Loading vulnerability…
GhostLock is a Linux kernel local privilege escalation vulnerability in the rtmutex priority-inheritance code, centered on remove_waiter() in kernel/locking/rtmutex.c. The flaw occurs when remove_waiter() is invoked on the proxy-lock rollback path in rt_mutex_start_proxy_lock() during futex_requeue() handling. In that path, the affected waiter belongs to waiter::task rather than the current task, but the vulnerable logic operated on current for dequeue and state cleanup. As a result, the kernel could perform rbtree dequeue operations without holding the correct waiter task pi_lock, fail to clear the actual waiter task's pi_blocked_on pointer, and run priority-chain adjustment against the wrong top-priority waiter task. The uncleared pi_blocked_on state leaves a dangling reference to freed stack-backed waiter state, creating a use-after-free condition in kernel memory. The bug was introduced during rtmutex rework and has been reported as affecting kernels since Linux 2.6.39, particularly where futex priority inheritance support is enabled.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
43 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (55 hidden).
Repository contains a real local Android kernel privilege-escalation exploit research project for CVE-2026-43499 (GhostLock), centered on rt_mutex/futex waiter corruption and adapted for Honor BVL-AN16 while retaining multiple Pixel target profiles. The code is not a framework module; the main exploit is built as an LD_PRELOAD shared object from exploit/exploit/src/preload.c and exploit/exploit/src/main.c via the provided Makefile. Structure: docs/ and disasm/ hold extensive reverse-engineering notes and kernel/module disassembly used to adapt the exploit. exploit/exploit/src/ contains the exploit implementation: slide.c performs KASLR leak attempts by abusing futex requeue PI and stack-copy side effects; fops.c builds a fake file_operations path and CFI/KASLR stages; pipe.c creates a physical read/write primitive by reclaiming/faking pipe buffers; root.c patches creds and SELinux, then triggers post-exploitation actions; preload.c is the constructor entry point and embeds/drops the su daemon; su_daemon.c implements a local root shell service over a UNIX socket. Target-specific offsets and variants live under src/targets/, with a dedicated honor-BVL-AN16 profile and many Pixel build profiles. Main capability: the exploit aims to leak kernel base, reclaim kernel heap pages, forge waiter/task/fops/pipe structures, obtain arbitrary kernel physical read/write, and then elevate the current process to root. Post-exploitation behavior is operational rather than just demonstrative: it attempts to disable SELinux, install a su binary at /apex/com.android.virt/bin/su, start a root daemon on /data/local/tmp/temp_su.sock, and modify wallpaper files as a visible success marker. Targeting: README and target headers show the primary target is Honor Magic6 Pro BVL-AN16 on Android 16 with kernel 6.1.128-android14-11-gec1055c9cbb5. The repository also includes reusable target profiles for several Google Pixel builds. The docs indicate the Honor adaptation is still research-heavy and reliability is constrained by SLUB/cross-cache reclaim behavior, but the codebase clearly implements an exploit rather than mere detection. Notable endpoints/targets are local only: device nodes such as /dev/kgsl-3d0 and /dev/fmps for Honor-specific stack-copy routes, /proc/sys/kernel/random/boot_id as a leak verification target, /sys/fs/selinux/enforce for post-root SELinux changes, and multiple filesystem paths for dropped binaries, logs, and wallpaper artifacts. No external network C2 or remote target infrastructure is present; the only socket service is a local AF_UNIX su daemon.
This repository is a real local Android kernel privilege-escalation exploit for CVE-2026-43499, tailored primarily to Samsung Galaxy S22-family devices and especially the SM-S901W firmware S901WVLS4DWL3. It is not a scanner or detector. The codebase is mostly C with one assembly blob wrapper, plus Python/C/shell tooling for generating target-specific kernel offsets. Repository structure: the main exploit logic lives under src/. src/preload.c is a constructor-based supervisor that repeatedly forks exploit attempts when loaded as a shared object. src/main.c orchestrates the full chain: leak KASLR slide, prepare fake kernel objects/pages, trigger the exp64 stage to corrupt ashmem_misc.fops, then run the CFI-safe post-exploitation stage to obtain stable kernel read/write and root. src/api.c installs and launches an embedded secondary binary (build/embed/cve_exp64_arm64 via src/exp64_blob.S) using a memfd-passed payload. src/exp64/main.c and src/exp64/stack.c implement the timing-sensitive futex/rt_mutex corruption and kernel-stack stamping stage. src/fops.c validates and repairs the fake file_operations overwrite and transitions into the arbitrary read/write stage. src/pipe.c builds a pipe-buffer-based physical memory read/write primitive after heap shaping and reclaim. src/root.c uses that primitive to modify SELinux enforcement and queue a fake work item that invokes a usermode helper. src/su_daemon.c is the post-exploitation root shell daemon/client. src/slide.c leaks the kernel slide via tracefs. src/util.c and kernelsnitch/* provide helpers for ashmem abuse, heap grooming, futex collision/bruteforce logic, and diagnostics. src/targets/... contains firmware-specific offsets and fingerprint data. target_generator/ contains tooling to derive target.h from a raw kernel Image. Main exploit capability: the exploit abuses a futex PI requeue bug to leave a dangling rt_mutex_waiter on a kernel stack, then repeatedly stamps crafted data over that stale waiter using IPv6 setsockopt(MCAST_JOIN_SOURCE_GROUP). The crafted waiter causes an rb-tree operation during rt_mutex chain walking to perform a controlled kernel write, replacing ashmem_misc.fops with a fake file_operations table. That fake table is then used to turn ashmem/configfs interactions into arbitrary kernel read/write primitives. After that, the exploit installs a stronger pipe-buffer-based physical read/write primitive, restores/repairs corrupted fields where needed, leaks or uses KASLR offsets, writes the SELinux enforcing byte to permissive, and queues a fake workqueue item to execute a root helper in kernel context. Post-exploitation result: the helper starts a UNIX socket daemon at /data/local/tmp/temp_su.sock. The client supports interactive shell mode and '-c' command execution, both backed by /system/bin/sh running as UID 0. The exploit also writes logs to /sdcard/cve-2026-43499.log and may keep a background allocation-holder process alive to preserve reclaimed kernel pages for stability. Targeting: the README and target headers show this is highly device/firmware-specific. It expects exact kernel symbols, structure offsets, and page fingerprints extracted from the victim boot image/kernel. The included target profile focuses on Samsung Galaxy S22 SM-S901W Android 14 kernel 5.10.168, while the README references adaptation from an S22 Ultra SM-S908W Android 15 kernel 5.10.226 variant. Overall, this is an operational, multi-stage local kernel root exploit with a concrete payload: stable root shell access via a local daemon after disabling SELinux and establishing kernel memory read/write.
This repository is a device-specific research port of CVE-2026-43499 for the Samsung Galaxy Z Fold4 SM-F936W (firmware F936WVLU1AVGA). It is not part of a common exploit framework; it is a standalone native exploit/research tree with substantial reverse-engineering artifacts. The repo mixes exploit code (`src/`), host-side analysis helpers (`analysis/tools/`), target documentation (`docs/`), and KernelSU-related build/audit material (`kernelsu/`). Main exploit capability: a local Android kernel exploitation chain targeting an rt_mutex / futex PI residual waiter corruption path described as an 'IonStack PI write-what-where' lineage. The code attempts to: discover KASLR via tracefs/perf, leak `mm_struct` using KernelSnitch timing/futex-hash techniques, reclaim an order-3 kernel page via skb spraying, construct fake waiter/lock/file_operations objects on the reclaimed page, stamp residual waiter state onto a kernel stack via socket options (`MCAST_JOIN_SOURCE_GROUP`, Samsung `SOL_SOCKET` option 1000), trigger `rt_mutex_adjust_prio_chain` / `CMP_REQUEUE_PI` behavior, and then validate a controlled overwrite of `ashmem_misc.fops`. Later stages include pipe-based physical read/write and root installation, but repository documentation and logs consistently state those stages are not reached on this target. Repository structure: `src/main.c` is the main exploit orchestrator and likely primary entry point; `src/fops.c` contains the pselect/fake-lock/CFI route logic; `src/common.h` centralizes constants and prototypes; `src/kernelsnitch/*` implements the mm leak primitive; `analysis/tools/perf_sp_probe.c` is a standalone diagnostic for sampling kernel stack pointers with `perf_event_open`; `analysis/tools/pi_tree_walk_sim.c` is a host-only simulator for fake rb-tree walk behavior. The `analysis/` tree contains boot image metadata, recovered symbol offsets, disassembly of `rt_mutex_adjust_prio_chain`, curated device logs, and reports documenting exploit progress and failure modes. `docs/PROGRESS.md` and `README.md` make clear this is an incomplete research port where reclaim and planting are working, but the critical `[7]` insert / page mutation / CFI write gate remains open. Exploit status/maturity: real exploit code is present and it performs active kernel-manipulation attempts, so it is an exploit rather than a detector. However, for this exact target the chain is still proof-of-concept/diagnostic: logs show successful KASLR resolution, residual-base measurement, page reclaim, and fake object planting, but repeated `cfi misc_fops mismatch`, `pipe physrw ... done=0 root=0`, and README statements confirm no successful arbitrary write or root on this device profile yet. Notable fingerprintable endpoints/targets are mostly local OS interfaces rather than remote C2/network infrastructure: `/proc/self/{setgroups,uid_map,gid_map}`, `/proc/kallsyms`, `/proc/modules`, perf interfaces, tracefs, futex syscalls, and socket options including Samsung-specific `SOL_SOCKET` option 1000 and IPv6 multicast group-source stamping. No hardcoded external IPs/domains or HTTP(S) callbacks were identified. The attack vector is primarily local privilege escalation on a very specific Samsung Android kernel build, with some network/socket-based kernel attack surface used internally as part of the exploitation mechanics.
This repository is a full Android application, not just a standalone exploit script. It implements a one-click local privilege-escalation and KernelSU installation workflow centered on CVE-2026-43499 (GhostLock). The codebase contains Kotlin Android UI/application logic, a native C probe library, Android instrumentation tests, and standard Gradle build files. Core structure: MainActivity.kt provides the UI and payload-source selection; InstallActivity.kt and InstallViewModel.kt orchestrate the install flow; PayloadRepository.kt handles remote manifest/artifact retrieval from GitHub; CustomPayloadStore.kt manages imported ELF .so payloads; ShizukuController.kt supports alternate execution through Shizuku; native_probe.c performs environment and kernel-surface probing and KernelSU detection. Tests include exploit-oriented instrumentation that probes kernel information exposure and invokes a helper binary with --run-payload against a CVE-2026-43499 payload. Main exploit capabilities: the app can 1) detect device/build/kernel characteristics, 2) match the device against a remote support manifest, 3) download a pinned exploit .so and KernelSU artifact from GitHub, or alternatively use a bundled libbs.so or user-imported .so, 4) execute the payload locally through a helper binary, optionally via Shizuku, 5) monitor logs/timeouts and cache KASLR/P0-related offsets, and 6) stage and verify KernelSU activation. The native probe also measures possible KASLR timing side channels on aarch64 and probes access to sensitive kernel interfaces such as tracefs, perf_event_open, bpf, pagemap, and ashmem. Attack model: primarily local privilege escalation on Android devices, with a secondary network component for fetching manifests and payloads from GitHub. It is not a remote exploit against a network service. The repository appears operational rather than purely demonstrative because it includes end-to-end installation logic, payload acquisition, execution orchestration, logging/history, and alternate execution paths. However, the actual exploit primitive is encapsulated in external/bundled ELF payloads and helper binaries rather than fully exposed in the provided source.
Repository is a real local Android kernel exploit research tree targeting CVE-2026-43499 (GhostLock rt_mutex priority-inheritance residual write) on a very specific Samsung target: Galaxy S26 Ultra SM-S948U1, firmware S948U1UES3AZF1. The stated goal is not full root but a stable 'SELinux-only park': derive KASLR, reclaim/spray a forged waiter page, trigger a constrained NULL write to selinux_state.enforcing, then keep the process parked so SELinux remains Permissive long enough for follow-on research. Structure: README documents the exploit chain, limitations, and usage. park_cal_one.sh is the main operator script: it pushes the prebuilt shared object to /data/local/tmp, launches /system/bin/true with LD_PRELOAD, waits for success markers in logs, parses KASLR/spray addresses, and writes finish_va.txt locally and on-device. build-park.ps1 and source/Makefile build the Android shared object and embedded helper binaries. generate_target.py is a large retargeting utility that parses boot.img/kernel metadata and generates source/src/target.h with offsets, symbol-derived constants, and layout information for a specific firmware. Core exploit code lives under source/src/. preload.c is the LD_PRELOAD constructor entry point; it unsets LD_PRELOAD, sets up synchronous logging, and calls run_exploit(). slide_tracefs.c implements the KASLR leak using tracefs sched_blocked_reason events under /sys/kernel/tracing, replacing an older boot_id-based method. util.c, pipe.c, and fops.c implement the reclaim/spray, forged waiter/fd_set encoding, pselect/futex routing, and direct write orchestration. kernelsnitch/ contains the KernelSnitch-based reclaim/collision logic used to shape kernel memory. azf1_p2.c contains an alternate Samsung/KGSL-based kstack oracle path using /dev/kgsl-3d0 and WARN log parsing from /proc/sec_log/logcat/dmesg, but README indicates this path is not the primary one for the included park build. Capabilities: the exploit is operational and more than a simple PoC. It performs kernel address discovery, memory reclaim/spray, forged rt_mutex waiter construction, and a constrained arbitrary write primitive sufficient to NULL selected writable kernel data targets. The included configuration specifically targets SELinux enforcement. The codebase also contains optional post-exploitation helpers: preload.c embeds and can drop a su binary, mount tmpfs at /apex/com.android.virt/bin, install /apex/com.android.virt/bin/su and /data/local/tmp/su, and launch a UNIX-domain su daemon at /data/local/tmp/temp_su.sock. su_daemon.c supports command execution (-c) and interactive shells over that socket. However, the repository’s own documentation explicitly says host uid=0 is not achieved by this package alone and that additional info leak / cred-finishing steps are still required. Notable fingerprintable artifacts are almost entirely local file/device paths rather than network endpoints: tracefs paths under /sys/kernel/tracing, Samsung log interfaces like /proc/sec_log, KGSL device /dev/kgsl-3d0, ashmem, /proc namespace and mount files, and the su daemon socket /data/local/tmp/temp_su.sock. No external C2, IPs, or HTTP(S) endpoints are present. Overall, this is a specialized, device-specific local privilege-escalation/SELinux-bypass exploit harness with embedded post-exploitation scaffolding, but packaged in a constrained 'park-only' form rather than a complete root chain.
GhostLock is a standalone Android local privilege escalation exploit repository targeting CVE-2026-43499, described as a futex PI stack use-after-free in Linux/Android GKI kernels. The repository is not a framework module; it contains a full exploit implementation in C plus Python tooling for extracting per-device kernel offsets from boot images/BTF/kallsyms. Repository structure: the main exploit lives under src/core/ with main.c as the entry point. main.c selects a supported kernel by exact uname -r match, runs the exploit, and also supports bootstrap modes (--bootstrap and --write1). pipe.c implements pipe_buffer heap shaping/spraying and establishes kernel physical read/write primitives. fops.c handles file_operations corruption/CFI-sensitive stages and pselect/fd_set waiter layout manipulation. slide.c leaks the KASLR base using a related pselect/futex route. root.c performs post-exploitation credential patching, SELinux disablement, and child-process validation of root. util.c contains helpers for ashmem/configfs access, environment parsing, diagnostics, and exploit state. miniadb.c is a minimal ADB client used after initial SELinux disablement to connect to localhost:5555 and run a shell command using a pre-positioned RSA key. The exploit chain, as documented and reflected in code, is: trigger futex PI UAF via pselect/futex interactions; reclaim/control freed waiter memory using pipe_buffer spraying; leverage rb_erase/tree manipulation for controlled kernel writes; use ashmem/file_operations/configfs primitives to gain stable kernel read/write; locate current task/cred and patch uid/gid/capabilities; disable SELinux; then optionally bootstrap a shell via local adbd. The code also includes KASLR handling, CFI-aware validation/restoration of ashmem_fops, and a bundled KernelSnitch component for locating mm_struct/direct-map relationships. Targeting is highly device- and kernel-specific. Supported offsets are embedded for OPPO Find X8, OnePlus Ace 6T, OnePlus 15, OPPO Pad 5, and realme RMX5070, with some entries marked untested. The exploit requires local execution on the device and exact kernel offset support; README explicitly states it is not a remote exploit. Auxiliary Python scripts in tools/ parse BTF and kallsyms to derive structure offsets and symbol addresses for adding new device support. Overall, this is a real operational local kernel exploit with a basic hardcoded post-exploitation path rather than a mere PoC or detector.
This repository is a real local Android privilege-escalation and post-exploitation toolkit/documentation set for achieving temporary root and in-memory KernelSU on a locked-bootloader Samsung Galaxy Z Fold4 (SM-F9360/q4q). It is not a remote exploit and contains both operational code and extensive porting notes. Repository structure is small and focused: README.md is the main technical write-up describing the full exploit chain and constraints; loader/ksu-load.c is the primary code artifact, implementing a manual-relocation KernelSU loader; scripts/restore-root.sh automates post-reboot restoration of root and module loading over adb; patches/ionstack-q4q-adapt.patch documents adaptations to an upstream CVE-2026-43499 exploit base; docs/PORTING-TIMELINE.md records debugging and porting decisions; release/SHA256SUMS references built artifacts. Main exploit capability: the repo chains CVE-2026-43499 to obtain temporary kernel-domain root, then bypasses Samsung DEFEX restrictions by using LD_PRELOAD to execute a constructor inside an existing trusted binary (/system/bin/true). From there, the loader reads a KernelSU .ko file, parses /proc/kallsyms, rewrites unresolved ELF symbols from SHN_UNDEF to SHN_ABS with absolute runtime addresses, optionally patches vermagic, and calls init_module(2). This is specifically designed to bypass Samsung kernel module loading obstacles including TRIM_UNUSED_KSYMS, modversions CRC checks, and vermagic mismatches. The resulting payload enables KernelSU and working su access (allow_shell=1), with KernelSU Manager support. The exploit is operational but device-specific. It targets Samsung Android 5.10 kernels on SM8450-based devices, validated on firmware F9360ZCSAIZF1. It requires exact kernel/toolchain compatibility for the KernelSU module and is explicitly non-persistent: every reboot requires rerunning the exploit and reloading the module. The helper script shows the intended workflow: wait for adb, ensure low device load, launch the CVE exploit asynchronously, poll the root command channel, disable kptr_restrict, trigger the LD_PRELOAD loader, and verify success via logs, /proc/modules, and su. No external network C2 or remote endpoints are present. The observable targets are local Android filesystem and procfs paths, especially /proc/kallsyms, /proc/sys/kernel/kptr_restrict, /proc/modules, /proc/self/attr/*, /system/bin/true, /system/bin/sh, and /data/local/tmp/* staging files. Overall, this repo’s purpose is to document and operationalize a reproducible locked-bootloader Samsung root chain using a kernel UAF exploit plus a custom in-memory KernelSU loader.
This repository is a real exploit/tooling bundle for temporary Android root on selected vivo/iQOO devices using CVE-2026-43499, described as a futex PI UAF kernel exploit, followed by optional KernelSU activation. It is not a scanner or README-only project. The repo contains multiple operator-facing wrappers rather than the core native exploit source itself: Termux bash toolboxes, Windows PowerShell one-click scripts, and Python helper utilities for the vivo X200 chain. Structure-wise, the repository has three main parts: (1) generic/older iQOO toolbox scripts such as `临时root工具箱iQOO.sh` and `IQOO临时root工具箱(1)/iQOO临时root工具箱.sh`; (2) a dedicated `x200/` subtree for the vivo X200 seven-stage exploit chain; and (3) Windows USB-based scripts under `vivo_iqoo临时root工具箱/` and `Z10TurboPro_临时root工具/`. There are also build/maintenance scripts (`build_final.py`, `bump_version.py`) for packaging an APK-based frontend, but those are ancillary and not exploit logic. The main exploit capability is local privilege escalation to temporary root. For non-X200 devices, the scripts push `preload.so` to `/data/local/tmp/preload.so` and trigger it via `LD_PRELOAD=/data/local/tmp/preload.so /system/bin/id`, then wait for a temporary `su` binary to appear under `/data/local/tmp/su`. After root is obtained, the scripts optionally push `ksud` and run `ksud late-load --allow-shell --package-name me.weishu.kernelsu` to activate KernelSU. For X200, the chain is more elaborate: the bash wrapper loads `x200_mode.sh`, verifies the device and kernel build, pushes `glt`, `w2host`, and module assets, derives offsets dynamically from `/proc/kallsyms` and `/sys/kernel/btf/vmlinux`, patches kernel modules for symbol/version compatibility, obtains a credential leak/capability-based root path, exposes a root command socket, and loads `permissive_restore.ko` and `kernelsu.ko`. The X200 helper scripts show the exploit is operational rather than a bare PoC. `offsets_auto.py` automates extraction of runtime and compile-time kernel offsets from kallsyms/BTF/ELF inputs. `patch_ko_all.py` rewrites unresolved kernel module symbols using live kallsyms and strips `__versions` to bypass CRC mismatch issues. `patch_vermagic.py` rewrites the KernelSU module vermagic string so it can be inserted on the target kernel. `rootcmd_client.py` connects to a forwarded local TCP port (`127.0.0.1:19000`) that maps to a device UNIX socket (`/data/local/tmp/rootcmd.sock`) and can issue privileged file and filesystem operations. Targeting is explicit and gated. The scripts reject kernels >= 6.6.140 as patched. The X200 path specifically checks for product/device PD2415 and kernel build `6.6.89-android15-8-gb57af212129c` (b57). The Windows scripts target iQOO Z10 Turbo Pro (`pd2453` / `V2453A`). README files list additional supported iQOO models that use preload-based payloads. Overall, this repository is a multi-platform operator toolkit for deploying a temporary root exploit chain against specific Android devices, with ADB as the transport/control plane, local device file paths under `/data/local/tmp` as staging locations, and optional KernelSU module/userland activation after successful exploitation.
This repository is a real local privilege-escalation exploit for CVE-2026-43499 targeting Qualcomm/Oplus Android 13-era devices running a vulnerable 4.19.157-perf aarch64 kernel. It is not a framework module; it is a standalone exploit project built around an LD_PRELOAD shared object. Repository structure: build logic is in Makefile and build.sh; README.md documents the target, build, and adb usage; adaptation-4.19.patch shows the porting changes from an upstream 6.x-oriented exploit; src/ contains the exploit implementation; src/targets/oplus-4.19.157-perf/target.h contains device/kernel-specific offsets and layout constants; src/su_blob.S and src/wallpaper_blob.S embed auxiliary payload files into the shared object. Core exploit flow: src/preload.c defines a constructor that runs automatically when preload.so is injected via LD_PRELOAD. It unsets LD_PRELOAD, opens a persistent disk log, and calls run_exploit(). src/main.c orchestrates the exploit: it prepares futex state, leaks KASLR base (src/slide.c), prepares a forged kernel page, triggers the rtmutex/futex race/UAF route with waiter/owner/consumer threads, and then reports whether kernel physical read/write and root installation succeeded. Exploit primitives: the bug is exercised through FUTEX_WAIT_REQUEUE_PI / FUTEX_CMP_REQUEUE_PI interactions and pselect-based stack shaping/routing. src/fops.c builds a fake file_operations structure and abuses configfs read/write paths to gain controlled kernel read/write behavior. src/pipe.c then upgrades this into a more powerful arbitrary physical read/write primitive by forging pipe_buffer structures and scanning candidate pipe pages/slab metadata. src/kernelsnitch/* provides the KernelSnitch-based mm_struct discovery/bruteforce support used to correlate kernel memory layout and improve reliability. Privilege escalation stage: src/root.c uses the physical read/write primitive to locate the current task, patch cred and real_cred fields, elevate UID/GID/capabilities, and directly modify SELinux-related state. It then spawns a child that attempts setgid(0), setuid(0), writes 0 to /sys/fs/selinux/enforce, installs an embedded su payload, and deploys wallpaper artifacts. Post-exploitation payloads: src/preload.c drops an embedded su binary to /apex/com.android.virt/bin/su, also copies a client to /data/local/tmp/su, and starts a root daemon implemented in src/su_daemon.c. That daemon listens on UNIX socket /data/local/tmp/temp_su.sock and supports both command execution mode (-c) and interactive shell mode, spawning /system/bin/sh as root. The preload code also attempts to enter adbd's mount namespace so the su binary is visible from adb sessions. Additionally, it writes embedded wallpaper files to /sdcard and /data/system/users/0/, restores contexts, and kills system_server to force wallpaper reload. Notable characteristics: the exploit is highly target-specific, with many hardcoded offsets and kernel structure layouts in target.h. It includes extensive crash-resilient logging to /sdcard/Download or /data/local/tmp with fsync after each line. No external network C2 or remote endpoints are present; all activity is local to the device. Overall, this is an operational Android kernel LPE PoC with bundled post-exploitation helpers rather than a simple detector or README-only repository.
This repository is a real local privilege escalation exploit for CVE-2026-43499 ('GhostLock'), specifically ported to the OPPO PCKM00 / OP4A57 running Android 11 with Linux 4.14.180-perf+. It is not a scanner or detector. The exploit is delivered as an aarch64 LD_PRELOAD shared object (exploit/preload.so) built from C sources under exploit/src/, with target-specific offsets in exploit/targets/oppo-pckm00/target.h and supporting reverse-engineering/offset-generation utilities in analysis/. Core exploit flow: exploit/src/main.c orchestrates multiple threads to trigger the vulnerable futex PI requeue path. exploit/src/slide.c first leaks the kernel base/KASLR slide using a pselect-based fake waiter structure and boot_id/nfulnl logger-related targets. exploit/src/fops.c then uses the same UAF/pselect stack-copy technique to obtain a controlled kernel write primitive, overwrite ashmem file_operations, and pivot into configfs-backed arbitrary kernel read/write. exploit/src/pipe.c upgrades this into a pipe_buffer-based physical memory read/write primitive. exploit/src/root.c walks task structures, patches credentials and security fields, attempts to disable SELinux enforcement, and coordinates a child process that calls setuid(0)/setgid(0). The exploit therefore goes well beyond proof-of-concept and provides an operational root chain. Post-exploitation behavior is notable. exploit/src/preload.c is the constructor entry point invoked automatically via LD_PRELOAD. It unsets LD_PRELOAD, opens panic-resilient disk logs under /sdcard/Download or /data/local/tmp, runs the exploit, and on success installs an embedded su binary/daemon and wallpaper artifact. The embedded su daemon source is in exploit/src/su_daemon.c and is also compiled/embedded via exploit/src/su_blob.S; it exposes a root shell service over the UNIX socket /data/local/tmp/temp_su.sock and executes /system/bin/sh for command or interactive sessions. wallpaper_blob.S embeds a wallpaper payload that is written into user/system wallpaper paths as a visible artifact or persistence marker. Repository structure: README.md explains the vulnerability, target device, build, and usage. report.md contains a detailed vulnerability and offset analysis for the target kernel. The analysis/ directory contains Python, C, and shell tooling for extracting kallsyms, locating symbol tables, generating headers, and validating structure offsets from a boot image/kernel source tree. The exploit/ directory contains the actual weaponized local exploit code and Makefile for Android NDK builds. Overall, the repository’s purpose is to provide a target-specific, operational Android kernel LPE chain from futex UAF to full root with auxiliary post-exploitation tooling.
This repository is an Android APK project intended to operationalize a local Android kernel privilege-escalation chain for CVE-2026-43499, branded here as 'GhostLock'. The structure is small and centered on a single app module: Gradle build files, AndroidManifest, one AIDL interface, and two Java classes. MainActivity is the primary orchestrator: it checks for Shizuku availability, requests permission, binds a Shizuku UserService, verifies shell identity with 'id', creates /data/local/tmp/a, extracts an embedded asset named 'ghostlock' into the app-private directory, copies it through the shell service to /data/local/tmp/a/ghostlock, chmods it executable, runs it, and finally executes 'su -c id' to confirm root. ShellService is a thin remote command runner that executes arbitrary 'sh -c' commands and returns stdout/stderr plus exit code. The exploit capability is therefore not a remote exploit but a local privilege-escalation launcher/stager that relies on Shizuku for shell-context execution and an external native exploit binary supplied by the operator. The README documents the intended target environment and build steps, but STRUCTURAL_NOTICE.md explicitly states the repository was AI-initialized, contains invalid assumptions and broken dependencies/URLs, and that CI never produced a working APK. So while the code clearly implements an exploit delivery chain, the repository appears incomplete and likely nonfunctional as-is without substantial repair and the missing native asset.
GhostLock-X200 is a real local Android privilege-escalation repository implementing a temporary root toolchain for vivo X200 (PD2415, Dimensity 9400, kernel 6.6.89 b57) using CVE-2026-43499/GhostLock. The repository is not just documentation: it contains device-side C exploit code, host-side PowerShell orchestration, Python offset/patching utilities, Bash build scripts, and kernel modules. The main workflow starts from root.ps1, which detects the device, optionally rebuilds offsets from firmware artifacts, and launches tools/scripts/root_full_permissive_restore.ps1. That script executes a staged chain: use the glt binary to obtain a kernel write primitive and flip SELinux/kptr_restrict, derive runtime offsets from kallsyms+BTF+ELF, patch kernel modules, run w2host to leak task/cred pointers and gain full capabilities, then load permissive_restore and optionally KernelSU. Repository structure is clear and purpose-built. exploit/src/ contains the core Android-native exploit components: main.c orchestrates the chain; slide.c implements the core rb_erase-based arbitrary write primitive via rt_mutex waiter corruption; fops.c establishes a fake file_operations/configfs read-write primitive and KASLR leak path; pipe.c adds pipe-based physical read/write; root.c performs credential patching and post-exploitation checks; preload.c deploys an embedded su daemon and wallpaper camouflage; su_daemon.c implements a Unix-domain root shell service; w2host.c is a separate helper that uses perf sampling to locate task/cred structures, escalates capabilities, and exposes a rootcmd service. target_x200.h hardcodes the validated b57 offsets, while tools/offset_tools/offsets_auto.py can regenerate them dynamically for compatible builds. The exploit’s main capabilities are substantial: arbitrary kernel memory write, physical memory read/write, KASLR/base discovery, task/cred discovery, capability escalation, SELinux state manipulation, kernel module loading, root shell deployment, and a root command channel. The rootcmd service supports operational post-exploitation actions such as file read/write and module load/unload/command execution, while su_daemon provides interactive or command-mode shell access over /data/local/tmp/temp_su.sock. The permissive_restore kernel module is used to restore selinux_state.initialized, force enforcing=0 after KernelSU re-enables enforcing, zero the GL host buffer for repeated exploitation in the same boot, and grant root creds in-kernel. KernelSU support is included via a shipped, vermagic-patched kernelsu.ko plus a reproducibility script. This is an operational PoC rather than a generic framework module. It is highly targeted to a specific device/kernel family, but it includes automation for adapting offsets to nearby builds. It is not a detection script and not obviously fake; the code, docs, and orchestration all align around achieving temporary root on a vulnerable Android device through a local kernel exploit chain.
This repository is a small Android application skeleton named GhostLock that demonstrates or enables privileged/local command execution through the Shizuku framework rather than a remote network exploit. The project contains a standard Gradle Android app layout, with the main logic in MainActivity.java and UserService.java, plus an AIDL interface definition in IUserService.aidl. MainActivity builds a simple UI with buttons to bind a Shizuku user service, execute the sample command 'id', and unbind. It requests Shizuku permission, registers binder lifecycle listeners, and binds to a user service using ComponentName(BuildConfig.APPLICATION_ID, UserService.class.getName()). Once connected, it calls the AIDL method exec(String command) on the service. UserService is the core exploit-like capability: it implements the AIDL stub and executes arbitrary shell commands using Runtime.getRuntime().exec(new String[]{"sh", "-c", command}). It captures stdout, stderr, waits for completion, and returns the combined output plus exit code. The destroy() method terminates the service process with System.exit(0). This makes the app an operational local command-execution tool in the context granted by Shizuku. There are no hardcoded remote URLs, IPs, or C2 endpoints. The notable fingerprintable artifacts are Android package/component identifiers, the Shizuku permission string, provider authority, and the shell invocation path. The manifest exports the Shizuku provider and declares the required permission moe.shizuku.manager.permission.API_V23. Build files show dependency on dev.rikka.shizuku:api/provider version 13.1.5 and a GitHub Actions workflow that builds and signs a release APK with a debug keystore. Overall purpose: a skeleton APK for local privileged command execution on Android via Shizuku-backed binder IPC. It is not a detection script and not obviously fake; it is a functional proof-of-use/operational helper app for executing arbitrary commands locally on a device where Shizuku is available and authorized.
This repository is a real local privilege-escalation exploit for CVE-2026-43499 ('GhostLock'), adapted to the HUAWEI MatePad Pro 11 GOT-W29 running HarmonyOS 4.x on a 4.19.157-perf+ ARM64 kernel. It is not a framework module; it is a standalone exploit tree with helper tools, target-specific offsets, and a deploy script. Repository structure: README.md documents the vulnerability, target device, exploit strategy, and validation results. exploit/ghostlock-source/ contains the main exploit source and Makefile. target/got_w29_target.h and exploit/ghostlock-source/src/target.h define device-specific kernel offsets and symbol addresses. tools/ contains standalone diagnostics and research utilities: perf_kaslr.c for KASLR leakage via perf_event_open, cycle_probe.c and edeadlk_probe.c for validating the futex PI EDEADLK trigger path, overlay_test.c for testing the fake waiter overlay behavior, kaslr.json with captured runtime addresses, and scan_branches.py for offline boot.elf analysis. build_tools/deploy_test.sh automates pushing binaries to a device and running either the trigger probe or the full exploit. Main exploit flow: preload.so is the primary entry point. Its constructor in src/preload.c unsets LD_PRELOAD and calls run_exploit(). run_exploit() initializes CPU affinity context, leaks the kernel slide, releases temporary grooming state, and then enters a direct-root stage. The exploit uses futex PI operations (FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI) to trigger the rtmutex rollback bug and leave a dangling pi_blocked_on pointer. It then overlays a fake rt_mutex_waiter structure using carefully arranged pselect()/fd_set state, causing kernel rb-tree manipulation to produce a controlled kernel write primitive. The code includes retry logic, child-process isolation, and timing/CPU pinning to improve reliability. Capabilities: (1) KASLR bypass via perf_event_open sampling of kernel instruction pointers; (2) creation of a dangling rt_mutex waiter state through a PI-cycle EDEADLK trigger; (3) controlled kernel memory write using fake waiter/tree fields and pselect-based overlay; (4) direct root credential installation by targeting task cred pointers and related kernel structures; (5) SELinux enforcement manipulation / policy reload attempts; (6) persistence/usability payload by dropping an embedded su binary and launching a root daemon. Payload behavior: After successful kernel compromise, the exploit writes an embedded AArch64 su daemon to /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally installs it into adbd's mount namespace, and starts a root daemon listening on the UNIX socket /data/local/tmp/temp_su.sock. The daemon accepts either command mode (-c) or interactive shell mode and executes /system/bin/sh as root after validating peer credentials (root or shell UID). Notable implementation details: The exploit is highly target-specific, with hardcoded offsets for task_struct, cred pointers, rt_mutex_waiter layout, direct-map calculations, and KASLR anchors. It uses Android-specific assumptions such as /system/bin/sh, linker64, chcon, APEX paths, and shell UID 2000. Logging is duplicated to a persistent file to survive crashes/oopses. The included tools show this repository is both a research artifact and an operational exploit implementation rather than a simple detector or README-only PoC.
This repository is a real Android-based local privilege-escalation installer rather than a standalone exploit implementation. Its purpose is to provide a one-click rooting workflow for explicitly supported Samsung Galaxy firmware builds by combining: (1) device fingerprinting and support-profile matching, (2) download of a commit-pinned external exploit payload and KernelSU artifact from GitHub, (3) execution of the exploit to obtain bootstrap root, and (4) staging/late-loading of KernelSU. Repository structure: the main app is under app/src/main/java/dev/busung/s25uroot/ and is written in Kotlin with Jetpack Compose UI. Key logic lives in PayloadRepository.kt (remote manifest/artifact retrieval and pinning), SupportManifest.kt (target profile parsing/matching), InstallViewModel.kt (installation orchestration, logging, timeout/stall handling, history), DeviceSnapshot.kt (collects manufacturer/model/kernel/build/sdk/ABI/page size), and NativeProbe.kt plus app/src/main/cpp/native_probe.c (JNI-based local capability probing and KernelSU detection). Android instrumentation tests in app/src/androidTest/java/dev/busung/s25uroot/ validate payload downloads and exercise exploit execution from an app context. Exploit capabilities: the app itself does not embed the kernel exploit source; instead it downloads a device-specific shared object named for CVE-2026-43499 and executes it via a helper binary/library. Strings and tests indicate expected success markers such as 'done=1 root=1' and 'exploit completed', showing the intended outcome is root acquisition. After exploitation, the app stages a downloaded KernelSU artifact ('ksud-s25u-kdp') and verifies KernelSU activation via /sys/module/kernelsu or /proc/modules. The UI and strings explicitly describe 'Acquire bootstrap root' and 'Late-load module and verify control channel.' Targeting: exact-match targeting is central. A remote JSON manifest defines supported profiles keyed by manufacturer, model, device, kernel release, kernel build version, build display/fingerprint, SDK, ABI, and page size. The README states it is for explicitly supported Samsung firmware builds only. Advanced mode allows manual profile selection with warnings about kernel/build mismatch and possible device instability/damage. Native/local probing: native_probe.c is notable because it fingerprints the local kernel attack surface from an untrusted Android app context. It probes access to tracefs, ashmem, slabinfo, boot_id, /proc/self/mem, perf_event_open, BPF map creation, tee syscall behavior, and /proc/self/pagemap. On ARM64 it also performs timing-based measurements against kernel virtual addresses in the 0xffffffc080000000 range across offsets up to 0x1f0000, suggesting KASLR slide inference support. The Android tests additionally probe many sensitive procfs/sysfs paths such as /proc/kallsyms, /proc/iomem, /proc/vmallocinfo, /sys/firmware/devicetree/.../kaslr-seed, and module section files under /sys/module/*/sections. Network behavior: the app reaches out only to GitHub infrastructure. It first queries the GitHub API for the current main-branch commit SHA of a payload repository, then rewrites manifest/artifact URLs to commit-pinned raw.githubusercontent.com URLs before downloading. It enforces HTTP 200, size limits, and exact artifact sizes from the manifest, but does not appear to verify cryptographic signatures/hashes in the shown code. Overall assessment: this is an operational exploit delivery/installer app for Android/Samsung rooting. The repository contains orchestration, targeting, probing, and installation logic, while the actual kernel exploit payload and KernelSU binaries are externalized in a separate payload repository. It is not merely a detector; it is designed to execute a real local kernel exploit and install root-management components on supported devices.
This repository is a real Android-based exploit installer rather than a standalone exploit payload. It packages a Kotlin/Jetpack Compose application ('Root My Galaxy') that identifies supported Samsung Galaxy devices, downloads a matching exploit and KernelSU artifact from a separate GitHub payload repository, executes the exploit to gain bootstrap root, and then stages/late-loads KernelSU. The actual exploit binary is external to this repo, but the code clearly orchestrates exploitation and post-exploitation steps. Repository structure: the main logic lives under app/src/main/java/dev/busung/s25uroot/. MainActivity.kt provides the UI, InstallActivity.kt drives the install workflow, InstallViewModel.kt coordinates support checks, downloads, exploit execution, logging, timeout handling, and Shizuku-assisted staging. PayloadRepository.kt fetches a support manifest and pinned artifacts from GitHub, verifies sizes, and stores them under the app files directory. ShizukuController.kt provides an alternate execution/staging path using the Shizuku service. NativeProbe.kt and native_probe.c implement a JNI library used for pre-exploitation probing and environment assessment. Tests under androidTest include exploit-oriented instrumentation that references CVE-2026-43499 payload names and validates successful root markers. Exploit capabilities observed in code: device/kernel matching against a remote manifest; download of exploit and KernelSU artifacts; execution of a helper binary with a downloaded shared-object payload; environment-variable tuning for exploit attempts, delays, timeout, KASLR slide/P0 offset reuse, and diagnostic modes; optional Shizuku-based remote execution and file staging into /data/local/tmp; verification of KernelSU activation after exploitation; persistent install history and logs. The native probe also measures potential side channels and kernel exposure surfaces, including tracefs, perf_event_open, bpf, tee, pagemap, and ARM64 KASLR timing probes over kernel virtual addresses. Targeting: strings, tests, and filenames indicate the exploit targets Samsung Galaxy devices, especially S25-series examples, on specific kernel versions such as 6.6.98, with CVE-2026-43499 as the referenced exploit artifact. The app is intentionally restrictive and only proceeds for model/kernel combinations listed in the remote support manifest. Notable endpoints and artifacts: GitHub API endpoints for app updates and payload commit resolution; raw.githubusercontent.com paths for support/targets-v3.json and pinned payload artifacts; numerous local kernel/proc/sysfs paths used for probing; and /data/local/tmp staging paths used in Shizuku mode. Overall, this is an operational exploit delivery/orchestration app with externalized payloads, not merely a detector or documentation-only repository.
This repository is a real Android local privilege-escalation exploit package for CVE-2026-43499, wrapped as both a native payload and an Android/Shizuku launcher app. The codebase is split into: (1) native exploit logic in src/core/*.c and headers, (2) device/kernel offset definitions in src/devices/*, (3) an Android app in app/src/main/* that stages and launches the payload as the shell user through Shizuku, and (4) a Python tooling component tools/extract_target.py for deriving target-specific offsets from boot images. Core exploit capability: the native binary ghostlock targets a futex PI use-after-free on Android kernels. The comments and code indicate a multi-stage chain: leak/derive kernel layout, obtain a kernel read/write primitive, modify security-relevant kernel state, and transition from shell to root. The exploit includes several advanced primitives: a tracefs-based KASLR leak (src/core/kaslr.c), ashmem/configfs-backed kernel read/write helpers (src/core/util.c, src/core/fops.c), pipe-based physical read/write primitives (src/core/pipe.c), and root installation logic (src/core/root.c). The root stage supports a Samsung-specific workqueue usermodehelper path to avoid direct cred writes on KDP-protected devices, then attempts KernelSU late-load for a more durable root environment. Targeting is narrow and explicit. README and offsets files show support for Samsung Galaxy Z Fold6 SM-F9560/q6q on kernel 6.1.145-android14-11-3254009-abF9560ZCS4DZG3. At runtime, src/core/main.c calls uname -r and rejects unsupported kernels. The repository includes a generated offsets framework for exact kernel matching, and tools/extract_target.py exists to create new device offset headers from boot.img/xbl_config.img and kallsyms/BTF data. The Android app is not the exploit itself; it is a launcher/stager. MainActivity stages libghostlock.so, ghostlock-helper, and a ksud payload, requests Shizuku permission, binds to ShellUserService, and forwards logs to the UI. ShellUserService writes the binaries into /data/local/tmp/.ghostlock-app, chmods them executable, sets environment variables such as GHOSTLOCK_HELPER_PATH and GHOSTLOCK_KSUD_PATH, and executes the native payload as UID 2000 (shell). This mirrors the documented adb shell execution path. The helper components extend post-exploitation functionality. src/core/su_daemon.c implements a root-side daemon/client protocol over a Unix domain socket at /data/local/tmp/temp_su.sock, with request/response structures and FD passing. src/core/umh_helper.c provides a root daemon and late-load client that can invoke insmod/lkmloader and KernelSU-related binaries/modules from /data/local/tmp. These components indicate the exploit is operational rather than a bare PoC: it includes staging, logging, privilege transition, and post-root orchestration. No external C2 or remote network exploitation behavior is present. The attack vector is local: the operator must already have shell-level execution via adb shell or Shizuku. The most fingerprintable observables are local filesystem paths under /data/local/tmp, tracefs and procfs paths used for kernel interaction and environment checks, and the exact supported kernel string. Overall, this is a targeted, operational Android kernel LPE exploit package with a companion app and tooling for per-device offset extraction.
Repository contains a local Android kernel exploit adaptation for GhostLock (CVE-2026-43499) targeting Honor AAK-AN00 on MagicOS 10 / kernel 6.6.89-android15. It is not a framework module; it is a standalone exploit project with a primary shared-object payload (preload.so) and a separate brute-force helper. The codebase is mostly C with small assembly blobs used to embed binaries/assets. Structure: exploit/src/main.c orchestrates the exploit flow; slide.c handles KASLR base discovery via a pselect/futex-based route; fops.c performs the fake file_operations/CFI stage and validates arbitrary kernel access setup; pipe.c builds a pipe_buffer-based physical read/write primitive; root.c performs post-exploitation credential and SELinux manipulation and launches payload actions; util.c contains helpers for ashmem/configfs-style kernel read/write setup, logging, and environment checks; kernelsnitch/* provides mm_struct/futex collision logic used for heap/structure discovery; preload.c is the constructor-based loader that unsets LD_PRELOAD and automatically runs the exploit when the shared object is loaded. su_daemon.c is a separate embedded root shell service/client that listens on a UNIX domain socket and can execute commands or provide an interactive shell. Main exploit capability: local privilege escalation from an unprivileged Android process to root. The README and code indicate a futex PI deadlock / stack-UAF trigger, stack reclaim via PR_SET_MM_MAP, fake waiter/task/file_operations construction, KASLR handling, and eventual kernel arbitrary read/write. The exploit then locates the current task, patches cred structures/capabilities/SELinux SID state, attempts to write SELinux enforcing to permissive, and verifies root in a child process. Post-exploitation behavior is substantial: it installs an embedded su binary into /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally installs it in adbd's mount namespace for ADB visibility, starts a daemonized root shell service on /data/local/tmp/temp_su.sock, logs to /data/local/tmp/su_daemon.log, and writes embedded wallpaper files to user/system wallpaper paths before killing system_server to force wallpaper reload. This makes the exploit operational rather than a bare PoC. The separate ghostlock_bruteforce.c is a standalone static ARM64 helper for environments where KASLR cannot be leaked directly. It iterates all 512 possible 2MB-aligned slides, persists progress in /data/local/tmp/slide_state, logs to /data/local/tmp/ghostlock_log.txt, and records success in /data/local/tmp/slide_win. Comments describe a fuller exploit chain involving inet6_protos[IPPROTO_UDP], loopback UDP triggering, and DirtyMode/core_pattern checks. No external C2 or remote network infrastructure is present. Network-related behavior is limited to local UNIX sockets for the su daemon and local kernel/socket primitives used during exploitation. The repository appears genuine, device-specific, and purpose-built for operational local rooting of the stated Honor Android target.
GhostLock is a real local Android kernel exploit repository targeting CVE-2026-43499, a futex PI use-after-free in Linux/Android kernels. It is not a framework module; it builds a standalone ARM64 Android binary named ghostlock via the Android NDK. The repository contains a complete exploit chain rather than a detector. Repository structure: src/core contains the exploit implementation, with main.c as the entry point and orchestration layer. fops.c implements the pselect/futex PI corruption route and file_operations redirection stage. util.c provides heap shaping, ashmem/configfs helpers, environment parsing, and KernelSnitch integration. slide.c leaks the kernel base/KASLR slide. pipe_physrw.c upgrades the initial configfs-based primitive into arbitrary kernel byte-level read/write using forged pipe_buffer objects. root.c performs direct credential patching and SELinux manipulation. umh_root.c provides an alternate privilege-escalation path by injecting a fake work item into system_unbound_wq so the kernel executes a usermode helper as root. miniadb.c is a minimal localhost ADB client used for bootstrap mode. target.h and runtime_struct_offsets.h define kernel symbol and structure offsets, while src/devices/*/offsets.h stores per-device/per-kernel profiles. Exploit capabilities: the code first abuses the futex PI UAF with a pselect stack overlay to gain controlled kernel writes. It can disable SELinux, redirect ashmem miscdevice file operations to fake fops, establish configfs-backed kernel read/write, leak KASLR, and then install a stronger arbitrary kernel memory read/write primitive via forged pipe buffers. From there it either patches task credentials to init_cred or triggers call_usermodehelper to execute /data/local/tmp/a/e --umh as UID 0. The UMH handler then execs /system/bin/sh with /data/local/tmp/.ghostlock_root.sh. The README and root.c also indicate support for installing embedded su/KernelSU components. Network/endpoint behavior: the exploit is primarily local, but bootstrap mode adds a network component by polling and connecting to adbd on 127.0.0.1 TCP, default port 5555 or a value read from /data/local/tmp/a/adb_port. miniadb.c performs ADB authentication using an RSA private key at /data/local/tmp/a/adbkey and then opens a shell to run /data/local/tmp/a/e. Other notable filesystem endpoints include /dev/ashmem, /sys/fs/selinux/enforce, /proc/self/status, /proc/self/attr/current, /system/bin/sh, and /data/local/tmp/.ghostlock_root.sh. Targeting: the repository includes explicit offset tables for multiple Android kernels and devices, especially OnePlus Ace 6T, OnePlus 15, OnePlus 13, Xiaomi 17, and some OPPO/other builds. The exploit auto-selects offsets by uname release string. The README also documents unsupported or infeasible devices where stack layout prevents the pselect overlay from landing correctly. Overall purpose: this repository is a multi-device Android jailbreak/root exploit for locked-bootloader phones. Its end goal is persistent or repeatable root/KernelSU installation without unlocking the bootloader or modifying the boot image.
Repository contains a two-stage local Linux kernel privilege-escalation chain plus a wrapper script. `cve-2025-21920-userns.c` is a C PoC for CVE-2025-21920 that uses unprivileged user and network namespaces, pure netlink device creation, and `/proc/net/dev_mcast` inspection to trigger an out-of-bounds read in VLAN handling and leak a kernel symbol address (`garp_pdu_rcv`) for KASLR bypass. `ghostlock.c` is the actual second-stage exploit for CVE-2026-43499 (“GhostLock”), a futex/rtmutex proxy-lock use-after-free that sprays controlled data onto a freed waiter structure via `prctl(PR_SET_MM_MAP)`, then abuses `sched_setattr`-driven priority-chain traversal to obtain an arbitrary kernel write. The intended post-exploitation action is overwriting `modprobe_path` with `/tmp/x`, then triggering modprobe through execution of `/tmp/y` or an unknown protocol socket so the kernel runs attacker-controlled code as root. `chain.sh` orchestrates the stages by running the leak binary, validating the leaked kallsyms-format line, copying it to `/kallsyms_leak.txt`, and launching the privilege-escalation binary. `cve-2026-43499-reference.md` is a detailed exploit write-up/reference implementation description, not the primary executable stage. Overall, this is a real exploit repository implementing a chained local privilege escalation against vulnerable Linux kernels, not merely a detector or crash-only PoC.
This repository is a small support repo for a GhostLock kernel exploit port targeting Xiaomi POCO F8 Ultra / REDMI K90 Pro Max global/Taiwan firmware (codename myron). It does not contain the full exploit implementation itself; instead, it provides the critical per-build kernel offset table required by the upstream GhostLock exploit project and a post-root helper shell script. Repository structure: 3 files total. README.md documents the target firmware, rationale for the port, validation notes, build/integration steps, and operational usage. offsets/myron_tw/offsets.h is the main technical artifact: a C header defining an OFFSETS_ENTRY for kernel 6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k on HyperOS OS3.0.6.0.WPMTWXM, including kernel_phys_load and many symbol/function offsets such as init_task, init_cred, init_uts_ns, selinux_enforcing, ashmem handlers, configfs helpers, and usermodehelper-related values. scripts/device_step1.sh is an Android shell script intended to be run after successful exploitation from a root shell. Main exploit capability: the repo enables local privilege escalation on the exact target build by supplying precise offsets for CVE-2026-43499 (GhostLock). The README states successful exploitation yields a root shell and SELinux permissive mode, but that capability comes from the external ghostlock binary built from JoinChang/ghostlock-oneplus using this repo's offsets. This makes the repo operational support material rather than a standalone exploit. Secondary capability: the included shell script performs privileged device modification after root is obtained. It backs up the abl_a and abl_b partitions to /data/local/tmp/*.img, prompts the operator to pull those backups and push an EFI payload, then writes gbl_efi_unlock.efi directly to /dev/block/by-name/efisp and reboots into bootloader. This is clearly part of a bootloader-unlock chain and requires root/local device access. Attack surface and targeting: purely local Android/kernel exploitation and post-exploitation partition flashing. No network communication, C2, or remote endpoints are present. The exploit is tightly pinned to one firmware/kernel build; the README explicitly warns that different Xiaomi/CN builds have different binaries and offsets, so this port will not work generically. Overall, this is a legitimate exploit-support repository: a target-specific GhostLock offset port plus a post-root flashing helper for Xiaomi myron global/Taiwan devices.
Repository contains a real Android arm64 local kernel privilege-escalation exploit for CVE-2026-43499, adapted from Nebula Security's IonStack research. It is not a scanner or detection script. The core exploit lives under exploit/src and is built as an LD_PRELOAD shared object (preload.so) plus an embedded su helper binary. Execution flow: preload.c constructor unsets LD_PRELOAD, cleans stale /apex tmpfs overlays, then calls run_exploit(); main.c orchestrates the race/exploitation threads; slide.c leaks the KASLR base using a pselect/futex waiter corruption technique; fops.c pivots into a fake file_operations/configfs-based stage; pipe.c establishes arbitrary kernel memory read/write using pipe-phys primitives; root.c locates and patches the current task cred structures, flips SELinux state, and triggers post-exploitation actions. Post-exploitation logic in preload.c and su_daemon.c installs or forwards su access, manages a UNIX socket daemon at /data/local/tmp/temp_su.sock, attempts KernelSU integration, and writes a boot service script for persistence. The repository is heavily target-specific: many target.h files encode kernel symbol offsets and structure layouts for vivo/iQOO and multiple Google Pixel/Motorola builds, with some targets overriding common source files (main.c, fops.c, pipe.c, slide.c, root.c, util.c). Build support is provided by exploit/Makefile and exploit/build.sh. Main capabilities observed: KASLR leak, arbitrary kernel read/write, credential and SELinux patching, anti-root bypass for vivo vr.ko, root shell enablement, and attempted soft-reboot persistence via KernelSU. No external network C2 is present; the only communication endpoint is a local UNIX socket used by the embedded su daemon.
This repository is a real local Android kernel privilege-escalation exploit chain, not a detector. It is a multi-stage C project with one helper Python script and embedded assembly blobs. The build system produces a main static binary ('preload') that embeds two secondary payloads: a 32-bit ARM exploit stage and an AArch64 su daemon/client. Repository structure: the top-level Makefile builds the exploit for Android using the NDK, targeting a specific project profile under src/targets/eureka-52168470043600520/target.h. Core logic is split across src/main.c (orchestration), src/api.c (launches embedded 32-bit stage via memfd and exec), src/exp32/main.c and src/exp32/stack.c (32-bit CVE-2026-43499 trigger and stack stamping race), src/fops.c (fake file_operations corruption and CFI-friendly stage), src/pipe.c (pipe_buffer-based physical kernel read/write), src/root.c (credential and SELinux patching plus root child handling), src/q3slide.c and src/slide.c (KASLR/kernel text leak via perf), src/preload.c (payload dropping, su installation, wallpaper handling), src/su_daemon.c (root shell daemon/client over UNIX socket), and src/util.c plus kernelsnitch headers (heap shaping, helpers, mm_struct/futex collision support). Main exploit capability: the code targets CVE-2026-43499 in the 32-bit compat futex PI requeue path. The 64-bit launcher crafts a 128-byte buffer and invokes an embedded 32-bit static PIE binary because the bug only aligns on the 32-bit syscall path. The 32-bit stage creates waiter/owner/consumer threads, abuses FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI to leave a dangling pi_blocked_on pointer to a waiter structure on the kernel stack, then races setsockopt(MCAST_JOIN_SOURCE_GROUP) to stamp attacker-controlled data onto that stack. This is used to corrupt kernel structures and redirect a target write. Post-corruption stage: the exploit appears to overwrite the ashmem miscdevice file_operations pointer with a forged fake_fops object. It then uses ashmem/configfs-style read/write gadgets to perform controlled kernel reads/writes, validates the fake fops, and leaks the KASLR base by reading function pointers from ASHMEM_FOPS and comparing them to expected offsets. The code is careful to refresh function pointers for CFI-aware kernels and restore original pointers after exploitation. Privilege-escalation stage: after gaining a stable primitive, pipe.c builds a pipe_buffer-based physical read/write capability by reclaiming freed kernel memory through AF_UNIX skb allocations and pipe cache shaping. root.c then walks the task list, locates the current task, patches credentials/capabilities/SELinux-related fields, attempts to write SELinux enforcing to permissive, and spawns a root child process to verify success. Final payload behavior: once root is obtained, preload.c/root.c install an embedded su binary under /data/local/tmp/su and also attempt to place a su binary at /apex/com.android.virt/app/su, including entering adbd's mount namespace so the binary is adb-visible. su_daemon.c implements a local root shell/command execution service over the UNIX socket /data/local/tmp/temp_su.sock, with optional SELinux context switching via /proc/self/attr/current. There is also optional wallpaper replacement logic, though some of it is commented out. Targeting: the included target profile and tables strongly indicate tuning for Google 'eureka' Android builds, likely Quest/VR-related hardware, on kernel 5.10. The exploit supports runtime symbol overrides through ionstack.conf and a generator script (gen_ionstack_config.py) that extracts offsets from a kernel ELF, making the exploit adaptable to nearby kernel builds without recompilation. Overall, this is an operational local privilege-escalation exploit chain for Android ARM64 devices with a vulnerable kernel, culminating in persistent root-style access via an installed su daemon/client.
Repository contains a real local Android kernel privilege-escalation exploit for CVE-2026-43499 targeting Android GKI 6.12 on multiple Pixel and Samsung builds. The codebase is centered under exploit/, with a Makefile that selects shared sources from exploit/src/ and optional per-target overrides from exploit/src/targets/<codename>-<build>/. The main runtime entry is exploit/src/preload.c, which uses a constructor to unset LD_PRELOAD and invoke run_exploit(); the intended artifact is preload.so, loaded locally on-device. Core exploit chain: (1) create the vulnerable futex PI deadlock cycle and trigger the CVE-2026-43499 dangling waiter state; (2) use pselect fd_set corruption plus sched_setattr-driven fake rb_tree traversal to obtain a deterministic kernel write primitive; (3) leak KASLR either through boot_id corruption or target-specific tracefs logic; (4) repoint ashmem file_operations so ashmem + ASHMEM_SET_NAME + pwrite/pread dispatch through configfs handlers, yielding arbitrary kernel read/write; (5) upgrade to pipe-based physical memory read/write by forging pipe buffer metadata; (6) patch task credentials and SELinux state to root the process; (7) install and launch an embedded su daemon and optional wallpaper artifact. The exploit is clearly operational rather than a simple PoC because it includes full post-exploitation steps and target-specific offsets. Important files: main.c orchestrates waiter/owner/consumer threads and the futex requeue race; fops.c implements the pselect corruption route and ashmem/configfs pivot; slide.c performs KASLR leakage; pipe.c implements physical R/W via pipe buffers; root.c patches creds and SELinux; preload.c installs persistence-like userland artifacts; su_daemon.c provides a root shell service over a UNIX socket; faketables.c, stage3.c, and stage3_loop.S implement an experimental stage-3 pgd-swap bridge for some Samsung m1q targets. KernelSnitch helper code under exploit/src/kernelsnitch/ is used to locate/leak mm_struct-related heap state via futex hash collisions. The repository includes many target.h files containing build fingerprints, kernel symbol offsets, direct-map bases, and structure offsets for specific device/build combinations. Some targets only provide target.h and reuse shared logic; others (notably caiman/comet/komodo/m1q) override multiple source files for device-specific behavior. Samsung m1q targets additionally adapt the exploit to Rust ashmem layouts by directly overwriting the static ashmem file_operations write_iter field instead of swapping a miscdevice fops pointer. No external network C2 is present. Observable endpoints are almost entirely local Android filesystem and procfs paths, especially /dev/ashmem, /proc/sys/kernel/random/boot_id, /sys/fs/selinux/enforce, /apex/com.android.virt/bin/su, and /data/local/tmp/temp_su.sock. Overall purpose: reliable local root on supported Android devices via a kernel race/corruption chain with integrated post-root tooling.
This repository is a standalone, device-specific Android local privilege-escalation exploit set for CVE-2026-43499, focused on Samsung Galaxy devices and especially the SM-A366W/A366WVLS3AYG1 profile. It is not just documentation: it contains native exploit source, target-specific offset tables, P0 fingerprint tables, a preload supervisor, a root helper/daemon, KernelSU integration artifacts, and tooling for target auditing. Structure: src/ contains the exploit implementation. main.c orchestrates exploitation, slide discovery, fake object preparation, kernel primitive installation, and root staging. slide.c and slide_app.c implement kernel base/KASLR discovery using tracefs and a physical P0 oracle path. fops.c and pipe.c implement the core corruption and physical/kernel read-write primitives using ashmem/configfs/file_operations and pipe buffer manipulation. root.c uses the achieved primitive to invoke call_usermodehelper work and launch a root daemon. su_daemon.c is the post-exploitation helper that can run as a daemon, accept local UNIX socket clients, and execute commands as root. util.c/common.h provide shared helpers and target abstraction. Targeting is highly exact. The repository includes multiple per-firmware target headers under src/targets/, each defining exact kernel offsets, structure layouts, physical load assumptions, and fingerprint tables. The exploit is clearly intended only for exact model/build/kernel matches, not generic Samsung devices. Capabilities: the exploit leaks kernel slide/base, establishes kernel read/write, restores modified pointers where possible, spawns a root-capable local daemon, and optionally stages exact-match KernelSU late-load binaries/modules. Documentation shows successful device-tested root and KernelSU loading on A36 and A56 exact builds, while some other profiles are build-verified or experimental. Additional repository content includes docs/ with detailed porting and validation records, kernelsu/ with Samsung-specific KernelSU patches and audit tools, integration/root-my-galaxy/ with app-side patch series for Root My Galaxy integration, and support/targets-v2.json which publishes downloadable payload and KernelSU artifact endpoints for supported profiles.
This repository is a local Linux/Android kernel exploit research project for CVE-2026-43499 (GhostLock), centered on futex PI / rt_mutex use-after-free exploitation on ARM64 Android devices. It is not part of a standard exploit framework. The repo contains both small standalone PoCs and a larger target-specific exploitation scaffold. Structure: README.md is a detailed Chinese-language failure analysis for vivo PD2229 (SM8475, Android 15, 5.10.233 GKI), concluding that although KASLR bypass and UAF triggering work, the full exploit chain is not feasible on this device because no tested syscall stack-reuse primitive overlaps the freed rt_mutex_waiter. leak.c is a standalone perf_event_open-based kernel IP leak PoC that estimates kernel base from sampled instruction pointers. test1/ghostlock.c is a self-contained trigger PoC for the GhostLock bug: it creates a 3-thread futex PI deadlock cycle, invokes FUTEX_CMP_REQUEUE_PI to obtain -EDEADLK, waits for the waiter’s syscall frame to unwind, and then probes the dangling pi_blocked_on pointer with FUTEX_LOCK_PI to induce the UAF path. test1/main.c + fops.c + net.c form a staged exploit skeleton: trigger the UAF, then start a stack-reuse thread that sprays select()/fd_set state and attempts follow-on scheduler interactions. Several files are placeholders/stubs (pipe.c, root.c, su_daemon.c, slide.c) to satisfy linking or represent incomplete stages. The target-specific directory test1/targets/PD2229-UP1A.15.3.10.3 contains adaptation artifacts: kernel symbol dumps, offsets, generated target headers, and large root/slide/util source files. These files show the intended full privilege-escalation design: leak KASLR, prepare fake waiter/task structures, gain constrained kernel read/write via ashmem/configfs-style primitives, overwrite credentials and SELinux state, and optionally install an embedded su daemon. The code references sensitive kernel symbols such as init_task, selinux_enforcing, ashmem_fops, and others, indicating a device-specific exploit porting effort. Main exploit capabilities observed in code: (1) local kernel info leak via perf_event sampling; (2) reliable triggering of the GhostLock futex UAF condition; (3) stack-reuse/select spray attempts for reclaiming freed kernel stack memory; (4) target-specific helper logic for kernel memory read/write and privilege escalation; (5) optional post-exploitation actions such as disabling SELinux and installing helper binaries. However, for the included PD2229 target, the repository’s own analysis states the exploit chain stops after UAF trigger/KASLR leak because the required stack overlap primitive is absent. Overall, this is a genuine exploit-development repository with operational PoCs and partially integrated LPE components, but not a demonstrated end-to-end root exploit for the analyzed PD2229 build.
This repository is a real local privilege-escalation exploit adaptation for GhostLock (CVE-2026-43499), tailored to the Xiaomi POCO F3 GT / Redmi K40 Gaming Edition (aresin) on Android 13 with a MediaTek MT6893 and Linux 4.14.186. It is not a framework module; it is a standalone exploit codebase plus many offset-extraction and reverse-engineering helpers. Core exploit structure: - src/main.c orchestrates the exploit. It creates the vulnerable 3-futex PI chain, triggers FUTEX_CMP_REQUEUE_PI, coordinates waiter/owner/consumer threads, and launches the main exploitation route. - src/slide.c implements KASLR leakage using a pselect-based fake waiter/stack-copy technique to recover _stext / kernel base. - src/fops.c performs the control-flow / fake file_operations stage, using crafted fd_sets and pselect routing to pivot into corrupted kernel objects and validate the stage. - src/pipe.c builds the physical read/write primitive by shaping pipe slab allocations, locating pipe_buffer objects, and forging pipe buffers for arbitrary kernel memory access. - src/root.c uses the arbitrary read/write primitive to walk task lists, locate the current task, patch cred structures/capabilities/SELinux SIDs, flip selinux_enforcing, and verify root. - src/preload.c provides an LD_PRELOAD constructor entrypoint and post-exploitation persistence/utility logic: it writes an embedded su binary, mounts tmpfs at /apex/com.android.virt/bin, optionally installs su into adbd's mount namespace, and starts a root su daemon. - src/su_daemon.c is the embedded payload binary. It exposes a root shell/command execution service over a UNIX domain socket at /data/local/tmp/temp_su.sock. - src/targets/aresin/target.h contains the device-specific offsets and constants that make this adaptation work. Exploit capabilities observed in code and docs: 1. Trigger the GhostLock futex PI bug and reliably cause kernel panic/UAF conditions. 2. Leak KASLR slide / kernel base. 3. Reclaim corrupted kernel memory and forge fake waiter/task/file_operations structures. 4. Achieve arbitrary kernel read/write via forged pipe_buffer primitives. 5. Patch task credentials and SELinux-related fields for root. 6. Install a usable post-exploitation root interface (embedded su daemon/client). Repository layout beyond the exploit: - Markdown docs (README.md, PROGRESS.md, OFFSETS.md, EXTRACTED_OFFSETS.md) document target requirements, extracted offsets, exploit stages, and testing status. They indicate the adaptation reliably triggers the vulnerability and has implemented the full intended chain, though notes mention ongoing tuning for stable full LPE. - Numerous tools/ scripts in C, Python, Java, and shell support reverse engineering and offset extraction from boot images, vmlinux, /proc/kallsyms, Ghidra, and live devices. These are auxiliary analysis utilities, not the main exploit path. - Duplicate *.cybermeowfia files preserve upstream/original variants for comparison. Notable targeting details: - The exploit is highly specialized to aresin/MT6893/4.14.186 and depends on exact offsets for task_struct, rt_mutex_waiter, ashmem/file_operations, slab metadata, and SELinux globals. - It is a local Android kernel exploit, not a remote exploit. - The payload is operational rather than merely demonstrative because it includes concrete privilege-escalation and root-shell installation logic, but it is still tightly hardcoded to one device/kernel profile rather than broadly weaponized.
This repository is a real local Android kernel privilege-escalation exploit for CVE-2026-43499 ('GhostLock'), adapted to the POCO M6 Pro (emerald). It is not a framework module; it builds a standalone binary named ghostlock using the Android NDK. The repository contains 22 files, primarily C source and headers under src/core plus device-specific offset tables under src/devices. Repository structure and purpose: - src/core/main.c is the main entry point and orchestrator. It selects device/kernel offsets via uname(), supports normal exploitation plus special modes (--bootstrap, --write1, --umh), initializes primitives, and drives the full exploit chain. - src/core/fops.c implements a key exploitation stage that corrupts/rewrites file_operations-related pointers and validates control over ashmem/configfs-backed kernel objects. It also appears to support KASLR-related routing and pselect-based stack shaping. - src/core/slide.c performs kernel base/KASLR slide discovery using crafted pselect/futex interactions and leaked kernel pointers. - src/core/util.c provides shared helpers, ashmem/configfs read/write primitives, environment-controlled tuning, startup logging, and KernelSnitch integration. - src/core/kernelsnitch/* contains the bundled KernelSnitch logic used to discover mm_struct-related information and futex hash collisions needed to stabilize exploitation. - src/core/pipe.c and src/core/pipe_physrw.c build a stronger post-exploitation primitive by reclaiming/finding pipe_buffer objects and forging them to achieve arbitrary physical/direct-map kernel read/write. - src/core/root.c uses the read/write primitive to locate the current task, patch cred structures/capabilities/SELinux SID, and verify root by spawning a child that calls setuid(0)/setgid(0) and attempts SELinux disablement. - src/core/umh_root.c provides an alternate/root persistence path by forging a kernel workqueue item that invokes call_usermodehelper_exec_work, ultimately executing /system/bin/sh /data/local/tmp/.ghostlock_root.sh as root. - src/core/miniadb.c is a compact ADB client that authenticates to local adbd using /data/local/tmp/a/adbkey and opens a shell command channel, used by bootstrap logic to run /data/local/tmp/a/e. - src/devices/emerald/offsets.h and src/devices/offsets.h define the exact kernel symbol and structure offsets required for the target device/kernel. Main exploit capabilities: 1. Triggers the futex priority-inheritance use-after-free vulnerability locally. 2. Uses timing/futex collision techniques (KernelSnitch) to recover kernel memory layout information. 3. Leaks or derives the kernel base/KASLR slide. 4. Corrupts kernel objects associated with ashmem/configfs/file_operations to gain controlled kernel read/write behavior. 5. Upgrades this into arbitrary kernel physical/direct-map read/write using forged pipe_buffer structures. 6. Locates the current task and credential structures, then patches UID/GID/capabilities and SELinux-related fields to obtain root. 7. Attempts to disable SELinux both by direct kernel memory write and by writing to /sys/fs/selinux/enforce. 8. Supports a usermode-helper execution path for root command/script execution. 9. Supports a bootstrap/post-exploitation path over localhost ADB TCP to run a staged binary. The exploit is operational rather than a minimal PoC: it includes target-specific offsets, multiple exploitation stages, validation logic, fallback/rooting methods, and post-exploitation helpers. However, it is still tightly bound to a specific Android kernel build and device family rather than being broadly weaponized.
This repository is a real Android local privilege-escalation exploit adaptation for CVE-2026-43499 (GhostLock), tailored to vivo PD2425 / iQOO Neo10. It is not a scanner or README-only project. The codebase is split into: (1) core exploit logic in src/, (2) target-specific overrides in src/targets/PD2425-UP1A.231005.007/, and (3) adaptation/support tooling in device_sources/tools/. The Makefile builds an aarch64 Android LD_PRELOAD shared object (preload.so) and an embedded PIE su daemon. Exploit chain and purpose: the project implements a staged kernel LPE chain. P0 attempts KASLR bypass by abusing a SLIDE primitive to leak kernel pointers via boot_id-related data. P1/P2 build kernel memory write/read and file-operations hijacking primitives using ashmem/configfs, crafted fake kernel objects, futex/pselect/TCP timing, page spraying, skb reclaim, and pipe-buffer physical read/write. P3 patches credentials and SELinux state to obtain root. The target-specific root.c also includes a bypass for vivo's vr.ko anti-root module by clearing per-task tag bytes and a syscall tracepoint flag before/around privilege escalation. Main exploit flow: src/preload.c is the practical entry point. Its constructor unsets LD_PRELOAD and calls run_exploit(). src/main.c orchestrates the exploit: initialize environment, pin CPU affinity, perform KASLR leak via slide_leak_kernel_base(), prepare a forged kernel page, then run coordinated waiter/owner/consumer threads that abuse futex PI requeue and pselect routing. src/fops.c handles the file-operations corruption/CFI stage and validates arbitrary kernel access. src/pipe.c establishes pipe-based physical kernel read/write primitives and verifies them with marker strings and 64-bit test values. src/root.c performs task/cred discovery and modification, SELinux disabling, and root-child coordination. Payload/post-exploitation: once root is achieved, the exploit writes an embedded su binary to /apex/com.android.virt/bin/su and /data/local/tmp/su, starts a root AF_UNIX daemon on /data/local/tmp/temp_su.sock, and supports both interactive shells and command execution through src/su_daemon.c. It also writes an embedded wallpaper payload to Android wallpaper paths and kills system_server to force reload. This makes the exploit more than a bare PoC; it includes an operational hardcoded payload. Repository structure: src/common.h centralizes constants, offsets, and prototypes; src/kernelsnitch/ contains the KernelSnitch-based mm_struct leak helpers; src/targets/PD2425-UP1A.231005.007/ overrides slide.c, util.c, root.c, and target.h with device/build-specific offsets and logic. device_sources/ documents how boot.img, init_boot.img, kernel.img, vmlinux.elf, abl.img, and vr.ko were used to derive offsets. The Python tools extract symbols from vmlinux, extract PE binaries from ABL/UEFI images, and automate generation of new target.h/adaptation directories for other builds. Notable targeting details: target.h hardcodes kernel symbol offsets such as commit_creds-related support symbols, init_task, SELinux globals, ashmem_fops, configfs handlers, and SLIDE-related addresses. The README indicates the current blocker is the KASLR bypass/boot_id overwrite stage, so the full chain may not yet succeed reliably on the stated target build, but the repository clearly contains exploit code intended to progress to full root and post-exploitation persistence/usability.
Repository is a standalone Android application that acts as a one-click installer/orchestrator for a device-specific Android kernel exploit and KernelSU deployment flow. It is not just a detector: the app identifies an exact supported firmware profile, downloads a matching native exploit payload and KernelSU artifact from a separate GitHub payload repository, executes a bundled bootstrap helper executable (libcve43499root.so) via ProcessBuilder, and attempts to obtain root and load KernelSU. Structure: the repo contains an Android app in Kotlin/Jetpack Compose, a native JNI probe in C (native_probe.c), Android instrumentation tests, Gradle/CMake build files, and a git submodule named payloads. The submodule supplies source for the bootstrap helper executable (su_daemon.c, late_load.c, hold_refs.c), which is compiled into the APK under a library-like name so Android extracts it into nativeLibraryDir as an executable file. Main exploit capabilities: (1) device fingerprinting and exact profile matching using kernel release, kernel build version, build display, SDK, ABI, and page size; (2) remote retrieval of immutable payload releases from GitHub Releases; (3) artifact verification by release tag anchoring and exact size checks; (4) execution of a native exploit payload named around CVE-2026-43499; (5) post-exploitation loading/verification of KernelSU; (6) local debug mode allowing payloads to be read from a user-selected folder instead of the network. Native probe behavior: native_probe.c is a reconnaissance/helper component, not the exploit itself. It probes access to sensitive kernel/userland surfaces such as tracefs, ashmem, slabinfo, boot_id, /proc/self/mem, perf_event_open, bpf map creation, tee syscall behavior, pagemap visibility, and on arm64 performs timing measurements against kernel virtual addresses to infer KASLR-related behavior. It also checks whether KernelSU is active by inspecting /sys/module/kernelsu or /proc/modules. Exploit execution path: tests and app logic show the helper is invoked with '--run-payload <payload> <helper> <log>' and environment variables such as SLIDE_P0_OFFSET, EXPLOIT_ATTEMPTS, PSELECT_DELAY_USEC, P0_ATTEMPT_TIMEOUT_SEC, SLIDE_ONLY, P0_ONLY, and diagnostic flags. This indicates the exploit supports repeated attempts, KASLR/P0 offset tuning, and diagnostic-only modes. Instrumentation tests expect markers like 'done=1 root=1' and 'exploit completed', confirming intended privilege escalation. Network endpoints: the app contacts GitHub API at api.github.com to resolve the latest payload release for Witaqua-tools/Root-My-Device-Payloads, then downloads targets-v2.json and release assets from github.com release-download URLs. Manager URLs in the manifest are accepted only if HTTPS. No hardcoded IPs or C2 infrastructure are present. Overall purpose: this repository is an operational exploit delivery app for supported Android devices/firmware, wrapping a native kernel exploit (CVE-2026-43499) and KernelSU installation workflow with profile selection, download verification, execution, logging, and history management.
This repository is a real local Android kernel privilege-escalation exploit suite, not a detector. It is a multi-file C codebase targeting ARM64 Android devices, especially Google Pixel-family builds, with per-build offset headers under src/targets/. The build system compiles a preloadable shared object (preload.so) and an embedded PIE su daemon, then packs the daemon and a wallpaper asset into the final shared object. Repository structure: core exploit logic lives in src/main.c, src/slide.c, src/fops.c, src/pipe.c, src/root.c, and src/util.c. The kernelsnitch/ directory contains a bundled side-channel/helper library used to recover mm_struct-related information and aid heap/kernel address discovery. src/preload.c provides the LD_PRELOAD-style constructor entry point and post-exploitation file deployment logic. src/su_daemon.c is a standalone root shell daemon/client that becomes the embedded payload. src/targets/ contains device/build-specific target.h files and, for some builds such as tokay-CP2A.260605.012, full target-specific replacements for common exploit modules. Exploit flow: the code first logs environment details, initializes ashmem-based primitives, and leaks the kernel text base/KASLR slide via slide_leak_kernel_base(). It then prepares a crafted kernel page with fake waiter/lock/fops structures, orchestrates futex priority-inheritance and pselect/TCP timing races, and attempts to corrupt or redirect kernel file_operations pointers. After that, it establishes a stronger arbitrary physical/kernel memory read-write primitive using forged pipe_buffer objects and slab/pipe cache shaping. With kernel read/write available, root.c walks the task list, locates the current task/cred structures, patches credentials and capabilities, and writes SELinux enforcing state to permissive/disabled. Post-exploitation capability is substantial. The exploit spawns a child that calls setgid(0)/setuid(0), writes to /sys/fs/selinux/enforce, installs an embedded su binary to /apex/com.android.virt/bin/su, optionally drops /data/local/tmp/su, attempts to install the su binary inside adbd's mount namespace for ADB visibility, and launches a root su daemon listening on /data/local/tmp/temp_su.sock. That daemon supports both interactive shells and one-shot command execution via /system/bin/sh. The preload component also writes an embedded wallpaper file to user/system wallpaper locations and triggers wallpaper reload/restart behavior. The code is operational rather than a minimal PoC: it includes target-specific offsets, multiple race strategies (pselect and TCP-based variants), heap shaping, KASLR bypass, kernel memory R/W validation, credential patching, SELinux manipulation, and a usable post-exploitation root shell payload. No external C2 or remote network infrastructure is present; all networking observed is local loopback or UNIX-domain IPC used internally by the exploit and payload.
This repository is a small target-adaptation companion for a local Android kernel privilege-escalation exploit, not a complete standalone exploit implementation. It contains 5 files: a long README documenting a failed porting attempt of CyberMeowfia/IonStack for CVE-2026-43499 to a vivo PD2241 (MediaTek MT6985 / Dimensity 9300), one C header with target-specific kernel constants and offsets, and two Python scripts that automate remote build-server setup and compilation over SSH. The core exploit capability represented here is local privilege escalation preparation: the header file defines firmware-specific kernel symbol offsets, memory layout constants, structure offsets (task_struct, cred, file_operations, page, seccomp, etc.), and Android build fingerprint data needed by the upstream exploit to target this exact device/firmware. The intended payload/result is root via a preload.so shared object loaded on-device, but this repository does not include the actual exploit logic that performs the vulnerability trigger; it only provides the MT6985 targeting data and build helpers. The README makes clear this is a failed adaptation attempt rather than a working exploit. According to the author, compilation succeeds and preload.so starts, but exploitation fails because the KernelSnitch-based mm_struct leak is unreliable on this MediaTek platform due to CONFIG_KASAN_HW_TAGS=y / MTE-tagged pointers, and because CONFIG_PANIC_ON_OOPS=y causes immediate reboot on kernel faults, preventing iterative brute-force attempts. The document also notes kernel layout drift between android13 and android15 GKI branches and warns that symbol offsets are firmware-version specific. Repository structure and purpose: - README.md: detailed postmortem of the failed exploit port, target environment, crash behavior, and lessons learned. - exploit/targets/android_15.0_kernel_MT6985/target.h: main technical artifact; target profile for vivo PD2241 firmware PD2241_A_15.2.10.2.W10.V000L1 with hardcoded kernel addresses/offsets. - scripts/server_setup.py: connects to a local SSH-accessible build VM, installs make/unzip, and extracts exploit_src.tar.gz. - scripts/server_compile.py: connects to the same SSH server, downloads Android NDK r29c from Google, builds the exploit with make PROJECT=android_15.0_kernel_MT6985, and checks the resulting preload.so. Notable endpoints are mostly local/host build infrastructure and target file paths rather than victim network infrastructure: localhost SSH at 127.0.0.1:2222, Google NDK download URL, remote build paths under /home/awa, Android execution path /system/bin/linker64, target deployment path /data/local/tmp/preload.so, and candidate kernel info-leak interfaces such as /proc/self/pagemap and /proc/mtk_*. Overall, this is best classified as a proof-of-concept target profile and build automation for a local Android kernel exploit adaptation, not an operational or weaponized exploit.
This repository is a real Android local privilege-escalation/rooting application rather than a simple detector. It is an Android app ('Root My Device') written primarily in Kotlin with a native C probe component and a CMake build that also packages a bootstrap helper executable as libcve43499root.so. The app is designed to root only explicitly supported Android firmware builds by downloading release-pinned artifacts from a separate GitHub payload repository. Structure: the main logic lives in app/src/main/java/org/witaqua/pwn/device/. MainActivity provides the UI, InstallActivity launches the installation flow, InstallViewModel orchestrates support checking, payload download, exploit execution, and KernelSU loading, PayloadRepository handles GitHub API access and artifact retrieval, DeviceSnapshot fingerprints the local device, and SupportManifest parses the downloaded targets-v2.json manifest. Native code in app/src/main/cpp/native_probe.c performs environment probing relevant to exploitation and KernelSU detection. Android instrumentation tests in app/src/androidTest validate payload download and exercise the exploit helper from an app context. Capabilities: the app fingerprints the device (kernel release/version, build ID, SDK, ABI, page size), fetches the latest payload release metadata from GitHub, validates that artifact URLs remain anchored to the expected release-download prefix, downloads an exploit shared object and a KernelSU artifact, marks them executable, and then runs the bundled helper with ProcessBuilder to execute the exploit payload. The helper/payload flow is intended to obtain 'bootstrap root', after which KernelSU is staged/late-loaded and its module/control channel verified. The README explicitly states the helper can serve 'su' over a socket after the payload gains root. Exploit-specific indicators: filenames and strings strongly indicate targeting CVE-2026-43499. The helper is intentionally disguised/packaged as a lib*.so file so Android extracts it into nativeLibraryDir with execute permissions. Tests and runtime logic reference success markers such as 'done=1 root=1' and 'exploit completed'. Environment variables such as SLIDE_P0_OFFSET, EXPLOIT_ATTEMPTS, PSELECT_DELAY_USEC, P0_ONLY, and diagnostic flags suggest tunable exploitation parameters for KASLR/offset discovery and repeated attempts. Native probe behavior: native_probe.c checks access to tracefs, ashmem, slabinfo, boot_id, /proc/self/mem, perf_event_open, BPF map creation, tee syscall behavior, and /proc/self/pagemap. On aarch64 it also performs timing-based measurements against kernel-space addresses around 0xffffffc080000000 to infer KASLR-related behavior. KernelSU presence is detected via /sys/module/kernelsu or /proc/modules. Network/endpoints: the only network communications in this repository are to GitHub endpoints for the payload repository and release assets. No hardcoded C2, external IPs, or arbitrary third-party hosts were found. Artifact downloads are constrained to the expected GitHub release prefix, which is a notable integrity/safety check. Overall purpose: this is an operational one-click Android rooting installer for supported devices, combining local kernel exploitation with post-exploitation KernelSU deployment. The actual exploit payload source is not in this repository; it is fetched from the payload submodule/release infrastructure, while this repository provides the app wrapper, device matching, download validation, execution harness, logging, and post-root installation flow.
This repository is a real local privilege-escalation exploit for CVE-2026-43499 (GhostLock), targeting a specific Android device port: OPPO Find X8 / PKB110 on MediaTek MT6991 running a vulnerable Android 15 GKI 6.6.118 kernel. It is not a framework module; it is a standalone exploit tree with build tooling, target-specific headers, and helper scripts. Repository structure: the top-level Makefile stages per-device headers from targets/pkb110 into source/src and builds a single output shared object, out/preload-pkb110.so. The source/ directory contains the exploit implementation. Core exploit logic is in source/src/main.c, fops.c, root.c, util.c, slide.c, pipe.c, and the bundled KernelSnitch code under source/src/kernelsnitch/. preload.c provides the LD_PRELOAD constructor entry point so the exploit runs automatically when the library is injected into a benign process. su_daemon.c implements a standalone root shell daemon/client, which is compiled as a PIE and embedded into the preload library via su_blob.S. ksud_blob.S and ksud_install.c similarly embed and deploy a KernelSU userspace binary. targets/pkb110/ contains the device-specific kernel layout constants and symbol offsets. tools/ contains porting and verification utilities for extracting offsets from boot images, checking BTF-derived structure layouts, probing device feasibility, parsing MediaTek preloader memory layout, and verifying assumptions under QEMU. Exploit capability: the exploit abuses the futex PI rt_mutex_waiter use-after-free to gain two write primitives. According to the code and README, Write 1 sets SELinux to permissive, and Write 2 replaces a forked child’s cred pointer with init_cred, yielding uid 0. The exploit then uses the rooted child to install an embedded su daemon and an embedded ksud binary, starting KernelSU in late-load --allow-shell mode. The parent process remains unprivileged; root access is exposed through the installed su daemon and KernelSU tooling. The exploit is operational rather than a bare PoC because it includes hardcoded post-exploitation payloads and installation logic. Notable implementation details: it is designed as a single-file deployment model where only preload.so needs to be pushed to the device. The su daemon and ksud binaries are embedded with .incbin and written out at runtime. The code includes a mini ADB client (miniadb.c) that can connect to localhost:5555, authenticate using a prepositioned RSA key, and execute a shell command. The exploit also contains fallback/auxiliary physical read-write and pipe shaping code, but the README states this port intentionally uses the direct two-write route rather than relying on the classic pipe physical read/write path because pipe slab reclamation was unreliable on this device. Primary entry points: source/src/preload.c is the main deployed entry point for the Android target, executing automatically via constructor when LD_PRELOAD is set. source/src/main.c also supports standalone execution modes such as --bootstrap and --write1 when built without GHOSTLOCK_PRELOAD. Overall, the repository’s purpose is to provide a device-adapted, reproducible Android local root exploit with immediate post-exploitation access mechanisms rather than just vulnerability detection.
This repository is a real local privilege-escalation exploit for CVE-2026-43499 ('IonStack'), ported to the Xiaomi 17T Pro (warhol) on Android 16 / GKI 6.12. It is not a scanner or detector. The top-level structure contains documentation (README.md, WARHOL_PORT.md), build logic (top-level Makefile and source/Makefile), exploit source under source/src/, target-specific generated headers under targets/, and helper analysis/generation tools under tools/. The main exploit artifact is a preloadable shared object, built as source/build/bin/preload.so and copied to out/preload-<device>.so. Execution is via LD_PRELOAD, and the constructor in source/src/preload.c automatically invokes run_exploit(). The exploit chain is fully local and kernel-focused: it first leaks the KASLR base (slide.c), then prepares fake kernel objects/pages and uses futex/pselect race primitives plus pipe/sk_buff-based memory manipulation (main.c, fops.c, pipe.c, util.c) to obtain a kernel write primitive. It then overwrites task credentials to root, disables SELinux enforcement in memory, and installs an embedded su payload. Payload behavior is substantial: preload.c embeds and drops a compiled su daemon binary (from su_daemon.c via su_blob.S), mounts tmpfs on /apex/com.android.virt/bin if needed, writes /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally installs the su binary into adbd's mount namespace, and starts a root daemon listening on the UNIX socket /data/local/tmp/temp_su.sock. The daemon accepts either interactive or command mode and spawns /system/bin/sh as root for local clients. Repository-specific targeting is strict. The exploit is version-locked to Android 16 GKI 6.12/android16-5 and requires exact target headers generated from the matching boot/vendor_boot/preloader images. Two target profiles are included for Xiaomi warhol OS3.0.304.0.WPSJPXM: retail and eng preloader variants. The included target.h files define kernel image addresses, KASLR anchors, waiter/fake-task offsets, and credential pointer offsets. The documentation emphasizes that mismatched builds or preloaders can crash or brick the device and that root is not persistent across reboot. Notable helper tooling includes payload_dump.py for extracting Android OTA payload partitions, kernel_banner.py and bootinfo.py for boot image inspection, generate_target.py for deriving target.h from boot/vendor_boot/preloader inputs, and preloader_memlayout.py for extracting MediaTek preloader memory layout and kernel physical load address. The included warhol-mte-fix.patch documents changes needed for this device's kernel MTE/KASAN HW tags handling. Overall, this is an operational Android local root exploit with a built-in post-exploitation payload, tailored to a narrow device/kernel combination rather than a generic framework module.
Repository is a local Android/Linux kernel validation and trigger package for CVE-2026-43499 (GhostLock), a futex PI / rtmutex use-after-free caused by remove_waiter() using current instead of waiter->task during proxy-lock rollback. It is not a remote exploit and not part of a framework. The repo mixes build artifacts, evidence, disassembly, and reporting material around a Xiaomi Mi 11T target running HyperOS OS1.0.19.0.UKWEUXM with kernel 4.19.191-gfbbcacfb8b1f. Core structure: top-level build files (CMakeLists.txt, build.ps1), README, and multiple compiled-target references indicate the main exploit components are ghostlock_validate, trigger, trigger_panic, and trigger_impact written in C for Android arm64. Although the actual .c source bodies are not included in the provided content dump, their behavior is extensively documented in logs: ghostlock_validate supports --detect, --dry-run, and --probe modes; trigger and trigger_impact perform more aggressive post-rollback probing. Two Python utilities under evidence/ automate bugreport extraction/keyword scanning and kernel Image disassembly refresh. The rest of the repository is dominated by evidence/, which contains final reports, vendor disclosure, crash logs, bugreport extracts, disassembly comparisons, firmware hashes, and empirical run transcripts. Exploit capability: the code reliably drives the kernel through FUTEX_CMP_REQUEUE_PI into rt_mutex_start_proxy_lock(), then into remove_waiter() rollback when the kernel returns EDEADLK. This demonstrates live reachability of the vulnerable path from unprivileged adb shell context (uid 2000). Optional probe/trigger stages then perform FUTEX_LOCK_PI after timeout to look for instability. On the documented Xiaomi target, repeated runs show EDEADLK and successful probe return, but no confirmed panic or privilege escalation. Thus the repository is best characterized as an operational validation/trigger harness for a local kernel memory-corruption bug, not a full LPE weapon. Targeting: README states affected Linux kernels span 2.6.39 through 6.18.x, with the repo specifically tuned for Xiaomi Mi 11T (amber/agate). Required target conditions include futex PI support and a matching vulnerable kernel. The harness checks device identity, kernel version, and offline disassembly evidence before running. Notable observables/endpoints: deployment and execution revolve around /data/local/tmp/{ghostlock_validate,trigger,trigger_impact}; evidence collection touches /sys/fs/pstore, /proc/last_kmsg, /data/tombstones, /data/system/dropbox, /data/anr, and /bugreports. Host-side analysis references Windows paths under C:\Users\strip\Downloads\CVE-2026-43499-main and D:\firmware\amber_OS1.0.19.0.UKWEUXM. The repo also fingerprints kernel symbol VAs for rt_mutex_start_proxy_lock, remove_waiter, and rt_mutex_adjust_prio_chain. Overall assessment: valid exploit-related repository, mature beyond a simple PoC because it includes build automation, target validation, optional trigger modes, and extensive evidence collection. However, it stops short of a weaponized exploit: no root payload, no credential overwrite, no persistence, and no demonstrated privilege escalation chain.
Repository contains a full local Android kernel privilege-escalation exploit port named pmg110-root for CVE-2026-43499, targeting OPPO PMG110 / K15 Pro+ on ColorOS 16 with a specific 6.6 Android GKI kernel. The top-level Makefile stages per-device headers from targets/<device>/ into source/src/ and builds a single shared object, preload.so, intended to be pushed to the device and executed via LD_PRELOAD against /system/bin/true. The exploit is not a framework module; it is a standalone C codebase with supporting Python and shell tooling. Core exploit flow: source/src/preload.c provides a constructor-based entry point that runs automatically when the library is loaded. It initializes logging, clears LD_PRELOAD inheritance, and calls run_exploit() from source/src/main.c. main.c selects the correct runtime symbol offsets based on uname -r, then executes the GhostLock exploit chain. The exploit abuses the futex PI rt_mutex_waiter use-after-free (CVE-2026-43499) to gain kernel write primitives. Supporting files implement the stages: fops.c builds the pselect/fd_set overlay route and CFI/fops corruption path; slide.c handles KASLR/slide-related leakage; util.c and kernelsnitch/* implement KernelSnitch-based mm_struct discovery and helper primitives; pipe.c establishes physical read/write via forged pipe_buffer structures; root.c performs the post-exploitation credential and SELinux manipulation. Capability-wise, the exploit performs two key kernel writes described in the README: Write 1 sets SELinux permissive, and Write 2 patches credentials to root/init_cred-equivalent state for a child process. After the child gains uid 0, root.c invokes install_embedded_su() from su_install.c. That installer writes an embedded aarch64 PIE su binary (built from su_daemon.c and embedded via su_blob.S) to /data/local/tmp/su and /apex/com.android.virt/bin/su, also attempting installation inside adbd's mount namespace via setns(/proc/<adbd>/ns/mnt). It then launches a daemonized root service that listens on the UNIX socket /data/local/tmp/temp_su.sock and logs to /data/local/tmp/su_daemon.log. The su daemon accepts either command mode (-c) or interactive shell mode and executes /system/bin/sh as root for authorized peers (uid 0 or shell/AID_SHELL 2000). Repository structure: source/src/ contains the exploit implementation in C plus one assembly blob wrapper; targets/pmg110-16.0.9.400/ contains device-specific target.h and device_offsets.h plus validation notes; tools/ contains porting and verification utilities such as extract_device.py, extract_btf.py, extract_target.py, preloader_memlayout.py, qemu_verify.py, check_feasibility.py, and device_probe.sh. These tools derive kernel symbol offsets, BTF struct offsets, pselect overlay feasibility, MediaTek preloader memory layout, and QEMU-based validation for new device ports. Notable endpoints are entirely local to the device: LD_PRELOAD path /data/local/tmp/preload.so, installed su binaries under /data/local/tmp/su and /apex/com.android.virt/bin/su, daemon socket /data/local/tmp/temp_su.sock, exploit log /data/local/tmp/.ghostlock.log, daemon log /data/local/tmp/su_daemon.log, and loopback TCP 127.0.0.1:5555 used only by the optional miniadb bootstrap code. No external C2 or remote network infrastructure is present. Overall, this is a real, device-specific, operational local privilege-escalation exploit with a bundled persistence-like local su service rather than a mere detector or proof-only crash PoC.
This repository is a device-specific local privilege-escalation exploit research port for CVE-2026-43499 targeting the Samsung Galaxy S24 Ultra SM-S928U1 on firmware S928USQS6DZF2. It is not a generic exploit and is tightly bound to one Android 14 kernel build via hardcoded offsets and target profiles under src/targets/e3q-S928USQS6DZF2/. Repository structure: the core exploit is implemented in C across src/main.c, src/preload.c, src/slide.c, src/fops.c, src/pipe.c, src/root.c, and src/util.c, with shared constants in src/common.h and target-specific offsets in src/targets/.../target.h. The kernelsnitch/ directory contains a bundled side-channel/leak component used to recover mm_struct-related information and support page preparation. src/su_daemon.c is a standalone root helper / su service binary. Documentation in README.md and docs/*.md is unusually detailed and describes current exploit progress, environment variables, crash analysis, and operational constraints. Main exploit capabilities: (1) preload/app payload orchestration with repeated supervised attempts (src/preload.c); (2) KASLR slide discovery via tracefs by enabling sched_blocked_reason and parsing raw trace pages (src/slide.c); (3) futex/PI and pselect-based residual stack UAF arming and routing logic (src/main.c, src/fops.c); (4) reclaimed page and fake object preparation, including fake waiter/task/lock structures and bank layouts (src/util.c, target profile); (5) pipe-object cache shaping and pipe-based physical memory read/write primitives once the exploit reaches that stage (src/pipe.c); and (6) post-exploitation root installation using a forged workqueue/call_usermodehelper path that launches a helper binary and exposes a local su daemon over a UNIX socket (src/root.c, src/su_daemon.c). The exploit is clearly real code, not a detector or fake sample. However, the included docs state the port is incomplete on this target: the authors report successful intermediate stages such as KernelSnitch mm leak/page preparation, bank reclaim, residual stack UAF arming, and some walk/replant behavior, but they explicitly state that reliable gate hits, pipe phys-rw, and final root have not yet been achieved on this S24U firmware. Therefore the repository is best classified as an operational but incomplete PoC/port with hardcoded payload logic rather than a fully weaponized exploit. Notable local endpoints and artifacts include tracefs paths under /sys/kernel/tracing for KASLR leakage, app-private files under /data/user/0/dev.busung.s25uroot/files for diagnostics/status, the root helper path /data/local/tmp/cve-2026-43499-root, and the UNIX socket /data/local/tmp/temp_su.sock plus abstract socket cve43499_roothold used by the root daemon. No external network C2 or remote endpoints are present; the attack vector is purely local.
This repository is a real Android local privilege escalation exploit for CVE-2026-43499, packaged as an LD_PRELOAD-triggered shared object (`preload.so`) that escalates privileges and then stages embedded KernelSU. The codebase is primarily C with small assembly blobs used to embed payload binaries. Structure and purpose: - `src/main.c`: orchestrates exploitation. It disables rseq, sets resource limits, leaks KASLR, prepares a forged kernel page, launches waiter/owner/consumer threads, and drives the main futex/pselect race route. - `src/slide.c`: performs KASLR slide leakage using a pselect/futex waiter corruption technique. Some targets override this file with target-specific variants. - `src/fops.c`: implements the fake file_operations route, including corruption of ashmem/configfs-related structures and restoration logic after gaining a primitive. - `src/pipe.c`: builds the post-corruption physical read/write primitive by shaping pipe-buffer allocations and forging pipe buffers; verifies read/write and 64-bit read/write with marker values. - `src/root.c`: uses the kernel R/W primitive to locate and patch task credentials, capabilities, seccomp, and SELinux state to obtain root. It can patch a child and/or the current process, then optionally install/launch KernelSU. - `src/preload.c`: constructor entry point for the shared object. It unsets `LD_PRELOAD`, optionally writes the embedded KernelSU binary to `/data/local/tmp/ksud`, and invokes `run_exploit()` automatically when any target process loads the library. - `src/kernelsnitch/*`: bundled KernelSnitch helpers used to recover/bruteforce `mm_struct`-related information needed by the exploit chain. - `src/su_daemon.c`: separate root shell helper implementing a Unix socket daemon/client over `/data/local/tmp/temp_su.sock` for interactive or command execution. - `src/targets/*`: many target-specific headers and, for some devices, overridden source files. These define kernel symbol offsets, structure offsets, direct-map layout, and pselect waiter layout for specific Android builds/devices. Main exploit capabilities: 1. Local-only exploitation via `LD_PRELOAD` on Android. 2. KASLR bypass using a pselect/futex-based kernel pointer leak. 3. Corruption of ashmem/configfs/file_operations-related kernel objects. 4. Establishment of kernel arbitrary read/write, especially via forged pipe buffers and direct-map/physical memory access helpers. 5. Privilege escalation by patching `cred`, seccomp, capabilities, and SELinux enforcing state. 6. Post-exploitation staging of embedded KernelSU (`late-load` mode) with configurable environment variables such as `KSUD_DST`, `KSUD_PACKAGE`, `KSUD_SKIP_WRITE`, `ROOT_PATCH_SELF`, and `DISABLE_SELINUX`. 7. Optional local root shell service through the bundled su daemon. The repository is not a framework module; it is a standalone exploit project with multiple target profiles. It is more than a PoC because it includes a concrete post-exploitation payload (KernelSU staging and optional su daemon), but the payload is largely hardcoded, so OPERATIONAL is the best fit rather than WEAPONIZED.
This repository is a real Android arm64 local privilege escalation exploit/adaptation project for CVE-2026-43499, not merely a detector. Its structure is split into two major parts: Python tooling for target adaptation and native exploit code for the on-device payload. The top-level scripts include detect_offset.py, which uses adb plus root/su on a same-firmware rooted device to derive p0_phys_offset and p0_kernel_phys_load from /proc/iomem, and generate_target.py, which parses boot.img, extracts kernel data, recovers IKCONFIG/kallsyms/BTF-derived information, and emits a target-specific source/src/target.h. The native source tree under source/src contains the actual exploit implementation, built by source/Makefile into preload.so and an embedded su daemon binary. Operationally, the exploit is delivered as an LD_PRELOAD shared object. preload.c defines a constructor that unsets LD_PRELOAD and immediately invokes run_exploit() when any target process loads the library. The documented trigger is LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true. The exploit logic in main.c and related files performs a two-stage attack: first, slide.c leaks the kernel base/KASLR-related address information; second, the direct-root stage uses futex, pselect, scheduler manipulation, crafted fd_sets, socket/pipe primitives, and reclaimed kernel page preparation to obtain a kernel write/corruption primitive. The code references KernelSnitch components for mm_struct/futex hash collision work, indicating a sophisticated local kernel exploitation chain rather than a simple userspace abuse. The payload capability is substantial. After successful exploitation, the code attempts direct credential installation to root, manipulates or reloads SELinux policy/enforcement, and then persists operator access by dropping an embedded su binary. preload.c mounts tmpfs on /apex/com.android.virt/bin if needed, writes /apex/com.android.virt/bin/su, also writes /data/local/tmp/su, optionally installs the su binary into adbd's mount namespace via /proc/<pid>/ns/mnt so it is visible from adb shell, and starts a daemonized root service. su_daemon.c implements both the daemon and client behavior: it listens on the UNIX socket /data/local/tmp/temp_su.sock, accepts peers with uid 0 or AID_SHELL, and supports either command execution mode (-c) or an interactive root shell by spawning /system/bin/sh. This makes the exploit operational rather than a bare proof-of-concept. Notable fingerprintable artifacts include the deployment and persistence paths /data/local/tmp/preload.so, /data/local/tmp/su, /data/local/tmp/temp_su.sock, /data/local/tmp/su_daemon.log, and /apex/com.android.virt/bin/su; the use of /system/bin/true as the preload trigger; and the reliance on /proc/iomem, /proc/mounts, /proc/self/attr/current, /sys/fs/selinux/enforce, and CPU sysfs nodes for adaptation/runtime tuning. Overall, this repository is a target-adaptation framework plus a working local Android kernel LPE payload that culminates in root shell access and a reusable su service.
This repository is a real local Android kernel privilege-escalation exploit for CVE-2026-43499, described as a Futex PI use-after-free leading to arbitrary kernel address write and ultimately root. It is not a scanner or detection script. The codebase is split into two major parts: (1) src/, which contains the core exploit chain, and (2) wrapper/, which packages the exploit plus external helper binaries into a single deployable executable. Repository structure: src/main.c is the main entry point for both the standalone binary and the LD_PRELOAD shared object mode. The Makefile builds two artifacts: build/unplus and build/unplus_preload.so. The exploit orchestration in run_exploit() performs environment setup, leaks the kernel base via slide_leak_kernel_base(), prepares a crafted kernel page, and launches the main PI-futex routing threads. src/route.c implements the core race/trigger path using FUTEX_WAIT_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI, pselect-based stack shaping, and a consumer thread that repeatedly calls sched_setattr on the waiter thread to influence timing. src/slide.c implements the KASLR leak stage. src/stage1.c contains the two main write stages: Write 1 disables SELinux by zeroing the enforcing byte, and Write 2 overwrites current->cred with init_cred to obtain root. src/direct_write.c provides a direct read primitive by corrupting boot_id-related kernel data and reading it back through /proc/sys/kernel/random/boot_id. src/fops.c and src/pipe_physrw.c build more advanced primitives around ashmem/configfs/file_operations corruption and forged pipe_buffer objects to achieve kernel physical read/write. src/root.c performs Android-specific post-exploitation: repairing SELinux state, invoking magiskpolicy, preparing KernelSU allowlist/context, loading a KernelSU module via ksud, and optionally killing vendor security processes. The exploit is highly device-specific. src/target.h is explicitly a template and contains many placeholder 0xDEADBEEF offsets. The operator must supply exact kernel symbol offsets, memory layout constants, per-CPU runtime addresses, and SELinux golden bytes for the target device/build. Without this adaptation, the exploit will compile but is unlikely to work. This strongly indicates an operational but not turnkey exploit. The wrapper/ directory provides a second-stage packer. wrapper/embed_payloads.py embeds the compiled exploit binary, preload library, magiskpolicy, ksud, and a KernelSU .ko into a generated header. wrapper/main.c extracts those payloads to /data/local/tmp, runs step 1 (SELinux permissive), then forks a child with LD_PRELOAD=/data/local/tmp/unplus_preload.so and execs /system/bin/true so the preload constructor executes the full exploit chain. After success, it cleans up most payloads and invokes /system/bin/su -c '/data/local/tmp/ksud soft-reboot'. Main exploit capabilities: local kernel exploitation on Android; KASLR leak; arbitrary kernel read/write primitives; SELinux disablement and later policy/state manipulation; credential overwrite to root; installation/loading of KernelSU-related components; persistence/operationalization steps such as allowlisting shell and soft reboot. There are no remote network C2 endpoints; the observable endpoints are local filesystem/procfs/sysfs paths and Android package/process names used during exploitation and post-exploitation.
This repository contains a real local Android kernel exploit named GhostLock, implemented primarily in C and built with the Android NDK into a single ARM64 executable named ghostlock. It targets CVE-2026-43499, described as a futex PI use-after-free in the Linux kernel, and is adapted specifically for locked-bootloader OnePlus 15T devices (PLZ110 / Snapdragon 8 Elite) with a supported 6.12.x kernel build. Repository structure is straightforward: src/core/ contains the exploit chain, src/devices/ contains per-kernel offset tables, and tools/ contains Python helpers for extracting kallsyms/BTF-derived offsets for new targets. The main entry point is src/core/main.c, which selects offsets by uname -r, supports normal exploit mode, --write1 mode, and --bootstrap mode. The Makefile compiles the exploit from several core C files. Exploit capability-wise, the code performs a multi-stage local privilege escalation chain: it uses pselect/select stack shaping plus futex PI manipulation to obtain a controlled kernel write primitive; uses that primitive first to disable SELinux (Write 1), then to overwrite a process cred pointer with init_cred and clear seccomp (Write 2). Additional modules implement KASLR bypass in two modes: SLIDE mode via boot_id corruption/leak and FOPS/CFI mode via ashmem file_operations pointer leakage. The exploit also includes heap grooming/spraying, KernelSnitch-based mm_struct discovery via futex hash collisions, and pipe_buffer hijacking to achieve arbitrary physical memory read/write. Notable files: fops.c handles pselect routing, fake waiter/task placement, and fops/configfs-based stages; slide.c implements the boot_id-based KASLR leak path; pipe.c implements arbitrary physical memory access through forged pipe_buffer structures; root.c handles task discovery, cred patching, seccomp clearing, and post-exploitation root child logic; miniadb.c is a built-in minimal ADB client used in bootstrap mode to connect to localhost:5555, authenticate with /data/local/tmp/a/adbkey, and execute the exploit again from an unrestricted ADB shell. The exploit is not merely a detector or README. It is operational exploit code with a hardcoded but functional payload chain. It is not framework-based. Its network exposure is limited to loopback ADB bootstrap traffic to 127.0.0.1:5555; the primary attack vector is local execution on the target Android device.
Repository contains a full local Android kernel privilege-escalation exploit for CVE-2026-43499 plus a simpler PoC. The main exploit lives under CVE-2026-43499/exploit and is built with a Makefile into a preloadable shared object (preload.so) plus an embedded su daemon binary. Core source files implement: (1) race orchestration using futex PI requeue and pselect/TCP timing primitives (main.c, fops.c, slide.c), (2) kernel address discovery/KASLR bypass and target-specific offset handling (slide.c, target.h files), (3) heap shaping and pipe-buffer forgery to obtain arbitrary physical/kernel memory read-write (pipe.c), (4) credential and SELinux patching to become root (root.c), and (5) post-exploitation payload delivery/persistence helpers (preload.c, su_daemon.c, su_blob.S, wallpaper_blob.S). The exploit is highly target-specific: many src/targets/<device-build>/target.h files define build fingerprints and kernel offsets for multiple Google Pixel-family builds, while several target directories simply include the tokay implementation. The tokay target is the most feature-rich variant, adding alternate TCP-based race routes, environment-controlled tuning, tmp_page/uname stages, and more extensive runtime diagnostics. The exploit’s main capability chain is: leak kernel base -> corrupt/replace ashmem/configfs-related fops pointers -> validate arbitrary kernel read/write -> walk task list and patch cred/security structures -> disable SELinux -> install and expose a root su daemon. The su daemon listens on a local UNIX socket and supports both command execution and interactive shell sessions. The repository also includes CVE-2026-43499/poc/poc.c, a constructor-driven crash/trigger PoC that exercises multiple kernel stack/UAF shaping methods (prctl, socket, pselect, TCP getsockopt, process_vm, keyctl, fd, futex) rather than full privilege escalation. SKILL.md is ancillary documentation for extracting boot image offsets and compiling a custom target, not the exploit itself.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
170 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A separate Linux kernel futex vulnerability used as the second stage in the IonStack exploit chain to escalate from browser code execution to root on a supported Android build.
Локальная уязвимость повышения привилегий в ядре Linux, связанная с use-after-free в обработке rtmutex/futex, позволяющая получить выполнение кода в ядре, root-права и выполнить побег из контейнера.
A Linux kernel vulnerability nicknamed GhostLock that existed for roughly 15 years and allows local privilege escalation to root and container escape, making it especially significant for cloud and containerized environments.
A Linux kernel local privilege escalation vulnerability caused by a use-after-free condition in the scheduling system's task cleanup logic, allowing attackers with local access to gain root privileges.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.