vusec / drammer Goto Github PK

View Code? Open in Web Editor NEW

484.0 484.0 164.0 132 KB

Native binary for testing Android phones for the Rowhammer bug

Makefile 2.26% C++ 97.74%

drammer's People

Contributors

Stargazers

Watchers

Forkers

jbrindle thomasking2014 geek-li gordol fatgrass chubbymaggie techlord-rce xiaokangwang security-geeks bigfoxses ggthedev nithinmurali baaslaawe polmes puniaze sucof futurelighthouse secpersu miigotu sanshao27 melbshark shenyuanv w5678912345 terry2012 androiddream wanming2008 blackjacktoken zyxtarmo rubyzy xjump hexiangpeng karolciba geekwish xmoezzz poeblu bowlingb jeperez dmitriy-riabov benzeng niejuhu dalishen99 hawking2013 supto hhcola zone1511 rorschach123 lopessec oernii bhohbaum kxp tigerking lgmars thor509 evido3s scyclzy kksamoy andrewjbennett kknet scrack avineshwar teardemon qingg fig1810 jy4618272 cclamb yang123vc evil0x-c qwe00921 googleweb halfkiss feixuezhi b0t0w1 yaoyi2008 pleasehireme daodaox moschang shaobofeng jianchi2001 howknows blacklin mkg20001 hkingz mmhobi7 freekdeman lookdev hoopan t1h0can getme20002 halo2me huntpig hjjety1234 kissthink neichen lhxkailiang hubgit122 youmuyou sange-x jrineck connlan chuanyo

drammer's Issues

Samsung S3 Typewriter Error

I built drammer and I tried to run it on the Samsung S3, but I get a Not a typewriter error after trying to figure out the row size by allocating the ion memory chunk.

normal to make phone reboot ?

weither i set on low or aggressif it is always cause my phone(oneplus 2) to reboot without giving me no result

LIcense

This is a very nice piece. Unfortunately, the repo is missing a license so it's unclear how one can use this software, if at all.

AOSP 4.4: XmlPullParserException: Binary XML file line #0: invalid drawable tag vector

When starting the GUI app:

06-30 09:40:21.827 1845-1845/org.iseclab.drammer E/AndroidRuntime: FATAL EXCEPTION: main
    Process: org.iseclab.drammer, PID: 1845
    android.content.res.Resources$NotFoundException: File res/drawable/ic_info_outline.xml from drawable resource ID #0x7f060062
        at android.content.res.Resources.loadDrawable(Resources.java:2101)
        at android.content.res.Resources.getDrawable(Resources.java:700)
        at android.support.v4.content.ContextCompat.getDrawable(ContextCompat.java:323)
        at android.support.v7.widget.TintManager.getDrawable(TintManager.java:147)
        at android.support.v7.view.menu.MenuItemImpl.getIcon(MenuItemImpl.java:421)
        at android.support.v7.view.menu.ActionMenuItemView.initialize(ActionMenuItemView.java:114)
        at android.support.v7.widget.ActionMenuPresenter.bindItemView(ActionMenuPresenter.java:206)
        at android.support.v7.view.menu.BaseMenuPresenter.getItemView(BaseMenuPresenter.java:182)
        at android.support.v7.widget.ActionMenuPresenter.getItemView(ActionMenuPresenter.java:192)
        at android.support.v7.widget.ActionMenuPresenter.flagActionItems(ActionMenuPresenter.java:451)
        at android.support.v7.view.menu.MenuBuilder.flagActionItems(MenuBuilder.java:1138)
        at android.support.v7.view.menu.BaseMenuPresenter.updateMenuView(BaseMenuPresenter.java:91)
        at android.support.v7.widget.ActionMenuPresenter.updateMenuView(ActionMenuPresenter.java:229)
        at android.support.v7.view.menu.MenuBuilder.dispatchPresenterUpdate(MenuBuilder.java:284)
        at android.support.v7.view.menu.MenuBuilder.onItemsChanged(MenuBuilder.java:1030)
        at android.support.v7.view.menu.MenuBuilder.startDispatchingItemsChanged(MenuBuilder.java:1053)
        at android.support.v7.app.AppCompatDelegateImplV7.preparePanel(AppCompatDelegateImplV7.java:1315)
        at android.support.v7.app.AppCompatDelegateImplV7.doInvalidatePanelMenu(AppCompatDelegateImplV7.java:1553)
        at android.support.v7.app.AppCompatDelegateImplV7.access$100(AppCompatDelegateImplV7.java:89)
        at android.support.v7.app.AppCompatDelegateImplV7$1.run(AppCompatDelegateImplV7.java:129)
        at android.os.Handler.handleCallback(Handler.java:733)
        at android.os.Handler.dispatchMessage(Handler.java:95)
        at android.os.Looper.loop(Looper.java:136)
        at android.app.ActivityThread.main(ActivityThread.java:5017)
        at java.lang.reflect.Method.invokeNative(Native Method)
        at java.lang.reflect.Method.invoke(Method.java:515)
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:779)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:595)
        at dalvik.system.NativeStart.main(Native Method)
     Caused by: org.xmlpull.v1.XmlPullParserException: Binary XML file line #0: invalid drawable tag vector
        at android.graphics.drawable.Drawable.createFromXmlInner(Drawable.java:933)
        at android.graphics.drawable.Drawable.createFromXml(Drawable.java:877)
        at android.content.res.Resources.loadDrawable(Resources.java:2097)
        at android.content.res.Resources.getDrawable(Resources.java:700) 
        at android.support.v4.content.ContextCompat.getDrawable(ContextCompat.java:323) 
        at android.support.v7.widget.TintManager.getDrawable(TintManager.java:147) 
        at android.support.v7.view.menu.MenuItemImpl.getIcon(MenuItemImpl.java:421) 
        at android.support.v7.view.menu.ActionMenuItemView.initialize(ActionMenuItemView.java:114) 
        at android.support.v7.widget.ActionMenuPresenter.bindItemView(ActionMenuPresenter.java:206) 
        at android.support.v7.view.menu.BaseMenuPresenter.getItemView(BaseMenuPresenter.java:182) 
        at android.support.v7.widget.ActionMenuPresenter.getItemView(ActionMenuPresenter.java:192) 
        at android.support.v7.widget.ActionMenuPresenter.flagActionItems(ActionMenuPresenter.java:451) 
        at android.support.v7.view.menu.MenuBuilder.flagActionItems(MenuBuilder.java:1138) 
        at android.support.v7.view.menu.BaseMenuPresenter.updateMenuView(BaseMenuPresenter.java:91) 
        at android.support.v7.widget.ActionMenuPresenter.updateMenuView(ActionMenuPresenter.java:229) 
        at android.support.v7.view.menu.MenuBuilder.dispatchPresenterUpdate(MenuBuilder.java:284) 
        at android.support.v7.view.menu.MenuBuilder.onItemsChanged(MenuBuilder.java:1030) 
        at android.support.v7.view.menu.MenuBuilder.startDispatchingItemsChanged(MenuBuilder.java:1053) 
        at android.support.v7.app.AppCompatDelegateImplV7.preparePanel(AppCompatDelegateImplV7.java:1315) 
        at android.support.v7.app.AppCompatDelegateImplV7.doInvalidatePanelMenu(AppCompatDelegateImplV7.java:1553) 
        at android.support.v7.app.AppCompatDelegateImplV7.access$100(AppCompatDelegateImplV7.java:89) 
        at android.support.v7.app.AppCompatDelegateImplV7$1.run(AppCompatDelegateImplV7.java:129) 
        at android.os.Handler.handleCallback(Handler.java:733) 
        at android.os.Handler.dispatchMessage(Handler.java:95) 
        at android.os.Looper.loop(Looper.java:136) 
        at android.app.ActivityThread.main(ActivityThread.java:5017) 
        at java.lang.reflect.Method.invokeNative(Native Method) 
        at java.lang.reflect.Method.invoke(Method.java:515) 
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:779) 
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:595) 
        at dalvik.system.NativeStart.main(Native Method)

Drammer Crashes

Rooted using Towel Root.
Samsung Galaxy S5 Active (SM-G870A)
4.4.2 Kitkat (Locked bootloader)
SE Enforcing.
Instant app crash upon tapping.

Hanging OnePlus 5, 8GB RAM

Cannot get the full log, since it hangs immediately, even when setting the "Relaxed" parameter to as low as possible. The phone needs a hard reboot, system completely frozen.

Nexus 5 misunderstanding of the results (no flips)

Hello,

I have a LG Nexus 5 with Hammerhead on Android 6.0.1.
I think I am in you article situation but when I run your code it looks like there is nothing happening.
This is the command I'm trying with the corresponding result.

///// COMMAND
$> ./rh_test -a -c 2500000 -d3

///// RESULT
[EXHAUST] - order 10 (4096 KB) - got 0 chunks
[EXHAUST] - order 9 (2048 KB) - got 0 chunks
[EXHAUST] - order 8 (1024 KB) - got 0 chunks
[EXHAUST] - order 7 ( 512 KB) - got 0 chunks
[EXHAUST] - order 6 ( 256 KB) - got 0 chunks
[EXHAUST] - order 5 ( 128 KB) - got 0 chunks
[EXHAUST] - order 4 ( 64 KB) - got 0 chunks
[EXHAUST] allocated 0 KB (0 MB)
[DEFRAG] Additionally got 0 chunks of size 4096 KB (0 bytes in total = 0 MB)
Page block order: 10
Pages per block: 1024
Free pages count per migrate type at order 0 1 2 3 4 5 6 7 8 9 10
Node 0, zone Normal, type Unmovable 57 46 13 1 1 1 0 1 0 2 1
Node 0, zone Normal, type Reclaimable 0 9 7 1 1 0 0 0 0 0 0
Node 0, zone Normal, type Movable 0 0 0 1 2 1 0 4 9 5 135
Node 0, zone Normal, type Reserve 0 0 0 0 0 0 0 0 0 0 1
Node 0, zone Normal, type CMA 0 0 1 0 0 0 1 0 1 1 3
Node 0, zone Normal, type Isolate 0 0 0 0 0 0 0 0 0 0 0
Node 0, zone HighMem, type Unmovable 41 35 13 3 0 0 0 0 0 0 0
Node 0, zone HighMem, type Reclaimable 0 0 0 0 0 0 0 0 0 0 0
Node 0, zone HighMem, type Movable 553 44 2 0 0 0 0 0 0 0 0
Node 0, zone HighMem, type Reserve 54 17 3 1 0 0 0 0 0 0 0
Node 0, zone HighMem, type CMA 1364 3245 458 11 0 0 0 0 0 0 0
Node 0, zone HighMem, type Isolate 0 0 0 0 0 0 0 0 0 0 0
Number of blocks type Unmovable Reclaimable Movable Reserve CMA Isolate
Node 0, zone Normal 31 3 151 1 4 0
Node 0, zone HighMem 36 0 170 1 76 0
[RS] Trying getprop
[RS] ro.product.model: Nexus 5
[RS] ro.product.name: hammerhead
[RS] ro.product.board: hammerhead
[RS] ro.board.platform: msm8974
[RS] known model: LG Nexus 5
[MAIN] Row size: 65536
[EXHAUST] - order 10 (4096 KB) - got 0 chunks
[EXHAUST] - order 9 (2048 KB) - got 0 chunks
[EXHAUST] - order 8 (1024 KB) - got 0 chunks
[EXHAUST] - order 7 ( 512 KB) - got 0 chunks
[EXHAUST] - order 6 ( 256 KB) - got 0 chunks
[EXHAUST] allocated 0 KB (0 MB)
[TMPL] - Bytes allocated: 0 (0 MB)
[TMPL] - Time: 1457894997
[TMPL] - Start templating
[TMPL] - bytes hammered: 0 (0 MB)
[TMPL] - median readtime: 0
[TMPL] - unique flips: 0 (1-to-0: 0 / 0-to-1: 0)
[TMPL] - exploitable flips: 0
[TMPL] - time spent: 0 seconds
/////

I really think I could have bit flips but nothing happen, I have the impression there is no memory allocated through the ION API and then no real hammering.

Am I missing something ?

Permission denied error in Galaxy S7 (G930F)

Device information:
Android Version: 8.0.0 Oreo
UX Version: Samsung Experience 9.0
Android Security Patch Level: April 1, 2018
(Occurs both in default and aggressive modes)

Mem exhausted error when there is memory left.

Android 4.1.2
About 100 MB of 400MB left.

Mayby my android is too old.

'Unfortunately, Drammer has stopped' message when attempting to open the Drammer app

The only option is Force Close. I'm on Jellybean 4.1.1.

get_phys_addr not work correctly in helper.h

on my android 5.0 , APQ8084 chip (SAMSUNG N9150), all pages have the same physical address in a 4MB chunk, why?
[FLIP] i:0xb6800000 l:4194304 v:0xb68621b4 p:0xbf0541b4 b: 8628 0x00000000 != 0x00000001 s:1478153785
[FLIP] i:0xb6800000 l:4194304 v:0xb68620ed p:0xbf0540ed b: 8429 0xffffffff != 0xfffffbff s:1478153785
[FLIP] i:0xb6800000 l:4194304 v:0xb6862a21 p:0xbf054a21 b:10785 0xffffffff != 0xfffffbff s:1478153785
[FLIP] i:0xb6800000 l:4194304 v:0xb68618c7 p:0xbf0548c7 b: 6343 0xffffffff != 0xefffffff s:1478153786
[FLIP] i:0xb6800000 l:4194304 v:0xb6862866 p:0xbf054866 b:10342 0xffffffff != 0xffefffff s:1478153786!
[FLIP] i:0xb6800000 l:4194304 v:0xb68678f7 p:0xbf0548f7 b:30967 0x00000000 != 0x80000000 s:1478153787
[FLIP] i:0xb6800000 l:4194304 v:0xb686611c p:0xbf05411c b:24860 0xffffffff != 0xffffffbf s:1478153787
[FLIP] i:0xb6800000 l:4194304 v:0xb686902e p:0xbf05402e b:36910 0x00000000 != 0x00040000 s:1478153789
[FLIP] i:0xb6800000 l:4194304 v:0xb6869140 p:0xbf054140 b:37184 0x00000000 != 0x00000080 s:1478153789
[FLIP] i:0xb6800000 l:4194304 v:0xb686aa55 p:0xbf054a55 b:43605 0x00000000 != 0x00001000 s:1478153789
[FLIP] i:0xb6800000 l:4194304 v:0xb6868946 p:0xbf054946 b:35142 0xffffffff != 0xffdfffff s:1478153789!
[FLIP] i:0xb6800000 l:4194304 v:0xb686e96f p:0xbf05496f b:59759 0xffffffff != 0x7fffffff s:1478153791
[FLIP] i:0xb6800000 l:4194304 v:0xb687189c p:0xbf05489c b:71836 0xffffffff != 0xffffffef s:1478153793
[FLIP] i:0xb6800000 l:4194304 v:0xb6871258 p:0xbf054258 b:70232 0xffffffff != 0xfffffff7 s:1478153794
[FLIP] i:0xb6800000 l:4194304 v:0xb687220b p:0xbf05420b b:74251 0xffffffff != 0xfeffffff s:1478153794
[FLIP] i:0xb6800000 l:4194304 v:0xb68772b7 p:0xbf0542b7 b:94903 0xffffffff != 0xfdffffff s:1478153796
[FLIP] i:0xb6800000 l:4194304 v:0xb687b111 p:0xbf054111 b:110865 0x00000000 != 0x00004000 s:1478153797
[FLIP] i:0xb6800000 l:4194304 v:0xb687c877 p:0xbf054877 b:116855 0xffffffff != 0xfbffffff s:1478153800
[FLIP] i:0xb6800000 l:4194304 v:0xb687c8ee p:0xbf0548ee b:116974 0xffffffff != 0xffbfffff s:1478153800
[FLIP] i:0xb6800000 l:4194304 v:0xb687e3fe p:0xbf0543fe b:123902 0xffffffff != 0xff7fffff s:1478153800

Samsung galaxy Note 8 (SM-N950F)

application drammer restart the phone immediately
Android 8.0.0

Acer Liquid Z330 - assertion failed

Drammer console output:

[MAIN] ION init
Detected chipset: Qualcomm
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: T01
[RS] ro.product.name: T01_ww
[RS] ro.product.board: MSM8909
[RS] ro.board.platform: msm8909
[RS] Allocating 256K ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
179 178 178 178 178 178 178 178 266 178 178 179 178 178 184 180 266 178 178 179 179 178 179 178 266 178 178 179 178 178 179 178 267 178 178 184 180 178 179 178 266 178 178 179 178 178 179 178 266 179 178 179 178 178 179 178 270 180 178 178 179 178 178 178
[RS] Median: 178
[RS] MAD: 0
[RS] IQR: 1
[RS] Corrected IQR: 6
[RS] Sequences: 8 1 7 1 7 1 7 1 7 1 7 1 7 1
[RS] Detected row size: 32768
[MAIN] Row size: 32768
[MAIN] Exhaust ION chunks for templating
[EXHAUST] - order 10 (4096 KB) - got 0 chunks
[EXHAUST] - order 9 (2048 KB) - got 0 chunks
[EXHAUST] - order 8 (1024 KB) - got 19 chunks
[EXHAUST] - order 7 ( 512 KB) - got 77 chunks
[EXHAUST] - order 6 ( 256 KB) - got 222 chunks
[EXHAUST] - order 5 ( 128 KB) - got 469 chunks
[EXHAUST] allocated 175744 KB (171 MB)
[MAIN] Initializing patterns
[MAIN] Start templating
[TMPL] - Bytes allocated: 179961856 (171 MB)
[TMPL] - Time: 1477950871
[TMPL] - Start templating
helper.h:63: uintptr_t get_phys_addr(uintptr_t): assertion "value & (1ULL << 63)" failed
Aborted

Add to F-Droid ?

Hi,

I'd like to make a request to add Drammer to F-Droid (www.f-droid.org).
Do the authors of Drammer support this inclusion (they don't need to do anything else ; the addition will be made by the F-Droid team) ?

Not work on Meizu m2 note.

[MAIN] ION init
Detected chipset: Mediatek
[MAIN] No or weird row size provided, trying auto detect
[RS] Trying getprop
[RS] ro.product.model: m2 note
[RS] ro.product.name: m2note
[RS] ro.product.board: m2note
[RS] ro.board.platform: mt6753
[RS] familiar model: HTC Desire 830
[RS] Allocating 256 ion chunk
[RS] Reading from page 0 and page x (x = 0..64)
251 246 276 280 289 292 294 293 274 274 278 282 277 277 278 278 277 277 342 342 297 294 291 291 278 277 274 275 279 278 280 279 291 290 293 293 341 342 279 278 277 278 278 278 312 276 277 277 293 293 290 290 280 278 342 342 280 279 277 278 278 278 275 274 
[RS] Median: 279
[RS] MAD: 3
[RS] IQR: 15
[RS] Corrected IQR: 20
count: 64
[RS] Sequences: 1 1 16 2 16 2 16 2 
[RS] Detected row size: 73728
[RS] WARNING! Weird row size detected, assuming familiar model's rowsize 65536
[MAIN] Row size: 65536
[MAIN] Exhaust ION chunks for templating
[EXHAUST] - order 10 (4096 KB) - got   0 chunks
[EXHAUST] - order  9 (2048 KB) - got 120 chunks
[EXHAUST] - order  8 (1024 KB) - got 140 chunks
[EXHAUST] - order  7 ( 512 KB) - got 142 chunks
[EXHAUST] - order  6 ( 256 KB) - got 143 chunks
[EXHAUST] allocated 498432 KB (486 MB)
[MAIN] Initializing patterns
[MAIN] Start templating
[TMPL] - Bytes allocated: 510394368 (486 MB)
[TMPL] - Time: 1479215190
[TMPL] - Start templating
[TMPL - status] flips: 0 | expl: 0 | hammered: 0 | runtime: 0 | median: 0 | kb_per_flip:  0.00 | perc_expl:  0.00 | special: 0 | 0-to-1: 0 | 1-to-0: 0
[TMPL - hammer] virtual row 63233: 0xf7010000 | physical row 22183: 0x56a79000
[TMPL - deltas] virtual row 63233: |141|141| |142|143| |138|138| |138|138| |141|142| |141|141| |139|138| |138|139| |145|145| |145|145| |144|144| |144|144| |145|149| |145|144| |144|143| |144|143| 
[TMPL - status] flips: 0 | expl: 0 | hammered: 65536 | runtime: 10 | median: 143 | kb_per_flip:  0.00 | perc_expl:  0.00 | special: 0 | 0-to-1: 0 | 1-to-0: 0
[TMPL - hammer] virtual row 63234: 0xf7020000 | physical row 22183: 0x56a79000

After 12 hours hammering no results.

Can you give me a Android app source code,Thank you

Don't run make test

An error occurs when running make test: Could not allocate 256K chunk for row size detection: Out of memory
[MAIN] ION init Detected chipset: Qualcomm [MAIN] No or weird row size provided, trying auto detect [RS] Trying getprop [RS] ro.product.model: SM-G900F [RS] ro.product.name: kltexx [RS] ro.product.board: MSM8974 [RS] ro.board.platform: msm8974 [RS] familiar model: LG Nexus 5 [RS] Allocating 256 ion chunk Could not allocate 256K chunk for row size detection: Out of memory
Device Samsubg Galaxy S5

I get an error when build the program setting STANDALONE_TOOLCHAIN variable to point to the toolchain

ONE_TOOLCHAIN=path/to/android-ndk-r11c/sysroot-arm/bin make
make: *** No targets set and no makefile found.