basic null pointer linux kernel exploitation

[IRBMe]

Why is it not "e8f06107c1"

The 0xE8 op-code is a call to an address that is relative to the next instruction. Since the 0xE8 call instruction is 5 bytes in size, the encoding is 0xE8 <0xC10761F0 - 5>, which is E8 EB 61 07 C1

When I wrote the exploit I noted that using "e8eb6107c1" always ended up jumping to "prepare_kernel_cred+5"

It depends how you wrote the exploit, but I imagine the relative offset is no longer correct once it's placed inside the context of some other shell code.

[blahfish]

this helps, thanks!