I am working on my school research on Dirty CoW (if you don't know what it is and you think the implementation might be relevant to my problem, see P.S. below).
I have found some solutions (i.e. https://github.com/scumjr/dirtycow-vdso) that use Dirty CoW to inject some shellcode into vDSO. The one in the link is for desktop Linux, but there are also solutions for Android (basically identical, except for a few changes).
I am trying to analyze the existing solutions and I have come to a problem - where is vDSO stored in Android?
The manual pages (http://man7.org/linux/man-pages/man7/vdso.7.html) say, that you can locate the file using
find arch/$ARCH/ -name '*vdso*.so*' -o -name '*gate*.so*'
By running a similar command on my Ubuntu 64bit (
find / -name '*vdso*' -o -name '*gate*.*so'), following lines are present in the output:
/lib/modules/4.13.0-32-generic/vdso /lib/modules/4.13.0-32-generic/vdso/vdsox32.so /lib/modules/4.13.0-32-generic/vdso/vdso32.so /lib/modules/4.13.0-32-generic/vdso/vdso64.so /lib/modules/4.13.0-21-generic/vdso /lib/modules/4.13.0-21-generic/vdso/vdsox32.so /lib/modules/4.13.0-21-generic/vdso/vdso32.so /lib/modules/4.13.0-21-generic/vdso/vdso64.so
And by using
hexdump on one of them I can see that it is the one, that is mapped in the memory (I wrote a program, that finds it and dumps it into a file).
However, when I run
adb root adb shell find -name '*vdso*' -o -name '*gate*.so*'
on my Android 4.4-r4 x86, the only output is
/proc/sys/vm/vdso_enabled (and the file content is
I know there is vDSO in the processes' memory, I wrote a dumping program ran from ADB for that as well. And I also adjusted the Dirty CoW exploit to inject my shellcode into the vDSO. I can see that the shellcode is in the vDSO from an app that I wrote and also from the dumping program that I mentioned earlier. My shellcode is only present in vDSO until I restart the device.
How does vDSO work in Android? Is there a file where it is stored? It seems not, because if it was there, the injected code would be there after the reboot as well. But how does the shellcode propagate to the other processes?
I am very grateful for your answers.
P.S.: Dirty CoW is a vulnerability of Linux kernel that lets you write into read only files (or anything that you can map into your memory) by causing a race condition of two threads - the first one has a loop where it is writing any text into memory (either into /
proc/self/mem or using
mmap to find the right place) and the other one is telling the system (also in a loop) that the same part of memory is no longer needed (using