[LG V20 Questions & Answers] p0w3r_off:
actually i'm trying to use this exploit for my Huawei P20 EML-L29.

what i have done so far:

- downgrade to EMUI 8.1.120 (Security Patch 01.04.2018)

- tried original poc, as well as poc3 and su98. all three are causing instant reboots. (which i would suggest that this phone is vulnerable for it).

The Message from su98 was:

"POC STARTED

MAIN: detected kernel version other than 3

MAIN: starting exploit for devices with waitqueue at 0x98

PARENT: soon will be calling WRITEV

IOCTLD

CHILD: Doing EPOLL_CTL_DEL.."

after the EPOLL_CTL_DEL it reboots and closes the adb connection naturally.

message("CHILD: Doing EPOLL_CTL_DEL.");

epoll_ctl(epfd, EPOLL_CTL_DEL, binder_fd, &event);

that means, that epoll_ctl() causes the restart. to me, it sounds like the adress for the binder is maybe different on this device. so the binding is tried, but seems to cause it.

i even have come so far that i extracted the kernel.img vmlinuz from exactly my used image EMUI 8.1.0.120 from update.zip (which is mysteriously called 1800). i used fix_kaslr_amd64 against it. this file is the vmlinuz file. i can run vmlinux.py against it and get lots of entries. but i really do fail with Binary Ninja and such (it doesnt seem to find what i search for).

it seems that i miss some points in adapting the su98.c.

Kernel version is 4.4.103. is there anything i can do now?

The Strange thing is, i cant get ANY of the disassemble tools really to work with droidimg. i tried everything. well, what i tried:

- Binary Ninja - no, no recognition of droidimg, still always loads only hex-editor

- IDA Pro - crashes on windows 10, no idea why but just gives access violations

- Ghidra - does not recognize droidimg, never says anything else as a file format than "binary file". no idea why. tried extension for it - no, still gets ignored.

I tampered with the values of the binder_address but no matter which of the values i try (198, 190) it always end with the same reboot. however, if i change WAITQUEUE_OFFSET TO 0x80, it doesnt reboot. but instead, it freezes the whole phone. i even need to restart it with power button (press longer than i guess 8 sec?). Since i needed the file to Run against fix_kaslr i assume the kernel uses kaslr, which maybe have sth to do with these reboots or freezes. or i really doesnt have the right value for binder_adress and waitqueue_offset.

But you know what, screw the search for addresses. i just heard from [MENTION=10174047]chompie1337[/MENTION] that this Kernel is compiled with CONFIG_DEBUG_SPINLOCK. Since that is the case, i think the vuln is basically useless on this device. damn. well, i guess thats it for this exploit. vuln doesnt seem to necessarily mean "useable".

I guess the best thing to do with a huawei p20 device is:

- boot it up, logon with your pin/code, whatever

- open settings

- open system

- hit reset

- hit factory reset

- hit reset

after the reset process is done, just make it unuseable. like open it with a flat screwdriver and remove all components at a time. after that, you can either a) incinerate them one by one (cautious: could be illegal depending on your local laws), b) throw them rightfully in the trash at your recycling depot or c) just make cool deco out of it :).

For me, i bought a Nokia 7.2 last week and with this device im just super happy :) First thing i did was unlocking the BL so nothing can ever stop me of modifying it of my own wishes =)) oh and of course - no, this exploit doesnt seem to work on nokia 7.2 since it have security update 5. january 2020 and Kernel version 4.4.153-perf+. no, i dont think it would make any sense to use the exploit here :D