Roarcannotprogramming

function tmc() {
    before=$(df -hl  / |awk '{print $3}' |tail -n1)
    count=0
	for snapshot in $(tmutil  listlocalsnapshots /|awk -F. '{print $4}');do
        let 'count++'
		echo "delete snapshot $snapshot"
		tmutil deletelocalsnapshots $snapshot;
	done
    after=$(df -hl  / |awk '{print $3}' |tail -n1)
    if [[ $count -ne 0 ]]; then

Roarcannotprogramming

#define _GNU_SOURCE
#include <fcntl.h>
#include <linux/types.h>
#include <pthread.h>
#include <signal.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>

Roarcannotprogramming

#include "banzi.h"

/**
 * global variables
 */
int sprayfd_child[2];
int sprayfd_parent[2];
int socketfds[10*INITIAL_PAGE_SPRAY];
unsigned long user_cs, user_ss, user_rflags, user_sp;
unsigned long long int base_addr;

Roarcannotprogramming

#include "banzi.h"

/*
 * socket 占页
 * https://www.willsroot.io/2022/08/reviving-exploits-against-cred-struct.html
 * 需要在内核中开启 CONFIG_USER_NS=y, 默认开启
 */

void unshare_setup(uid_t uid, gid_t gid) {
    int temp;