Bug Hunter Diary

The left-hand side of Figure 3-6 shows the offsets into the zeropage. The middle lists the actual values of the zero page. The righthandside shows the references the kernel makes into the zero page.Table 3-1 describes the zero page data layout illustrated in Figure 3-6.Table 3-1: Description of the Zero Page Data LayoutFunction/Line of codeip_sioctl_tunparam()9432ip_sioctl_tunparam()9446putnext()147putnext()176putnext()177putnext()180putnext()273Data referencedby the kernelill = ipif->ipif_ill;putnext(ill->ill_wq, mp1);putnext(queue_t*qp, mblk_t *mp)Descriptionipif is NULL, and the offset of ipif_ill within the ipifstructure is 0x8. Therefore, ipif->ipif_ill referencesaddress 0x8. The value at address 0x8 is assigned toill. So the ill structure starts at address 0x10 (see(1) in Figure 3-6).The value of ill->ill_wq is used as a parameter forputnext(). The offset of ill_wq inside the ill structureis 0x10. The ill structure starts at address 0x10, soill->ill_wq is referenced at address 0x20.The address of qp equals the value pointed to byill->ill_wq. Therefore, qp starts at address 0x28 (see(2) in Figure 3-6).qp = qp->q_next; The offset of q_next inside the qp structure is 0x18.Therefore, the next qp gets assigned the value fromaddress 0x40: the start address of qp (0x28) + offsetof q_next (0x18). The value at address 0x40 is again0x28, so the next qp structure starts at the sameaddress as the one before (see (3) in Figure 3-6).sq = qp->q_syncq; The offset of q_syncq inside the qp structure is 0x78.Since q_syncq is referenced later, it has to point toa valid memory address. I chose 0x7d0, which is anaddress in the mapped zero page.qi = qp->q_qinfo; The value of qp->q_qinfo is assigned to qi. The offsetof q_qinfo inside the qp structure is 0x0. Since theqp structure starts at address 0x28, the value 0x0 isassigned to qi (see (4) in Figure 3-6).putproc = qi-> The value of qi->qi_putp is assigned to the functionpointer putproc. The offset of qi_putp inside theqi_putp;qi structure is 0x0. Therefore, qi->qi_putp is referencedat address 0x0, and the value at this address(0x0000000041414141) is assigned to the functionpointer.Escape from the WWW Zone 45