polygraphene/DirtyPipe-Android

Reproduce exploit on pixel 6

Closed this issue · 2 comments

YeJZ commented

Hello, I am planning to reproduce the exploit on pixel 6. When running the exploit ,it prompts unsupported version,as show below:

image

I confirmed that in the libstagefright_soft_mp3dec.so at offset 0x1000, its value is 0x5f, as follows

image

Then I understand that I don't need to modify the offset of libc.so or the offset of vendor_file.

In theory, by simply erasing the version check in the exploit, I can successfully run the exploit on my pixel 6, right?

Your device has an older firmware than the code supports.
Put -f option on the argument of dirtypipe-android to ignore version check.

YeJZ commented

It works. Thank you.