How to confirm R0 register when bypass PXN

[GeneBlue]

Hello fi01:
Thanks for providing this POC code,it helps me a lot.As a beginner,I am researching a method to bypass PXN recently.However,something are confusing me.When we attempt to bypass PXN,we need use R0 or R1 to build a ROP chain.So,how to confirm R0 or R1? inet_release() func in kernel source,arg is sock.setup_getroot() func in POC code,arg is sk. If sk equals sock? This poc cann't running in an emulator,so i cann't debug kernel to prove these. Could you help me please?

[GeneBlue]

I have solve this problem.

[r4nd0mus3r]

How did you solve this?

[GeneBlue]

@r4nd0mus3r debug goldfish kernel and research panic info in nexus

[r4nd0mus3r]

@GeneBlue every time I try to debug the goldfish kernel the code gets stuck into an infinite loop while trying to control sk. How did you bypass that? I tried after a while overwriting the socks table with new vulnerable sockets and then trying again but still same issue.