{"action":"opened","issue":{"url":"https://api.github.com/repos/crmulliner/adbi/issues/11","labels_url":"https://api.github.com/repos/crmulliner/adbi/issues/11/labels{/name}","comments_url":"https://api.github.com/repos/crmulliner/adbi/issues/11/comments","events_url":"https://api.github.com/repos/crmulliner/adbi/issues/11/events","html_url":"https://github.com/crmulliner/adbi/issues/11","id":57425951,"number":11,"title":"Hijack fails if mprotect() is restricted","user":{"login":"scintill","id":848492,"avatar_url":"https://avatars.githubusercontent.com/u/848492?v=3","gravatar_id":"","url":"https://api.github.com/users/scintill","html_url":"https://github.com/scintill","followers_url":"https://api.github.com/users/scintill/followers","following_url":"https://api.github.com/users/scintill/following{/other_user}","gists_url":"https://api.github.com/users/scintill/gists{/gist_id}","starred_url":"https://api.github.com/users/scintill/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/scintill/subscriptions","organizations_url":"https://api.github.com/users/scintill/orgs","repos_url":"https://api.github.com/users/scintill/repos","events_url":"https://api.github.com/users/scintill/events{/privacy}","received_events_url":"https://api.github.com/users/scintill/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-12T07:18:30Z","updated_at":"2015-02-12T07:18:30Z","closed_at":null,"body":"In testing on CyanogenMod 12, I saw consistent `SEGV_ACCERR` with the \"shell code\" entrypoint as the fault address, and `-1` value in `r0`.  I believe this means the `mprotect()` call to make the stack executable failed.  If I turn off SELinux enforcement (`setenforce 0`), it appears to get further (I believe it was an ARM/Thumb hook mismatch that crashed it later.)  I don't know a lot about it, but there appears to be an SELinux feature [`execstack`](https://danwalsh.livejournal.com/6117.html?thread=23525) that prevents the stack from being made executable.\r\n\r\nI don't know if this is a CM-specific SELinux policy, or how widely it will be implemented in other Android 5.0 builds, but it would make sense if this is in AOSP.\r\n\r\nThere's another Android injector [here](https://code.google.com/p/libandroidinjector/), which appears to function without `mprotect()` (you have to adjust inject.c for your needs.)  I haven't tested it on Android 5 yet, though.\r\n\r\nI know solving this is not trivial, so I'm not requesting it, just noting the issue."}}