David Buchanan

11 Sept 2001

what a lovely day, I sure hope nothing bad happens

David Buchanan reposted

31 Mar

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

11 May

[ accept bonus cookies ]

11 May

I think I slightly look down on people who use vscode but I also use vscode myself

hmm

anyway I guess this is proof that a full Play Integrity bypass is within "weekend project" territory. this approach does not exploit any bugs or rely on leaked key material, so it cannot be patched.

David Buchanan@retr0.id

injected frida-gadget via slightly modified AndKittyInjector

David Buchanan reposted

Replying to @retr0.id

injected frida-gadget via slightly modified AndKittyInjector

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

I just migrated into dumpstate which has, afaict, the most permissive selinux policy

injected frida-gadget via slightly modified AndKittyInjector

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

aaaand there it is, root shell in pid 1 context (which isn't the best selinux context but hey, it's root)

it's very funny to me that you can't mmap an anonymous+exec page, but you can map an executable file just fine and then overwrite it with your own code. all these mitigations are very annoying, but they are only an annoyance.

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

however it looks like ptrace_attach does a different (inlined?) check, so I need to patch that too!

now we're cooking - thinking about it, I can probably use this to inject shellcode into pid1 and spawn myself a root shell that way

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

claude's exploit did not work so I'll have to use my brain oldschool style (claude seems repeatedly confused by physical vs virtual address spaces)

I gave up on getting a root shell, since that isn't my real goal here. I just want to be able to inject code into other processes. I patched ptrace_may_access in kernel .text to always return true, so now I can access anything that would normally be gated on that - e.g. /proc/pid/maps.

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

I let claude devise a new LPE strat and I haven't reviewed it, but trying things is ~free

for this device, the kernel is always at a fixed physical address - so walking kernel structs is easy. so the plan is, find pid1's cred struct and duplicate it into the current process. and also disable DEFEX (which seems easy once the offsets are known)

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

now I'm pointing claude at the headless loader scripts I wrote for github.com/DavidBuchana..., so I should get a nice clean symbolicated kernel loaded in ghidra, with struct layouts, without any manual effort

noice

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

finally had some good luck, physmem dump is in progress

reverse engineering in 2026 is so cool

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

Actually I might be hitting samsung's "DEFEX" mitigations: docs.samsungknox.com/admin/fundam...

I've had an unlucky streak in terms of getting the exploit to trigger, I'm currently trying to dump all of physmem to a file for analysis but it hasn't landed yet.

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

ok yeah this is a SELinux Thing™, will need a more intelligent exploit strat. surely there is good prior art of anrdoid phys r/w -> root?

current plan: dump /sys/kernel/btf/vmlinux out of kernel memory (normally it needs root to read), then I can infer layouts of all the kernel structs I care about, and do more targeted struct-walking instead of pattern scanning

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

debugging it is tedious because it takes several attempts for the phys r/w setup to not crash the whole device

plausibly this is a SELinux thing™, I thought I'd keep things simple to start with so I'm just patching cred - if anyone has any guesses what the issue might be lmk

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

the exploit so far: github.com/DavidBuchana...

succeed at locating the current pid's struct cred, but for some reason died during/after trying to patch it

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

some *very* promising initial results, although it crashed at the end, while trying to test the r/w primitive. plausibly because I flipped too many bits - will keep attempting (this one was on the third attempt, previous attempts just crashed the device)

hell yeah - second attempt after this, the r/w primitive worked fully. now I need to figure out the second half of the LPE - overwriting a setuid binary won't work

da.vidbuchanan.co.ukCan You Get Root With Only a Cigarette Lighter? | Blog

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

so, can I use this to LPE into kernel? probably. I'll try to use the approach I described here, although it'll need some tweaking for aarch64/android: www.da.vidbuchanan.co.uk/blog/dram-em... if it works, this is a Play Integrity bypass on a fully patched device, without using any software bugs.

I'm letting claude port the exploit, which may be a bad idea.

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

what I *am* interested in is the interface between the CPU and the DRAM. I've removed the epoxy and carefully sanded away some of the solder mask. what happens when I poke the data lines with a needle?