PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reverse Engineering Samsung S6 SBOOT - Part II

blog.quarkslab.com | research | #android | #reverse-engineering | #tee | #samsung | #bootloader | #trustonic
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Part two of the Samsung S6 SBOOT reverse engineering series: two techniques for locating Trustonic's TEE (t-base) inside the proprietary bootloader blob, continuing the path toward the TEE OS.
Published
Collected

Related coverage

research · blog.quarkslab.com
Attacking the Samsung Galaxy A* Boot Chain
Chaining vulnerabilities in the Samsung Galaxy A boot chain, Quarkslab achieves bootloader code execution, persistent Android root and leaks Secure World memory — including Android Keystore keys.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 3)
Part three of the Samsung TrustZone series: the vulnerabilities found in Secure World components (Kinibi trustlets) and how they were exploited to reach code execution in EL3 on Galaxy devices.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 2)
Part two of the Samsung TrustZone series introduces the toolset built for the research: Ghidra/IDA loaders for MCLF and SBOOT, a trustlet communication framework, an AFL/Unicorn fuzzer and more.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 1)
Part one of a three-part series touring Samsung's TrustZone implementation (with Trustonic/Kinibi): its components, how they interact, and the TEE security model on Galaxy S6-S9 devices.
research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part I
First part of the Samsung S6 SBOOT series: ARMv8 background, IDA Pro tooling and helper plugins, plus right and wrong assumptions made while reversing this undocumented bootloader blob.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back