Understanding how rootadb finds method call in ELF binary

Question

The android debug bridge daemon adbd that runs on Android devices may be compiled without root support (ALLOW_ADBD_ROOT=0). There is a tool called rootadb which is able to patch an existing adbd binary by (as I understood it) replacing the calls to setuid() and setgid() with NOP instructions, effectively preventing it from dropping its privileges.

I don't understand how the code finds the place of the syscalls inside the binary.

As far as I see, it iterates over the all the bytes and checks if the bytes match something:

u32 *sgid = (u32*)&setgid;

int fd = open( "/sbin/adbd", O_RDWR );
fstat( fd, &st );
buf = memalign( 32, st.st_size );
read( fd, buf, st.st_size );
lseek64( fd, 0, SEEK_SET );

for( start = buf, end = start + st.st_size - 0x20; start < end; start++ )
    if( !memcmp( &start[1], &sgid[1], sizeof( u32 ) * 2 ) )
        memcpy( &start[1], patch, sizeof( patch ) );

How does this work? With what kind of data are sgid and __setuid actually filled?

Answer 1

I'm not 100% sure, but I have a reasonable idea.

The first line of code loads a pointer to the address of setgid, and treats it as a 32 bit pointer.

The loop iterates over the binary, and looks for occurrences of 8 bytes that equal address of the setgid function. If it finds one, it applies the patch, starting at the first byte of that location.