Driving forward in Android drivers

Part 7 of the Windows Registry Adventure series, mapping which Windows components parse registry data and identifying the most promising attack surface for deeper research.

Part 6 of the Windows Registry Adventure series, examining kernel-mode registry objects and the additional attack surface they expose to privilege escalation research.

Part one of a macOS audio series: building a fuzzer for CoreAudio by sending Mach messages, covering the attack surface, harness design, and early results.

Part 1 of the Windows Registry Adventure series, introducing the research goals, methodology, and headline results from auditing how Windows parses registry data.

Part 2 of the Windows Registry Adventure series, giving a brief history of the registry as a Windows feature and how its evolution shaped today's attack surface.

This blog post discusses a bug leading to memory corruption in Samsung's Android kernel (specifically the kernel of the Galaxy A50, A505FN - I haven't looked at Samsung's kernels for other devices). I will describe the bug and how I wrote a (very unreliable) exploit for it. I will also describe how a second vulnerability, which had long been fixed in the upstream kernel, the upstream stable releases, and the Android common kernel, but not in Samsung's kernel, aided in its exploitation.