## https://sploitus.com/exploit?id=DBCCC43D-2352-57B4-ADF7-0BB84AF85B94
CVE-2026-43499 β Android arm64 Local Privilege Escalation
A research adaptation of IonStack based on Nebula Security, targeting Android arm64 kernel-level local privilege escalation.
iQOO Neo11 (PD2520) | SM8750 | Snapdragon 8 Elite | Android 15
---
> **For educational/security research purposes only.** Please run this on a device that you own or have been authorized to use. This is a real kernel exploit; incorrect use may cause a kernel panic or damage the device. β
## Features
- **KASLR Sliding Address Leak:** Implemented using the `pselect` race primitive. On this target, `perf` sampling will show incorrect base addresses leading to a panic; this feature is disabled.
- ** Arbitrary Kernel Memory Read/Write:** Based on the `pipe_phys` primitive (`pipe_read64`, `pipe_write64`, `pipe_phys_read_data`, `pipe_phys_write_data`).
- **Bypass of `vr.ko` Anti-Root Mechanism:** Vivoiβs anti-root module terminates any process with `uid 0`. This chain redirects its `sys_exit` probe to a no-op and clears per-task flags.
- **Independent SU Daemon Process** (rollback option) **+ KernelSU LKM Boot**, allowing root access to be retained across soft restarts.
- **Multi-model Support:** Each build generates the `target.h` offset table from the corresponding modelβs `boot.img`.
---
## Environment Requirements
- Python 3, LLVM / `llvm-objdump`
- Android NDK r29 (or r28) β Requires `aarch64-linux-android35` version of clang
- `make` (GNU make; MSYS2 UCRT64 for Windows) or the projectβs `build.sh` script
- `adb`
- Target modelβs `boot.img` + `profile_*.json` (physical offsets / kernel physical loading addresses)
---
## Project Structure
```text
CVE-2026-43499/
βββ LICENSE # Apache-2.0
βββ README.md
βββ exploit/
β βββ Makefile # GNU make build script
β βββ build.sh # Directly calls NDK clang build (no need for make)
β βββ 10-neo11-su.sh # KernelSU boot service script
β βββ assets/wallpaper.webp # Embedded example wallpaper
β βββ build/ # Build artifacts (preload.so, su_daemon)
β βββ src/
β βββ main.c # Entrance / thread routing
β βββ preload.c # LD_PRELOAD loader, su/KernelSU/bootshell installation
β βββ slide.c # KASLR sliding address leak
β βββ pipe.c # pipe-phys arbitrary read/write
β βββ fops.c # Forging file_operations
```
β βββ root.c # cred / seccomp / vr.ko patches
β βββ su_daemon.c # independent su daemon + client
β βββ targets// # target.h / root.c for each model
βββ poc/
βββ poc.c # minimize PoC
```
---
## Building
Configure the Android NDK (or set `ANDROID_NDK_HOME`):
```sh
# Use GNU make (automatic generation or manually)
make PROJECT=PD2520-BP2A.250605.031.A3 clean preload
# Or use the provided script (no need for make)
ANDROID_NDK_HOME=/path/to/ndk bash build.sh
```
Output:
- `build/PD2520-BP2A.250605.031.A3/bin/preload.so`
- `build/embed/su_daemon_aarch64_pie`
To adapt it for other models, first generate `target.h` from `boot.img` of that model (see `exploit/Makefile`βs `list-projects`), then build with the corresponding `PROJECT`. ---
## How to use
Push the file and trigger exploitation using `adb`:
```sh
adb push build/PD2520-BP2A.250605.031.A3/bin/preload.so /data/local/tmp/preload.so
adb shell "LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true"
```
Verify root access:
```sh
adb shell su -c id
# uid=0(root) gid=0(root) context=u:r:ksu:s0
```
On vivo/iQOO devices, this chain will also neutralize `vr.ko`, so the `su` process wonβt be silently killed. ---
## Notes
- The `pipe` primitive writes directly into kernel memory. Incorrect offsets, non-standard addresses, or writing small integers at pointer locations may cause **kernel panic** and force a device restart. - The `kernelsu.ko` must match the running kernel (e.g., `vermagic`). Ko files compiled for other kernels (e.g., `6.6.127`) cannot be loaded on `6.6.89`; `insmod` reports `ENOENT`. - Root access obtained in one run is not retained after a **hard reboot**, unless the KernelSU LKM is embedded in the kernel (only soft reboots retain it). ---
## License
[Apache-2.0](LICENSE)
---
## Acknowledgments and Copyright
This project is adapted and enhanced based on **Nebula Security**βs **IonStack** research. Original research:
- [IonStack part II: GhostLock](https://nebusec.ai/research/ionstack-part-2)
- [Nebula Security](https://nebusec.ai)
Source code retains original authorsβ watermarks (e.g., `nebusec_*` tags) and adheres to the Apache-2.0 license. Your attribution statement can be found in [LICENSE](LICENSE). ----
## Disclaimer
This project is intended solely for defensive research and education purposes. The author assumes no responsibility for any misuse, damage, or illegal use of this software. Please use it only on hardware that you own and have the right to test.