#define _GNU_SOURCE #include #include #include #include #include #include #include #include #include #include #include #include #include static void execute_one(void) { int idx = 0; const int ONE = 1; // socket$can_j1939 arguments: [ // domain: const = 0x1d (8 bytes) // type: const = 0x2 (8 bytes) // proto: const = 0x7 (4 bytes) // ] // returns sock_can_j1939 const int fd = socket(0x1d, 2, 7); // ioctl$ifreq_SIOCGIFINDEX_vcan arguments: [ // fd: sock (resource) // cmd: const = 0x8933 (4 bytes) // arg: ptr[out, ifreq_dev_t[vcan_device_names, ifindex_vcan]] { // ifreq_dev_t[vcan_device_names, ifindex_vcan] { // ifr_ifrn: buffer: {76 63 61 6e 30 00 00 00 00 00 00 00 00 00 00 00} // (length 0x10) elem: ifindex_vcan (resource) pad = 0x0 (20 bytes) // } // } // ] memcpy((void*)0x200000001440, "vcan0\000\000\000\000\000\000\000\000\000\000\000", 16); if (ioctl(fd, 0x8933, 0x200000001440ul) != -1) idx = *(uint32_t*)0x200000001450; // bind$can_j1939 arguments: [ // fd: sock_can_j1939 (resource) // addr: ptr[in, sockaddr_can_j1939] { // sockaddr_can_j1939 { // can_family: const = 0x1d (2 bytes) // pad = 0x0 (2 bytes) // can_ifindex: ifindex_vcan (resource) // name: int64 = 0x0 (8 bytes) // pgn: can_j1939_pgn { // pgn_ps: can_j1939_pgn_ps = 0x1 (1 bytes) // pgn_pf: can_j1939_pgn_pf = 0xf0 (1 bytes) // pgn_flags: can_j1939_pgn_flags = 0x4 (1 bytes) // pgn_unused: const = 0x0 (1 bytes) // } // addr: can_j1939_addrs = 0xfe (1 bytes) // pad = 0x0 (3 bytes) // } // } // len: bytesize = 0x18 (8 bytes) // ] *(uint16_t*)0x200000000100 = 0x1d; *(uint32_t*)0x200000000104 = idx; *(uint64_t*)0x200000000108 = 0; *(uint8_t*)0x200000000110 = 1; *(uint8_t*)0x200000000111 = 0xf0; *(uint8_t*)0x200000000112 = 4; *(uint8_t*)0x200000000113 = 0; *(uint8_t*)0x200000000114 = 0xfe; bind(fd, (struct sockaddr *) 0x200000000100ul, 0x18ul); setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &ONE, sizeof(ONE)); send(fd, "\x81\xb6\x41\xf1\xf3\x84\x37\x04\xb6", 9, 0); send(fd, "\x81\xb6\x41\xf1\xf3\x84\x37\x04\xb6", 9, 0); } int main(int argc, char *argv[]) { mmap((void *) 0x200000000000ul, 0x1000000ul, PROT_WRITE|PROT_READ|PROT_EXEC, MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); if (unshare(CLONE_NEWNET)) return 1; system("ip link add name vcan0 up type vcan"); system("ip addr add 172.20.20.0/24 dev vcan0"); execute_one(); return 0; }