Skip to content

Commit 496d8c6

Browse files
committed
Add Pixel 3a offsets and corrected firmware version.
1 parent 158db46 commit 496d8c6

2 files changed

Lines changed: 11 additions & 3 deletions

File tree

SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/aarch64/README.md

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,16 @@
11
## 64 bit version
22

3-
The 64 bit version 90.0.4430.91 of Chrome is tested with Samsung Galaxy A71 firmware version A715FXXU3BUB5.
3+
The 64 bit version 90.0.4430.91 of Chrome are tested with the following devices:
4+
1. Pixel 3a firmware version RQ1A.210205.004
5+
2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
46

5-
The offsets included in `arm64_renderer.patch` are with respect to this firmware. The `arm64_renderer.patch` is used to simulate a compromised renderer.
7+
The offsets included in `arm64_renderer.patch` are with respect to A71. To test Pixel3a, change the A71 specific offsets to the following instead:
8+
```
9+
uint64_t executeOffset = 0x711354;
10+
uint64_t systemOffset = 0x5f278;
11+
```
12+
13+
The `arm64_renderer.patch` is used to simulate a compromised renderer.
614

715
The patch `browser.patch` patches the browser to make local testing more convenient. It does the following:
816
1. It removes the `ServerCards` check to simulate having a credit card store in an account (rather than on the device):

SecurityExploits/Chrome/SandboxEscape/CVE-2021-30528/arm/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
## 32 bit version
22

33
The 32 bit version 88.0.4324.181 of Chrome are tested with the following devices:
4-
1. Pixel 3a firmware version RP1A.200720.009
4+
1. Pixel 3a firmware version RQ1A.210205.004
55
2. Samsung Galaxy A71 firmware version A715FXXU3BUB5
66

77
The offsets included in `arm_renderer.patch` are with respect to these firmware. (To test on Pixel 3a, the offset for A71 needs to be commented out) The `arm_renderer.patch` is used to simulate a compromised renderer.

0 commit comments

Comments
 (0)