backdoor_mmap_tools

This code is still ugly, please re-write it and send pull-requests, if you want to use this.

How to use

Install mmap backdoor

install_backdoor
Uninstall mmap backdoor

install_backdoor -u
Run shell with temporary root privilege.

run_root_shell
Run command "/data/local/autoexec.sh" with root privilege.

run_autoexec
Fix CVE-2013-6282 vulnerability with custom __get/put_user handlers.

fix_cve_2013_6282
Unlock fjsec LSM for Fujitsu devices.

unlock_lsm_fjsec
Unlock MIYABI LSM for SHARP devices.

unlock_lsm_miyabi
Unlock MMC protected partitions for SHARP devices.

unlock_mmc_protect
Unlock SEC LSM for SC-04E.

unlock_sec_sc04e
Disable TOMOYO LSM for Panasonic and LG devices.

disable_ccsecurity
Call reset_security_ops to disable normal LSM.

reset_security_ops
Print kernel symbols out.

kallsymsprint

Download and unpack android-ndk-r10e-linux-x86_64.zip from https://developer.android.com/ndk/downloads/older_releases.html

Add to path

  `export PATH=$PATH:~/android-ndk-r10e`

Download sources git clone --recursive git@github.com:joka90/backdoor_mmap_tools.git
Build cd backdoor_mmap_tools && ndk-build NDK_PROJECT_PATH=. APP_PLATFORM=android-15 APP_ALLOW_MISSING_DEPS=true APP_BUILD_SCRIPT=./Android.mk

Name		Name	Last commit message	Last commit date
Latest commit History 213 Commits
device_database @ 725e43b		device_database @ 725e43b
fjsec		fjsec
kallsymsprint		kallsymsprint
libdiagexploit @ 14fa56b		libdiagexploit @ 14fa56b
libexploit_utils @ 5bda668		libexploit_utils @ 5bda668
libfb_mem_exploit @ de67230		libfb_mem_exploit @ de67230
libfj_hdcp_exploit @ d2a7461		libfj_hdcp_exploit @ d2a7461
libfutex_exploit @ eb6d6f4		libfutex_exploit @ eb6d6f4
libkallsyms @ aa38ae7		libkallsyms @ aa38ae7
libmsm_acdb_exploit @ 4600540		libmsm_acdb_exploit @ 4600540
libperf_event_exploit @ 4bcdfc0		libperf_event_exploit @ 4bcdfc0
libpingpong_exploit @ 27d0586		libpingpong_exploit @ 27d0586
libput_user_exploit @ d437838		libput_user_exploit @ d437838
miyabi		miyabi
mmc_protect		mmc_protect
read_write_value		read_write_value
run_autoexec		run_autoexec
sc01e		sc01e
sc04e		sc04e
zlib @ 2766038		zlib @ 2766038
.gitmodules		.gitmodules
Android.mk		Android.mk
README.md		README.md
backdoor_mmap.c		backdoor_mmap.c
backdoor_mmap.h		backdoor_mmap.h
build_remap_pfn_range.c		build_remap_pfn_range.c
build_remap_pfn_range.h		build_remap_pfn_range.h
cred.c		cred.c
cred.h		cred.h
disable_ccsecurity.c		disable_ccsecurity.c
fix_cve_2013_6282.c		fix_cve_2013_6282.c
install_backdoor.c		install_backdoor.c
kallsyms.c		kallsyms.c
kallsyms.h		kallsyms.h
main.c		main.c
mm.c		mm.c
mm.h		mm.h
mmap.c		mmap.c
ptmx.c		ptmx.c
ptmx.h		ptmx.h
reset_security_ops.c		reset_security_ops.c