View source for Kernel memory write via ROP gadget

[[Evasi0n]] cannot set the destination pointer in a <code>memmove()</code> operation to an arbitrary value because the vtable pointer is necessary to call the wanted function. This problem is solved by searching for a <code>STR R1, [R2]; BX LR</code> gadget in memory and that is being used to write four bytes at a time. With this all patches can be made.

== See also ==
* [[Kernel Patches]] (like <code>sb_evaluate()</code> and <code>task_for_pid()</code>)

== References ==
* [http://blog.azimuthsecurity.com/2013/02/from-usr-to-svc-dissecting-evasi0n.html Analysis by kernelpool]

[[Category:Exploits]]