Target Module
-
enum class RopActionId : uint32_t
Enum for predefined ROP action IDs.
Values:
-
enumerator MSLEEP
-
enumerator COMMIT_INIT_TASK_CREDS
-
enumerator SWITCH_TASK_NAMESPACES
-
enumerator WRITE_WHAT_WHERE_64
-
enumerator FORK
-
enumerator TELEFORK
-
enumerator KPTI_TRAMPOLINE
-
enumerator MSLEEP
-
enum class RopItemType : uint8_t
Enum for the types of ROP items.
Values:
-
enumerator CONSTANT_VALUE
-
enumerator SYMBOL
-
enumerator ARGUMENT
-
enumerator CONSTANT_VALUE
-
struct RopItem
- #include <Target.h>
Represents a single item in a ROP chain.
-
struct RopActionArgMeta
- #include <Target.h>
Metadata for a ROP action argument.
-
struct RopActionMeta
- #include <Target.h>
Metadata for a ROP action.
-
struct StructField
- #include <Target.h>
Represents a field within a struct.
-
struct Struct
- #include <Target.h>
Represents a kernel struct definition.
-
class Target
- #include <Target.h>
Represents a specific kernel target with its symbols, ROP gadgets, and other definitions.
Public Functions
-
Target(const std::string &distro, const std::string &release_name, const std::string &version = "")
Constructor for a Target.
- Parameters:
distro – The distribution name.
release_name – The release name.
version – The version string (optional).
-
uint32_t GetSymbolOffset(std::string symbol_name)
Get the offset of a symbol within the target.
- Parameters:
symbol_name – The name of the symbol.
- Throws:
ExpKitError – if the symbol is not found or has an offset of 0.
- Returns:
The offset of the symbol.
-
std::vector<RopItem> GetRopActionItems(RopActionId id)
Get the ROP items for a specific ROP action ID.
- Parameters:
id – The ROP action ID.
- Throws:
ExpKitError – if the ROP action ID is not found.
- Returns:
A vector of ROP items for the specified action.
-
void AddSymbol(const std::string &name, uint64_t value)
Add a symbol to the target.
- Parameters:
name – The name of the symbol.
value – The value (offset) of the symbol without the base address.
-
void AddRopAction(const std::string &name, std::vector<RopItem> value)
Add a ROP Action to the target.
- Parameters:
name – The name of the ROP Action.
value – The ROP Action items (array of RopItem).
-
void AddStruct(const Struct &value)
Add a struct definition to the target.
- Parameters:
value – The struct structure
-
void AddStruct(const std::string &name, uint64_t size, const std::vector<StructField> &fields)
Add a struct definition to the target.
- Parameters:
name – The name of the struct.
size – The size of the struct.
fields – A vector of StructField objects representing the fields of the struct.
-
Target(const std::string &distro, const std::string &release_name, const std::string &version = "")
-
class TargetDb
- #include <TargetDb.h>
Manages a database of kernel targets, including both static and dynamically parsed ones.
Public Functions
-
TargetDb(const std::string &filename)
Constructs a TargetDb object.
- Parameters:
filename – A database file to read from.
-
TargetDb(const std::vector<uint8_t> &data)
Constructs a TargetDb object from a byte buffer.
- Parameters:
data – The buffer containing the KXDB file data.
-
TargetDb(const std::string &filename, const std::vector<uint8_t> &fallback_kxdb)
Constructs a TargetDb object.
- Parameters:
filename – A database file to read from if exists.
fallback_kxdb – The buffer containing the fallback / built-in KXDB file data if the file does not exists.
-
void AddTarget(const Target &target)
Adds a target to the database.
- Parameters:
target – The target to add.
-
Target GetTarget(const std::string &distro, const std::string &release_name)
Retrieves a Target object by distro and release name.
- Parameters:
distro – The distribution name.
release_name – The release name.
- Returns:
The Target object.
-
Target GetTarget(const std::string &version)
Retrieves a Target object by version.
- Parameters:
version – The version string.
- Returns:
The Target object.
-
Target AutoDetectTarget()
Automatically detects the target based on the system’s kernel version.
- Throws:
ExpKitError – if the target cannot be detected.
- Returns:
The detected Target object.
-
TargetDb(const std::string &filename)