Bug Hunter Diary

Back on the Linux host, I started the kernel debugger (see SectionB.5 for more information on how to build this gdb version):linux# gdb_osx KernelDebugKit_10.4.8/mach_kernelGNU gdb 2003-01-28-cvs (Mon Mar 5 16:54:25 UTC 2007)Copyright 2003 Free Software Foundation, Inc.GDB is free software, covered by the GNU General Public License, and you arewelcome to change it and/or distribute copies of it under certain conditions.Type "show copying" to see the conditions.There is absolutely no warranty for GDB. Type "show warranty" for details.This GDB was configured as "--host= --target=i386-apple-darwin".(gdb) target remote-kdpI then instructed the debugger to use Apple’s kernel debug protocol(kdp):Once the debugger was running, I attached to the kernel of thetarget system for the first time:(gdb) attach 10.0.0.2Connected.0x001a8733 in lapic_dump () at /SourceCache/xnu/xnu-792.13.8/osfmk/i386/mp.c:332332 int i;(gdb) continueContinuing.As the debugger output shows, it seemed to work! The OS X systemwas frozen at that time, so I continued the execution of the kernelwith the following debugger command:Now everything was set up for remotely debugging the kernel ofthe Mac OS X target system.Step 4: Get Control over EIPAfter I had successfully connected the debugger to the kernel of thetarget system, I opened a terminal on the Mac OS X machine andagain executed the POC code described in Listing 7-2:osx$ iduid=502(seraph) gid=502(seraph) groups=502(seraph)osx$ ./pocA Bug Older Than 4.4BSD 123