CVE-2026-43499 Failure Log: MT6985 Adaptation Attempt

Conclusion: Spent 68M tokens, didn't get root.
Reason: KernelSnitch timing attack is unreliable on MTK Dimensity 9300, CONFIG_PANIC_ON_OOPS=y leaves no room for trial and error.
**This article records the complete pitfall process for future reference to avoid the same traps.

Background

What Was Done

1. Source Code Analysis → Extracting Struct Offsets

Extracted from arch/arm64/include/asm/memory.h + include/linux/fs.h + android/abi_gki_aarch64.xml:

• Memory layout: KIMAGE_TEXT_BASE = 0xffffffc008000000, VA_BITS=39, DIRECT_MAP=256GB
• task_struct: 36864 bits, fully parsed (ABI XML layout-offset-in-bits)
• file_operations: no iopoll (android13 GKI), IOCTL=0x48, open=0x68
• cred: atomic_t usage = 4 bytes, uid=0x04
• struct page: 64 bytes, slab_cache=0x18

Key finding: the source is android15 GKI, the device is android13 GKI — task_struct offsets differ by 0x40~0x88 bytes, so the source cannot be blindly copied.

2. Firmware Unpacking → Extracting Symbols

OTA zip (8.3GB)
  → payload.bin (8.2GB)
    → payload_dumper → boot.img (96MB, v4 header)
      → LZ4 解压 → Image (50MB ARM64)
        → kallsyms-finder → 187810 符号

Extracted symbols from two firmware versions (15.2.7.6 / 15.2.10.2) — the same symbol differs by 10KB~200KB between the two versions, you must use the right version.

3. Disassembly Verification → Capstone Confirms Key Offsets

# rt_mutex_adjust_pi 中:
LDR x21, [x19, #0x8b0]  → pi_blocked_on = 0x8b0 (android15 值, 非 frankel)

This confirmed that the task_struct layout is the android15 branch, not frankel's android13.

4. Compilation → Passes

NDK r29, make PROJECT=android_15.0_kernel_MT6985 → preload.so (150KB).

5. Running → Repeated Crashes

[+] preload starting pid=25414
[+] p0 profile ... 所有符号正确加载
[-] KernelSnitch mm_struct leak failed     ← 有时没这条 (偶尔成功)
[+] slide child context route=pselect      ← slide KASLR leak 子进程启动
[内核 panic]                                ← rt_mutex_adjust_prio_chain+0x1b0

Crashing instruction (capstone):

ldar w8, [x27]    ; x27 = waiter->lock (从 [x28, #0x38] 加载)
                  ; x27 值是垃圾 → 页表无映射 → translation fault
                  ; → die() → panic → 重启

Why It Failed

Root Cause 1: KernelSnitch Is Unreliable on MTK

KernelSnitch is the entry point of the entire exploit — it leaks the mm_struct address through the timing difference of futex hash buckets:

1. Collision detection succeeded — found 5 collisions at a low threshold
2. Bruteforce matching almost always failed — the core problem is:

MT6985 有 CONFIG_KASAN_HW_TAGS=y → 内核用 MTE 标签标记 slab 分配
mm_struct 的指针带了 KASAN tag → futex_hash 基于 tagged pointer 计算

但 bruteforce 扫描 direct map (untagged 地址) → 算出来的 hash 对不上
即使加上 MTE tag 遍历 (0-14 共 15 种), 在 VA_BITS=39 的系统上
tag 位 (bit56-59) 与符号扩展位重叠 → 有些 tag 组合产生无效地址 → 漏检

Pixel devices don't have KASAN_HW_TAGS, so this mechanism works there. MTK doesn't.

Root Cause 2: CONFIG_PANIC_ON_OOPS Is the Killer

Pixel:  内核 OOPS → dump_stack → 继续跑 → exploit 可重试
MT6985: 内核 OOPS → die() → panic() → 秒重启 → 无试错空间
π 链破坏稍有偏差就全盘崩，Pixel 上偏差了只是"这次没成功，换组地址再来"。

Additionally, the bootloader is locked (flash.locked=1) → cannot flash a custom kernel to remove this option.

Root Cause 3: Kernel Version Drift

源码树: 5.15.178 android15 GKI
设备:   5.15.178-android13 (vivo vendor)

Although both major version numbers are 5.15.178, the GKI branches differ (android13 vs android15), and the layouts of key structs such as task_struct/cred are inconsistent. After repeatedly switching between the frankel and android15 offset sets, it was ultimately pinned down by disassembly.

Adjustments Tried (All Useless)

Current State of target.h

In exploit/targets/android_15.0_kernel_MT6985/target.h:

It assembles fine and runs, but loses in the last mile.

If You Want to Continue

Prerequisites (All Required)

1. Remove CONFIG_PANIC_ON_OOPS — either flash a custom kernel (requires unlocking the bootloader), or find an MT6985 device with this option disabled by default
2. Fix KernelSnitch — requires cache timing calibration for the MTK Dimensity 9300, or completely replacing KernelSnitch in the exploit with another mm_struct leak method

Possible Alternative Approaches

• /proc/self/pagemap — restricted on this device (returns all zeros)
• MTK-specific debug interfaces (/proc/mtk_*) — exist but need further analysis
• MTK camera/GPU driver ioctl vulnerabilities — a simpler privilege escalation path
• Wait for the community to port an MTK variant

Residual Value of This Repository

• symbols/kallsyms_PD2241_15.2.10.2.txt — complete 15.2.10.2 symbol table; later users can use it directly
• device_config.txt — the device's actual kernel config, showing what the vendor changed
• exploit/targets/android_15.0_kernel_MT6985/target.h — struct offsets verified
• scripts/server_compile.py — automated compilation, rebuilds quickly after changing parameters

Pitfall Checklist (For Future Reference)

1. Extracting files on Windows: tar -xf may fail on large zips; use Python zipfile or manually extract first
2. payload_dumper protobuf version conflict: the generated update_metadata_pb2.py requires protobuf 5.x; you need to manually delete the runtime_version import line
3. Running ./preload.so directly will segfault: you must use /system/bin/linker64 /data/local/tmp/preload.so
4. ABI XML is more accurate than the source code: layout-offset-in-bits is computed by the compiler, 100x more accurate than manually counting 5000 bytes
5. GKI branches affect the layout: task_struct differs across android13/14/15; offsets cannot be copied across branches
6. Different firmware versions have different symbol offsets: 15.2.7.6 and 15.2.10.2 differ by 10KB~200KB
7. vivo vendor adds a large number of OEM fields: CONFIG_ANDROID_VENDOR_OEM_DATA=y, CONFIG_SCHED_INFO=y, CONFIG_RSC_* → deviates from standard GKI

Timeline

07/28  下载 CyberMeowfia 仓库 + MT6985 源码
07/29  源码分析 (memory.h, fs.h, ABI XML, 各种 struct)
       固件解包 (payload.bin → boot.img → Image)
       符号提取 (kallsyms-finder → 187810 符号)
       多轮编译 + 多轮崩溃 + 反汇编验证
       5 次自动重试 → 全部失败
       写成这篇
-------------------------------------------
总计: ~68M tokens, 0 root shells

2026-07-29, lived to tell the tale