Database Users

Getting serious about root: FIOASYNC bug

Presently we're running a little short on kernel exploits, with the following being the only one that looks remotely plausible:
http://xorl.wordpress.com/2010/01/14/cve-2009-4141-linux-kernel-fasync-locked-file-use-after-free/
Big hold-up? For all that we have a trigger, we don't have an exploit. I believe it's up to us at this point to make that happen.
If I'm reading it right, it looks like the bug initially rears its head right here:
Code:
void __kill_fasync(struct fasync_struct *fa, int sig, int band)
{
while (fa) {
struct fown_struct * fown;
if (fa->magic != FASYNC_MAGIC) {
printk(KERN_ERR "kill_fasync: bad magic number in "
"fasync_struct!\n");
return;
}
[B]fown = &fa->fa_file->f_owner;[/B]
/* Don't send SIGURG to processes which have not set a
queued signum: SIGURG has its own default signalling
mechanism. */
if (!(sig == SIGURG && fown->signum == 0))
send_sigio(fown, fa->fa_fd, band);
fa = fa->fa_next;
}
}
... as fa_file now points to invalid memory (having been free'd earlier). The f_owner member gets shot out to send_sigio, which look like this:
Code:
void send_sigio(struct fown_struct *fown, int fd, int band)
{
struct task_struct *p;
enum pid_type type;
struct pid *pid;
int group = 1;
read_lock(&fown->lock);
type = fown->pid_type;
if (type == PIDTYPE_MAX) {
group = 0;
type = PIDTYPE_PID;
}
[B]pid = fown->pid;[/B]
if (!pid)
goto out_unlock_fown;
read_lock(&tasklist_lock);
do_each_pid_task(pid, type, p) {
send_sigio_to_task(p, fown, fd, band, group);
} while_each_pid_task(pid, type, p);
read_unlock(&tasklist_lock);
out_unlock_fown:
read_unlock(&fown->lock);
}
... in which we see the f_owner member being dereferenced. Also it gets pushed through several other functions which may be exploitable.
There are several questions to be answered before we can start attacking this:
Can we resolve the address of the fa_file data structure so we can overwrite the f_owner value?
Can we do anything with it once we've done that? (Presumably we can set it to zero to cause a null-pointer dereference, but we're mmap_min_addr = 32768 on the most recent versions, so unless we can flag the mmap region to grow down and apply memory pressure to reach page 0 this will do us no good.)
Failing the plan above: are any of the functions that f_owner gets pushed into vulnerable? I evaluated this over the weekend, but without the help of a trained kernel dev I'm not going to get very far.
While I studied a lot of this in uni, I'll admit I'm green when it comes to actually writing these exploits. I'm hoping that this will get the creative juices flowing, and perhaps provide a more comprehensive resource in case any hard-core kernel hackers want to take a look at what we're doing or give us pointers (harhar) in the right direction.
Thanks, guys. Great work up to this point.

In the original POC if you change /bin/true to /system/bin/sh you can get a new shell to open just not as root. So I'm guessing that their needs to be more added to the POC to make it a full exploit.

Right, the fork()'s in the PoC exist only to cause the file descriptor's fasync_struct to be erroneously killed, not start a root session. The root session would need to be started (presumably) by the kernel doing something to our maliciously crafted fown_struct.
The tough part is figuring out exactly where and what that fown_struct needs to be.

Well I definetly agree with you that this seems to be our best best bet I am some what of a newbie when it comes to linux allthough i am learning as i go. Do you know of any good sites to read up on kernel hacking?

Sorry Guys just got the word that this one is dead for us.....
Here is the explantion i got.
some_person said:
Nope, the bug didn't exist in 2.6.27. That's why they say >= 2.6.28 are vulnerable.
As far as how the bug works, there are 2 other issues. 1) our kernel probably wasn't compiled with AT_RANDOM 2) we don't have an elf executable.
The exploit you found does not give us root access, it crashes the system. Basically, you open the "random number generator" file, lock it, and close it... but the lock release when you close it. Then you have to call an elf executable because that generates a random number (running an elf executable) provided the kernel was compiled AT_RANDOM. you continue to call that executable (and generating random numbers) until the the lock is released on the "random number generator" file... then it's your program's turn... the kernel tries to send your program notification that the file is available, but your program has moved on. BLAM the kernel stops (or "oops").
Click to expand...
Click to collapse

Sorry to dredge up an old thread:
This exploit *will* work. According to Zanfur, the hole is in our kernel. We need to use it without AT_RANDOM (which I dont know how to do).

http://sourceware.org/ml/libc-alpha/2008-10/msg00016.html

I am pretty sure we do have elf executables, here is proof:
% file m6
m6: ELF 32-bit LSB executable, ARM, version 1 (SYSV), dynamically linked (uses shared libs), not stripped
If our kernel is susceptible to this bug then it should work, as long as there is a way to do it without at random.

Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.

jballz0682 said:
Though I do not in any way represent my self as a hacker or developer I was wondering if I could throw in my 2 cents. I notice that this bug/exploit won't work because it requires AT RANDOM. I was wondering if it s possible to write code that does what the function does and insert it in. Is root required to do this (i.e. insert code into the kernel that wasn't there before) or is this a matter of know-how? Just some brainstorming I thought that I would throw in.
Click to expand...
Click to collapse
This won't get us root. Even zanfur said it. Moving on....

Framework43 said:
This won't get us root. Even zanfur said it. Moving on....
Click to expand...
Click to collapse
To clarify, even if we get AT_RANDOM functionality working, we can't use this to exploit our kernel. All we can do with this is get data from a file that was recently closed. The point of this exploit is to send a signal to a process, but there are no processes we could send a signal to that would give us root.

Our kernel seems practically invulnerable, it appears that almost all exploits are patched

[Q]Can someone please make a guide how to get IMEI.

I dont understand alot. Read the thread about IMEI, but still cant get IMEI. Can someone please make guide for newbie?

Why do you need IMEI? If it is for Swype, there are countless workarounds. If not, then, well, I'll post a guide. But I need which app, and the ROM.

Hey everyone. I was just hoping that I saw this thread here or I was going to make it. I have been through Dizzy's thread with jealousy and have tried a few different things but could never get it to work.
A step by step guide would be awesome and greatly appreciated.
I want it for HBO Go and a few games that need it to run. Thanks again if this is possible.

Alot of app in the market need IMEI to use. Like Zenonia, Tap Tap and others

The best (and also the original) guide is by DizzyDen and you can find that here: http://forum.xda-developers.com/showthread.php?t=1103766
Read through it carefully so you know what to expect.

Ok, but if some1 got time and can make a guide step by step it will be good. Not everybody know English so good, so thx.

DISCLAIMER: This is a quickie guide that's written down from memory, so please be very careful if you choose to follow these directions. Nothing I say here is better than what's already listed in Dizzy's very informative post, it's just a shortened version.
Dizzy's thread is here: http://forum.xda-developers.com/showthread.php?t=1103766
AGAIN, please be careful. What follows, while it worked wonderfully for me and others, may break your Nook. You've been duly warned.
If you find these steps useful to you at all, please go to Dizzy's thread and thank Dizzy for the program.
-Cheers
=======================================================
1. Install the Java JDK on your machine (assuming windows) by going here:
http://www.oracle.com/technetwork/java/javase/downloads/jdk-6u26-download-400750.html
I use the Windows x86 one and that worked for me. YMMV.
2. Once Java is installed properly, download DizzyDen's IMEI zip file. I will not link it here, refer to the his/her original post to get the most up to date file.
3. Unzip the file into a directory somewhere convenient.
4. Go to your Nook and make sure you have the adbWireless app (download it from the market if you need to).
5. Run the adbWireless app and press the big green button. It will turn red and then show you an ip address. Make a note of this.
6. Launch Dizzy's IMEI program (!IMEIme.exe). At the dialog box "Do you want to use In-Place update features?" Answer YES.
7. The program will attempt ADB via USB and fail. Press OK.
8. At the next dialog box, enter the IPORT info from the adbWireless screen into this box.
9. Let it do it's thing. There may be other dialog boxes, I don't have my Nook with me right now to check, but they should be pretty obvious. When it's all done, the Nook should reboot and Dizzy's program will clean up after itself.
10. Now try out some of the IMEI required apps and see if they work.
Apps that worked for me once I did this:
XDA Free
Zenonia 3
Caligo Chasers
Mega Jump

fuul4nook said:
DISCLAIMER: This is a quickie guide that's written down from memory, so please be very careful if you choose to follow these directions. Nothing I say here is better than what's already listed in Dizzy's very informative post, it's just a shortened version.
Dizzy's thread is here: http://forum.xda-developers.com/showthread.php?t=1103766
AGAIN, please be careful. What follows, while it worked wonderfully for me and others, may break your Nook. You've been duly warned.
If you find these steps useful to you at all, please go to Dizzy's thread and thank Dizzy for the program.
-Cheers
=======================================================
1. Install the Java JDK on your machine (assuming windows) by going here:
http://www.oracle.com/technetwork/java/javase/downloads/jdk-6u26-download-400750.html
I use the Windows x86 one and that worked for me. YMMV.
2. Once Java is installed properly, download DizzyDen's IMEI zip file. I will not link it here, refer to the his/her original post to get the most up to date file.
3. Unzip the file into a directory somewhere convenient.
4. Go to your Nook and make sure you have the adbWireless app (download it from the market if you need to).
5. Run the adbWireless app and press the big green button. It will turn red and then show you an ip address. Make a note of this.
6. Launch Dizzy's IMEI program (!IMEIme.exe). At the dialog box "Do you want to use In-Place update features?" Answer YES.
7. The program will attempt ADB via USB and fail. Press OK.
8. At the next dialog box, enter the IPORT info from the adbWireless screen into this box.
9. Let it do it's thing. There may be other dialog boxes, I don't have my Nook with me right now to check, but they should be pretty obvious. When it's all done, the Nook should reboot and Dizzy's program will clean up after itself.
10. Now try out some of the IMEI required apps and see if they work.
Apps that worked for me once I did this:
XDA Free
Zenonia 3
Caligo Chasers
Mega Jump
Click to expand...
Click to collapse
Very good write up... a couple of things...
7... if you edit the ini file after first run... set Use_ADB_USB = 0 you won't have to deal with that question... it will disable the usb function in my program.
8: you only have to enter the port number in that box if you change the default port in your adbwifi app... you can also set a default ip address : port in the ini file and it will have it pre-loaded in the ip input box.

Ok here is my ini settings [Settings]
Use_In_Place = 1
Use_Previous_Patch = 0
Use_Serial_Number = 0
Use_MAC_Address = 0
Use_Manual_Input = 1
Encrypt_IMEI = 0
Use_ADB = 1
Use_ADB(usb) = 0
Use_ADB(WiFi) = 1
Clean_Up = 1
WiFi_IP_Address = 192.168.2.100
IMEI = 4938567924
I try to write the Ip. It say Adb wifi failed. Then i try IPort. Failed agian. My Ip is 192.168.2.100. Try with 2 adb wifi app.

devil4eto said:
Ok here is my ini settings [Settings]
Use_In_Place = 1
Use_Previous_Patch = 0
Use_Serial_Number = 0
Use_MAC_Address = 0
Use_Manual_Input = 1
Encrypt_IMEI = 0
Use_ADB = 1
Use_ADB(usb) = 0
Use_ADB(WiFi) = 1
Clean_Up = 1
WiFi_IP_Address = 192.168.2.100
IMEI = 4938567924
I try to write the Ip. It say Adb wifi failed. Then i try IPort. Failed agian. My Ip is 192.168.2.100. Try with 2 adb wifi app.
Click to expand...
Click to collapse
what is your computer ip address? if it is not also in the 192.168.2.0 network... you have IP isolation on for wifi and the computer will not talk to the nook.

Ok it seem my PC IP is class A 78..... i use my neighbor wifi. Can i fix the problem somehow? Can i do it with USB adb? I try but get error... Sorry my English is not very good.

[Issue] Omni 4.4 wifi can't find network

Hey guys,
I finally built omni 4.4 for Gtab2 10.1
My wifi is turned On, but can't find any network.
I used latest blobs from samsung stock rom 4.2.2 to be sure.
logcat:
http://pastebin.com/xm6un9Tg
During the build process i faced an error :
Code:
out/target/common/obj/APPS/framework-res_intermediates/src/com/android/internal/R.java
out/target/common/obj/APPS/framework-res_intermediates/src/android/R.java
expected "}"
public static final class string-array{ }
^
this is not the exact error code but it was almost this.
To bypass this error i just comented both class, i wonder if this can be related?
thanks

I'd suggest looking at other device bringup commits first.
4.4 requires wifi configuration changes and storage configuration changes.

Entropy512 said:
I'd suggest looking at other device bringup commits first.
4.4 requires wifi configuration changes and storage configuration changes.
Click to expand...
Click to collapse
mmhh still no luck.
I don't have any error message in logcat now but still scanning for network and can't find any.
I based my change on aries bring up commit.
Now my ext sdcard work if i'm root, i may need to change some permission in fstab,
and i add edit this line in init.espresso10.rc
Code:
service wpa_supplicant /system/bin/wpa_supplicant \
-Dnl80211 -iwlan0 -e/data/misc/wifi/entropy.bin [email protected]:wpa_wlan0 \
-c/data/misc/wifi/wpa_supplicant.conf -O/data/misc/wifi/sockets
and if I try to add an ssid by hand i got this error in logcat:
Code:
E/WifiConfigStore( 441): failed to set SSID: "mywifi"
E/WifiConfigStore( 441): Failed to set a network variable, removed network: 0
E/WifiStateMachine( 441): Failed to save network
thanks.

Did you add it, or change the one that was already there?

Entropy512 said:
Did you add it, or change the one that was already there?
Click to expand...
Click to collapse
I add it to try, there is no wifi network, it loop on "searching network"

I wonder if my error can be related to what i said earlier
sevenup30 said:
During the build process i faced an error :
Code:
out/target/common/obj/APPS/framework-res_intermediates/src/com/android/internal/R.java
out/target/common/obj/APPS/framework-res_intermediates/src/android/R.java
expected "{"
public static final class string-array{ }
^
this is not the exact error code but it was almost this.
To bypass this error i just comented both class, i wonder if this can be related?
thanks
Click to expand...
Click to collapse
Do you face this error while building omni? can it be because of my java version? i'm on java 6

finally got it working, it was related in init conf file like you said.
Does someone just know how can I disable hardwar keyboard at first boot?
Because of that keyboard never show up so i have to skip the first settings and disable it in language & input.

sevenup30 said:
finally got it working, it was related in init conf file like you said.
Click to expand...
Click to collapse
Could you precise which mod you did in init conf file ?
Because I've the same problem with a build for Acer A200 : loop on AP scan, no results, no possibilities to configure an AP manually....
Thanks

sevenup30 said:
finally got it working, it was related in init conf file like you said.
Does someone just know how can I disable hardwar keyboard at first boot?
Because of that keyboard never show up so i have to skip the first settings and disable it in language & input.
Click to expand...
Click to collapse
Fix or remove the broken kernel driver that's reporting a keyboard as being present when it's not.
Another possibility is you're missing KL/IDC files for some input device that is being treated as a hardware keyboard when it's not. (See the galaxys2-common family - the sii9234 or whatever it is IDC file was needed to keep that input device from being detected as a HW keyboard)

[GSM]Getting phone number programmatically

hi
i am writing an app that needs to get sim cards phone number.
i tried this but its not working.
Code:
TelephonyManager telemamanger = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
String getSimSerialNumber = telemamanger.getLine1Number();
it returns null....
i have tried every thing but nothing worked.
any help?

poria1999 said:
hi
i am writing an app that needs to get sim cards phone number.
i tried this but its not working.
Code:
TelephonyManager telemamanger = (TelephonyManager) getSystemService(Context.TELEPHONY_SERVICE);
String getSimSerialNumber = telemamanger.getLine1Number();
it returns null....
i have tried every thing but nothing worked.
any help?
Click to expand...
Click to collapse
It should work, however there is no guarantee that phone number is physically stored on a SIM-card or broadcasted from the network to the phone.
Alternative solution might be to ask the user to enter phone number manually in case if telemamanger.getLine1Number() returns null.

How to search StorageFiles

I need a way to search in StorageFiles with dynamically pattern, which comes from a TextBox. The directive "Windows.Storage.Search" doesnt exist in windows phone 8.1 runtime, as i saw. Now my question is, how can i do this in alternative way?

The only way to do it with WP 8.1 since Microsoft ALWAYS fails to implement the important things are to query using LINQ.
Ex:
Code:
var result = (await Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(x => txtBox.Text));
That's about all you can do pretty much. (Thanks Microsoft).

Thank you for the example. But it wont work for me, it shows me the following error(s):
Code:
A local variable named 'x' cannot be declared in this scope because it would give a different meaning to 'x', which is already used in a 'parent or current' scope to denote something else
and
Code:
Cannot convert lambda expression to type 'string' because it is not a delegate type
Thats really odd from Microsoft, that they havent implementet the search function like in WinRT (Windows Store App).

The first error is pretty simple. You already have the variable named "x" and it would be very bad if compiler didn't give you that error.
Change the name of the variable to something else that you don't use in that scope and it will work.
And for second problem, try this one:
Code:
private List<string> Result()
{
var result = ((List<Windows.Storage.Search.CommonFileQuery>)Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).Where(x => x.ToString().Contains(txtBox.Text));
return result as List<string>;
}
private async Task<List<string>> ResultAsync()
{
return await Task.Run(() => Result()).ConfigureAwait(continueOnCapturedContext: false);
}
You should call ResultAsync method and get the result in this way:
Code:
List<string> myList = ResultAsync().Result;

That's not going to work. You can't cast a StorageFile as a string.
To fix my code (simple lambda typo)
Code:
var result = (await Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(txtBox.Text));
if(result.Any())
{
// Do shtuff
}
Also, you should never access the .Result of an async task because you never know if it completed yet.

Ok, first error is done, but the second error is still here
Code:
Cannot convert lambda expression to type 'string' because it is not a delegate type

You are missing the point of the TAP (Task Async Pattern).
Both main thread and async method will be in execution in the same time. When the async method finish his work, main thread will stop and catch the result trough the Result property.
TAP is the recommended way of asynchronous programming in C#. The only thing with TAP is to use ConfigureAwait method in non-console type of apps to avoid deadlock.
Sooner or later you will get the result from TAP method. Nothing will get in the conflict with the main thread.

Oh wait, @andy123456 I updated my response. I forgot String.Contains ISNT a lambda .
@Tonchi91, I know all about the TAP. I've been using it since it was CTP. I've seen the awkward situations with threading in WP .

Now... if he did
Code:
List<string> myList;
ResultAsync().ContinueWith(t=> { myList = t.Result; });
I wouldn't be worried .

Ok the errors are gone, but the debugger show me the following exception:
Code:
Value does not fall within the expected range
Is this search method case-sensitive? I tried with an exact input in the TextBox.

Hmmm. Let's see your full code.

its actually only for testing, so i added your code to a button (asnyc) and will show the output in a textBlock.
Code:
private async void buttonTest_Click(object sender, RoutedEventArgs e)
{
//Result();
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(textBox_test.Text));
if (result.Any())
{
// Do shtuff
textBlock_test.Text = result.ToString();
}
}
The error is coming from here
Code:
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName))

andy123456 said:
its actually only for testing, so i added your code to a button (asnyc) and will show the output in a textBlock.
Code:
private async void buttonTest_Click(object sender, RoutedEventArgs e)
{
//Result();
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName)).
Where(x => x.Name.
Contains(textBox_test.Text));
if (result.Any())
{
// Do shtuff
textBlock_test.Text = result.ToString();
}
}
The error is coming from here
Code:
var result = (await Windows.Storage.KnownFolders.CameraRoll.GetFilesAsync(Windows.Storage.Search.CommonFileQuery.OrderByName))
Click to expand...
Click to collapse
Oh Camera Roll.. You MIGHT need to have the capability to view the camera roll enabled. I forget what it's called, but you need a specific cap in order to view from there. Also, I would try to see if you can use a generic folder instead.
I would try Windows.Storage.ApplicationData.Current.LocalFolder.GetFilesAsync() as your method after the await just to test whether you can read correctly.

Yes but in wp8.1 runtime app, there arent caps anymore. The capability for access to the pictures is simply calles pictures library and is enabled. I have tested it as you said, but it gives me the same exception.

A quick tip: another way to do this is to use the Win32 C runtime API. You can, for example, use the FindFirst/NextFile functions (http://msdn.microsoft.com/en-us/library/windows/desktop/aa364418(v=vs.85).aspx) which support searches using wildcards (* and ? characters in the first parameter). These functions are wrapped in my NativeLibraries classes, but are also just publicly available for third0party developers to call from their own C++ DLLs.
Alternatively, you can use the .NET System.IO.Directory class, which has functions like EnumerateFiles(String path, String searchPattern). This is probably the better way to do it, actually.
Of course, if you want these operations to not block the current thread, you'll need to explicitly put them in their own thread or async function.
EDIT: This also assumes you have read access to the relevant directories. You application data directory works fine, for example (you can get its path from the relevant StorageFolder object). Other directories that can be accessed via WinRT functions may go through a broker function instead of being directly readable.

The point is, that i have an array with filenames. Now i need the StorageFile files which contains these filenames. My idea was to search for these files and return the files as StorageFile, so i can work with these. Or is there a simpler / another way?

http://msicc.net/?p=4182 <-- try this

Thank you, i have already done this and its working. But how can i compare the Files to read, with already read files and take only the not yet read files?