CVE-2026-43499 / GhostLock PoC for OPPO MT6835

This repository preserves a compact research snapshot for the GhostLock-style exploit chain targeting an OPPO MT6835-based device.

Scope

• Exploit source tree under exploit
• Minimal proof-of-concept under poc
• Supporting analysis notes and build artifacts that were produced during the investigation

What is included

• A shared Android exploit implementation for the CVE-2026-43499 workflow
• A target-specific configuration for the OPPO PLS120 / MT6835 investigation
• A compiled preload payload under exploit/build/oppo-PLS120-BP2A.250605.015/bin/preload.so
• A compact set of analysis notes in exploit/src/targets/oppo-PLS120-BP2A.250605.015/report.md

Important notes

• The repository intentionally omits some large vendor-specific binary artifacts and local build environment files to keep the snapshot portable and privacy-conscious.
• The exact device build and kernel identifiers were generalized in the report to reduce exposure while keeping the exploit logic and offsets intact.
• This content is provided for defensive research and education only.

Build

From the repository root:

cd exploit
make PROJECT=oppo-PLS120-BP2A.250605.015

Usage

After building the preload payload, push it to a test device and run it under a controlled lab environment:

adb push exploit/build/oppo-PLS120-BP2A.250605.015/bin/preload.so /data/local/tmp/
adb shell chmod 755 /data/local/tmp/preload.so
adb shell LD_PRELOAD=/data/local/tmp/preload.so id

Repository layout

.
├── boot/                  # trimmed analysis artifacts
├── exploit/               # exploit source and build output
├── poc/                   # minimal PoC entry point
├── tools/                 # auxiliary analysis scripts
└── README.md

Disclaimer

Use only on devices and systems you are authorized to test. The author assumes no liability for misuse.