hycqaq/logitech-g-cloud-ghostlock-cve-2026-43499罗技云掌机 · GhostLock CVE-2026-43499 root 尝试
⚠️ For research and defensive purposes only
All content in this repository is generated by DeepSeek AI, for security research, vulnerability analysis, and defensive security assessment only.
Standard exploit chain NOT applicable
The CVE-2026-43499 vulnerability exists and is reachable via futex PI race (EDEADLK confirmed), but Qualcomm rewrote the rtmutex core code (rbtree → bitmap/linked-list). The standard IonStack write primitive (rb_erase constrained write) does not exist on this kernel.
The CVE-2026-43499 vulnerability exists and is reachable via futex PI race (EDEADLK confirmed), but Qualcomm rewrote the rtmutex core code (rbtree → bitmap/linked-list). The standard IonStack write primitive (rb_erase constrained write) does not exist on this kernel.
| Item | Value |
|---|
| Model | Logitech G Cloud (HALO) |
| Firmware | SQ02K.60.0228 (2025-08-27) |
| SoC | Qualcomm Snapdragon 720G (SM7125, ATOLL) |
| GPU | Adreno 618 (700MHz) |
| CPU | Kryo 465: 2×Cortex-A76 @2.3GHz + 6×Cortex-A55 @1.8GHz |
| Process | 8nm |
| RAM | 4GB LPDDR4X |
| Storage | 64GB UFS |
| Display | 7-inch IPS LCD, 1920×1080, 60Hz |
| Battery | 6000mAh |
| Connectivity | Wi-Fi 5, Bluetooth 5.1, USB-C 3.1 |
| Kernel | Linux 4.14.190-perf+ (Clang 10.0.7, GNU ld 2.27) |
| Kernel Build | scm@a9b0f71b66dc, SMP PREEMPT, 2025-08-27 |
| Kernel Base | Qualcomm LA.UM.9.1.r1-09200-SMxxx0.0 |
| Android Version | Android 11 (API 31) |
| Built by | Tencent Level Infinite (Zing build system) |
| Bootloader | Locked, avb=vbmeta, dm-verity enabled |
| KASLR | Enabled (bypassable via perf_event_open) |
| Protections | KPTI ✅ / PAN ✅ / SCS ❌ / CFI ❌ / PAC ❌ |
| SELinux | Enforcing |
| Hardware ID | GR0006 (Logitech HALO CN) |
| Software Partner | Logitech (hardware) + Tencent Games (software) |
📥 Mega.nz Download Link:
[https://mega.nz/folder/I2MUkQyD#n6bG8gzsjqKNdpk8napniQ]Included files:
Logitech-HALO_CN-SQ02K.60.0228-USER.zip— Full firmware (1.37 GB)boot.img— Full boot image (64 MB)kernel— Uncompressed ARM64 kernel (35 MB)kernel.gz— Compressed kernel (15 MB)ramdisk— Boot ramdisk (87 KB)config.txt— Full kernel build config (61 KB)
GhostLock-SD720G-CVE-2026-43499/
├── exploit/ # Kernel exploit source & binaries
│ ├── sd720g_exploit.c # Main exploit (race trigger + KASLR + log)
│ ├── sd720g_exploit # Compiled ARM64 binary (2.1 MB)
│ ├── target_sd720g.h # Core symbol offsets (12 functions)
│ ├── target_sd720g_complete.h # Full 37 symbol table
│ ├── perf_leak_sd720g.c # KASLR base leak tool
│ ├── perf_leak # Compiled binary (2.1 MB)
│ └── compile_perf_leak.bat # NDK build script
│
├── preload/ # LD_PRELOAD shared library
│ ├── sd720g_preload.c # Constructor-based exploit
│ ├── arm.so # Compiled ARM64 .so (16 KB)
│ └── compile_preload.bat # Build script
│
├── tools/ # Analysis & extraction scripts
│ ├── extract_kallsyms.py # Pure Python kallsyms parser (PIE-aware)
│ ├── extract_symbols.py # Symbol offset extractor
│ ├── find_ghostlock_bug.py # Binary search for pi_blocked_on=NULL pattern
│ ├── reanalysis.py # 0x105aeb0 & rb_erase call chain trace
│ ├── trace_waiter.py # rt_mutex_waiter field write search
│ ├── analyze_pi_state.py # pi_state alloc/free lifecycle analysis
│ └── kgsl_uaf_test.c # KGSL GPU UAF trigger test
│
├── docs/ # Analysis documents
│ ├── CVE2026-43499_SD720G_分析.md # Full analysis report (Chinese)
│ ├── GHOSTLOCK_SD720G_PORT_RECORD.md # Porting record & findings
│ ├── CVE2026-43499_SD720G_参考数据汇总.md # Reference data & symbol table
│ ├── ALTERNATIVE_STRATEGY.md # Alternative attack paths
│ ├── HEAP_ANALYSIS.md # Heap / pi_state lifecycle
│ ├── STACK_ANALYSIS.md # Stack reclaim feasibility
│ ├── WRITE_PRIMITIVE.md # Write primitive research
│ ├── BOOT_ANALYSIS.md # Boot image structure
│ └── FINAL_ANALYSIS.md # Final conclusions
| Item | Note |
|---|---|
| KASLR Leak | perf_event_open works via PERF_TYPE_SOFTWARE (paranoid=-1) |
| Futex PI Race | EDEADLK (errno=35) confirms deadlock path reachable |
| Symbol Extraction | 37 symbols extracted from kallsyms (including commit_creds, prepare_kernel_cred, init_task, etc.) |
| LD_PRELOAD Loading | arm.so compiled correctly, loads and executes on device |
| Item | Reason |
|---|---|
| Qualcomm Bitmap RT Mutex | rt_mutex_adjust_prio_chain uses bitmap priority queue instead of standard rbtree |
| No Stack Waiter | remove_waiter frame only 0x30 (48 bytes), no local struct rt_mutex_waiter |
| Dead Code | remove_waiter (0xCEAA0) has no direct callers in kernel binary |
| No rb_erase Chain | 0x105aeb0 is a ring buffer operation function, not rb_erase |
| pi_state Lifecycle | Uses refcount+RCU instead of direct kfree, differs from standard Linux |
| Big.LITTLE | KernelSnitch mm_struct leak fails on A76+A53 heterogeneous CPU |
| CONFIG_CRYPTO_USER_API_AEAD | Not enabled — CVE-2026-31431 (Copy Fail) not exploitable |
CVE-2026-43499 vulnerability exists: ✅ (str xzr at 0xdbf10)
Standard IonStack exploit chain: ❌ (Qualcomm code differs)
Alternative write primitive: ⚠️ Not found in current analysis
# Push files
adb push preload/arm.so /data/local/tmp/
adb push exploit/perf_leak /data/local/tmp/
adb shell chmod 755 /data/local/tmp/arm.so /data/local/tmp/perf_leak
# Step 1: Leak KASLR base
adb shell /data/local/tmp/perf_leak
# Step 2: Trigger GhostLock race
adb shell LD_PRELOAD=/data/local/tmp/arm.so env
# After crash, check dmesg
adb shell dmesg | grep -A 30 "PC\|Call trace\|Internal error"
For Research Purposes Only
This repository is for cybersecurity research and defensive purposes only. The authors are not responsible for any misuse.
Generated by DeepSeek AI
All code and analysis in this repository were generated with assistance from DeepSeek AI for educational and research reference only.