PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Attacking the Samsung Galaxy A* Boot Chain

blog.quarkslab.com | research | #android | #exploitation | #vulnerability | #samsung | #bootloader | #little-kernel
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Chaining vulnerabilities in the Samsung Galaxy A boot chain, Quarkslab achieves bootloader code execution, persistent Android root and leaks Secure World memory — including Android Keystore keys.
Published
Collected

Related coverage

research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part II
Part two of the Samsung S6 SBOOT reverse engineering series: two techniques for locating Trustonic's TEE (t-base) inside the proprietary bootloader blob, continuing the path toward the TEE OS.
research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part I
First part of the Samsung S6 SBOOT series: ARMv8 background, IDA Pro tooling and helper plugins, plus right and wrong assumptions made while reversing this undocumented bootloader blob.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · eshard.com
Pixel 6 Bootloader: Exploitation - Part III
The third part of our series of exploitation of the Google's Pixel 6 bootloader.
blog · projectzero.google
Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge
Project Zero researched the Samsung Galaxy S6 Edge and reported 11 high-impact security issues, discussing motivations, methodology and lessons learned from the device research.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 3)
Part three of the Samsung TrustZone series: the vulnerabilities found in Secure World components (Kinibi trustlets) and how they were exploited to reach code execution in EL3 on Galaxy devices.
Back