PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Reverse Engineering Samsung S6 SBOOT - Part I

blog.quarkslab.com | research | #android | #reverse-engineering | #samsung | #bootloader | #armv8 | #ida
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

First part of the Samsung S6 SBOOT series: ARMv8 background, IDA Pro tooling and helper plugins, plus right and wrong assumptions made while reversing this undocumented bootloader blob.
Published
Collected

Related coverage

research · blog.quarkslab.com
Attacking the Samsung Galaxy A* Boot Chain
Chaining vulnerabilities in the Samsung Galaxy A boot chain, Quarkslab achieves bootloader code execution, persistent Android root and leaks Secure World memory — including Android Keystore keys.
research · blog.quarkslab.com
Reverse Engineering Samsung S6 SBOOT - Part II
Part two of the Samsung S6 SBOOT reverse engineering series: two techniques for locating Trustonic's TEE (t-base) inside the proprietary bootloader blob, continuing the path toward the TEE OS.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
blog · projectzero.google
Hack The Galaxy: Hunting Bugs in the Samsung Galaxy S6 Edge
Project Zero researched the Samsung Galaxy S6 Edge and reported 11 high-impact security issues, discussing motivations, methodology and lessons learned from the device research.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 3)
Part three of the Samsung TrustZone series: the vulnerabilities found in Secure World components (Kinibi trustlets) and how they were exploited to reach code execution in EL3 on Galaxy devices.
research · blog.quarkslab.com
A Deep Dive Into Samsung's TrustZone (Part 2)
Part two of the Samsung TrustZone series introduces the toolset built for the research: Ghidra/IDA loaders for MCLF and SBOOT, a trustlet communication framework, an AFL/Unicorn fuzzer and more.
Back