Repository navigation
Add deb13-apxs2 amd64 profile and stage-3 composition knobs - #2
Merged
devploit merged 5 commits intoOct 30, 2026
Merged
Conversation
New build profile: PHP 8.4.26 source-built mod_php (apxs2) on Debian 13, Apache 2.4.69 prefork, one worker, amd64. Offsets differ from the docker 8.4.26 image (different toolchain): zif_system 0x3b19a0, zval_ptr_dtor 0x584f00, htdata 0x6e0d8. Stages 1-2 dispatch cleanly with these values. Third stage-3 layout with a K=5 bin-32 phase shift: the freed session reference lands at R0 = chunk+0x2260+0x60*K, linear in the number of preceding bin-32 pads (gdb watchpoint sweep). Five (4,4) pads align the bin-56 reclaim slot so a 31-byte fake reference is written whole (chars at R0). The built-in 55-byte ref frames the same payload at R0+8 and never reclaims here. New per-build stage-3 knobs (profile fields, env-driven through the same P2S_STAGE3_PADS pattern): stage3_cookie, stage3_wfields, stage3_fake_len, stage3_fakes, stage3_b_name_len. php2shell_calibrate.py --stage3-pads accepts an explicit a:bxN spec alongside the two built-in layouts. Stage-3 phase is instance-dependent on this build: uid=33(www-data) 4/4 runs with the profile's parameters on one apache master instance, no reclaim on masters started the same way (probabilistic, like the 8.4.25 profile; restart and retry). Proof command read out-of-band from /tmp inside the apache mount namespace (PrivateTmp). All knobs documented in docs/upstream-changes.md section 2b.
The calibrator now keeps the measured stage-3 branch: explicit pads default to the non-carrier layout, --stage3-carrier can force either branch, and the generated upstream_profile follows the result. Add tests for pads/carrier/profile metadata, update the status table and inventory, and record the contributor-reported deb13 calibration as such.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
New build profile: PHP 8.4.26 source-built mod_php (apxs2) on Debian 13, Apache 2.4.69 prefork, one worker, amd64. Offsets differ from the docker 8.4.26 image (different toolchain): zif_system 0x3b19a0, zval_ptr_dtor 0x584f00, htdata 0x6e0d8. Stages 1-2 dispatch cleanly with these values.
Third stage-3 layout with a K=5 bin-32 phase shift: the freed session reference lands at R0 = chunk+0x2260+0x60*K, linear in the number of preceding bin-32 pads (gdb watchpoint sweep). Five (4,4) pads align the bin-56 reclaim slot so a 31-byte fake reference is written whole (chars at R0). The built-in 55-byte ref frames the same payload at R0+8 and never reclaims here.
New per-build stage-3 knobs (profile fields, env-driven through the same P2S_STAGE3_PADS pattern): stage3_cookie, stage3_wfields, stage3_fake_len, stage3_fakes, stage3_b_name_len. php2shell_calibrate.py --stage3-pads accepts an explicit a:bxN spec alongside the two built-in layouts.
Stage-3 phase is instance-dependent on this build: uid=33(www-data) 4/4 runs with the profile's parameters on one apache master instance, no reclaim on masters started the same way (probabilistic, like the 8.4.25 profile; restart and retry). Proof command read out-of-band from /tmp inside the apache mount namespace (PrivateTmp).
All knobs documented in docs/upstream-changes.md section 2b.