#define _GNU_SOURCE #include #include #include #include #include #include #include #include uint64_t r[1] = {0xffffffffffffffff}; int main(void) { syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul, /*prot=*/7ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul, /*flags=*/0x32ul, /*fd=*/-1, /*offset=*/0ul); intptr_t res = 0; memcpy((void*)0x20000080, "/sys/devices/virtual/net/bond0/bonding/arp_ip_target\000", 53); res = syscall(__NR_openat, /*fd=*/0xffffffffffffff9cul, /*file=*/0x20000080ul, /*flags=*/2ul, /*mode=*/0ul); if (res != -1) r[0] = res; memcpy( (void*)0x20000140, "\x00\xdc\x39\x49\xf4\x87\xd1\xc0\x35\xf7\x35\x07\xd7\x73\x6a\x4a\x68\x3b" "\xe7\x1d\x54\x49\x8a\x75\x6d\xb5\x16\xa4\xf9\xd2\x7c\xe2\x99\x57\x56\xc0" "\xe8\x75\xd9\x6d\x9e\xc0\x19\x8e\xfb\x4c\x75\x5c\x79\xd2\x71\x40\x15\x52" "\xab\x41\xd4\xdd\x13\x42\xda\xa5\xf8\xc7\x19\x2f\xbf\x4e\x9a\x74\xec\x5b" "\x1e\x47\xbc\xca\x9d\x3e\x3b\x0e\x7a\x43\x90\x66\x85\x4c\xb5\x1f\xc8\x35" "\x6b\x1f\x51\x1d\x97\x17\xb7\xd5\x8e\x5a\xc5\x6b\xd0\xeb\x73\x1f\xd8\xc3" "\x9d\xc4\xff\x0a\x5d\x14\x65\x3e\xe0\x7d\x3b\x72\x26\xef\x39\x2b\x7e\x84" "\xc1\x82\x21\x4d\x2a\x1e\x9f\xf1\x06\x1a\x8e\x14\xec\xfe\xc4\x94\x82\x1f" "\xcf\xe9\x01\x34\x29\x6f\x2b\x9b\x21\x12\x8a\x41\xde\x34\x9a\xab\xfe\x94" "\x7c\xb9\xe4\x6c\x16\x9a\x49\xd6\xee\x22\x14\xf7\xef\xbb\xa5\xe1\xad\x79" "\x61\xaa\x0c\xc4\xca\xa0\x38\xc4\x20\xbf\x59\x65\x8f\xae\xd7\xdf\x44\x5d" "\xd6\x16\x7f\x08\x0b\xaa\x7d\x6b\x47\xb4\xa6\x13\x78\x91\x87\x77\x0a\x91" "\x41\x35\x9a\xba\x3e\x6a\x67\x03\x79\x04\xb4\xc0\x09\xc5\x50\xd6\x6d\x2b" "\x74\x31\xc7\xe0\x3c\x10\xad\xff\xfe\x71\xc7", 245); syscall(__NR_write, /*fd=*/r[0], /*buf=*/0x20000140ul, /*count=*/0xf5ul); return 0; }