Privilege Escalation in Qualcomm TrustZone on Nexus Devices

This repository is a full exploit implementation for CVE-2016-2431, a privilege escalation vulnerability in Qualcomm's TrustZone (TZBSP) on Android devices. The exploit is implemented in C and ARM assembly, and is designed to run on a vulnerable Android device with a Qualcomm chipset. The main entry point is 'jni/main.c', which initializes communication with the QSEECom API, loads the Widevine application from '/vendor/firmware', locates it in memory, and then loads and executes custom shellcode (built from 'shellcode.S' to 'shellcode.bin') in a code cave within the TrustZone kernel. The exploit leverages a buffer overflow and manipulation of internal TrustZone data structures to achieve arbitrary code execution at the TrustZone kernel level. The codebase is modular, with separate files for QSEECom API interaction, exploitation utilities, TrustZone-specific exploitation, and payload management. The exploit is operational and provides a working method for privilege escalation on affected devices, but the payload is basic and can be customized for further actions. No network endpoints are present; the attack vector is local, requiring code execution on the target device.

This repository is a sophisticated exploit targeting Qualcomm's TrustZone KeyMaster and Widevine applications on Android devices, specifically exploiting CVE-2015-6639 and CVE-2016-2431. The exploit is implemented in C and ARM assembly, with a modular structure under the 'jni/' directory. Key files include 'main.c' (the exploit orchestrator), 'exploit_utilities.c', 'tzbsp_exploit.c', and 'shellcode.S' (the payload). The exploit works by initializing QSEECom handles, loading the vulnerable TrustZone applications, and using a series of crafted QSEECom commands and buffer overflows to gain code execution in the secure world. Custom shellcode is injected into a code cave in TrustZone memory, which then copies out the KeyMaster keys (KEK and HMAC) to the attacker. The exploit requires local code execution on a vulnerable device and does not use network endpoints. The structure is well-documented, with clear separation between exploitation logic, payload, and utility functions. The exploit is operational, providing a working method to extract highly sensitive cryptographic keys from affected devices.