1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
import gdb
gr = gdb.execute
inf = gdb.selected_inferior()
pid = inf.pid
base = None
for line in open("/proc/%d/maps" % pid):
parts = line.split()
try:
lo, hi = [int(x,16) for x in parts[0].split('-')]
except Exception:
continue
if base is None and "libnvidia-eglcore" in line and int(parts[2],16) == 0:
base = lo
print("BASE 0x%x PID %d" % (base or 0, pid))
def u64(a): return int(gdb.parse_and_eval("*(unsigned long*)0x%x" % a))
def u32(a): return int(gdb.parse_and_eval("*(unsigned int*)0x%x" % a))
state = {"chits":0, "cleared":0, "whits":0, "wrote":0}
class BC(gdb.Breakpoint):
def __init__(self):
super().__init__("*0x%x" % (base + 0xB33D30), internal=False)
self.silent = True
def stop(self):
state["chits"] += 1
try:
obj = int(gdb.parse_and_eval("$rdi"))
n = int(gdb.parse_and_eval("$rsi"))
cnt = u32(obj + 0x22efc)
for i in range(0, min(cnt, 32)):
p = u64(obj + 0x1428 + i*8)
if not p:
continue
tgt = p + n * 0x10
try:
v16 = int(gdb.parse_and_eval("*(unsigned short*)0x%x" % (tgt + 0xe)))
if v16 == 0xffff:
gr("set {unsigned short}0x%x = 0" % (tgt + 0xe))
gr("set {unsigned int}0x%x = 0" % tgt)
gr("set {unsigned short}0x%x = 0" % (tgt + 0xc))
state["cleared"] += 1
if state["cleared"] <= 10:
print("CLEAR#%d obj=0x%x n=0x%x tgt=0x%x" % (state["cleared"], obj, n, tgt))
except Exception:
pass
except Exception as e:
if state["chits"] <= 4:
print("chitfail %s" % e)
return state["chits"] >= 6000
class BW(gdb.Breakpoint):
def __init__(self):
super().__init__("*0x%x" % (base + 0xDCEBD9), internal=False)
self.silent = True
def stop(self):
state["whits"] += 1
try:
rbx = int(gdb.parse_and_eval("$rbx"))
sub = u64(rbx + 0x70)
obj2 = u64(sub + 0x58)
off = u32(obj2 + 0x60)
holder = u64(obj2 + 0x58)
base2 = u64(holder + 0x58)
word = base2 + off
val = u32(word)
if state["whits"] <= 6 or val == 0:
print("WORD#%d addr=0x%x val=0x%x" % (state["whits"], word, val))
if val == 0:
gr("set {unsigned int}0x%x = 1" % word)
state["wrote"] += 1
if state["wrote"] <= 10:
print("WORDWROTE 0x%x" % word)
except Exception as e:
if state["whits"] <= 4:
print("whitfail %s" % e)
return False
try:
BC(); BW(); print("BPS-SET")
gr("continue")
except Exception as e:
print("bpfail %s" % e)
print("T99-DONE chits=%d cleared=%d whits=%d wrote=%d" % (state["chits"], state["cleared"], state["whits"], state["wrote"]))
|
