Quantcast
Channel: A summer with pwntools
Viewing all articles
Browse latest Browse all 14

Weekly update on SROP integration

$
0
0
This week I worked on fixing the examples at the pull request and improving them based on feedback.

Spent some time trying to investigate why the r0 load fails after the sigreturn call. I tried using qemu but for some reason that just faults on the "svc 0x0" instruction when the sigreturn number is loaded to r7 and the sigreturn call isn't even made, so I'm trying it on the raspberry pi for the moment.
After a lil bit of digging we have this!
http://lxr.free-electrons.com/source/arch/arm/kernel/signal.c#L142

Which is called from this!
http://lxr.free-electrons.com/source/arch/arm/kernel/signal.c#L189

It seems that restore_sigframe fails and causes the goto badframe.
This week I'll check that out.

Viewing all articles
Browse latest Browse all 14

Trending Articles