๐Ÿ’ฅ Phase 2: ret2usr ๊ณต๊ฒฉ ์นจํˆฌ (SMEP ๋ถ€์žฌ ํ™˜๊ฒฝ) Step 1/3: ์ปค๋„ ํ•จ์ˆ˜ ํฌ์ธํ„ฐ ๋ณ€์กฐ
๊ณต๊ฒฉ์ž๊ฐ€ ์ปค๋„ ์†Œ์ผ“ ๋ฒ„๊ทธ๋ฅผ ์•…์šฉํ•˜์—ฌ ์ปค๋„ ๋‚ด๋ถ€ ํ•จ์ˆ˜ ํฌ์ธํ„ฐ๋ฅผ ์œ ์ € ๊ณต๊ฐ„ ์‰˜์ฝ”๋“œ ์ฃผ์†Œ(0x00401337)๋กœ ๋ฎ์–ด์”€.
CPU CPL: Ring 0
์Šˆํผ๋ฐ”์ด์ € ์œ ์ง€
RIP: 0x00401337
์œ ์ € ๋ฉ”๋ชจ๋ฆฌ ์ฃผ์†Œ
CR4.SMEP = 0
๋ฐฉ์–ด ๋ถ€์žฌ (DISABLED)
ret2usr HIJACK
๋ถˆ๋ฒ• ๋ถ„๊ธฐ ์„ฑ๊ณต
โšก ์ปค๋„ ์ทจ์•ฝ ํ•จ์ˆ˜ ํ•จ์ˆ˜ ํฌ์ธํ„ฐ ๋ณ€์กฐ๋จ ๐Ÿ’€ ์œ ์ € ๊ณต๊ฐ„ ์•…์„ฑ ์‰˜์ฝ”๋“œ 0x00401337 (Ring 0๋กœ ์‹คํ–‰!) commit_creds() ํ˜ธ์ถœ ๐Ÿšจ Ring 0 ์žฅ์•… MMU / ์„ธ์ดํ”„ํ‹ฐ ํ•ด์ œ
CPU ์‹คํ–‰ ๋ ˆ๋ฒจ
Ring 0 (์Šˆํผ๋ฐ”์ด์ €)
๋ช…๋ น์–ด ์ธ์ถœ ์˜์—ญ
User Space (< TASK_SIZE)
์ต์Šคํ”Œ๋กœ์ž‡ ์„ฑ๊ณต๋ฅ 
100% (๊ถŒํ•œ ํƒˆ์ทจ ์„ฑ๊ณต)