Skip to content

Commit

Permalink
fix typo in hitcon dtb writeup
Browse files Browse the repository at this point in the history
  • Loading branch information
sampritipanda committed Dec 11, 2021
1 parent 120ae4b commit 38c81bb
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion 2021/hitcon-ctf-2021/dtb/README.md
Expand Up @@ -93,4 +93,4 @@ if (state) {

Regmap overlapping doesn't work by default because of `memblock_is_memory` which scans `memblock.memory`, but overwriting `memblock.memory.regions[0].base` (`0x41df0f88`) with the spin table primitive allows us to bypass the check. With the overlapping regmap, we could flip arbitrary bit in the kernel code, and patching the kernel to make an LED device loads its color name from the flag location was straightforward.

[This is our final exploit (example.dts).](./example.dts) and [generator](./xor-patcher.py)
[This is our final exploit (example.dts).](./example.dts) and [generator](./xor_patcher.py)

0 comments on commit 38c81bb

Please sign in to comment.