Post #2142683
2026-04-29 23:17 UTC
@implr @wolf480pl You can just write to any running process' .text if you have access to the binary.
You should just be able to write a better implementation of close() into /lib/libc.so.6 - one that also drops you a +s, no questions asked su in /tmp before actually closing the file, and wait until a privileged process bites.
Replies (1)
-
@wolf480pl@mstdn.io 2026-04-29 23:33
@q3k @implr people have done that with dirtypipe before https://github.com/polygraphene/DirtyPipe-Android/blob/master/TECHNICAL-DETAILS.md