Adapting this CVE about exploit HOT 4 CLOSED

So sad, I can't bypass ASLR with that:

C:\adb>adb shell
shell@F01F:/ $ echo 0 > /proc/sys/kernel/randomize_va_space
/system/bin/sh: can't create /proc/sys/kernel/randomize_va_space: Permission denied
1|shell@F01F:/ $

Now I have level 2 (full randomization):

C:\adb>adb shell
shell@F01F:/ $ cat /proc/sys/kernel/randomize_va_space
2
shell@F01F:/ $

I'm also not allowed to create anything in /etc/ because that's read-only file system and no root, of course.

Nevertheless I tried to attach to android_server in IDA. But it doesn't see the phone's processes. I assume it's because I can't do su.

Any ideas how to overcome this?

BTW thanks for the article on StageFright exploit. It's kinda useful on revealing the details.

from exploit.

That is only a device-depended PoC. You need to change the spray base for your device.

from exploit.

@huntcve
Could you tell me how I can determine this spray address? Is out there some manual or article for that?

Looking at the code I see that you have changed not only spray address (sp_addr) but ROP pivot (newpc_val) also. Where did you get those values?

upd:
It seems I've found a very basic step-by-step instruction. Now I have to check things out to see how they're going.

from exploit.

Closing this as no longer actual for me.

from exploit.