fi01
/ How to exploit msm_acdb
Created
June 25, 2013 11:09
Stack-based buffer overflow in acdb audio driver (CVE-2013-2597)
msm_acdb攻略のまとめ
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| * 本来の流れ | |
| do_vfs_ioctlはacdb_ioctlをコールし、(1)のコードでリターンする。 | |
| do_vfs_ioctl: | |
| STMPW [SP], { R4-R9, LR } | |
| ... | |
| BL acdb_ioctl | |
| ... | |
| ADD SP, SP, #$44 // (2) | |
| LDMUW [SP], { R4-R9, PC } // (1) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Usage: insmod lsm_disabler.ko addr=<address for reset_security_ops> | |
| # lsm_disabler.ko addr=0xc031311c | |
| diff --git a/security/Kconfig b/security/Kconfig | |
| index f972310..b8d1730 100644 | |
| --- a/security/Kconfig | |
| +++ b/security/Kconfig | |
| @@ -228,5 +228,7 @@ config DEFAULT_SECURITY | |
| default "apparmor" if DEFAULT_SECURITY_APPARMOR | |
| default "" if DEFAULT_SECURITY_DAC |
fi01
/ Get address for ptmx_fops and perf_swevent_enabled
Created
June 17, 2013 03:51
Decompress kernel image first
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -- How to disassemble kernel | |
| Disassemble uncompressed kernel image binary by arm-linux-androideabi-objdump command in ndk | |
| arm-linux-androideabi-objdump --disassemble-all -b binary -m arm --adjust-vma=0xc0008000 kernel.Image > kernel.dasm | |
| -- How to get address for variable ptmx_fops | |
| ptmx_fops is used in function unix98_pty_init. | |
| unix98_pty_init() | |
| { |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 2013/7/28 VpnFaker-V21.zipのアドレスを更新。 | |
| 2013/5/27 「11. LSMの解除」の解除コマンド名が間違っていたため訂正。 | |
| 2013/5/27 「7. 再起動を行う」のプロンプトを訂正。 | |
| 2013/5/24 「6. VpnFakerをインストールする」の手順に抜けがあったため追記。 | |
| VpnFaker.apkを/data/appにコピーするコマンドが抜けていた。 | |
| 2013/5/20 root権限の取得について補足 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| % mkdir .repo | |
| % pushd .repo | |
| % wget https://gist.github.com/fi01/4378311/raw/e384e900b0ad5a6e1b3a87d4d04a3bc82615980c/local_manifest.xml | |
| % popd .. | |
| % repo init -u git://github.com/fi01/android.git -b jellybean | |
| % repo sync | |
| % pushd device/samsung/sc02d |
fi01
/ local_manifest.xml
Last active
December 10, 2015 03:58
local_manifest.xml to build CM10/CM10.1/ParanoidAndroid for SC-02D
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?xml version="1.0" encoding="UTF-8"?> | |
| <manifest> | |
| <project name="fi01/android_device_samsung_sc02d" path="device/samsung/sc02d" remote="github" /> | |
| <project name="fi01/android_device_samsung_smdk4210-tab" path="device/samsung/smdk4210-tab" remote="github" /> | |
| <project name="fi01/android_kernel_samsung_smdk4210" path="kernel/samsung/smdk4210" remote="github" /> | |
| <project name="CyanogenMod/android_hardware_atheros_wlan" path="hardware/atheros/wlan" remote="github" revision="jellybean" /> | |
| <project name="CyanogenMod/android_hardware_samsung" path="hardware/samsung" remote="github" /> | |
| <project name="CyanogenMod/android_packages_apps_SamsungServiceMode" path="packages/apps/SamsungServiceMode" remote="github" /> | |
| </manifest> |
NewerOlder