1
2

❯ file ./bzImage
./bzImage: Linux kernel x86 boot executable bzImage, version 4.15.8 (simple@vps-simple) #19 SMP Mon Mar 19 18:50:28 CST 2018, RO-rootFS, swap_dev 0X6, Normal VGA

1
2

❯ file ./vmlinux
./vmlinux: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, BuildID[sha1]=1d8344e71a82bc43821029796ef65bebfe8e65c3, not stripped

1
2

❯ file /boot/vmlinuz-linux-zen
/boot/vmlinuz-linux-zen: Linux kernel x86 boot executable bzImage, version 6.7.7-zen1-1-zen (linux-zen@archlinux) #1 ZEN SMP PREEMPT_DYNAMIC Fri, 01 Mar 2024 15:07:23 +0000, RO-rootFS, swap_dev 0XD, Normal VGA

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

❯ file ./chall
./chall: ELF 64-bit LSB executable, UCB RISC-V, RVC, double-float ABI, version 1 (SYSV), statically linked, for GNU/Linux 4.15.0, with debug_info, not stripped

❯ ./chall
exec: Failed to execute process: './chall' the file could not be run by the operating system.

❯ qemu-riscv64 ./chall
Welcome to moeCTF 2022
Plz input your flag:
flag{test}
ops, wrong input!
Please try again⏎ 

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#!/bin/bash

qemu-system-x86_64 \
-initrd core.cpio \
-kernel bzImage \
-append 'console=ttyS0 root=/dev/ram oops=panic panic=1 kaslr' \
-enable-kvm \
-monitor /dev/null \
-m 128M \
--nographic  \
-smp cores=1,threads=1 \
-cpu kvm64,+smep \
-s

1
2
3
4
5
6

# 打包
find . -print0 \
| cpio --null -ov --format=newc \
| gzip -9 > $1
# 解包
cpio -idv < ./rootfs.cpio

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

struct cred {
    atomic_t    usage;
#ifdef CONFIG_DEBUG_CREDENTIALS
    atomic_t    subscribers;    /* number of processes subscribed */
    void        *put_addr;
    unsigned    magic;
#define CRED_MAGIC    0x43736564
#define CRED_MAGIC_DEAD    0x44656144
#endif
    kuid_t        uid;        /* real UID of the task */
    kgid_t        gid;        /* real GID of the task */
    kuid_t        suid;        /* saved UID of the task */
    kgid_t        sgid;        /* saved GID of the task */
    kuid_t        euid;        /* effective UID of the task */
    kgid_t        egid;        /* effective GID of the task */
    kuid_t        fsuid;        /* UID for VFS ops */
    kgid_t        fsgid;        /* GID for VFS ops */
    unsigned    securebits;    /* SUID-less security management */
    kernel_cap_t    cap_inheritable; /* caps our children can inherit */
    kernel_cap_t    cap_permitted;    /* caps we're permitted */
    kernel_cap_t    cap_effective;    /* caps we can actually use */
    kernel_cap_t    cap_bset;    /* capability bounding set */
    kernel_cap_t    cap_ambient;    /* Ambient capability set */
#ifdef CONFIG_KEYS
    unsigned char    jit_keyring;    /* default keyring to attach requested
                     * keys to */
    struct key __rcu *session_keyring; /* keyring inherited over fork */
    struct key    *process_keyring; /* keyring private to this process */
    struct key    *thread_keyring; /* keyring private to this thread */
    struct key    *request_key_auth; /* assumed request_key authority */
#endif
#ifdef CONFIG_SECURITY
    void        *security;    /* subjective LSM security */
#endif
    struct user_struct *user;    /* real user ID subscription */
    struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
    struct group_info *group_info;    /* supplementary groups for euid/fsgid */
    struct rcu_head    rcu;        /* RCU deletion hook */
};

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

// 保存寄存器值到变量中
size_t user_cs, user_ss, user_rflags, user_sp;
void saveStatus() {
    __asm__("mov user_cs, cs;"
            "mov user_ss, ss;"
            "mov user_sp, rsp;"
            "pushf;"
            "pop user_rflags;"
            );
    puts("\033[34m\033[1m[*] Status has been saved.\033[0m");
}
// 返回用户态时布置栈帧：
↓   swapgs
    iretq
    user_shell_addr
    user_cs
    user_eflags //64bit user_rflags
    user_sp
    user_ss