000000a0c = 0; *(uint8_t*)0x200000000a10 = 2; *(uint8_t*)0x200000000a11 = 0; *(uint16_t*)0x200000000a12 = htobe16(0xa); *(uint32_t*)0x200000000a14 = 0x20; *(uint8_t*)0x200000000a18 = 0; *(uint8_t*)0x200000000a19 = 0xa; *(uint16_t*)0x200000000a1a = 0x301; *(uint32_t*)0x200000000a1c = 0; *(uint32_t*)0x200000000a20 = 0; *(uint8_t*)0x200000000a24 = 2; *(uint8_t*)0x200000000a25 = 0; *(uint16_t*)0x200000000a26 = htobe16(0); *(uint16_t*)0x200000000a28 = 9; *(uint16_t*)0x200000000a2a = 1; memcpy((void*)0x200000000a2c, "syz0\000", 5); *(uint32_t*)0x200000000a34 = 0x64; *(uint8_t*)0x200000000a38 = 9; *(uint8_t*)0x200000000a39 = 0xa; *(uint16_t*)0x200000000a3a = 0x401; *(uint32_t*)0x200000000a3c = 0; *(uint32_t*)0x200000000a40 = 0; *(uint8_t*)0x200000000a44 = 2; *(uint8_t*)0x200000000a45 = 0; *(uint16_t*)0x200000000a46 = htobe16(0xfffc); *(uint16_t*)0x200000000a48 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000a4a, 0xa, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a4b, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a4b, 0, 7, 1); *(uint32_t*)0x200000000a4c = htobe32(1); *(uint16_t*)0x200000000a50 = 9; *(uint16_t*)0x200000000a52 = 2; memcpy((void*)0x200000000a54, "syz1\000", 5); *(uint16_t*)0x200000000a5c = 9; *(uint16_t*)0x200000000a5e = 1; memcpy((void*)0x200000000a60, "syz0\000", 5); *(uint16_t*)0x200000000a68 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000a6a, 5, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a6b, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a6b, 0, 7, 1); *(uint32_t*)0x200000000a6c = htobe32(8); *(uint16_t*)0x200000000a70 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000a72, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a73, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a73, 0, 7, 1); *(uint32_t*)0x200000000a74 = htobe32(0x94); *(uint16_t*)0x200000000a78 = 0x20; STORE_BY_BITMASK(uint16_t, , 0x200000000a7a, 9, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a7b, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a7b, 1, 7, 1); *(uint16_t*)0x200000000a7c = 0x1c; STORE_BY_BITMASK(uint16_t, , 0x200000000a7e, 2, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a7f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a7f, 1, 7, 1); *(uint16_t*)0x200000000a80 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000000a82, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a83, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a83, 1, 7, 1); *(uint16_t*)0x200000000a84 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000a86, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a87, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a87, 0, 7, 1); *(uint32_t*)0x200000000a88 = htobe32(4); *(uint16_t*)0x200000000a8c = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000000a8e, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a8f, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a8f, 1, 7, 1); *(uint16_t*)0x200000000a90 = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000a92, 1, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000a93, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000a93, 0, 7, 1); *(uint32_t*)0x200000000a94 = htobe32(4); *(uint32_t*)0x200000000a98 = 0x3c; *(uint8_t*)0x200000000a9c = 0xc; *(uint8_t*)0x200000000a9d = 0xa; *(uint16_t*)0x200000000a9e = 0x101; *(uint32_t*)0x200000000aa0 = 0; *(uint32_t*)0x200000000aa4 = 0; *(uint8_t*)0x200000000aa8 = 2; *(uint8_t*)0x200000000aa9 = 0; *(uint16_t*)0x200000000aaa = htobe16(0); *(uint16_t*)0x200000000aac = 9; *(uint16_t*)0x200000000aae = 2; memcpy((void*)0x200000000ab0, "syz1\000", 5); *(uint16_t*)0x200000000ab8 = 9; *(uint16_t*)0x200000000aba = 1; memcpy((void*)0x200000000abc, "syz0\000", 5); *(uint16_t*)0x200000000ac4 = 0x10; STORE_BY_BITMASK(uint16_t, , 0x200000000ac6, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000ac7, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000ac7, 1, 7, 1); *(uint16_t*)0x200000000ac8 = 0xc; STORE_BY_BITMASK(uint16_t, , 0x200000000aca, 0, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000acb, 0, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000acb, 1, 7, 1); *(uint16_t*)0x200000000acc = 8; STORE_BY_BITMASK(uint16_t, , 0x200000000ace, 3, 0, 14); STORE_BY_BITMASK(uint16_t, , 0x200000000acf, 1, 6, 1); STORE_BY_BITMASK(uint16_t, , 0x200000000acf, 0, 7, 1); *(uint32_t*)0x200000000ad0 = htobe32(2); *(uint32_t*)0x200000000ad4 = 0x14; *(uint16_t*)0x200000000ad8 = 0x11; *(uint16_t*)0x200000000ada = 1; *(uint32_t*)0x200000000adc = 0; *(uint32_t*)0x200000000ae0 = 0; *(uint8_t*)0x200000000ae4 = 2; *(uint8_t*)0x200000000ae5 = 0; *(uint16_t*)0x200000000ae6 = htobe16(0xa); *(uint64_t*)0x200000000008 = 0xe8; *(uint64_t*)0x200000000418 = 1; *(uint64_t*)0x200000000420 = 0; *(uint64_t*)0x200000000428 = 0; *(uint32_t*)0x200000000430 = 0; syscall(__NR_sendmsg, /*fd=*/r[0], /*msg=*/0x200000000400ul, /*f=*/0ul); // socket$nl_netfilter arguments: [ // domain: const = 0x10 (8 bytes) // type: const = 0x3 (8 bytes) // proto: const = 0xc (4 bytes) // ] // returns sock_nl_netfilter res = syscall(__NR_socket, /*domain=*/0x10ul, /*type=*/3ul, /*proto=*/0xc); if (res != -1) r[1] = res; // sendmsg$NFT_BATCH arguments: [ // fd: sock_nl_netfilter (resource) // msg: ptr[in, msghdr_netlink[nft_batch_msg]] { // msghdr_netlink[nft_batch_msg] { // addr: nil // addrlen: len = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // vec: ptr[in, iovec[in, nft_batch_msg]] { // iovec[in, nft_batch_msg] { // addr: ptr[inout, array[ANYUNION]] { // array[ANYUNION] { // union ANYUNION { // ANYBLOB: buffer: {14 00 00 00 10 00 01 f5 00 00 00 00 00 // 00 00 00 00 00 00 0a 20 00 00 00 00 0a 01 01 00 00 00 00 // 00 00 00 00 0a 00 00 00 09 00 01 00 73 79 7a 30 00 00 00 // 00 48 00 00 00 03 0a 01 02 00 00 00 00 00 00 00 00 0a 00 // 04 00 09 00 01 00 73 79 7a 30 00 00 00 00 09 00 03 00 73 // 79 7a 31 00 00 00 00 08 00 07 00 6e 61 74 00 14 00 04 80 // 08 00 01 40 00 00 00 03 08 00 02 40 00 00 00 00 14 00 00 // 00 02 0a 69 ef f1 64 00 00 00 00 00 00 00 00 00 01 14 00 // 00 00 11 00 01} (length 0x97) // } // } // } // len: len = 0xa4 (8 bytes) // } // } // vlen: const = 0x1 (8 bytes) // ctrl: const = 0x0 (8 bytes) // ctrllen: const = 0x0 (8 bytes) // f: send_flags = 0x0 (4 bytes) // pad = 0x0 (4 bytes) // } // } // f: send_flags = 0x0 (8 bytes) // ] *(uint64_t*)0x200000000000 = 0; *(uint32_t*)0x200000000008 = 0; *(uint64_t*)0x200000000010 = 0x200000000200; *(uint64_t*)0x200000000200 = 0x200000000340; memcpy((void*)0x200000000340, "\x14\x00\x00\x00\x10\x00\x01\xf5\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x0a\x20\x00\x00\x00\x00\x0a\x01\x01\x00\x00\x00\x00\x00\x00" "\x00\x00\x0a\x00\x00\x00\x09\x00\x01\x00\x73\x79\x7a\x30\x00\x00\x00" "\x00\x48\x00\x00\x00\x03\x0a\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00" "\x0a\x00\x04\x00\x09\x00\x01\x00\x73\x79\x7a\x30\x00\x00\x00\x00\x09" "\x00\x03\x00\x73\x79\x7a\x31\x00\x00\x00\x00\x08\x00\x07\x00\x6e\x61" "\x74\x00\x14\x00\x04\x80\x08\x00\x01\x40\x00\x00\x00\x03\x08\x00\x02" "\x40\x00\x00\x00\x00\x14\x00\x00\x00\x02\x0a\x69\xef\xf1\x64\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x01\x14\x00\x00\x00\x11\x00\x01", 151); *(uint64_t*)0x200000000208 = 0xa4; *(uint64_t*)0x200000000018 = 1; *(uint64_t*)0x200000000020 = 0; *(uint64_t*)0x200000000028 = 0; *(uint32_t*)0x200000000030 = 0; syscall(__NR_sendmsg, /*fd=*/r[1], /*msg=*/0x200000000000ul, /*f=*/0ul); return 0; }