mirror of
https://github.com/morluto/rea.git
synced 2026-10-23 14:22:30 -05:00
Ysopwnable
163ee09a74
* feat(native): inspect recorded crashes through pwntools and pwndbg * fix(native): bind core note semantics to raw owner bytes * fix(native): validate recorded core ABI and evidence scalars * fix(native): require complete recorded note interpretations * fix(native): bind physical core notes to original headers
25 lines
765 B
C
25 lines
765 B
C
#include <stdint.h>
|
|
#include <pthread.h>
|
|
#include <stdatomic.h>
|
|
#include <unistd.h>
|
|
static atomic_int ready;
|
|
static void *recorded_thread(void *unused) {
|
|
(void)unused;
|
|
__asm__ volatile("movabs $0xfedcba9876543210, %%r12" ::: "r12");
|
|
atomic_store(&ready, 1);
|
|
for (;;) pause();
|
|
return 0;
|
|
}
|
|
__attribute__((noinline)) static void fixture_crash(uint64_t value) {
|
|
volatile uint64_t *pointer = (volatile uint64_t *)(uintptr_t)0x123;
|
|
*pointer = value;
|
|
}
|
|
int main(void) {
|
|
pthread_t thread;
|
|
pthread_attr_t attr;
|
|
if (pthread_attr_init(&attr) || pthread_attr_setstacksize(&attr, 65536) || pthread_create(&thread, &attr, recorded_thread, 0)) return 1;
|
|
while (!atomic_load(&ready)) usleep(1000);
|
|
fixture_crash(UINT64_C(0x1122334455667788));
|
|
return 0;
|
|
}
|