fi01
/ local_manifest.xml
Last active
December 10, 2015 03:58
local_manifest.xml to build CM10/CM10.1/ParanoidAndroid for SC-02D
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <?xml version="1.0" encoding="UTF-8"?> | |
| <manifest> | |
| <project name="fi01/android_device_samsung_sc02d" path="device/samsung/sc02d" remote="github" /> | |
| <project name="fi01/android_device_samsung_smdk4210-tab" path="device/samsung/smdk4210-tab" remote="github" /> | |
| <project name="fi01/android_kernel_samsung_smdk4210" path="kernel/samsung/smdk4210" remote="github" /> | |
| <project name="CyanogenMod/android_hardware_atheros_wlan" path="hardware/atheros/wlan" remote="github" revision="jellybean" /> | |
| <project name="CyanogenMod/android_hardware_samsung" path="hardware/samsung" remote="github" /> | |
| <project name="CyanogenMod/android_packages_apps_SamsungServiceMode" path="packages/apps/SamsungServiceMode" remote="github" /> | |
| </manifest> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| % mkdir .repo | |
| % pushd .repo | |
| % wget https://gist.github.com/fi01/4378311/raw/e384e900b0ad5a6e1b3a87d4d04a3bc82615980c/local_manifest.xml | |
| % popd .. | |
| % repo init -u git://github.com/fi01/android.git -b jellybean | |
| % repo sync | |
| % pushd device/samsung/sc02d |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 2013/7/28 VpnFaker-V21.zipのアドレスを更新。 | |
| 2013/5/27 「11. LSMの解除」の解除コマンド名が間違っていたため訂正。 | |
| 2013/5/27 「7. 再起動を行う」のプロンプトを訂正。 | |
| 2013/5/24 「6. VpnFakerをインストールする」の手順に抜けがあったため追記。 | |
| VpnFaker.apkを/data/appにコピーするコマンドが抜けていた。 | |
| 2013/5/20 root権限の取得について補足 |
fi01
/ Get address for ptmx_fops and perf_swevent_enabled
Created
June 17, 2013 03:51
Decompress kernel image first
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| -- How to disassemble kernel | |
| Disassemble uncompressed kernel image binary by arm-linux-androideabi-objdump command in ndk | |
| arm-linux-androideabi-objdump --disassemble-all -b binary -m arm --adjust-vma=0xc0008000 kernel.Image > kernel.dasm | |
| -- How to get address for variable ptmx_fops | |
| ptmx_fops is used in function unix98_pty_init. | |
| unix98_pty_init() | |
| { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Usage: insmod lsm_disabler.ko addr=<address for reset_security_ops> | |
| # lsm_disabler.ko addr=0xc031311c | |
| diff --git a/security/Kconfig b/security/Kconfig | |
| index f972310..b8d1730 100644 | |
| --- a/security/Kconfig | |
| +++ b/security/Kconfig | |
| @@ -228,5 +228,7 @@ config DEFAULT_SECURITY | |
| default "apparmor" if DEFAULT_SECURITY_APPARMOR | |
| default "" if DEFAULT_SECURITY_DAC |
fi01
/ How to exploit msm_acdb
Created
June 25, 2013 11:09
Stack-based buffer overflow in acdb audio driver (CVE-2013-2597)
msm_acdb攻略のまとめ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| * 本来の流れ | |
| do_vfs_ioctlはacdb_ioctlをコールし、(1)のコードでリターンする。 | |
| do_vfs_ioctl: | |
| STMPW [SP], { R4-R9, LR } | |
| ... | |
| BL acdb_ioctl | |
| ... | |
| ADD SP, SP, #$44 // (2) | |
| LDMUW [SP], { R4-R9, PC } // (1) |
fi01
/ How to use msm_acdb explot
Created
July 28, 2013 04:42
Stack-based buffer overflow in acdb audio driver (CVE-2013-2597)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| To use msm_acdb explot we need to work 4 steps. | |
| 1. Find how to run command with root or system previlege | |
| 2. Get offset for registers to setup | |
| 3. Choose proper code in kernel image | |
| 4. Setup parameters in acdb.c | |
| 1. Find how to run command with root or system previlege | |
| Do it your self. :-P |
fi01
/ SH-05Eのブートローダ
Last active
March 22, 2018 23:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ブートローダはaboot。同名のパーティションに保存されている。 | |
| ブートイメージの起動には署名(SHA256)が必要、いわゆるlocked。 | |
| 署名が合わない時はtamperedフラグをセットし、shdiag | |
| パーティションにログを書き込み、起動停止。この時本来は | |
| fastbootになるが、fastboot自体が削除されている。 | |
| テンポラリにイメージを読み込み、署名のチェック後に | |
| カーネルとramdiskを実際の本来のアドレスにコピーするため、 | |
| lokiが使う脆弱性は無い。 | |
| 署名が確認されるとkernelのcmdlineに | |
| androidboot.authorized_kernel=trueが追加される。 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/security/Kconfig b/security/Kconfig | |
| index 61e0643..0bfdc80 100755 | |
| --- a/security/Kconfig | |
| +++ b/security/Kconfig | |
| @@ -235,5 +235,7 @@ config DEFAULT_SECURITY | |
| source security/ccsecurity/Kconfig | |
| +source security/ccs_disabler/Kconfig | |
| + |
fi01
/ How to dump log partition on SH device
Last active
December 25, 2015 06:58
VpnFakerを使ってSHARP端末のlogパーティションをダンプする。
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| - logパーティションのダンプ | |
| 1. root権限で動作するスクリプトを用意 | |
| ディレクトリ: /data/local/tmp | |
| ファイル名: get-log.sh | |
| パーミッション: 755 | |
| 2. system権限で動作するスクリプトを用意 | |
| ディレクトリ: /data/local/tmp | |
| ファイル名: onBoot |
OlderNewer