[AT&T Samsung Galaxy S 4 Android Development] jeboo:
I got this idea after reading about CVE-2013-6282 and seeing the source for it.

As we all know, anyone with MF3+ bootloaders on ATT/VZW cannot load custom kernels/recoveries. Hashcode saved the day with Safestrap, which allowed users to run custom ROMs using stock, signed boot.imgs (initramfs/kernel). Unfortunately booting a custom kernel is still not possible due to BL restrictions.

With this latest root exploit, it is possible to overwrite kernel memory and thus remove some of the restrictions of the stock kernel. Most important is the ability to insert kernel modules not signed by Samsung, specifically kexec. This module can allow one to load any custom kernel regardless of BL restrictions. Before you ask, I have never compiled nor worked with kexec!

I'm going to go over the process just for completeness, you can skip this section if you want. It's mostly for devs:

With 4.3, when you insert one of the included modules (ie, /system/lib/modules), you will see the following in dmesg:

<4>[ 2003.009063] TIMA: lkmauth--launch the tzapp to check kernel module; module len is 3224
<4>[ 2003.009124] TIMA: lkmauth -- hdr before kreq is : e3003000
<4>[ 2003.009155] TIMA: lkmauth--send cmd (tima_lkm) cmdlen(304:320), rsplen(264:320) id 0x00050000, req (0xE511C000), rsp(0xE511C140), module_start_addr(0xE3003000) module_len 3224
<4>[ 2003.012237] TIMA: lkmauth--verification succeeded.

Though I'm not intimately familiar with the workings of lkmauth, it's obvious it's querying the trustzone (TZ) to verify the module. If we now change one insignificant byte in the module, you get:

<4>[ 2301.298980] TIMA: lkmauth--launch the tzapp to check kernel module; module len is 3224
<4>[ 2301.299011] TIMA: lkmauth -- hdr before kreq is : e300c000
<4>[ 2301.299041] TIMA: lkmauth--send cmd (tima_lkm) cmdlen(304:320), rsplen(264:320) id 0x00050000, req (0xE511C000), rsp(0xE511C140), module_start_addr(0xE300C000) module_len 3224
<3>[ 2301.301391] TIMA: lkmauth--verification failed -1
<4>[ 2301.301544] TIMA: MSG=lkm_modified; result (TIMA_RESULT=MSG=lkm_modified;)

We can use these messages to narrow down the code in the kernel. I'm using ATT MK2 as the example here:

kernel/module.c

/* parse result */
if (krsp->ret == 0) {
pr_warn("TIMA: lkmauth--[B]verification succeeded[/B].\n");
ret = 0; /* ret should already be 0 before the assignment. */
} else {

pr_err("TIMA: lkmauth--[B]verification failed[/B] %d\n", krsp->ret);
ret = -1;
....

If we unpack boot.img, then decompress the zImage, we can find this code in the binary. Fire up IDA and set the base address to 0xC0008000. You should be able to resolve the above string reference to:

ROM:C00B9C20 44 11 98 E5 LDR R1, [R8,#0x144]
ROM:C00B9C24 00 00 51 E3 CMP R1, #0
[B][COLOR="Red"]ROM:C00B9C28 02 00 00 1A BNE loc_C00B9C38[/COLOR][/B]
ROM:C00B9C2C 54 01 9F E5 LDR R0, =a4TimaLkmauthVe ; "<4>TIMA: lkmauth--verification succeede"...
ROM:C00B9C30 CA 57 1D EB BL sub_C080FB60
ROM:C00B9C34 3C 00 00 EA B loc_C00B9D2C

That BNE is the target for our patch. So bypasslkm will basically overwrite that test with a NOP instruction thus forcing the authentication to succeed.

I tested inserting a modified stock module and one I compiled. Btw, if you wanna use the modules from the kernel source tree, be sure to add

-fno-pic to CFLAGS_MODULE in the Makefile.

-------------------------------------------------------------------------------------------------------------

Usage:

bypasslkm is run alone, and patches the kernel in memory. It does NOT make any changes to the filesystem, and a reboot will require re-executing the patch. Please note the patch will remain in memory until you run 'bypasslkm -r' OR reboot. THIS CAN LEAVE YOUR OS IN A VULNERABLE STATE TO MALWARE. Ideally, you would run the patch, insert your module, then run the patch with -r.

Typical usage:

adb push bypasslkm /data/local/tmp

cd /data/local/tmp

chmod 755 bypasslkm

./bypasslkm

insmod <modulename.ko>

./bypasslkm -r

Supported stock kernels: ATT MK2, VZW MK2, VZW MJ7

CREDITS

fi01 - awesome source for the CVE!

CUBE - getroot source!

djrbliss - thanks for the makefile =P

DOWNLOAD:

Get the latest from my git: https://github.com/jeboo/bypasslkm