Editing Vulnerabilities
Jump to navigation
Jump to search
The edit can be undone. Please check the comparison below to verify that this is what you want to do, and then publish the changes below to finish undoing the edit.
Latest revision | Your text | ||
Line 1: | Line 1: | ||
== | == Hardware Exploits == | ||
=== | === PCIe man-in-the-middle attack === | ||
* First done on 1.01 by failoverflow on PS4 launch ! | |||
* Detailed at 33c3: [https://fail0verflow.com/media/33c3-slides/#/5 33c3 slides by Marcan] | |||
* Permits kernel and userland dumping | |||
* | |||
* | |||
* | |||
=== syscon glitching === | |||
It is possible to glitch the syscon debug interface to allow access and dump keys. Originally done by an anonymous member of fail0verflow. | |||
=== Aeolia/Belize SCA/DPA === | |||
Aeolia side channel analysis with differential power analysis has been shown to be able to recover key material on all PS4 models. Since Sony never used private/public key pairs, it is possible to exploit this and gain complete control over the southbridge. You can attack the main FreeBSD kernel from here. | |||
== WebKit/Userland Exploits == | |||
=== [[Internet_Browser#Webkit_exploit|FW 6.20 - JSArray::shiftCountWithArrayStorage (CVE-2018-4441)]] === | |||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC | |||
* Specter for the rewriting for PS4 | |||
* Lokihardt (from Google Project Zer0) for the exploit PoC | |||
* Specter for the rewriting for PS4 | |||
* St4rk for helping Specter | * St4rk for helping Specter | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * bugs.chromium.org/p/project-zero/issues/detail?id=1685 | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* github.com/Cryptogenic/PS4-6.20-WebKit-Code-Execution-Exploit | |||
* | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 6.50 FW | '''Yes''' in 6.50 FW | ||
---- | ---- | ||
=== FW 4.50-5. | === [[Internet_Browser#Webkit_exploit|FW 4.50-5.50 - haveABadTime Type Confusion (CVE-2017-7005)]] === | ||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC | * Lokihardt (from Google Project Zer0) for the exploit PoC | ||
* ALEXZZZ9 for the first PS4 implementation (on 5.01), and at same time for burning the exploit | * ALEXZZZ9 for the first PS4 implementation (on 5.01), and at same time for burning the exploit | ||
* | * qwertyoruiopz for rewriting and porting to 5.05 and 5.50 | ||
==== Analysis ==== | ==== Analysis ==== | ||
Line 564: | Line 49: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * github.com/ALEXZZZ9/PS4-5.01-WebKit-Exploit-PoC | ||
* [http://crack.bargains/550/ PS4 5.50 (WebKit Only)] | * [http://crack.bargains/550/ PS4 5.50 (WebKit Only)] | ||
* | * github.com/Cryptogenic/PS4-5.05-Kernel-Exploit/blob/master/expl.js | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in | '''Yes''' in 5.53 FW | ||
---- | ---- | ||
=== FW | === [[Internet_Browser#Webkit_exploit|FW 4.50-5.01 - setAttributeNodeNS Use-After-Free (UAF)]] === | ||
==== Credits ==== | ==== Credits ==== | ||
* Lokihardt (from Google Project Zer0) for the exploit PoC | * Lokihardt (from Google Project Zer0) for the exploit PoC | ||
* | * qwertyoruiopz for the rewriting for PS4 | ||
* Specter for the writeup | |||
* | |||
==== Analysis ==== | ==== Analysis ==== | ||
* | * bugs.chromium.org/p/project-zero/issues/detail?id=1187 exploit report by lokihardt | ||
* [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup] | * [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/WebKit/setAttributeNodeNS%20UAF%20Write-up.md Specter's setAttributeNodeNS Exploit Writeup] | ||
Line 641: | Line 78: | ||
---- | ---- | ||
=== FW 3. | === [[Internet_Browser#Webkit_exploit|FW 3.50-4.07 - Stack Uninitialized Read (UAF)]] === | ||
==== Credits ==== | ==== Credits ==== | ||
* | * Uses parts of Pegasus webkit exploit | ||
* Specter | * Created by qwerty | ||
* Analysed by Specter | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/4.0x%20WebKit%20Exploit%20Writeup.md Specter's 4.0x WebKit Exploit Writeup] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 654: | Line 92: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC Specter's commented and usable version] | *[https://github.com/Cryptogenic/PS4-4.0x-Code-Execution-PoC Specter's commented and usable version] | ||
* [https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 mirrorred expl.js from | *[https://gist.github.com/X41/36acd2a6939e4cebbecba45d35bf0d75 mirrorred expl.js from qwerty] | ||
==== Patched ==== | ==== Patched ==== | ||
Line 661: | Line 99: | ||
==== Tested ==== | ==== Tested ==== | ||
Works on 3. | Works on 3.50-4.07. Maybe working on 3.15 after porting gadgets offsets. Not working on 3.00. | ||
---- | ---- | ||
=== FW <= | === [[Internet_Browser#Webkit_exploit|FW <= 3.70 - JSArray.sort() Use-After-Free (UAF)]] === | ||
==== Credits ==== | ==== Credits ==== | ||
* xyz for the original exploit on PSVita | |||
* xyz for the original exploit on PSVita | |||
* Fire30 for porting to PS4 | * Fire30 for porting to PS4 | ||
* Specter for improved PS4 playground | * Specter for improved PS4 playground | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * ttps://blog.xyz.is/2016/webkit-360.html PSVita 3.60 HENKaku webkit exploit writeup | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer | When attempting to update a vector via sortCompactedVector() - data is written based on a pointer, though the pointer isn't re-updated nor nulled. When this memory in free()'d, the reference is maintained and thus memory corruption can occur. | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * ttps://github.com/henkaku/henkaku/blob/master/webkit/exploit.js PSVita 3.60 webkit exploit by xyz | ||
* | * ttps://github.com/Fire30/PS4-3.55-Code-Execution-PoC PS4 Playground 3.15-3.70 by Fire30 | ||
* | * ttps://github.com/Cryptogenic/PS4-Playground-3.55 improved PS4 playground by Specter | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4. | '''Yes''' in 4.00 FW | ||
==== Tested ==== | ==== Tested ==== | ||
3.15, 3.50, 3.51, 3.55, 3.70. Not working on 2.03. | |||
---- | ---- | ||
=== FW <= 3.50 - WebCore::TimerBase::heapPopMin() | === [[Internet_Browser#Webkit_exploit|FW <= 3.50 - WebCore::TimerBase::heapPopMin UAF (only crash)]] === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * github.com/WebKit/webkit/commit/98845d940e30529098eea7e496af02e14301c704 | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
"As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." | "As of firmware version 3.55 a patch has been included to prevent a use-after-free segmentation fault from being exploited. This could have led to a ROP chain and code execution. It would have been cool if someone would have done some real research on it..." | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* | * psxhax.com/threads/ps4-3-50-webkit-exploit-from-playstation-4-dev-qwertyoruiop.450/ | ||
* | * psxhax.com/threads/ps4-heap-use-after-free-at-webcore-3-50-poc-by-hunter128.452/ | ||
* | * wololo.net/talk/viewtopic.php?t=45888 | ||
==== Patched ==== | ==== Patched ==== | ||
Line 760: | Line 144: | ||
==== Tested ==== | ==== Tested ==== | ||
3.15, 3.50 | |||
---- | ---- | ||
=== FW <= 2.03 - | === [[Internet_Browser#Webkit_exploit|FW <= 2.03 - CSSSelector Heap Overflow (CVE-2014-1303)]] === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides] | * [https://www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not.PDF BlackHat EU 2014 'WebKit Everywhere - Secure Or Not?' slides] | ||
* | * www.blackhat.com/docs/eu-14/materials/eu-14-Chen-WebKit-Everywhere-Secure-Or-Not-WP.pdf | ||
* | * cansecwest.com/slides/2015/Liang_CanSecWest2015.pdf | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 807: | Line 158: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [https://github.com/Fire30/PS4-2014-1303-POC | * ROP PoC for firmware 2.03 by Fire30: [https://github.com/Fire30/PS4-2014-1303-POC PS4 2.03] | ||
* [ | * [hxxp://wololo.net/2016/04/21/proof-of-concept-webkit-exploit-running-on-ps4-firmwares-up wololo article] | ||
* | * Exploit for PSVita: vitasploit 3.30-3.36 by xyz | ||
==== Patched ==== | ==== Patched ==== | ||
Line 816: | Line 166: | ||
==== Tested ==== | ==== Tested ==== | ||
* | * 2.03 | ||
---- | ---- | ||
=== | === [[Internet_Browser#Webkit_exploit|FW <= 1.76 - JSArray.sort() Heap Overflow (CVE-2012-3748)]] === | ||
==== Credits ==== | ==== Credits ==== | ||
* Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | * Vitaliy Toropov for the exploit on Mac OS X Safari (September 4, 2013) | ||
* nas and Proxima for the first PS4 POC on 1.76 PS4 ( | * nas and Proxima for the first PS4 POC on 1.76 PS4 (Oct. 23, 2014) | ||
* sony for patching the exploit in FW 2.00 ( | * sony for patching the exploit in FW 2.00 (Oct 27, 2014) | ||
* CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | * CTurt for the rewriting (PS4 1.76 PlayGround) and implementation with his 1.76 kexploit (December 6, 2015) [https://twitter.com/CTurtE/status/673581693207502849] | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * packetstormsecurity.com/files/123088/ | ||
* [https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov] | * [https://www.exploit-db.com/exploits/28081/ Exploit PoC by Vitaliy Toropov] | ||
Line 876: | Line 187: | ||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
* [http://wololo.net/talk/viewtopic.php?p=368577 first POC for 1.76 PS4 by nas and Proxima] | * [http://wololo.net/talk/viewtopic.php?p=368577 first POC for 1.76 PS4 by nas and Proxima] | ||
* | * wololo.net/downloads/index.php/download/8230 mirror | ||
* | * daxhordes.org/ps4_176/ps4_dump.html live test | ||
* | * daxhordes.org/ps4_176/ps4_dump2.html livetest2 | ||
* | * daxhordes.org/ps4_176/ps4_rop2.html ROP2 | ||
* [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt] | * [https://cturt.github.io/PS4-playground/ PS4 playground 1.76 by CTurt] | ||
* | * bitbucket.org/DaveeFTW/psvita-260-webkit/src/master/ PSVita 2.00-3.20 webkit exploit | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
== | == Userland securities == | ||
=== | === Userland ASLR === | ||
* Very old firmwares (<= 1.05) | * Very old firmwares (<= 1.05) don't have ASLR enabled, but it was introduced sometime before firmware 1.70. "Address Space Layout Randomization" (ASLR) is a security technique which causes the base addresses of modules to be different every time you start the PS4. | ||
* To defeat | * To defeat userland ASLR on FWs >=1.70, we can use the module imports table to find other modules address once we know SceWebkit2 address. | ||
=== Module imports table cleaned before execution === | === Module imports table cleaned before execution === | ||
* Between 1.76 and 4.05, Sony did that to prevent | * Between 1.76 and 4.05, Sony did that to prevent webkit exploiters from defeating userland ASLR easily. | ||
* Now we have to dump entire | * Now we have to dump entire userland sandboxed memory, and by studying it we can defeat ASLR: | ||
1. Chose a function (ex: __stack_chk_fail) imported from | 1. Chose a function (ex: __stack_chk_fail) imported from LibKernel by SceWebkit2 | ||
2. Read pointer contained at the address where the call is done | 2. Read pointer contained at the address where the call is done | ||
3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | 3. Substract to this pointer the offset of the function (ex: __stack_chk_fail) in LibKernel module | ||
4. This result is LibKernel base address. This method works for any imported module. | 4. This result is LibKernel base address. This method works for any imported module. | ||
=== DEP / NX === | === DEP / NX === | ||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to userland memory then executing it. | |||
* "Data Execution Prevention" / "No eXecute" is enabled on all firmwares. It prevents allocating memory as both RW and RX at same time (RWX) so preventing us from writing shellcode to | |||
* 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | * 2 ways to bypass this security: JiT vulnerability (FW <= 1.76) or ROP (all FWs). | ||
=== JiT removed from webbrowser === | === JiT removed from webbrowser === | ||
* On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | * On FW <= 1.76, you could map RWX memory from ROP by abusing the JiT functionality and the sys_jitshm_create and sys_jitshm_alias system calls. This however was fixed after 1.76, as WebKit has been split into two processes. One handles javascript compilation and the other handles other web page elements like image rendering and DOM. The second process will request JiT memory upon hitting JavaScript via IPC (Inter-Process Communication). Since we no longer have access to the process responsible for JiT, we can no longer (at least currently), map RWX memory for proper code execution unless the kernel is patched. | ||
* Workaround is to use ROP. | * Workaround is to use ROP. | ||
=== Syscalls removed === | === Syscalls removed === | ||
==== Syscall 0 disabled ==== | |||
=== | |||
* Between 1.76 and 4.05, Sony has removed system call 0, so we can no longer call any system call we like by specifying the call number in the rax register. | |||
* We will have to use wrappers from the libkernel.sprx module provided to us to access system calls. | |||
=== bpf_write function stripped out of the kernel === | === bpf_write function stripped out of the kernel === | ||
Line 975: | Line 233: | ||
=== bpf_open function blocked for unprivileged processes === | === bpf_open function blocked for unprivileged processes === | ||
* On 5.50, opening BPF has been blocked for unprivileged processes such as WebKit and other apps/games. It's still present in the sandbox, however attempting to open it will fail and yield EPERM. This aims blocking bpf exploits like the 4.55 and 5.05 kexploit. | |||
== Kernel Exploits == | |||
=== FW <= 5.05 - BPF Race Condition (Yielding Double Free()) === | |||
== Kernel == | |||
=== FW <= | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition] | [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%205.05%20BPF%20Double%20Free%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 5.05 BPF Race Condition] | ||
==== Bug Description ==== | ==== Bug Description ==== | ||
Again due to improper locking, two threads can enter the BPF "SETWF" ioctl command handler. While the bug is similar to that of 4.55, the method of attack is slightly different. Since write() was removed for BPF in 4.70, instead of triggering a use-after-free with write() - "SETWF" is ran in parallel via threading. Eventually, both calls will copy the same pointer to the stack, leading to both threads free()'ing the same pointer, poisoning the freelist. This can later be leveraged via heap spraying to corrupt heap memory to obtain arbitrary code execution in supervisor mode (ring0). | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[http://crack.bargains/505k/ PS4 5.05 WebKit + Kernel Exploit]<br/> | |||
[https://github.com/Cryptogenic/PS4-5.05-Kernel-Exploit PS4 5.05 WebKit + Kernel Exploit Source] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 5. | '''Yes''' in 5.50FW | ||
---- | ---- | ||
=== FW <= 4.55 - BPF Race Condition (Yielding UaF) === | === FW <= 4.55 - BPF Race Condition (Yielding UaF) === | ||
==== Analysis ==== | ==== Analysis ==== | ||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition] | [https://github.com/Cryptogenic/Exploit-Writeups/blob/master/FreeBSD/PS4%204.55%20BPF%20Race%20Condition%20Kernel%20Exploit%20Writeup.md Specter's Writeup of the 4.55 BPF Race Condition] | ||
Line 1,275: | Line 262: | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4. | '''Yes''' in 4.70FW | ||
---- | ---- | ||
=== FW <= 4.05 - NamedObj Type Confusion (namedobj - Adieu) === | |||
=== FW <= | |||
==== Analysis ==== | ==== Analysis ==== | ||
[https://fail0verflow.com/blog/2017/ps4-namedobj-exploit/ fail0verflow's Writeup on the 1.01-4.05 Kernel Exploit]<br/> | |||
[https://github.com/Cryptogenic/Exploit-Writeups/blob/master/PS4/%22NamedObj%22%204.05%20Kernel%20Exploit%20Writeup.md Specter's Writeup on his 4.05 implementation] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Type confusion in the namedobj system once exploited can lead to an arbitrary free() allowing an attacker to craft a use-after-free() (UAF) situation to corrupt kernel memory. This can be leveraged to eventually obtain an arbitrary code execution primitive in supervisor mode (ring0). | |||
-- | |||
==== Exploit Implementation ==== | ==== Exploit Implementation ==== | ||
[https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | [https://github.com/Cryptogenic/PS4-4.05-Kernel-Exploit PS4 4.05 WebKit + Kernel Exploit] | ||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 4.06 FW | '''Yes''' in 4.06 FW | ||
---- | ---- | ||
=== FW <= | === FW <= 1.76 - Dynamic Library Prepare Close (dlclose) === | ||
* Discovered by CTurt. Privately implemented thanks to qwertyoruiopz. CTurt published a writeup then the exploit was publicly implemented by kR105 and on another side by Zer0xFF and Bigboss (psxdev). | |||
* | |||
==== Analysis ==== | ==== Analysis ==== | ||
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by CTurt with the help of qwertyoruiopz)] | |||
[http://cturt.github.io/dlclose-overflow.html Analysis of sys_dynlib_prepare_dlclose PS4 kernel heap overflow (by CTurt with the help of | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Line 1,413: | Line 296: | ||
---- | ---- | ||
=== FW <= 1.76 - BadIRET | === FW <= 1.76 - BadIRET === | ||
==== Analysis ==== | ==== Analysis ==== | ||
* | * Ported from FreeBSD 9 to PS4 by CTurt. | ||
[http://cturt.github.io/ps4-3.html Hacking the PS4, part 3 - Kernel exploitation (by '''CTurt''')]<br/> | |||
[https://nvd.nist.gov/vuln/detail/CVE-2014-9322 NVD Bug Description] | |||
==== Bug Description ==== | ==== Bug Description ==== | ||
Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from | Faults associated with the stack segment (SS) register are not handled properly, allowing unprivileged users to trigger an IRET instruction that accesses a GS Base from userland memory, providing an attacker with a method of privilege escalation. | ||
==== | ==== Source ==== | ||
[http://seclists.org/oss-sec/2015/q3/66 CVE-2014-9322] | |||
<br/>[http://www.filedropper.com/ps4-bad-iret-5fs Public binary] | |||
==== Patched ==== | ==== Patched ==== | ||
'''Yes''' in 2.00 FW | '''Yes''' in 2.00 FW | ||
=== | ==== Implementation ==== | ||
[https://mega.nz/#!Fo1xFDrb!EuOl5s6g_IPTtI6dAknSKYJZ8YLzZWvx1MPUPmkr3Sg (mirror)] | |||
==== | |||
== Kernel securities == | == Kernel securities == | ||
=== Kernel ASLR === | === Kernel ASLR === | ||
* At some point after the 1.76 FW, ASLR (Address Space Layout Randomization) was enabled in the kernel. | |||
* This means that to properly exploit the kernel to escalate privileges, an information disclosure vulnerability will most likely be needed to defeat ASLR and locate the kernel in memory. | |||
=== Kernel SMAP === | === Kernel SMAP === | ||
* In 5.0x FW and above, "Supervisor Mode Access Prevention" (SMAP), a new custom mitigation was added to the kernel to prevent exploiters from pivoting the stack pointer into userland memory (attempting to do so will crash the system). | |||
* A new exploitation strategy is needed for running kROP (kernel ROP) chains, such as qwertyoruiopz method used in the 5.05 BPF kernel exploit:<br /> | |||
We need to get our ROP chain into kernel memory. To do this, qwertyoruiopz decided to go with the method he used on the iPhone 7 - essentially using JOP to push a bunch of stack frames onto the kernel stack, and memcpy()'ing the chain into RSP. | |||
{{Reverse Engineering}} | {{Reverse Engineering}} | ||
<noinclude> | <noinclude>[[Category:Main]]</noinclude> | ||
[[Category:Main]] | |||
</noinclude> |