ninjaprawn / async_wake-fun

async_wake with a bit of fun! - async_awake by Ian Beer (https://bugs.chromium.org/p/project-zero/issues/detail?id=1417#c3)
161 stars 63 forks source link

Crashing issue #16

Open dsfsdsfss opened 6 years ago

dsfsdsfss commented 6 years ago

addr_t find_add_x0_x0_0x40_ret(void) { addr_t off; uint32_t k; k = (uint32_t )(kernel + xnucore_base); for (off = 0; off < xnucore_size - 4; off += 4, k++) { if (k[0] == 0x91010000 && k[1] == 0xD65F03C0) { return off + xnucore_base + kerndumpbase; } } k = (uint32_t *)(kernel + prelink_base); for (off = 0; off < prelink_size - 4; off += 4, k++) { if (k[0] == 0x91010000 && k[1] == 0xD65F03C0) { return off + prelink_base + kerndumpbase; } } return 0; }

ghost commented 6 years ago

Please add more information about the problem

dsfsdsfss commented 6 years ago

if (k[0] == 0x91010000 && k[1] == 0xD65F03C0) {

that line apparently crashes the exploit

ninjaprawn commented 6 years ago

Occasionally happens. Next commit should theoretically resolve it (something about malloc issue, should say so in the log)

dsfsdsfss commented 6 years ago

it happens every time for me

ninjaprawn commented 6 years ago

Reboot the device (or press and hold home + lock till black screen then let go and power on)

dsfsdsfss commented 6 years ago

I have done that

dsfsdsfss commented 6 years ago

and no changes have been made to the code

ghost commented 6 years ago

Should be all fixed with the latest commit. Download it again an re run. @ninjaprawn updated it