Privilege Escalation in Android Widevine QSEE TrustZone

This repository contains a proof-of-concept (POC) exploit for CVE-2015-6639, a privilege escalation vulnerability in the Qualcomm Secure Execution Environment (QSEE) on Android devices, specifically targeting the Widevine TrustZone application. The exploit is implemented in C and is structured as an Android NDK project, with the main entry point in 'jni/main.c'. The code interacts with the QSEECom API to load the Widevine TrustZone application, locate it in memory, and exploit a vulnerability via crafted PRDiag* commands. The exploit demonstrates the ability to read arbitrary files from TrustZone secure storage, specifically extracting the Widevine keybox file ('/persist/data/app_g/sfs/keybox_lvl1.dat'), which can compromise DRM-protected content and escalate privileges. The repository is well-structured, with separate files for API interaction, exploit utilities, vulnerability triggers, and command definitions. No network endpoints are present; the attack vector is local, requiring code execution on the target device.

This repository is a sophisticated exploit targeting Qualcomm's TrustZone KeyMaster and Widevine applications on Android devices, specifically exploiting CVE-2015-6639 and CVE-2016-2431. The exploit is implemented in C and ARM assembly, with a modular structure under the 'jni/' directory. Key files include 'main.c' (the exploit orchestrator), 'exploit_utilities.c', 'tzbsp_exploit.c', and 'shellcode.S' (the payload). The exploit works by initializing QSEECom handles, loading the vulnerable TrustZone applications, and using a series of crafted QSEECom commands and buffer overflows to gain code execution in the secure world. Custom shellcode is injected into a code cave in TrustZone memory, which then copies out the KeyMaster keys (KEK and HMAC) to the attacker. The exploit requires local code execution on a vulnerable device and does not use network endpoints. The structure is well-documented, with clear separation between exploitation logic, payload, and utility functions. The exploit is operational, providing a working method to extract highly sensitive cryptographic keys from affected devices.