Use-After-Free Privilege Escalation in Android Binder

This repository is a research/exploit project for Android Binder/HwBinder internals centered on CVE-2023-20938, a use-after-free in binder_transaction_buffer_release. It is not just documentation: the exploit/ directory contains a standalone C exploit that opens /dev/hwbinder, manually constructs raw Binder/HwBinder ioctl payloads, resolves android.hidl.token@1.0::ITokenManager through android.hidl.manager@1.0::IServiceManager, creates or retrieves a token-backed binder object, and then sends malformed one-way Binder transactions intended to trigger the vulnerable kernel path. Repository structure is mixed: (1) extensive Markdown notes explaining Binder internals, vulnerability root cause, exploitation strategy, and HIDL parcel construction; (2) generated HIDL artifacts under hidl_gen/ for IServiceManager and ITokenManager, used as references for transaction layout and method numbering; (3) exploit/ C sources implementing raw Binder/HwBinder helpers and the UAF trigger; and (4) nativeBinder/, an Android app/NDK test harness that creates a native binder service and experiments with obtaining binder handles from Java/NDK objects. Main exploit flow in exploit/main.c: open /dev/hwbinder via hwbinder_open; resolve ITokenManager handle using find_tokenManager with interface token android.hidl.manager@1.0::IServiceManager and instance "default"; create a token for a dummy binder value (0xdeadbeef) using create_token; fork a child thread/process path that retrieves a handle associated with that token (via anansi_get / related helper paths in hwbinder.c); then call trigger_uaf in exploit/binder.c. The trigger sends BC_TRANSACTION messages with flat_binder_object payloads and deliberately malformed offsets_size values of sizeof(offsets)-1, matching the repository notes that the bug is reachable when buffer/offset validation fails on misaligned offsets. The exploit is therefore a local kernel memory corruption trigger rather than a complete end-to-end root exploit. Notable capabilities: raw ioctl-based Binder and HwBinder communication; manual HIDL parcel marshalling using BINDER_TYPE_PTR scatter-gather objects; service discovery through IServiceManager; token-based binder object exchange through ITokenManager; binder handle acquisition and reference manipulation (BC_ACQUIRE, BC_FREE_BUFFER); and a concrete malformed transaction sequence to hit the vulnerable release path. The Android app in nativeBinder/ is auxiliary research tooling, not the primary exploit, and demonstrates creating a native binder service, checking Binder accessibility, and attempting to derive a kernel binder handle from a Java IBinder object. No external C2 or remote network exploitation is present. The attack vector is strictly local against Android Binder/HwBinder kernel interfaces and system HIDL services.