PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Analysis of Qualcomm Secure Boot Chains

blog.quarkslab.com | research | #reverse-engineering | #exploitation | #qualcomm | #secure-boot | #armv8 | #el3
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A six-month internship study of Qualcomm secure boot chains: dumping bootROM/SBL on Nexus 6P and Nokia 6, taking over the chain and hooking the secure monitor for EL3 read/write.
Published
Collected

Related coverage

research · blog.quarkslab.com
Breaking Secure Boot on the Silicon Labs Gecko platform
Vulnerability research on Silicon Labs' Gecko Bootloader: an OTA parser flaw in the open-source Gecko SDK that breaks Secure Boot and affects connected devices built on the platform.
research · blog.quarkslab.com
Attacking the ARM's TrustZone
Second TrustZone post: a technical view of the attack surface — monitor message handlers, trustlets and Secure Boot — and what code execution at each privilege level enables.
research · blog.quarkslab.com
Vulnerabilities in High Assurance Boot of NXP i.MX microprocessors
Quarkslab details two NXP i.MX High Assurance Boot vulnerabilities: ASN.1 parsing flaws let attackers bypass secure-boot signature verification and run arbitrary code on 12 processor families.
research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part I
First part of the Samsung S6 SBOOT series: ARMv8 background, IDA Pro tooling and helper plugins, plus right and wrong assumptions made while reversing this undocumented bootloader blob.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back