KaraZajac
cd9bea6399
build / build (clang / debug) (push) Waiting to run
build / build (clang / default) (push) Waiting to run
build / build (gcc / debug) (push) Waiting to run
build / build (gcc / default) (push) Waiting to run
build / sanitizers (ASan + UBSan) (push) Waiting to run
build / clang-tidy (push) Waiting to run
build / drift-check (CISA KEV + Debian tracker) (push) Waiting to run
build / static-build (push) Waiting to run
skeletonkey_offsets_resolve() runs sources in priority order: env vars first, then /proc/kallsyms. On any default host kallsyms returns all-zero addresses (kptr_restrict), and parse_symfile treated "all zero" by UNCONDITIONALLY zeroing modprobe_path/init_task — clobbering the values apply_env had just set from SKELETONKEY_MODPROBE_PATH / SKELETONKEY_INIT_TASK. Net effect: the documented env-var offset override silently did nothing, so every --full-chain kernel primitive reported "offsets couldn't be resolved" even when correct offsets were supplied. Now the all-zero path only clears fields it tagged OFFSETS_FROM_KALLSYMS itself, preserving env (and table/System.map) values. Verified on Ubuntu 22.04.0 / 5.15.0-25: with SKELETONKEY_MODPROBE_PATH set, the resolver now reports "modprobe_path=0x... (env)", the modprobe_path finisher engages, and nf_tables' pipapo arb-write fires. (nf_tables itself still returns an honest EXPLOIT_FAIL: the reconstructed double-free arb-write doesn't reliably land the write yet — recorded in docs/EXPLOITED.md.) This fix is the prerequisite for verifying any of the ~13 primitive full-chains. Unit harness green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0118iUgHY44hdRtANgyCmu7y