Android x86内核vDSO相关：Dirty CoW注入方案分析遇阻求助

Hey there, since you're deep into your university research on Dirty CoW and analyzing vDSO shellcode injection implementations for both desktop Linux and Android, let's walk through the most common pain points folks hit with these setups—and how to debug them:

• vDSO Layout & Symbol Offset Mismatches
  Desktop Linux and Android have totally different vDSO memory layouts. For example, Android's vDSO is often mapped at a unique base address, and core symbols like clock_gettime might sit at different offsets compared to desktop builds. To verify this:

  • On desktop: Run cat /proc/self/maps | grep vdso to grab the mapped region path, then use objdump -s -j .text /path/to/vdso to inspect symbol positions.
  • On Android: Use adb shell cat /proc/self/maps | grep vdso to locate the region, then pull the vDSO binary and use readelf or ndk-stack to compare symbol offsets against the desktop version.
  • Remember: The entire injection relies on overwriting a specific function's prologue in the vDSO. If your offset is off, the shellcode will either crash the process or do nothing at all.

• SELinux Blocking on Android
  Modern Android devices run SELinux in enforcing mode by default. Even if Dirty CoW lets you bypass write protections, SELinux might block execution of your injected shellcode or restrict access to critical memory regions. A quick test to confirm this:

  • Run adb shell setenforce 0 to switch to permissive mode temporarily. If your injection works after this, you'll need to adjust your shellcode to fit within SELinux policies or find a way to leverage a process context that allows execution.

• Kernel Version & Patch Compatibility
  While Dirty CoW (CVE-2016-5195) was patched in newer kernels, even vulnerable versions can have subtle differences in how copy-on-write works. Desktop kernels and Android's custom vendor kernels (Qualcomm, MediaTek, etc.) often handle page tables differently. Make sure:

  • Your target device/OS is running a confirmed vulnerable kernel version—check the patch status for CVE-2016-5195 to be sure.
  • You're adapting the exploit code to match the kernel's page handling logic (some implementations hardcode page sizes or offsets that don't translate across kernel variants).

• Architecture-Specific Shellcode Issues
  x86/x86_64 shellcode written for desktop Linux won't run on ARM/ARM64 Android at all. You'll need to:

  • Recompile your shellcode for the target Android architecture (use arm-linux-gnueabi-as for ARM, aarch64-linux-gnu-as for ARM64).
  • Double-check system call numbers—Android uses different syscall IDs than desktop Linux for some functions (e.g., execve is syscall 1 on x86 desktop, but syscall 11 on ARM Android).

• Debugging Pro Tips

  • On desktop: Attach gdb to your target process before running the exploit, set a breakpoint on the vDSO function you're overwriting, and step through to see if your shellcode executes as expected.
  • On Android: Use gdbserver paired with adb forward for remote debugging. Check kernel logs with adb shell dmesg—Dirty CoW attempts often leave traceable errors here if they're blocked or fail at the kernel level.

If you can share more specific details about what's going wrong (like crash logs, error messages, or which part of the implementation is failing), I can help you narrow things down even further!

内容的提问来源于stack exchange，提问作者Topper Harley