GhostLock for POCO F8 Ultra / REDMI K90 Pro Max — Global & Taiwan Variant (myron, WPMTWXM)

GhostLock (CVE-2026-43499) kernel exploit port for the global/Taiwan firmware of the POCO F8 Ultra / REDMI K90 Pro Max (codename myron, Snapdragon 8 Elite Gen 5 / SM8850).

Target: HyperOS OS3.0.6.0.WPMTWXM — kernel 6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k

English summary below / 下方有英文摘要。

Why this port is needed

同一支手機、同一個 codename,國際/臺灣版(WPMTWXM,即 POCO F8 Ultra)和大陸版(WPMCNXM)的核心不是同一個 binary:

ROM	kernel release	build time
Taiwan 3.0.1.0.WPMTWXM	`...-ga5f232d1ead0-ab14083253-4k`	2025-09-11
Taiwan 3.0.6.0.WPMTWXM	`...-g5a0e85dd9db0-ab14499855-4k`	2025-11-26
China 3.0.306/308.WPMCNXM	`...-g16e473de48a3-abogki462654244-4k`	2025-11-19

The China version tracks Google's official GKI branch (abogki*), while the Taiwan version uses Xiaomi's own integration branch
The git commits differ between the two, the config differs by 7 options, and everything is compiled with +pgo +bolt +lto— any code difference will completely scramble the symbol layout
Measured: init_task/init_cred differ by 0x10000, selinux_state differs by 0x120c8 (not a fixed offset)

Data-only exploits like GhostLock require the exact addresses from that specific build, so all payloads computed for the China version are completely invalid on the international version. This repo fills in the offset table that the international version is missing.

offsets/myron_tw/offsets.h — 臺版 3.0.6.0 的完整 target(給 JoinChang/ghostlock-oneplus 用)
scripts/device_step1.sh — root 後的 ABL 備份 + unlock EFI 刷入腳本
Releases 裡有編好的 ghostlock binary(arm64)

Verified analysis results

kallsyms 靜態提取正確性:用 _text 為基準回讀 binary 交叉驗證—— init_task.comm="swapper"、init_cred.usage=4、init_uts_ns.release 與 uname 逐字元一致。不需要實機 root 就能取得可靠偏移。
Struct 布局與陸版完全相同(BTF 驗證):task_struct 5184 bytes、 cred@0x900、pi_blocked_on@0xA18 等,與上游 STRUCT_OFFSETS_6_12 一致。
棧配置可行性:futex_wait_requeue_pi(frame 0x1c0,waiter@sp+0x80)和 core_sys_select(frame 0x1b0,stack_fds@sp+0x18)與已驗證可行的 Xiaomi 17 (pudding) 完全相同 → PSELECT_SHIFT=0。
selinux_state.enforcing 在 +0、policycap 在 +2,單 byte 寫入不會弄壞 policycap。
Rust ashmem → 只有 Path B(直接 PI write)可用,Path A (UMH) 不可用。

Build

git clone https://github.com/JoinChang/ghostlock-oneplus.git
cd ghostlock-oneplus
cp /path/to/this-repo/offsets/myron_tw/offsets.h src/devices/myron_tw/offsets.h
# 在 src/devices/offsets.h 的 #include 清單加一行:
#   #include "myron_tw/offsets.h"
make NDK_CC=<你的 NDK>/toolchains/llvm/prebuilt/*/bin/aarch64-linux-android35-clang

Usage

adb shell uname -r
# 必須是 6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k,否則程式會拒絕執行

adb push ghostlock /data/local/tmp/e
adb shell chmod 755 /data/local/tmp/e
adb shell /data/local/tmp/e

Success → root shell + SELinux permissive (soft root, invalid after reboot)
If it fails and reboots = timing was missed, rerun; for repeated panics try fine-tuning such as PSELECT_SHIFT=-1
Do not let the device OTA — after an update the kernel is replaced, the offsets become invalid, and the new version may have already patched the vulnerability

Follow-up (BL unlock)

After rooting, international models can be unlocked via the ABL replacement method (no official quota needed): back up abl_a/b → flash the unlock EFI → use fastboot to flash the factory ABL + spoof → restore. The factory ABL is obtained from the abl.img of the Taiwan 3.0.1.0 ROM you have on hand (this repo does not include Xiaomi proprietary firmware files). scripts/device_step1.sh is the device-side part of this process. This process does not wipe user data.

Porting to other regional versions (MIXM / EUXM / INXM…)

This repo only covers WPMTWXM. Xiaomi compiles the kernel separately for each regional branch, so offsets cannot be shared— but the method can. The three tools in tools/ are what we actually use to generate the Taiwan target:

# 1. 從你的 OTA 包解出 boot.img(payload.bin 用 payload-dumper),然後:
python3 tools/extract_offsets.py boot.img          # 產生 OFFSETS_ENTRY + 交叉驗證
python3 tools/check_btf.py boot.img                # 驗證 struct 布局(決定 STRUCT_OFFSETS 能否沿用)
python3 tools/check_feasibility.py boot.img        # 驗證 pselect 棧配置(決定 SHIFT)

extract_offsets.py: Extract kallsyms, calculate all offsets, and read back init_task.comm / init_cred.usage / init_uts_ns.release for cross-validation—if it doesn't pass, don't use it
check_btf.py: Read the task_struct/cred/selinux_state field offsets from the kernel's embedded BTF, and compare them item by item against STRUCT_OFFSETS_6_12
check_feasibility.py: Disassemble the frame layouts of futex_wait_requeue_pi and core_sys_select, and compare them against known feasible kernels (requires pip install capstone)

All three passed, so your version will most likely work. You're welcome to send a PR to add the target for the new region version.

Acknowledgments

Nebula Security — GhostLock 原始研究與 PoC
JoinChang/ghostlock-oneplus — 本 port 的基底
酷安社群的各種移植經驗

English Summary

The global firmware of the POCO F8 Ultra (REDMI K90 Pro Max) ships a different kernel build than the CN firmware (different branch, config, and PGO/BOLT layout), so all community-published GhostLock offsets — computed on CN ogki kernels — miss on global devices. This repo provides the missing target offsets for OS3.0.6.0.WPMTWXM (6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k), statically extracted from the official OTA package and cross-validated (kallsyms + BTF + in-image reads), plus a prebuilt binary in Releases. Struct layouts are identical to the CN build; only symbol addresses differ. Stack-frame layout matches the verified-working Xiaomi 17 (pudding).

Use only on your own device. The vulnerability is public (kernelCTF-mandated disclosure); this port exists so global-variant owners can root their own phones.

Disclaimer / 免責聲明

僅供自有裝置的授權安全研究。For authorized security research on your own devices only. 不保證任何結果,使用風險自負。

ghostlock-myron-tw

Most Popular