feat: perf KASLR leak (primary), slide as fallback - #30
Merged
Conversation
added 7 commits
July 21, 2026 03:19
slabinfo shows mm_struct objsize=1024 (0x400), MM_STRUCT_SZ stays 0x400. KSNITCH_COLLISIONS lowered from 4 to 1 to match device behavior. Added get_ksnitch_collisions() for runtime override via env var.
The duchamp slide route was missing a consumer thread that calls sched_setattr_tid() on the waiter thread. Without this, there is no PI chain formation and the boot_id KASLR leak always fails. Changes: - Add slide_consumer_thread() that calls sched_setattr_tid() on the waiter thread while it's blocked in pselect - Launch consumer thread in slide_pselect_stack_copy() - Remove perf_leak_stext() fallback (untested, unreliable) - KSNITCH_COLLISIONS lowered to 1 with env var override
Port perf_leak_text_base() from CyberMeowfia PR #36 (Moto G05 MTK). Uses PERF_TYPE_SOFTWARE + PERF_COUNT_SW_CPU_CLOCK to sample kernel IPs, takes minimum kernel IP >= KIMAGE_TEXT_BASE, rounds to 2MB alignment. Your device has perf_event_paranoid=-1 so this should work. - perf leak tries first, slide leak as fallback - Busy-loop sampling instead of sleep - Filters kernel IPs via PERF_RECORD_MISC_KERNEL flag - P0_KERNEL_PHYS_DELTA is 0 for duchamp, so text_base = min_kip & ~(2MB-1)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Port perf_leak_text_base() from CyberMeowfia PR #36 (Moto G05 MTK).
How it works:
Flow: perf leak tries first → if fails, slide leak as fallback
Your device has perf_event_paranoid=-1, so this should work without issues.