⬢ DragonFlyBSD Kernel Audit
DF-3017 / offsets.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
/* DF-3017 weaponization: kernel structure offsets (guest-side) */
#define _KERNEL_STRUCTURES
#include <sys/types.h>
#include <sys/param.h>
#include <sys/sysref.h>
#include <sys/conf.h>
#include <sys/device.h>
#include <sys/devfs.h>
#include <sys/proc.h>
#include <sys/ucred.h>
#include <sys/uio.h>
#include <sys/stat.h>
#include <stddef.h>
#include <stdio.h>

int main(void) {
	printf("sizeof(struct cdev)        = %zu\n", sizeof(struct cdev));
	printf("  off si_flags   = %zu\n", offsetof(struct cdev, si_flags));
	printf("  off si_inode   = %zu\n", offsetof(struct cdev, si_inode));
	printf("  off si_uminor  = %zu\n", offsetof(struct cdev, si_uminor));
	printf("  off si_umajor  = %zu\n", offsetof(struct cdev, si_umajor));
	printf("  off si_name    = %zu (SPECNAMELEN+1=%d)\n", offsetof(struct cdev, si_name), SPECNAMELEN+1);
	printf("  off si_ops     = %zu\n", offsetof(struct cdev, si_ops));
	printf("  off si_bops    = %zu\n", offsetof(struct cdev, si_bops));
	printf("  off si_iosize_max = %zu\n", offsetof(struct cdev, si_iosize_max));
	printf("  off si_sysref  = %zu (sysref size %zu)\n", offsetof(struct cdev, si_sysref), sizeof(struct sysref));
	printf("  off si_hlist   = %zu\n", offsetof(struct cdev, si_hlist));
	printf("sizeof(struct devfs_node)  = %zu\n", sizeof(struct devfs_node));
	printf("  off d_dev=%zu mp=%zu v_node=%zu node_type=%zu mode=%zu uid=%zu flags=%zu\n",
	    offsetof(struct devfs_node, d_dev), offsetof(struct devfs_node, mp),
	    offsetof(struct devfs_node, v_node), offsetof(struct devfs_node, node_type),
	    offsetof(struct devfs_node, mode), offsetof(struct devfs_node, uid),
	    offsetof(struct devfs_node, flags));
	/* dev_ops layout is fixed by hand: head{name@0,maj@8,flags@12,data@16,
	 * refs@24,id@28}, d_default@32, d_open@40, d_close@48, d_read@56 ... */
	printf("sizeof(struct sysref) = %zu refcnt=%zu flags=%zu\n",
	    sizeof(struct sysref), offsetof(struct sysref, refcnt), offsetof(struct sysref, flags));
	printf("struct proc: p_pid=%zu p_ucred=%zu p_list=%zu size=%zu\n",
	    offsetof(struct proc, p_pid), offsetof(struct proc, p_ucred),
	    offsetof(struct proc, p_list), sizeof(struct proc));
	printf("struct ucred: cr_uid=%zu cr_ruid=%zu cr_svuid=%zu cr_ngroups=%zu cr_groups=%zu cr_prison=%zu size=%zu\n",
	    offsetof(struct ucred, cr_uid), offsetof(struct ucred, cr_ruid),
	    offsetof(struct ucred, cr_svuid), offsetof(struct ucred, cr_ngroups),
	    offsetof(struct ucred, cr_groups), offsetof(struct ucred, cr_prison),
	    sizeof(struct ucred));
	printf("struct thread: td_proc=%zu td_lwp=%zu\n",
	    offsetof(struct thread, td_proc), offsetof(struct thread, td_lwp));
	printf("struct lwp: lwp_proc=%zu\n", offsetof(struct lwp, lwp_proc));
	printf("sizeof(struct iovec)=%zu UIO_SMALLIOV=%d\n", sizeof(struct iovec), UIO_SMALLIOV);
	return 0;
}