polygraphene / DirtyPipe-Android

Dirty Pipe root exploit for Android (Pixel 6)
771 stars 130 forks source link

Reproduce exploit on pixel 6 #7

Closed YeJZ closed 2 years ago

YeJZ commented 2 years ago

Hello, I am planning to reproduce the exploit on pixel 6. When running the exploit ,it prompts unsupported version,as show below:

image

I confirmed that in the libstagefright_soft_mp3dec.so at offset 0x1000, its value is 0x5f, as follows

image

Then I understand that I don't need to modify the offset of libc.so or the offset of vendor_file.

In theory, by simply erasing the version check in the exploit, I can successfully run the exploit on my pixel 6, right?

polygraphene commented 2 years ago

Your device has an older firmware than the code supports. Put -f option on the argument of dirtypipe-android to ignore version check.

YeJZ commented 2 years ago

It works. Thank you.