Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.
Path: blob/master/external/source/exploits/CVE-2016-4655/flatten-macho.m
Views: 11779
//1// main.m2// flatten-macho3//4// Created by qwertyoruiop on 4/6/17.5// Copyright © 2017 qwertyoruiop. All rights reserved.6//78#import <Foundation/Foundation.h>9#import <mach-o/loader.h>10#import <fcntl.h>11#import <unistd.h>12#import <sys/stat.h>13#import <sys/mman.h>1415int main(int argc, const char * argv[]) {16if(argc != 3)17{18printf("usage: %s <input> <output>\n", argv[0]);19return -1;20}21int fd = open(argv[1], O_RDONLY);22int fd_w = open(argv[2], O_RDWR|O_CREAT|O_TRUNC, 0755);2324char header[0x4000];25pread(fd, header, 0x4000, 0);2627struct mach_header_64* mh = header;28uint64_t min = -1;29uint64_t max = 0;30struct load_command* lc = mh+1;31for (int i = 0; i < mh->ncmds; i++) {32if (lc->cmd == LC_SEGMENT_64)33{34struct segment_command_64* sg = lc;35if (strcmp(sg->segname, "__PAGEZERO") != 0) {36printf("segment %s\n", sg->segname);37if (sg->vmaddr < min) min = sg->vmaddr;38if (sg->vmaddr+sg->vmsize > max) max = sg->vmaddr+sg->vmsize;39}40}41lc = (((char*)lc)+lc->cmdsize);42}4344printf("found base: %llx, max: %llx\n", min, max);45if(lseek(fd_w, max, SEEK_SET) == -1)46{47printf("seek failed\n");48return -1;49}5051lc = mh+1;52for (int i = 0; i < mh->ncmds; i++) {53if (lc->cmd == LC_SEGMENT_64)54{55struct segment_command_64* sg = lc;56printf("mapping to %llx %llx %llx\n", sg->vmaddr, sg->fileoff, sg->filesize);5758if (sg->filesize == 0) {59lc = (((char*)lc)+lc->cmdsize);60continue;61} // ignore pagezero62char* map = mmap(0, sg->vmsize, PROT_READ, MAP_ANON|MAP_PRIVATE, -1, 0);63if(mmap(map, sg->filesize, PROT_READ, MAP_FIXED|MAP_FILE|MAP_PRIVATE,fd,sg->fileoff) == MAP_FAILED)64{65printf("mmap failed\n");66return -1;67}68printf("seeking to %llx\n", sg->vmaddr-min);69lseek(fd_w, sg->vmaddr-min, SEEK_SET);70write(fd_w, map, sg->vmsize);71munmap(map, sg->vmsize);72}73lc = (((char*)lc)+lc->cmdsize);74}7576return 0;77}78798081