⬢ DragonFlyBSD Kernel Audit
DF-5825 / probe_state.c
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
/* probe_state.c - print sizeof/offsetof of kdmsg_state & kdmsg_msg + RB layout
 * for DF-5825 exploit offset verification.  Build with -D_KERNEL_STRUCTURES.
 */
#include <stdio.h>
#include <stddef.h>
#include <sys/types.h>
#include <sys/dmsg.h>

int
main(void)
{
	printf("sizeof(kdmsg_state) = %zu\n", sizeof(kdmsg_state_t));
	printf("offsetof rbnode      = %zu\n", offsetof(kdmsg_state_t, rbnode));
	printf("  rbe_left  @ +0\n");
	printf("  rbe_right @ +8\n");
	printf("  rbe_parent@ +16\n");
	printf("  rbe_color @ +24\n");
	printf("offsetof scan        = %zu\n", offsetof(kdmsg_state_t, scan));
	printf("offsetof subq        = %zu\n", offsetof(kdmsg_state_t, subq));
	printf("offsetof iocom       = %zu\n", offsetof(kdmsg_state_t, iocom));
	printf("offsetof parent      = %zu\n", offsetof(kdmsg_state_t, parent));
	printf("offsetof msgid       = %zu\n", offsetof(kdmsg_state_t, msgid));
	printf("offsetof flags       = %zu\n", offsetof(kdmsg_state_t, flags));
	printf("sizeof(kdmsg_msg)    = %zu, offsetof(any) = %zu\n",
	       sizeof(kdmsg_msg_t), offsetof(kdmsg_msg_t, any));
	printf("sizeof(dmsg_hdr)     = %zu\n", sizeof(dmsg_hdr_t));
	printf("sizeof(kdmsg_iocom)  = %zu\n", sizeof(kdmsg_iocom_t));
	printf("iocom staterd_tree @ %zu\n", offsetof(kdmsg_iocom_t, staterd_tree));
	printf("iocom statewr_tree @ %zu\n", offsetof(kdmsg_iocom_t, statewr_tree));
	printf("iocom conn_state   @ %zu\n", offsetof(kdmsg_iocom_t, conn_state));
	printf("iocom freerd_state @ %zu\n", offsetof(kdmsg_iocom_t, freerd_state));
	printf("iocom freewr_state @ %zu\n", offsetof(kdmsg_iocom_t, freewr_state));
	printf("iocom state0       @ %zu\n", offsetof(kdmsg_iocom_t, state0));
	printf("state refs         @ %zu\n", offsetof(kdmsg_state_t, refs));
	return 0;
}
/* appended: iocom offsets (compiled only when -DIOC_PROBE defined) */
#ifdef IOC_PROBE
#include <stddef.h>
int main2(void);
#endif