From 074facfadce6ad8bbc3c3b944876d116a7a2c37c Mon Sep 17 00:00:00 2001 From: Gezine <30000519+Gezine@users.noreply.github.com> Date: Tue, 19 May 2026 22:22:47 +0900 Subject: [PATCH 1/3] Change elfldr _start arguments to match new sdk --- src/loader.c | 37 +++++++++---------------------------- 1 file changed, 9 insertions(+), 28 deletions(-) diff --git a/src/loader.c b/src/loader.c index cf46005..fa5a6b4 100644 --- a/src/loader.c +++ b/src/loader.c @@ -138,16 +138,7 @@ int init_loader_args() { } int master_sock = socket(AF_INET6, SOCK_DGRAM, 0); - if (master_sock == -1) { - notify("failed to create master socket !!"); - return -1; - } - int victim_sock = socket(AF_INET6, SOCK_DGRAM, 0); - if (victim_sock == -1) { - notify("failed to create victim socket !!"); - return -1; - } *(uint32_t *)(loader_ctx.args_map + 0x00) = 0x14; *(uint32_t *)(loader_ctx.args_map + 0x04) = IPPROTO_IPV6; @@ -218,37 +209,27 @@ int init_loader_args() { loader_ctx.args.pipe_f_data = rpipe_f_data; loader_ctx.args.kernel_text_base = kaddrs.ktext; loader_ctx.args.ret = ret_addr; - loader_ctx.args.flag = 0x54455854; // 'T','E','X','T' notify("syscall_wrapper: %#lx\nrwpipe: [%i, %i]\nrwpair: [%i, " "%i]\npipe_f_data: %#lx\nkernel_text_base: %#lx\nret: %lx", - loader_ctx.args.syscall_wrapper, loader_ctx.args.rwpipe[0], - loader_ctx.args.rwpipe[1], loader_ctx.args.rwpair[0], - loader_ctx.args.rwpair[1], loader_ctx.args.pipe_f_data, + loader_ctx.args.syscall_wrapper, rwpipe[0], rwpipe[1], rwpair[0], + rwpair[1], loader_ctx.args.pipe_f_data, loader_ctx.args.kernel_text_base, loader_ctx.args.ret); return 0; } int run_loader() { - typedef void (*elfldr_entry)(loader_args_t* args); - - elfldr_entry entry = loader_ctx.entry; + typedef int (*entry_fn)(loader_args_t*, uint32_t); + entry_fn entry = (entry_fn)loader_ctx.entry; - notify("running elfldr..."); + notify("Calling elfldr entry at %#lx", loader_ctx.entry); + + int result = entry(&loader_ctx.args, 0x54455854u); // TEXT - entry(&loader_ctx.args); - - notify("elfldr returned %#lx !!", *(uint64_t *)loader_ctx.args.ret); + notify("elfldr returned %d !!", result); munmap(loader_ctx.base, loader_ctx.size); - - remove_pktinfo_from_so(loader_ctx.args.rwpair[0]); - - close(loader_ctx.args.rwpair[0]); - close(loader_ctx.args.rwpair[1]); - close(loader_ctx.args.rwpipe[0]); - close(loader_ctx.args.rwpipe[1]); - munmap(loader_ctx.args_map, PAGE_SIZE); + return 0; } \ No newline at end of file From c90970047067cbda72008d8e862b690c40e08102 Mon Sep 17 00:00:00 2001 From: Gezine <30000519+Gezine@users.noreply.github.com> Date: Tue, 19 May 2026 23:16:04 +0900 Subject: [PATCH 2/3] Restore cleanup stuffs --- include/loader.h | 1 - src/loader.c | 36 +++++++++++++++++++++++++++--------- 2 files changed, 27 insertions(+), 10 deletions(-) diff --git a/include/loader.h b/include/loader.h index a8091d1..940b61f 100644 --- a/include/loader.h +++ b/include/loader.h @@ -30,7 +30,6 @@ typedef struct { uintptr_t pipe_f_data; uintptr_t kernel_text_base; uint64_t *ret; - uint32_t flag; } loader_args_t; typedef struct { diff --git a/src/loader.c b/src/loader.c index fa5a6b4..c387a66 100644 --- a/src/loader.c +++ b/src/loader.c @@ -138,7 +138,16 @@ int init_loader_args() { } int master_sock = socket(AF_INET6, SOCK_DGRAM, 0); + if (master_sock == -1) { + notify("failed to create master socket !!"); + return -1; + } + int victim_sock = socket(AF_INET6, SOCK_DGRAM, 0); + if (victim_sock == -1) { + notify("failed to create victim socket !!"); + return -1; + } *(uint32_t *)(loader_ctx.args_map + 0x00) = 0x14; *(uint32_t *)(loader_ctx.args_map + 0x04) = IPPROTO_IPV6; @@ -212,24 +221,33 @@ int init_loader_args() { notify("syscall_wrapper: %#lx\nrwpipe: [%i, %i]\nrwpair: [%i, " "%i]\npipe_f_data: %#lx\nkernel_text_base: %#lx\nret: %lx", - loader_ctx.args.syscall_wrapper, rwpipe[0], rwpipe[1], rwpair[0], - rwpair[1], loader_ctx.args.pipe_f_data, + loader_ctx.args.syscall_wrapper, loader_ctx.args.rwpipe[0], + loader_ctx.args.rwpipe[1], loader_ctx.args.rwpair[0], + loader_ctx.args.rwpair[1], loader_ctx.args.pipe_f_data, loader_ctx.args.kernel_text_base, loader_ctx.args.ret); return 0; } int run_loader() { - typedef int (*entry_fn)(loader_args_t*, uint32_t); - entry_fn entry = (entry_fn)loader_ctx.entry; + typedef void (*entry_fn)(loader_args_t*, uint32_t); + + elfldr_entry entry = loader_ctx.entry; - notify("Calling elfldr entry at %#lx", loader_ctx.entry); - - int result = entry(&loader_ctx.args, 0x54455854u); // TEXT + notify("running elfldr..."); - notify("elfldr returned %d !!", result); + entry(&loader_ctx.args, 0x54455854u); // TEXT + + notify("elfldr returned %#lx !!", *(uint64_t *)loader_ctx.args.ret); munmap(loader_ctx.base, loader_ctx.size); - munmap(loader_ctx.args_map, PAGE_SIZE); + remove_pktinfo_from_so(loader_ctx.args.rwpair[0]); + + close(loader_ctx.args.rwpair[0]); + close(loader_ctx.args.rwpair[1]); + close(loader_ctx.args.rwpipe[0]); + close(loader_ctx.args.rwpipe[1]); + + munmap(loader_ctx.args_map, PAGE_SIZE); return 0; } \ No newline at end of file From 7afa2cf9801a27a6c64e802c07e78ae13cfaece0 Mon Sep 17 00:00:00 2001 From: Gezine <30000519+Gezine@users.noreply.github.com> Date: Tue, 19 May 2026 23:17:31 +0900 Subject: [PATCH 3/3] Forgot to rename elfldr_entry --- src/loader.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/loader.c b/src/loader.c index c387a66..6765a92 100644 --- a/src/loader.c +++ b/src/loader.c @@ -229,7 +229,7 @@ int init_loader_args() { } int run_loader() { - typedef void (*entry_fn)(loader_args_t*, uint32_t); + typedef void (*elfldr_entry)(loader_args_t*, uint32_t); elfldr_entry entry = loader_ctx.entry;