Updated Level1 of KernelExploitation

This commit is contained in:
Jack Ren
2025-10-16 23:24:06 +08:00
parent d5bfc6ce0a
commit a5eeaba86a

View File

@@ -26,9 +26,17 @@ int main() {
printf("%s", &buf[0x200]);
return 0;
}
// $ sudo cat /proc/modules
// Protection:
// - No KASLR.
// - CONFIG_SLAB_FREELIST_RANDOM=n
// - CONFIG_SLAB_FREELIST_HARDENED=n
// Debug:
// Use `sudo cat /proc/modules` to get kernel module base.
// gdb> add-symbol-file /challenge/challenge1.ko 0xffffffffc0000000
// gdb> b kheap_open
// gdb> b kheap_ioctl
// A slot is 0x200 bytes.
// An aligned slub slot is 0x200 bytes.
// $ gcc exploit.c -o exploit