> For the complete documentation index, see [llms.txt](https://lightc.gitbook.io/pwn-gitbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lightc.gitbook.io/pwn-gitbook/kpwn/kpwn-structs/tty-jie-gou-ti.md). # tty结构体 ## struct ### tty 使用pahole跑一遍 ```c struct tty_struct { int magic; /* 0 4 */ struct kref kref; /* 4 4 */ struct device * dev; /* 8 8 */ struct tty_driver * driver; /* 16 8 */ const struct tty_operations * ops; /* 24 8 */ int index; /* 32 4 */ /* XXX 4 bytes hole, try to pack */ struct ld_semaphore ldisc_sem; /* 40 48 */ /* --- cacheline 1 boundary (64 bytes) was 24 bytes ago --- */ struct tty_ldisc * ldisc; /* 88 8 */ struct mutex atomic_write_lock; /* 96 32 */ /* --- cacheline 2 boundary (128 bytes) --- */ struct mutex legacy_mutex; /* 128 32 */ struct mutex throttle_mutex; /* 160 32 */ /* --- cacheline 3 boundary (192 bytes) --- */ struct rw_semaphore termios_rwsem; /* 192 40 */ struct mutex winsize_mutex; /* 232 32 */ /* --- cacheline 4 boundary (256 bytes) was 8 bytes ago --- */ spinlock_t ctrl_lock; /* 264 4 */ spinlock_t flow_lock; /* 268 4 */ struct ktermios termios; /* 272 44 */ struct ktermios termios_locked; /* 316 44 */ /* --- cacheline 5 boundary (320 bytes) was 40 bytes ago --- */ char name[64]; /* 360 64 */ /* --- cacheline 6 boundary (384 bytes) was 40 bytes ago --- */ struct pid * pgrp; /* 424 8 */ struct pid * session; /* 432 8 */ long unsigned int flags; /* 440 8 */ /* --- cacheline 7 boundary (448 bytes) --- */ int count; /* 448 4 */ struct winsize winsize; /* 452 8 */ /* Bitfield combined with next fields */ long unsigned int stopped:1; /* 456:32 8 */ long unsigned int flow_stopped:1; /* 456:33 8 */ /* XXX 30 bits hole, try to pack */ /* Force alignment to the next boundary: */ long unsigned int :0; long unsigned int unused:62; /* 464: 0 8 */ /* XXX 2 bits hole, try to pack */ int hw_stopped; /* 472 4 */ /* Bitfield combined with previous fields */ long unsigned int ctrl_status:8; /* 472:32 8 */ long unsigned int packet:1; /* 472:40 8 */ /* XXX 23 bits hole, try to pack */ /* Force alignment to the next boundary: */ long unsigned int :0; long unsigned int unused_ctrl:55; /* 480: 0 8 */ /* XXX 9 bits hole, try to pack */ unsigned int receive_room; /* 488 4 */ int flow_change; /* 492 4 */ struct tty_struct * link; /* 496 8 */ struct fasync_struct * fasync; /* 504 8 */ /* --- cacheline 8 boundary (512 bytes) --- */ wait_queue_head_t write_wait; /* 512 24 */ wait_queue_head_t read_wait; /* 536 24 */ struct work_struct hangup_work; /* 560 32 */ /* --- cacheline 9 boundary (576 bytes) was 16 bytes ago --- */ void * disc_data; /* 592 8 */ void * driver_data; /* 600 8 */ spinlock_t files_lock; /* 608 4 */ /* XXX 4 bytes hole, try to pack */ struct list_head tty_files; /* 616 16 */ int closing; /* 632 4 */ /* XXX 4 bytes hole, try to pack */ /* --- cacheline 10 boundary (640 bytes) --- */ unsigned char * write_buf; /* 640 8 */ int write_cnt; /* 648 4 */ /* XXX 4 bytes hole, try to pack */ struct work_struct SAK_work; /* 656 32 */ struct tty_port * port; /* 688 8 */ /* size: 696, cachelines: 11, members: 46 */ /* sum members: 656, holes: 4, sum holes: 16 */ /* sum bitfield members: 128 bits, bit holes: 4, sum bit holes: 64 bits */ /* last cacheline: 56 bytes */ }; ``` 可以通过打开`/dev/ptmx`来分配一个`tty_struct`结构体 其魔数为`0x5401` ```c struct tty_operations { struct tty_struct * (*lookup)(struct tty_driver *, struct file *, int); /* 0 8 */ int (*install)(struct tty_driver *, struct tty_struct *); /* 8 8 */ void (*remove)(struct tty_driver *, struct tty_struct *); /* 16 8 */ int (*open)(struct tty_struct *, struct file *); /* 24 8 */ void (*close)(struct tty_struct *, struct file *); /* 32 8 */ void (*shutdown)(struct tty_struct *); /* 40 8 */ void (*cleanup)(struct tty_struct *); /* 48 8 */ int (*write)(struct tty_struct *, const unsigned char *, int); /* 56 8 */ /* --- cacheline 1 boundary (64 bytes) --- */ int (*put_char)(struct tty_struct *, unsigned char); /* 64 8 */ void (*flush_chars)(struct tty_struct *); /* 72 8 */ int (*write_room)(struct tty_struct *); /* 80 8 */ int (*chars_in_buffer)(struct tty_struct *); /* 88 8 */ int (*ioctl)(struct tty_struct *, unsigned int, long unsigned int); /* 96 8 */ long int (*compat_ioctl)(struct tty_struct *, unsigned int, long unsigned int); /* 104 8 */ void (*set_termios)(struct tty_struct *, struct ktermios *); /* 112 8 */ void (*throttle)(struct tty_struct *); /* 120 8 */ /* --- cacheline 2 boundary (128 bytes) --- */ void (*unthrottle)(struct tty_struct *); /* 128 8 */ void (*stop)(struct tty_struct *); /* 136 8 */ void (*start)(struct tty_struct *); /* 144 8 */ void (*hangup)(struct tty_struct *); /* 152 8 */ int (*break_ctl)(struct tty_struct *, int); /* 160 8 */ void (*flush_buffer)(struct tty_struct *); /* 168 8 */ void (*set_ldisc)(struct tty_struct *); /* 176 8 */ void (*wait_until_sent)(struct tty_struct *, int); /* 184 8 */ /* --- cacheline 3 boundary (192 bytes) --- */ void (*send_xchar)(struct tty_struct *, char); /* 192 8 */ int (*tiocmget)(struct tty_struct *); /* 200 8 */ int (*tiocmset)(struct tty_struct *, unsigned int, unsigned int); /* 208 8 */ int (*resize)(struct tty_struct *, struct winsize *); /* 216 8 */ int (*get_icount)(struct tty_struct *, struct serial_icounter_struct *); /* 224 8 */ int (*get_serial)(struct tty_struct *, struct serial_struct *); /* 232 8 */ int (*set_serial)(struct tty_struct *, struct serial_struct *); /* 240 8 */ void (*show_fdinfo)(struct tty_struct *, struct seq_file *); /* 248 8 */ /* --- cacheline 4 boundary (256 bytes) --- */ int (*poll_init)(struct tty_driver *, int, char *); /* 256 8 */ int (*poll_get_char)(struct tty_driver *, int); /* 264 8 */ void (*poll_put_char)(struct tty_driver *, int, char); /* 272 8 */ int (*proc_show)(struct seq_file *, void *); /* 280 8 */ /* size: 288, cachelines: 5, members: 36 */ /* last cacheline: 32 bytes */ }; ``` 泄露内核`text`段地址和内核线性映射区，劫持内核执行流