Incorrect Authorization in Qualcomm Graphics GPU Micronode Command Execution

This is a 97-file GPLv3 local-kernel exploitation research repository, not a framework module. Its core is ghostlock_repo/ghostlock_oppo_final.c plus ghostlock_repo/ghostlock_arm32.c/.h. These C programs implement/reference exploitation of CVE-2026-43499 ('GhostLock'), described as an ARM32 Linux rtmutex/futex priority-inheritance stack use-after-free caused by clearing pi_blocked_on for current rather than the waiter owner during proxy-lock rollback. The proposed chain uses FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI across coordinated threads to leave a dangling rt_mutex_waiter on the waiter thread's kernel stack. Controlled deep-stack user-copy syscalls are then intended to overwrite the stale waiter fields, force an rtmutex chain walk to enqueue it into a fake lock, and store the dangling stack address into a writable callback slot. The callback is subsequently invoked through an ioctl/read path to execute stamped ARM32 code. For the OPPO 00522 adaptation, hard-coded addresses include init_task (0xC1A112C0), init_cred (0xC1A174D0), commit_creds (0xC0148C60), device_switch_proc_fops (0xC1ABA320), a fake lock around 0xC1ABA338/0xC1ABA344 depending on report revision, and selinux_state at 0xC1D5A720 with enforcing at +1. The intended payload disables SELinux and clears the armed callback; the Huawei reference instead calls commit_creds(init_cred) and starts a root shell. The documentation contains conflicting intermediate research conclusions and address/layout revisions, but its top-level README and ghostlock_repo README consistently state the final practical conclusion: on the actual OPPO 5.4.134-perf-00522 msm-5.4 build, the chain-walk/enqueue path crashes the kernel, while candidate /proc/switch/{lcd,mt,tp} triggers are denied by SELinux. It should therefore be treated as a detailed failed-target research case and a potentially adaptable proof-of-concept mechanism, not a reliable exploit for that OPPO build. Most remaining files are Python ARM32 reverse-engineering utilities, kallsyms extractors, kernel-stack-depth/copy scanners, disassembly logs, symbol tables, and reports. The _rev/ subtree separately analyzes Qualcomm KGSL interfaces and historical candidates including CVE-2022-22057-style mmap/gpuobj lifetime issues and GPU-side command/race concepts. Those reports explicitly rule out several CPU-side KGSL theories on this exact build (for example, map_user_mem TOCTOU because get_user_pages is protected by mmap locking) and identify firmware, refcount, or mitigation constraints. heota_query.py is an ancillary OTA-retrieval tool: it implements the OPPO HeyOTA AES-CTR request format and queries iota.coloros.com to obtain firmware information for offline kernel extraction. Fetch scripts retrieve external GitHub comparison code; they are auxiliary research tooling rather than exploit runtime dependencies.

This is a five-file C repository implementing a local Android kernel privilege-escalation exploit for CVE-2025-21479, rather than a scanner or a remote exploit. The main entry point, source/cheese.c, includes both the KGSL/Adreno ioctl and PM4 command definitions in adrenaline.h and the raw-kernel kallsyms parser in kallsyms_lookup.c. It creates a specially configured KGSL draw context, maps userspace command buffers into GPU memory, and abuses a CP_SMMU_TABLE_UPDATE validation flaw involving self-draw-state versus ring-buffer handling. This permits manipulation of the GPU TTBR0/page tables to create an arbitrary physical-memory read/write primitive. The code then stabilizes that primitive with a large self-mapping, dumps the kernel from a device-specific physical base, and parses compressed kallsyms directly from the raw image, accommodating virtual KASLR. It locates SELinux-related state and clears enforcing, resolves credential and syscall symbols, temporarily replaces __do_sys_capset with embedded AArch64 credential-escalation shellcode, triggers it from a child via capset(), restores the modified kernel bytes/page mappings, and finally runs sh or supplied arguments as UID 0. device_info.txt documents the tested vivo iQOO Neo8/SM8475 Android 14 target. README.md supplies compilation, adb deployment, device-tuning, and environment-variable guidance. The supplied listing does not include the prebuilt exploit binary mentioned by the README; the analyzed file count is five.

Neo9Root is a device-specific Android local privilege-escalation repository for the Vivo iQOO Neo9 PD2338C. Its intended primary binary, exploit/exploit_vivo_neo9 (and its corresponding exploit_vivo.c source), is referenced throughout the README and deployment scripts but is not present in the supplied file listing. The available files nevertheless document and support an operational exploit chain based on CVE-2025-21479, an Adreno GPU SDS/CP_SET_DRAW_STATE validation flaw used to invoke privileged SMMU page-table updates and achieve arbitrary physical kernel-memory writes. The documented chain writes SELinux enforcement off, patches cap_bprm_creds_from_file to preserve effective capabilities across exec, and installs/invokes a target-specific vhangup syscall stub. stub10 is the active caps-only design: it obtains current credentials through sp_el0, sets fsuid/fsgid to zero, and enables 41 capability bits while avoiding an euid=0 transition that would trigger Vivo vr.ko anti-root behavior. stub12 is a more comprehensive credential rewrite variant, while stub5 replaces current credentials with init_cred. The exploit is transient: modifications are RAM-only and are removed by reboot. Operational client components are present. client/rootc.c Base64-encodes commands and exchanges them through /data/local/tmp/rootd_cmd and rootd_out; client/su is a Termux/MT Manager-compatible wrapper; client/u0.c uses CAP_SETUID/CAP_SETGID to execute a supplied absolute-path program as UID/GID 0; and client/shim.c is an LD_PRELOAD interceptor that redirects kptr_restrict writes. PowerShell scripts push the exploit/client trio via ADB, reboot to create a favorable memory-allocation window, repeatedly launch the exploit daemon, and validate capability and protected-directory access. The archive directory contains older root-daemon and deployment variants, including a Unix-domain socket command service at /data/local/tmp/rootd.sock. The tools directory consists of Python reverse-engineering utilities for kernel images and Vivo's vr.ko module, including Capstone/pyelftools disassembly, relocation inspection, and string extraction. Documentation also contains exploratory notes on CVE-2026-64560, but no corresponding exploit implementation is included in the listed repository files. No outbound network service, remote C2 endpoint, hardcoded IP address, or HTTP request is implemented; the attack is local and normally delivered through physical USB/ADB access.

This repository is a real local Android privilege-escalation project targeting vivo iQOO Neo9 (PD2338C) devices via CVE-2025-21479 in the Adreno/KGSL GPU stack. Its stated goal is bootloader-unlock-free 'caps-root': instead of setting euid=0, it preserves euid 2000 to evade the vendor vr.ko anti-root logic while granting full effective capabilities and root-equivalent access. Repository structure: the top-level README documents the exploit chain, deployment, and operational constraints. The client/ directory contains the active userland interface: rootc.c implements a file-based command client that base64-encodes commands and exchanges them through /data/local/tmp/rootd_cmd and /data/local/tmp/rootd_out, while client/su is a shell wrapper that makes the daemon look like a conventional su binary for Termux/MT Manager. The exploit/stubs/ directory contains ARM64 kernel stubs (stub5.s, stub10.s, stub12.s) that directly manipulate task cred structures and capability bitmaps. The scripts/ directory contains PowerShell automation for pushing binaries, rebooting the phone, waiting for a cold boot window, launching the exploit with CHEESE_STEXT_PA/CHEESE_DAEMON/CHEESE_PATCH_CAP, and validating success. The docs/ directory is extensive and documents exploit development, debugging, kernel offsets, anti-root behavior, and reliability issues. The archive/ directory contains older daemon/socket-based approaches and prior deployment scripts. The tools/ directory is not exploit delivery code; it is analyst tooling for reverse engineering kernel.img and vr.ko, extracting strings, disassembling code, and locating symbols/URLs. Main exploit capability: according to the README and docs, the exploit uses CVE-2025-21479 to obtain arbitrary physical kernel write by abusing GPU command processing and SMMU page-table manipulation. It then patches kernel state/functions such as cap_bprm_creds_from_file and kptr_restrict, may flip SELinux enforcing to permissive, and installs a resident command-execution path. The resulting daemon provides arbitrary shell command execution with full capabilities, exposed through rootc and the su wrapper. This is a local exploit, not a remote one. Operationally, the exploit is tailored to a very specific device/kernel build and depends on a reboot-derived 'cold window' for reliability. The scripts repeatedly reboot, push binaries to /data/local/tmp, start the exploit in the background, and poll for /data/local/tmp/rootd_ready.txt or log messages indicating readiness. Once ready, commands are executed through the file queue and output is returned to the caller. Notable endpoints are almost entirely local filesystem and procfs paths on the Android target. There are no C2 servers or remote exploitation endpoints in the code shown. The only network-like references are README badge URLs and GitHub links. Overall, this is an operational local root exploit toolkit with deployment automation and reverse-engineering support files, not merely a detector or theoretical PoC.

This repository is a compact local Android kernel exploit for CVE-2025-21479 targeting the Qualcomm Adreno/KGSL GPU driver, with the stated goal of achieving SELinux permissive mode from an untrusted Termux shell on Snapdragon Samsung devices. The repo contains 5 files: a README, MIT license, a KGSL/Adreno helper header (adrenaline.h), a standalone kernel symbol extraction utility (extract-kallsyms.c), and the main exploit (gpu_sam.c). Structure and purpose: - adrenaline.h defines KGSL ioctl structures, command packet helpers, and GPU command-building primitives used to interact with /dev/kgsl-3d0. - extract-kallsyms.c is a support utility, not the exploit itself. It parses a supplied Android kernel image dump, reconstructs kallsyms metadata, and writes a local kallsyms.txt file containing symbol addresses. This is used to avoid hardcoding kernel symbol offsets. - gpu_sam.c is the main exploit. It logs to /sdcard/gpu_sam.log, loads symbol addresses from kallsyms.txt, sets up GPU contexts and memory mappings, constructs crafted GPU command buffers, and attempts to obtain stable kernel physical memory read/write. It then locates the SELinux state/enforcing target and patches the low byte to disable enforcement. Main exploit capabilities: - Local privilege-impacting kernel exploitation via the KGSL GPU driver. - Uses GPU command submission and mapped memory to build a physical memory access primitive. - Dynamically resolves kernel symbols from a user-generated kallsyms.txt rather than embedding fixed offsets. - Translates kernel virtual addresses to physical addresses using discovered kernel base values. - Reads and writes kernel memory, specifically targeting SELinux enforcement state. - Provides SELinux permissive mode, but the README explicitly says the root primitive is not yet implemented in this version. Notable targeting details: - README identifies this as an SELinux-permissive-only variant of the Cheese exploit for CVE-2025-21479. - Claimed tested target is Samsung SM-S901W S22 Snapdragon with locked bootloader, Android 14, kernel 5.10.168; comments also mention S22 Ultra SM-S908W. - Requires the exact boot.img/kernel from the target firmware and possible adjustment of kernel base scan constants. Overall, this is a real local exploit repository rather than a detector or fake PoC. It is operational because it contains concrete exploitation logic and a working payload (kernel memory patch to disable SELinux enforcement), but it is not fully weaponized or generalized into a larger framework.

This repository is a full local Android privilege-escalation exploit for CVE-2025-21479, targeting a Samsung Galaxy Z Flip 5 configuration with an Adreno A7xx GPU. It is not a framework module; it consists of one large native exploit source file, one GPU helper header, and several shell scripts that operationalize post-exploitation. Structure: README.md documents the target device, firmware constraints, patch check, and usage. include/adrenaline.h provides KGSL/Adreno ioctl structures, enums, and PM4/GPU command builders used to interact with the GPU driver. src/exploit.c is the main exploit and contains the vulnerability chain: GPU arbitrary physical read/write, KASLR leak via _stext discovery, firmware-symbol verification, SELinux state overwrite to permissive, and an init-hook-based root command server bootstrap. The scripts directory contains operational wrappers: run.sh pushes and launches the exploit over adb; root_cmd.daemon creates a FIFO-backed resident root shell service; rootsh.sh sends commands to that service and retrieves output; rootbin.sh pushes a shared object and executes it as root via LD_PRELOAD into a stock binary to bypass DEFEX restrictions. Main capabilities: The exploit is designed for local exploitation with adb/device access, not remote delivery. It abuses the GPU/KGSL interface to gain arbitrary physical memory access, then uses that primitive to locate kernel text despite KASLR, resolve expected kernel symbols for the tested firmware, modify SELinux enforcement state, and patch/hook /system/bin/init to launch a resident root command runner. Post-exploitation, the operator can run arbitrary shell commands as root and also execute custom native payloads as root using a stock host binary and LD_PRELOAD. Notable targeting details visible in code include Samsung-specific kernel constants, firmware-specific virtual addresses (e.g., FW_STEXT_VA, FW_SWAPPER_PG_DIR_VA, FW_INIT_TASK_VA, FW_SELINUX_STATE_VA), and init binary patch/cave offsets tied to the tested firmware build. The README explicitly states the exploit is exact-device/firmware oriented and non-persistent across reboot. Overall, this is an operational local root exploit with built-in post-exploitation tooling rather than a mere proof-of-concept or detector.

This repository contains a sophisticated local privilege escalation exploit targeting Android devices with Qualcomm Adreno GPUs, specifically exploiting CVE-2025-21479. The main exploit logic resides in 'exploit.c', which orchestrates the attack by interacting with the GPU driver via /dev/kgsl-3d0, manipulating GPU memory, and patching kernel code to disable security checks and escalate privileges. The exploit includes routines for mapping user memory into GPU space, crafting GPU command buffers, and directly patching the kernel's __do_sys_capset function to bypass capability checks. Helper files ('helpers/analyze.c', 'helpers/extract-kallsyms.c', and 'kallsyms_lookup.c') are used for analyzing and extracting kernel symbols, which are critical for reliably locating and patching kernel functions. The exploit ultimately spawns a root shell if successful. The code is written in C and is operational, though the README notes it is a work in progress and may require adaptation for specific devices or kernel versions. No network endpoints are involved; the attack vector is purely local, requiring code execution on the target device.

This repository contains a local privilege escalation exploit targeting Meta Quest 3 and Quest 3S headsets running vulnerable firmware (prior to the August 10, 2025 patch) with Adreno A7xx GPUs. The exploit leverages CVE-2025-21479, a vulnerability in the Qualcomm Adreno GPU driver, to gain kernel memory access and escalate privileges to root. The main exploit logic is implemented in 'cheese.c', which interacts with the GPU via '/dev/kgsl-3d0', manipulates GPU command buffers, and ultimately patches the kernel's sys_capset function with custom shellcode to obtain a root shell. The repository also includes 'adrenaline.h' (helper routines for GPU command construction), 'kallsyms_lookup.c' (for resolving kernel symbols), and a build script. The exploit is operational and provides a root shell if successful, but is highly device- and version-specific. The README provides detailed background, usage instructions, and links to related research. No network endpoints are involved; the attack vector is local, requiring code execution on the target device.