869
edits
Changes
Jump to navigation
Jump to search
Line 30:
Line 30: + + + + + +
→ARM11 kernel
! Description
! Description
! Fixed in system version
! Fixed in system version
|-
| [[SVC]] table too small
| The table of function pointers for SVC's only contains entries up to 0x7D, but the biggest allowed SVC for the table is 0x7F. Thus, executing svc7E or svc7F would make the SVC-handler read after the buffer, and interpret some ARM instructions as function pointers.
However this would require patching the kernel .text or modifying SVC-access-control. Even if you could get these to execute, they would still jump to memory that isn't mapped as executable.
| None
|-
|-
| [[SVC|svcBackdoor (0x7B)]]
| [[SVC|svcBackdoor (0x7B)]]