GhostLock

This repository is a real local Android kernel privilege-escalation exploit for CVE-2026-43499 (“GhostLock”), centered on an ARM64 futex/pselect race chain that leaks KASLR, corrupts kernel structures, establishes kernel arbitrary read/write via forged pipe buffers, and then patches credentials/SELinux state to obtain root. The README and target report explicitly frame it as a PoC/research snapshot for OPPO PLS120 (MediaTek MT6835), but the source tree contains many target profiles for Google device codenames/builds as well. Repository structure: the main exploit lives under exploit/. The Makefile builds an Android aarch64 shared object preload.so plus an embedded su daemon binary. Core shared logic is in exploit/src/common.h, main.c, fops.c, pipe.c, slide.c, root.c, preload.c, and kernelsnitch/*.h. Target-specific offsets and, for some devices, overridden source files live under exploit/src/targets/<project>/. boot/extracted/exploit_symbols.json and the OPPO report document kernel symbol extraction and offset derivation. The README mentions poc/ and tools/, but those are not present in the provided file listing. Execution flow: preload.c is the practical entry point. It runs automatically via a constructor when the shared object is injected with LD_PRELOAD, unsets LD_PRELOAD, initializes persistent logging, and calls run_exploit(). main.c orchestrates the exploit threads. slide.c first performs a KASLR leak using a pselect/futex waiter corruption route. fops.c then abuses ashmem/configfs-related file operation corruption to gain a stable primitive. pipe.c shapes pipe-related kernel allocations and forges pipe_buffer objects to implement physical/arbitrary kernel read/write. root.c walks task structures, patches cred and SELinux-related fields, spawns a child that calls setuid(0)/setgid(0), writes /sys/fs/selinux/enforce, and then installs post-exploitation payloads. Capabilities observed in code: - KASLR base leak (slide_leak_kernel_base) - Kernel memory read/write through configfs/ashmem and forged pipe buffers - Task/cred discovery and patching for root - SELinux enforcement disable attempt - Embedded su deployment to /apex/com.android.virt/bin/su and /data/local/tmp/su - Root daemon over UNIX socket /data/local/tmp/temp_su.sock supporting command mode (-c) and interactive shell - Optional installation into adbd mount namespace for adb-visible su - Wallpaper replacement and system_server kill to trigger reload - Persistent logging to /sdcard/Download/log_*.txt to survive crashes/reboots The exploit is not network-based; it is a local post-compromise/privilege-escalation tool requiring code execution on the target device. It is more than a bare PoC because it includes a hardcoded operational payload (su daemon and device modifications), but it is not part of a larger public exploitation framework.

Repository contains two distinct exploit projects under IonStack. CVE-2026-10702 is a browser-based Firefox Android exploit implemented as HTML/JavaScript. index.html acts as the launcher/UI, repeatedly loading exploit.html in child frames, handling user confirmation, device fingerprint gating, progress reporting, and success/failure messaging via postMessage. exploit.html contains the actual browser exploit logic, including device checks, memory-manipulation primitives, and command polling/reporting. ansi.js is only a UI helper for ANSI-colored logs. CVE-2026-43499 is the larger and more mature component: a local Android ARM64 privilege-escalation exploit with many device-specific target profiles. The build system compiles a preload.so shared object and an embedded su_daemon binary. Core source layout is modular: main.c orchestrates the exploit stages and thread choreography; slide.c performs KASLR bypass/leak or forced fixed-base handling; fops.c builds the ashmem file_operations hijack and configfs-based arbitrary kernel read/write stage; pipe.c develops a pipe-buffer-based physical memory read/write primitive; root.c patches credentials/capabilities/SELinux and validates root; preload.c is the constructor-driven loader and post-exploitation installer; su_daemon.c provides a local root shell service over a UNIX domain socket. The exploit chain for CVE-2026-43499 is clearly intended to achieve full local root. It uses futex PI/requeue and pselect/TCP-based stack-copy routing to corrupt kernel waiter structures, overwrite ashmem misc fops with a forged fake_fops table, then leverage configfs callbacks for controlled kernel memory access. After that it installs a stronger pipe-based physical R/W primitive, locates task/cred structures, sets uid/gid to 0, adjusts capabilities, disables SELinux enforcement, and drops a su binary plus a root shell daemon. There are also optional direct /dev/mem helper paths that attempt a simpler overwrite if the device permits it. Repository structure shows heavy per-device specialization. Many target directories are thin wrappers including shared tokay or frankel implementations, while target.h files define build fingerprints and kernel offsets for each supported build. PROGRESS.md indicates the Xiaomi jinghu path is still under active development and not fully reliable yet, but the codebase overall is a real exploit repository rather than a detector or placeholder.

This repository is a real, device-specific local privilege escalation exploit for CVE-2026-43499 targeting the Korean Samsung Galaxy S25 Ultra SM-S938N on build S938NKSUACZF1. It is not a framework module; it is a standalone Android/aarch64 exploit port with target-specific kernel offsets in src/targets/pa3q-S938NKSUACZF1/target.h and a Makefile that builds two binaries: a preloadable exploit shared object (build/cve-2026-43499) and a root helper executable (build/cve-2026-43499-root). Repository structure and purpose: - README.md documents the exact supported firmware, build/deploy/run steps, retry behavior, and expected root result. - src/preload.c is the practical entry point: an LD_PRELOAD constructor supervises up to 16 isolated exploit attempts, varying pselect timing to improve race reliability. - src/main.c orchestrates the exploit flow: environment setup, KASLR slide leak, race threads, exploitation, and spawning a detached keeper process named cve43499-hold to preserve reclaimed kernel-backed allocations. - src/slide.c performs automatic KASLR slide recovery using tracefs by enabling sched_blocked_reason tracing and parsing raw per-CPU trace records. - src/fops.c contains the pselect/futex race logic and the stage that corrupts/restores ashmem file operations to obtain a controlled kernel primitive. - src/pipe.c upgrades the primitive into physical kernel read/write by reclaiming and forging pipe_buffer objects, then validates read/write and 64-bit access with proof tags. - src/root.c uses the kernel read/write primitive to disable SELinux enforcement and queue a forged call_usermodehelper work item on system_unbound_wq, launching the root helper binary from kernel context. - src/su_daemon.c is the post-exploitation payload: a root daemon/client over a UNIX socket that executes commands or provides an interactive shell. - src/util.c and src/kernelsnitch/* provide support code for ashmem path handling, logging, futex timing/bruteforce, and mm_struct-related heap manipulation/leak support. Main exploit capabilities: 1. Device-specific KASLR bypass via tracefs. 2. Race-based kernel memory corruption using futex PI/pselect orchestration. 3. Temporary overwrite of ashmem/configfs-related kernel file operations to gain arbitrary kernel read/write. 4. Upgrade to physical memory read/write through forged pipe_buffer structures. 5. Post-exploitation root path that sets SELinux to permissive and launches a root daemon. 6. Stable temporary persistence until reboot via a detached keeper process that preserves reclaimed slabs/pages. The exploit is clearly operational rather than a simple PoC because it includes a working payload, retry logic, target-specific offsets, primitive validation, SELinux modification, and a usable root shell/command daemon. It is local-only: there are no remote network targets, C2 servers, or external callback endpoints. The only socket endpoint is a local AF_UNIX socket used after exploitation for root command execution.

This repository is a real local Android kernel privilege-escalation exploit for CVE-2026-43499, tailored very specifically to the Xiaomi Redmi K70 Ultra (rothko) on HyperOS/Android 14 with a MediaTek MT6989 kernel build. It is not a framework module and contains full exploit code plus a post-exploitation su daemon. Repository structure: the Makefile builds two main artifacts: a preload shared object (preload.so) and an embedded PIE su daemon blob. Core exploit logic is split across src/main.c, src/slide.c, src/fops.c, src/pipe.c, and src/util.c. target.h contains hardcoded target-specific kernel addresses and structure offsets. src/preload.c provides the LD_PRELOAD constructor entry point and post-root installation logic. src/su_daemon.c is a standalone root shell daemon/client that gets embedded into the preload payload via src/su_blob.S. src/standalone.c is a minimal normal executable entry point. Exploit flow: the code uses a futex CMP_REQUEUE_PI use-after-free race with multiple threads (waiter/owner/consumer) to corrupt rt_mutex_waiter state. It prepares controlled kernel pages and uses pselect/fd_set shaping to route fake waiter/task structures into kernel memory handling. A first stage in slide.c leaks the kernel text base/KASLR slide. The direct-root stage then uses repeated controlled writes to modify kernel data structures, locate the current task, and replace cred pointers with init_cred/root equivalents. The exploit also disables SELinux enforcing by writing to the selinux state. The README indicates fallback logic for physical page discovery when /proc/self/pagemap is blocked, including anonymous-page brute force and KernelSnitch timing side-channel support. Post-exploitation capability: once root is obtained, preload.c writes an embedded su binary to /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally enters adbd's mount namespace so adb shell can see the binary, then launches a Unix-domain-socket-based root daemon at /data/local/tmp/temp_su.sock. The daemon accepts either interactive shell sessions or one-shot command execution and only serves peers with uid 0 or Android shell uid 2000. Overall purpose: this is an operational, target-specific local root exploit with built-in persistence-lite/operator convenience features, not just a crash PoC. It performs kernel exploitation, privilege escalation, SELinux bypass, and local root shell deployment on a narrowly defined Android device/kernel combination.

Repository contains two distinct exploit projects. CVE-2026-10702 is a browser/HTML+JavaScript exploit targeting Firefox on Android. It consists mainly of index.html, exploit.html, and ansi.js. index.html acts as a controller UI that spawns exploit.html in iframes, handles retries/timeouts, and receives progress/success/failure via postMessage. exploit.html contains the actual browser exploit logic: device fingerprint gating, memory-corruption-style primitives, command execution/polling logic, and reporting back to the parent frame. It references Firefox private app storage and appears intended for browser-only exploitation with Android command execution as the end goal. CVE-2026-43499 is the larger and more operational exploit. It is a local Android ARM64 privilege-escalation exploit built as an LD_PRELOAD shared object via the included Makefile and CI workflow. The codebase is organized into reusable core files (main.c, slide.c, fops.c, pipe.c, root.c, preload.c, su_daemon.c, kernelsnitch helpers) plus many per-device target directories containing build fingerprints and kernel offsets. The exploit chain performs: KASLR slide disclosure (slide.c), fake file_operations / routing stages (fops.c), pipe-based physical kernel read/write primitive construction (pipe.c), credential and SELinux manipulation (root.c), and post-exploitation persistence/utility actions (preload.c + su_daemon.c). The payload installs an embedded su binary under /apex/com.android.virt/bin/su, drops a local client to /data/local/tmp/su, starts a root daemon on UNIX socket /data/local/tmp/temp_su.sock, and can execute commands or provide an interactive root shell. It also writes wallpaper files and restarts system_server to force wallpaper reload. The repository is not a framework module; it is standalone exploit code. It is clearly a real exploit rather than a detector: it contains kernel memory primitives, target-specific offsets, root credential patching, SELinux disable attempts, and a working post-exploitation payload. The target coverage includes multiple Google Pixel-family build fingerprints and OnePlus Ace3, with many target directories reusing shared source through include indirection. CI builds preload.so artifacts for several named projects and even documents adb-based deployment using LD_PRELOAD.

This repository is a real local Android kernel privilege-escalation exploit set, not a scanner. It is written primarily in C with small assembly blobs and a Makefile-based Android NDK build flow that outputs a preloadable shared object (preload.so) and embeds a separate su daemon binary plus a wallpaper asset. Repository structure: the top-level src/ directory contains the generic exploit pipeline: main.c orchestrates the race/exploitation flow; slide.c performs kernel base/KASLR disclosure; fops.c performs fake file_operations routing and CFI-stage setup; pipe.c converts the primitive into arbitrary physical/kernel memory read-write using forged pipe buffers; root.c patches credentials and SELinux state to obtain root; preload.c is the LD_PRELOAD-style loader and post-exploitation installer; su_daemon.c is a standalone root shell daemon/client. util.c/common.h provide helpers, ashmem/configfs primitives, logging, and environment parsing. kernelsnitch/ contains a futex timing/collision helper used to recover mm_struct-related information. src/targets/ contains per-device/per-build offset profiles and, for some targets, full target-specific source overrides. Many target directories are thin include wrappers around the tokay or frankel implementations, indicating code reuse with per-build offsets. Exploit capabilities: the code targets specific Google Pixel-family Android builds on ARM64. It first leaks the kernel text base (slide/KASLR bypass), then prepares fake kernel objects and abuses futex PI/requeue plus pselect or alternate loopback TCP timing/race routes to redirect execution through crafted structures. It uses ashmem/configfs-style read/write helpers to corrupt or replace kernel file_operations pointers, then validates and restores them. After gaining a stronger primitive, it shapes pipe-related slab allocations and forges pipe_buffer metadata to achieve arbitrary kernel/physical memory read and write. Finally, it locates the current task/cred structures, patches UID/GID/capabilities and SELinux SID/enforcement, and spawns a child that calls setuid(0)/setgid(0), writes 0 to /sys/fs/selinux/enforce, installs an embedded su binary, and starts a root shell daemon. Post-exploitation behavior: the payload is operational and concrete. It writes a su binary to /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally installs it into adbd's mount namespace for adb visibility, and launches a daemon listening on the UNIX socket /data/local/tmp/temp_su.sock. The daemon supports both command execution (-c) and interactive root shells via /system/bin/sh. The exploit also writes an embedded wallpaper file to user/system wallpaper locations and triggers wallpaper/framework reload behavior, which appears to be a visible artifact or persistence-adjacent action rather than part of the core LPE. Targeting: hardcoded build fingerprints and kernel offsets show explicit support for multiple Pixel devices/builds including blazer, caiman, comet, frankel, komodo, mustang, oriole, rango, and tokay across Android 16/17-era builds. Success depends heavily on matching these offsets and timing assumptions. The presence of environment-variable knobs in the tokay variant indicates tuning for reliability, but the payload remains largely fixed rather than operator-customizable, so OPERATIONAL is the best maturity fit.

This repository is a real Android local privilege-escalation exploit for CVE-2026-43499, targeting Xiaomi Android 16 devices in the 'popsicle' family and related Xiaomi 17-series devices. It is not a framework module; it is a standalone exploit toolkit composed of helper Python scripts plus native Android exploit code. Repository structure: the top level contains README.md, detect_offset.py, generate_target.py, and a sample profile JSON. The Python helpers are preparatory tooling: detect_offset.py uses adb and root access on a reference device to derive two physical-address parameters from /proc/iomem; generate_target.py parses boot.img, extracts kernel metadata/symbol/layout information, and emits source/src/target.h tailored to the target kernel. The source/ directory contains the actual exploit build system and native code. The Makefile builds two artifacts: an embedded PIE su daemon binary and the final preload.so shared object. Exploit flow: preload.so is intended to be pushed to the device and executed via LD_PRELOAD against /system/bin/true. Its constructor in source/src/preload.c automatically unsets LD_PRELOAD and calls run_exploit(). The exploit first performs a kernel slide/KASLR leak (slide.c), then transitions into a direct root stage (main.c, pipe.c, util.c). The native code heavily uses futex operations, pselect fd_set shaping, scheduler interactions, pipe/socket primitives, and crafted fake kernel objects/pages. The bundled KernelSnitch code is used to infer kernel memory/mm_struct-related information and support page preparation/reclamation. The code indicates a local kernel memory corruption/write primitive rather than a remote vector. Capabilities: successful exploitation yields uid 0/euid 0, manipulates kernel credentials, disables SELinux enforcement, and installs an embedded su implementation. The exploit writes su to /apex/com.android.virt/bin/su and /data/local/tmp/su, optionally enters adbd's mount namespace so the binary is adb-visible, then launches a root daemon listening on the UNIX socket /data/local/tmp/temp_su.sock. The su client supports both '-c <cmd>' command execution and interactive root shell sessions by spawning /system/bin/sh. Logging is written to /data/local/tmp/su_daemon.log. Notable implementation details: source/src/preload.c handles persistence-like post-exploitation setup by mounting tmpfs on /apex/com.android.virt/bin, writing the embedded su payload, relabeling files with /system/bin/chcon, and starting the daemon. source/src/su_daemon.c implements the root shell service over AF_UNIX, restricting peers to uid 0 or AID_SHELL. source/src/util.c and related files contain CPU affinity tuning and kernel page preparation logic to improve exploit reliability. Overall, this is an operational local root exploit with a built-in post-exploitation payload rather than a simple crash PoC or detection script.

This repository is a real local Android kernel privilege-escalation exploit and rooting toolkit, not a detector. It targets CVE-2026-43499 ('IonStack' per README) and is designed primarily for Xiaomi duchamp/Redmi K70E, while also carrying many device-specific offset profiles for Google Android builds under src/targets/. The build system selects a target profile and compiles a preloadable shared object, preload.so, plus embedded helper daemons. Repository structure: core exploit logic lives in src/main.c, src/slide.c, src/fops.c, src/pipe.c, src/root.c, and src/preload.c. src/kernelsnitch/ contains timing/futex helpers used to derive kernel memory layout information. src/targets/ contains per-device/per-build target.h files and, for some targets, full overrides of common/fops/main/pipe/slide/util implementations. Assembly blobs ksud_blob.S and su_blob.S embed daemon binaries into the final artifact. The Makefile builds preload.so and an embedded su daemon binary. Exploit flow: preload.so executes automatically via a constructor when injected with LD_PRELOAD. The code first leaks KASLR/kernel base using a pselect-based side channel and futex/priority-inheritance race machinery. It then performs a fake file-operations/FOPS hijack against ashmem/configfs-related kernel objects to gain a stronger primitive. Next it forges pipe_buffer structures to obtain arbitrary kernel physical read/write. With that primitive, root.c locates the target task/cred structures, zeroes UID/GID fields, grants full capabilities, disables seccomp, and writes SELinux enforcing to 0. After successful privilege escalation, preload.c/root.c drop an embedded privileged daemon to /data/local/tmp/ksud and start it. A separate su daemon implementation exposes a local UNIX socket at /data/local/tmp/temp_su.sock and can spawn /system/bin/sh for command or interactive root shell access. Notable capabilities: local kernel exploitation, KASLR bypass, arbitrary kernel physical memory read/write, credential patching, SELinux disablement, seccomp disablement, root shell/command execution, and semi-persistent post-exploitation via dropped daemon binaries. No external network C2 or remote endpoints are present; the exploit is entirely local and file/IPC driven.

This repository is a local Android kernel exploit research project targeting GhostLock (CVE-2026-43499) on the Logitech G Cloud / Snapdragon 720G running Linux 4.14.190-perf+. It is not a framework module; it is a standalone exploit-development repo with three main parts: exploit code, preload-based execution code, and offline analysis tooling/docs. Repository structure: the exploit/ directory contains the main local PoC and helper binaries. exploit/perf_leak_sd720g.c is a working KASLR disclosure utility that uses perf_event_open with PERF_TYPE_SOFTWARE or a tracepoint fallback to sample kernel callchains and derive KIMAGE_TEXT_BASE from the minimum observed kernel address. exploit/sd720g_exploit.c is the main GhostLock trigger: it creates a three-futex PI race using multiple threads, invokes FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI, attempts a pselect-based stack spray/fake waiter layout, and prepares a modprobe_path-oriented post-exploitation script/marker. The target_sd720g*.h headers provide hardcoded symbol offsets and runtime address macros for the specific Qualcomm kernel. The preload/ directory contains preload/sd720g_preload.c, an LD_PRELOAD shared object that automatically runs via a constructor when loaded into a process. It repeats the KASLR leak and race trigger logic, writes results to Firefox app-private files, attempts to capture kernel logs from /dev/kmsg or /proc/kmsg, and is intended to be launched through an external browser-based chain. This gives the repo a second execution mode beyond direct adb shell execution. The tools/ directory contains offline reverse-engineering and symbol-extraction utilities. Python scripts parse kallsyms from a raw kernel image, extract target symbol offsets, search for the GhostLock bug pattern, trace waiter-related field accesses, and analyze pi_state lifecycle and Qualcomm-specific rtmutex behavior. tools/kgsl_uaf_test.c is separate exploratory code for testing a KGSL GPU UAF path and is not part of the main GhostLock chain. Capabilities: the code clearly implements a local kernel attack vector, not a remote one. Its strongest confirmed capability is KASLR bypass via perf_event_open. It also reliably exercises the vulnerable futex PI race path and is designed to gather crash telemetry. The intended end state is root via a constrained write leading to modprobe_path hijack or related kernel object corruption. However, the repository's own documentation repeatedly concludes that Qualcomm's modified rtmutex implementation replaces the expected rbtree-based primitive with bitmap/list logic, breaking the standard IonStack exploitation path. As a result, the current code appears operational as a KASLR leak + race trigger + crash-analysis toolkit, but not as a reliable privilege-escalation exploit on this target. Notable targeting details: the exploit is highly device- and kernel-specific. It assumes Android 11, ARM64, Qualcomm kernel internals, specific symbol offsets, and permissive perf_event settings. It references init_task, modprobe_path, commit_creds, prepare_kernel_cred, ashmem_fops, configfs callbacks, and other kernel symbols as future exploitation anchors. Overall, this is a serious exploit-development repository with real local kernel exploitation code, but the included implementation is best characterized as an operational research PoC whose final root primitive is incomplete on the analyzed Qualcomm SD720G kernel.

GhostLock is a real local Android kernel privilege-escalation exploit repository targeting CVE-2026-43499, a futex PI use-after-free in Linux/Android kernels. The repo is primarily C code with small assembly blobs and Python helper scripts. It is not a framework module; it is a standalone exploit suite focused on locked-bootloader Android devices, especially OnePlus Ace 6T, with additional target headers for multiple Google device builds. Repository structure: core exploit logic lives under src/. Generic components include main.c (thread orchestration for the futex/PI race), fops.c (pselect-based fake waiter/file_operations corruption route), slide.c (KASLR leak via boot_id-related read primitive), pipe.c (forged pipe_buffer-based kernel physical read/write), root.c (task/cred discovery and root installation), util.c/common.h (helpers, ashmem/configfs read-write primitives, environment logging), preload.c (constructor-triggered exploit plus post-root deployment), and su_daemon.c (embedded root shell daemon/client). The kernelsnitch/ directory contains a bundled helper for locating mm_struct/futex hash collisions. tools/extract_target.py and tools/extract_btf.py extract symbol and struct offsets from boot images/BTF to support new kernels. Target-specific overrides and offset tables are under src/targets/, with ace6t containing the most complete exploit path including miniadb.c and dynamic offsets.h. Main exploit capabilities: it first obtains a write primitive through the futex PI waiter corruption path, then uses a SLIDE/KASLR leak stage to recover kernel base, then installs a stronger kernel memory primitive by corrupting ashmem/configfs-related file operations and forging pipe buffers for physical kernel read/write. With that primitive it locates the current task, patches credentials or points task->cred at init_cred, disables SELinux, and spawns a root child. Post-exploitation code installs an embedded su binary, starts a UNIX-domain su daemon, optionally writes wallpaper files, and can make su visible in adbd's mount namespace. Bootstrap/network behavior: the ace6t target adds a standalone bootstrap mode intended for app/seccomp contexts. It performs a reduced first-stage write to disable SELinux, waits for adbd on localhost TCP 5555, then uses a built-in minimal ADB client to authenticate with a local RSA key and execute the full exploit binary through adb shell. This is the only meaningful network endpoint in the code; otherwise the exploit is local. The mini ADB client dynamically loads libcrypto.so, signs ADB AUTH tokens using /data/local/tmp/a/adbkey, opens a shell service, and runs /data/local/tmp/a/e. Targeting: README claims verified support for OnePlus Ace 6T on Android 16 / kernel 6.12.38 variants, with additional offset coverage for OnePlus 15 and many Google device build headers (frankel, mustang, rango, stallion). The ace6t target uses runtime uname-based kernel matching via src/targets/ace6t/offsets.h and refuses unknown kernels. Overall purpose: this repository is an operational local jailbreak/root exploit for vulnerable Android kernels on locked-bootloader devices. It is more than a PoC because it includes full post-exploitation payloads (root shell daemon, bootstrap ADB client, persistence-supporting installation steps), but payloads are fairly fixed/hardcoded rather than framework-customizable.

Repository is a real Android arm64 local privilege escalation exploit/adaptation project for CVE-2026-43499. It is not a framework module; it contains both Python tooling for target adaptation and native C/assembly exploit code. Structure: (1) detect_offset.py derives p0_phys_offset and p0_kernel_phys_load from a rooted same-firmware device via adb+su and /proc/iomem; (2) generate_target.py parses boot.img, extracts kernel metadata/config/kallsyms/BTF, and generates source/src/target.h with target-specific macros; (3) source/Makefile builds an Android shared object preload.so and an embedded su daemon binary; (4) native exploit sources implement the actual LPE chain. Exploit flow: preload.so is pushed to /data/local/tmp and executed through LD_PRELOAD against /system/bin/true. Its constructor unsets LD_PRELOAD and calls run_exploit(). The exploit first performs a KASLR/kernel base leak in slide.c, then transitions to a direct root stage using futex/pselect-based corruption and kernel page preparation primitives spread across main.c, fops.c, pipe.c, slide.c, and util.c. The code references fake task/lock structures, pselect waiter word placement, futex PI/requeue operations, skb-based reclaim/page preparation, and bundled KernelSnitch logic for mm_struct/futex hash related discovery. This indicates a sophisticated local kernel exploitation chain rather than a simple wrapper. Post-exploitation payload is explicit and operational: preload.c writes an embedded su binary to /apex/com.android.virt/bin/su and /data/local/tmp/su, may mount tmpfs on /apex/com.android.virt/bin, attempts SELinux context adjustment via /system/bin/chcon, optionally installs the su binary into adbd's mount namespace for adb visibility, and starts a daemon. su_daemon.c implements both client and daemon modes over a UNIX domain socket at /data/local/tmp/temp_su.sock, allowing either interactive shells or command execution via /system/bin/sh -c as root. Logs are written to /data/local/tmp/su_daemon.log. README instructions confirm successful exploitation by running /data/local/tmp/su -c id and expecting uid=0(root). Overall purpose: provide a generalized per-device adaptation and build framework for exploiting CVE-2026-43499 on Android arm64 kernels, culminating in root access and a reusable local su service. No external network C2 or remote endpoints are present; the attack surface is local on-device execution plus adb-assisted deployment.

This repository is a real local privilege escalation exploit for CVE-2026-43499 targeting the OnePlus 15 on Android 16. It is not a framework module; it is a standalone exploit chain with helper tooling, build scripts, and an embedded post-exploitation root payload. Repository structure: - README.md documents the workflow: detect physical offsets, generate a target header from boot.img, build preload.so, push it to the device, trigger it with LD_PRELOAD, then use a bundled su client. - detect_offset.py is a helper script that uses adb and a rooted shell to read /proc/iomem and derive p0_phys_offset and p0_kernel_phys_load for the target profile. - generate_target.py is a large target-generation utility that parses Android boot images, extracts kernel metadata/config/kallsyms/BTF-derived layout information, and emits source/src/target.h with hardcoded addresses and offsets required by the exploit. - source/Makefile builds two main artifacts: a PIE su daemon binary and the preload.so shared object that embeds that daemon. - source/src/*.c and headers implement the exploit chain itself. Exploit flow and capabilities: 1. Execution begins in source/src/preload.c via a constructor function, so merely loading preload.so with LD_PRELOAD triggers exploitation automatically. 2. The exploit performs environment setup and CPU/core selection for reliability. 3. It leaks the kernel base/KASLR slide using logic in slide.c, which uses crafted pselect/futex interactions and kernel object manipulation to recover kernel text-related data. 4. It prepares crafted kernel pages and uses futex priority-inheritance plus pselect-based corruption/write primitives (main.c, fops.c, pipe.c, util.c) to achieve direct kernel memory writes. 5. Using target-specific offsets from target.h, it modifies task credential pointers to obtain uid/euid/gid 0 and interacts with SELinux state, including enforcement disablement/policy reload logic. 6. After root is obtained, preload.c installs an embedded su binary into /apex/com.android.virt/bin/su and /data/local/tmp/su, starts a root daemon listening on a UNIX socket, and exposes root command execution to local/adb shell users. Post-exploitation payload details: - source/src/su_daemon.c implements both a daemon mode and client mode. - The daemon binds AF_UNIX socket /data/local/tmp/temp_su.sock, accepts connections from uid 0 or shell (AID_SHELL), and can either execute a supplied command with /system/bin/sh -c or provide an interactive root shell over a PTY. - preload.c attempts to make the su binary visible inside adbd's mount namespace so adb shell sessions can use it. Notable technical indicators: - Heavy use of futex operations (FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, FUTEX_CMP_REQUEUE_PI), pselect fd_set shaping, timerfd/pipe descriptors, CPU affinity tuning, and kernel structure offsets indicates a sophisticated kernel LPE rather than a simple misconfiguration abuse. - target.h contains concrete kernel image addresses such as INIT_TASK, INIT_CRED, SELINUX_ENFORCING, and KASLR anchors, confirming the exploit is tightly coupled to a specific kernel build/profile. Overall, this is an operational Android kernel LPE PoC with an integrated root persistence/helper component. It is more than a detector: it includes the full exploitation chain, target generation tooling, build system, and a usable root shell/daemon payload.

SpringPeace is a Windows-oriented GUI/CLI wrapper around public research exploit code for CVE-2026-43499. It is not a standalone kernel exploit implementation; instead, it operationalizes the upstream x-spy exploit engine by automating target profiling, payload generation, and ADB-based deployment for Android devices. Repository structure: the top level contains documentation, launcher helpers, and packaging metadata. The main logic lives under tools/springpeace-oneclick/: springpeace.py is the CLI/core orchestrator, springpeace_gui.py is a Tkinter GUI, presets.json stores candidate kernel-load presets and device notes, requirements.txt lists Python dependencies, and two PowerShell scripts build PyInstaller executables. A compatibility patch modifies the upstream generate_target.py logic to better support Windows file handling and broader kernel symbol/call-chain layouts. Exploit capability: the tool reads a supplied Android boot.img, extracts header/kernel metadata, version strings, and symbol/BTF-related information, then generates multiple candidate target profiles because the kernel physical load address may not be directly inferable from boot.img alone. It compiles multiple payload.so candidates with Android NDK/LLVM, records them in a manifest, and can automatically push/try them over ADB until root is confirmed. The documentation explicitly describes the result as temporary root that is lost on reboot. Targeting: the repo explicitly targets CVE-2026-43499 on Android arm64 devices, especially Snapdragon-based Xiaomi and OnePlus/OPPO devices on 6.12.x kernels. Presets and notes mention OnePlus 15R, Xiaomi/Redmi popsicle-family devices, and a Redmi Turbo 5 Max sample. The docs include kernel-specific constants and candidate physical-load values such as 0xa8000000 and 0xc7800000. Operational details: the GUI supports tool checks, ADB device detection, boot.img inspection, build-only mode, and one-click root mode. The CLI exposes subcommands including payload generation and ADB execution. The code expects local copies of adb.exe, Android NDK clang, and the upstream exploit generator. The default remote execution path on the Android device is /data/local/tmp/preload.so. Assessment: this is a real exploit wrapper/orchestration project rather than a detector. It provides a usable payload-building and deployment workflow, but payload customization is tied to the upstream engine and local toolchain rather than a full exploitation framework, so OPERATIONAL is the best fit.

Repository is a research/adaptation project for the GhostLock local privilege-escalation chain targeting CVE-2026-43499 on OPPO Find X6 Pro (PGEM10, Android 15, Linux 5.15.149 ARM64). It is not a simple README-only repo: it contains modified exploit source, reusable KASLR-leak code, standalone test programs, Python kernel-analysis tooling, and extensive reports documenting why the original exploit chain fails on this PAC-enabled target. Core exploit capability: the code orchestrates a futex PI race using FUTEX_LOCK_PI, FUTEX_WAIT_REQUEUE_PI, and FUTEX_CMP_REQUEUE_PI across waiter/owner/consumer threads. The original chain aims to reclaim/shape kernel stack data via pselect, forge an rt_mutex_waiter, overwrite file_operations pointers (ashmem/configfs confusion), gain arbitrary kernel read/write through pipe_buffer manipulation, then patch credentials and SELinux state for root. The modified adaptation replaces the original SLIDE KASLR leak with a working perf_event_open-based callchain leak implemented in exploit-src/main_modified.c and src/kaslr_perf.c. That module samples kernel callchains from PERF_TYPE_SOFTWARE / PERF_COUNT_SW_CPU_CLOCK events, extracts deep kernel return addresses, and derives the runtime kernel base/slide. Main exploit files: exploit-src/main_modified.c is the primary adapted entry point; it adds perf_kaslr_leak(), invokes perf_event_open, mmaps the perf ring buffer, parses PERF_RECORD_SAMPLE records, computes kaslr_base/kaslr_slide, then proceeds into the futex race orchestration. exploit-src/slide_modified.c contains the original SLIDE/pselect stack-copy logic and fake waiter construction, including fd_set shaping and timerfd/pipe descriptor setup, but the repo documentation states this stage is blocked on the target because PAC/BTI inflate futex-related stack frames beyond the reachable pselect overwrite depth. common_modified.h contains key exploit constants and declarations, including Android ashmem ioctl definitions, mm_struct sizing changes (0x500 -> 0x400), pipe/cred/SELinux helper declarations, and kernel-address macros. Repository structure: exploit-src/ holds original vs modified exploit sources for comparison; src/ contains the reusable perf-based KASLR bypass module; tests/ contains standalone utilities for KASLR leakage, futex hash analysis, KASLR brute force, path/bucket analysis, and attack-surface checks (Dirty Pipe, OverlayFS, netfilter/nftables visibility); analysis-scripts/ contains Python ELF/call-graph tooling that scans a local vmlinux.elf for PACIASP prologues, BL edges, and deep call chains; reports/ and docs/ contain detailed adaptation notes, offset verification, architecture diagrams, build logs, and failure analysis. Notable findings from the repo’s own analysis: the adaptation successfully validates offsets, mm_struct sizing, and the futex trigger, and provides a reliable KASLR bypass on the target. However, the full LPE chain is not completed on the documented OPPO device because ARM PAC causes futex call-chain stack depth (~0xA70) to exceed the pselect overwrite depth (~0x620), preventing the SLIDE/fops-overwrite stage from landing. Thus this repo is best characterized as an operational local exploit adaptation with a working KASLR-leak payload and partial exploit chain, rather than a fully successful end-to-end root exploit for the documented target.

This repository is a standalone Android bootloader-unlock toolkit, not tied to a common exploit framework. It contains two primary entry points: `8e5-unlock.bat` for Windows and `8e5-unlock.sh` for macOS/Linux. Both scripts automate the same workflow against supported Xiaomi/Redmi devices over USB using bundled ADB/Fastboot tools. Core capability: the scripts claim to exploit `CVE-2026-43499` by pushing `preload-8e5-Ennea.so` and `linuxloader_unlock.efi` to `/data/local/tmp/`, then invoking `LD_PRELOAD=/data/local/tmp/preload-8e5-Ennea.so id` to obtain temporary root. After root is confirmed via `su -c id`, the scripts back up the device's `abl_a` and `abl_b` partitions, flash a patched ABL image selected by device codename, and write the EFI component to `efisp`. The device is then rebooted into fastboot, where the script checks `oem device-info`, erases the `frp` partition, erases `efisp`, flashes `misc_wipedata_mi.img` to `misc` to force a factory reset, restores the original ABL backups, and reboots. Repository structure is small: 9 files total, with 2 code files, 2 markdown documentation files, one binary wipe image, and minimal platform-tools metadata. The actual exploit payload binaries referenced by the scripts (`preload-8e5-Ennea.so`, `linuxloader_unlock.efi`, and patched ABL files under `unlockFolder/factoryABL/`) are described in the docs but are not present in the provided file listing, suggesting the archive may be incomplete or trimmed. Even so, the scripts clearly implement an operational unlock chain rather than mere detection. The attack vector is primarily local/physical over USB against a connected Android handset, with destructive side effects including FRP clearing and full data wipe.

This repository is a real Android local privilege-escalation exploit for CVE-2026-43499 targeting Xiaomi Android 16 devices, especially the 'popsicle' platform referenced as Xiaomi 17 Pro Max. The repo is structured in two stages: helper tooling and the actual exploit. The Python helpers are 'detect_offset.py', which uses adb plus 'su -c cat /proc/iomem' on an already rooted reference device to derive physical memory offsets, and 'generate_target.py', a large target-generation utility that parses boot.img, extracts the arm64 kernel image, recovers symbols/BTF/layout information, and emits a device-specific 'target.h'. The exploit itself lives under 'source/src/' and is built as 'preload.so' via the provided Makefile. Operationally, the exploit is triggered through an LD_PRELOAD constructor in 'preload.c'. Once loaded into '/system/bin/true', it runs 'run_exploit()', pins execution to a performant CPU, leaks the kernel base/KASLR slide using the 'slide' stage, then performs a direct root stage that manipulates kernel memory. The C code shows heavy use of futex PI/requeue primitives, crafted fd_set/pselect state, scheduler interactions, skb-based page preparation/reclaim, and the bundled 'KernelSnitch' code to reason about kernel memory structures such as mm_struct and futex hash buckets. This indicates a sophisticated local kernel exploitation chain rather than a simple logic bug trigger. Post-exploitation capability is substantial. The payload does not stop at proving code execution: it aims to install root credentials, disable SELinux enforcement, and deploy an embedded su implementation. 'preload.c' writes the embedded su binary to '/apex/com.android.virt/bin/su' and '/data/local/tmp/su', optionally enters the adbd mount namespace to make the su binary adb-visible, and starts a background daemon. 'su_daemon.c' implements both the daemon and client: it binds an AF_UNIX socket at '/data/local/tmp/temp_su.sock', accepts connections from uid 0 or shell (AID_SHELL), and supports either command execution ('su -c <cmd>') via '/system/bin/sh -c' or an interactive root shell over a PTY. This makes the exploit OPERATIONAL rather than a bare PoC. No external network C2 or remote endpoints are present; the attack vector is strictly local. Fingerprintable artifacts are mostly Android filesystem and procfs/sysfs paths, the adb invocation pattern, the boot image input, and the Unix socket/log/su installation paths. Overall, this repository is a complete, device-tailored Android kernel LPE chain with build-time kernel analysis and a built-in root shell persistence/access component.

Repository contains two distinct exploit tracks. The first, IonStack/CVE-2026-10702, is a browser-based JavaScript/HTML exploit targeting Firefox on Android. It uses index.html as an orchestrator that spawns exploit.html in child frames, exchanges status via postMessage, fingerprints the device using build identifiers, and appears to drive a command-execution workflow while reporting progress/results back to the parent UI. It is a browser attack vector, not just a detector. The second and much larger component, IonStack/CVE-2026-43499/exploit, is a local Android kernel privilege-escalation exploit written primarily in C for arm64 and built as a preload shared object. The Makefile builds preload.so and an embedded su daemon binary for multiple device-specific targets. Core structure: main.c coordinates the race/exploit flow; slide.c leaks KASLR; fops.c corrupts/rewrites file_operations-related state via ashmem/configfs primitives; pipe.c establishes kernel physical read/write using forged pipe buffers; root.c patches credentials and SELinux-related state to obtain root; preload.c acts as constructor entry point and post-exploitation installer; su_daemon.c provides a root command/interactive shell service over a UNIX socket; target.h files encode per-device kernel offsets and build fingerprints. Exploit capability for CVE-2026-43499 is substantial: it leaks kernel base, gains arbitrary kernel read/write, locates and patches task/cred structures, attempts to set SELinux permissive, spawns a root child, installs a su binary into /apex/com.android.virt/bin/su and /data/local/tmp/su, starts a daemon on /data/local/tmp/temp_su.sock, and modifies wallpaper files. The repository includes many target profiles for Google Android builds (blazer, caiman, comet, frankel, komodo, mustang, rango, stallion) and one OPPO PJA110 profile. Several target directories override common files with device-specific exploit logic and offsets. Overall, this is a real exploit repository with operational post-exploitation payloads, not a fake or detection-only project.

Repository contains two distinct exploit projects. CVE-2026-10702 is a browser-only HTML/JavaScript exploit for Firefox on Android. Its structure is small: index.html is the launcher/UI wrapper, exploit.html contains the main exploitation logic, and ansi.js renders colored logs. The browser exploit uses iframe/parent postMessage coordination, fingerprints the device via build ID, gates execution with user confirmation, and appears to run commands while polling output/status files via Android shell utilities. It is clearly an exploit rather than a detector. CVE-2026-43499 is the larger component: a local Android ARM64 kernel privilege-escalation exploit written in C with a Makefile-based build system. The codebase is organized into reusable core files (main.c, fops.c, pipe.c, slide.c, root.c, preload.c, su_daemon.c, common.h, kernelsnitch helpers) plus many target-specific directories under src/targets containing build fingerprints and kernel offsets for numerous Google device codenames and one OPPO target. The exploit chain includes: KASLR leak via slide.c, fake file_operations / pselect-futex race logic in fops.c, pipe-based physical read/write primitive in pipe.c, credential and SELinux patching in root.c, and post-exploitation persistence/utility actions in preload.c. Main capabilities of CVE-2026-43499: obtain arbitrary kernel read/write, locate and patch current task credentials, elevate to uid 0, attempt SELinux permissive mode, install an embedded su binary, start a root daemon over UNIX socket /data/local/tmp/temp_su.sock, optionally expose su inside adbd mount namespace, and modify wallpaper/system state. The embedded su daemon supports both interactive shells and one-shot command execution using /system/bin/sh. The exploit is operational and tailored to specific Android builds rather than broadly weaponized. Notable repository structure: many duplicated target variants (blazer, caiman, comet, frankel, komodo, mustang, rango, stallion, tegu, oppo-find_n2) each define BUILD_FINGERPRINT and kernel symbol/structure offsets. This indicates the exploit is highly dependent on exact kernel layout and intended for real-device exploitation across selected Android 16/17 builds.

This repository is a small local Linux kernel PoC for CVE-2026-43499, adapted specifically for ARM 32-bit (ARMv7/Android-style) environments. It contains four files: a README, two shell scripts, and one C trigger program. The core exploit logic is in trigger.c, while ghostlock_check.sh performs on-device version/config checks and ghostlock_all.sh combines a quick kernel-version assessment with automatic execution of the trigger binary. The exploit is not remote and does not provide code execution or privilege escalation payloads. Instead, it is a denial-of-service style validation PoC: it attempts to trigger a futex priority-inheritance use-after-free in the Linux kernel by orchestrating multiple threads and futex states. The code builds a deadlock/requeue chain involving futex1, futex2, and cycle_futex, then invokes FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI to reach an EDEADLK path and probe the suspected dangling waiter state with FUTEX_LOCK_PI. The expected outcome is kernel panic and reboot, which the README explicitly states. Repository structure and purpose: README.md documents affected/fixed kernel ranges and adb-based usage; ghostlock_check.sh is a detection helper that inspects uname output, /proc/config.gz or /proc/config for CONFIG_FUTEX_PI, and /proc/kallsyms for related symbols; ghostlock_all.sh is a convenience wrapper that checks kernel version and launches /data/local/tmp/trigger after a warning delay; trigger.c is the actual PoC implementation. The code includes ARM EABI syscall constants and a futex_time64 fallback mechanism, indicating deliberate portability work for 32-bit ARM kernels. Overall, this is a genuine proof-of-concept crash trigger for vulnerability verification on local Android/Linux ARMv7 targets.

This repository is a compact proof-of-concept exploit for CVE-2026-43499, a Linux kernel futex priority-inheritance use-after-free in rtmutex waiter cleanup. The repo contains one real exploit source file (trigger.c), a CMake build file configured for Android NDK arm64 builds, a README explaining the bug and usage, and a captured kernel crash log demonstrating successful triggering. The exploit is local-only and does not contact any remote network service. Its purpose is to reliably drive the kernel into the vulnerable remove_waiter() path by coordinating three threads/tasks and three futexes. The code uses raw futex syscalls via syscall(SYS_futex) and specifically exercises FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI to create a deadlock cycle that returns EDEADLK. Due to the bug, the waiter task's pi_blocked_on pointer is left referencing a waiter structure on a kernel stack frame that later unwinds. After a timed wait expires, the code intentionally churns the waiter thread's kernel stack with repeated SYS_getpid calls, then performs FUTEX_LOCK_PI on cycle_futex to force rt_mutex_adjust_prio_chain() to follow the stale pointer and crash the kernel. Repository structure: - trigger.c: Main PoC. Defines three futex variables, helper wrappers, two worker threads (owner_fn and waiter_fn), and main orchestration logic. - CMakeLists.txt: Android NDK/CMake build configuration producing a native executable named trigger for arm64-v8a / android-26. - README.md: Vulnerability description, affected versions, build/deploy instructions using adb, and fix commit reference. - dmesg_crash.txt: Example kernel panic output showing the crash in rt_mutex_adjust_prio_chain. - .gitignore: Ignores build artifacts. Exploit capability assessment: this is a denial-of-service PoC rather than a privilege-escalation exploit. It demonstrates reliable reachability of the vulnerable kernel path and produces a kernel panic on vulnerable systems, but it does not include a post-exploitation payload, shell, or arbitrary code execution primitive.