APV leak-assisted ROP — Pixel 9 / media.swcodec

Small, self-contained research package for CVE-2026-0006 (APV decoder heap overflow). It demonstrates a controlled native call in media.swcodec, ending in __android_log_assert(NULL, NULL, "RCE-7F3A92C1") with the nonce visible in a real tombstone (Abort message: 'RCE-7F3A92C1').

Quick start

Requirements: Pixel 9 rooted (/debug_ramdisk/su), adb, Python 3.12 with NumPy. The device must use the stock libobs.so (no instrumentation overlay).

scripts/build_device.sh   # installs thumb3.dex and apvscan
scripts/run.sh 12         # up to 12 fresh attempts

Success prints RCE PROVATA and writes out/APVRCE_success.txt. artifacts/tombstone_rce.txt is the captured success from the reference run.

Chain

1. A fresh media.swcodec decodes CLEAN_MSG.mp4 (metadata carrying the nonce).
2. Read-only oracle (apvscan) derives the live values:
   • release@448 - 0x29044 → codec base;
   • GOT[malloc] @ codec+0x2d448 → malloc@libc+0x596f0 → libc base.
3. gen/gen_forge.py builds the APV comb payload:
   • release@448 = libc + 0xede9c (__libunwind_Registers_arm64_jumpto);
   • PC = liblog + 0xc250 (__android_log_assert);
   • x0=x1=0, x2 = address of the metadata carrying RCE-7F3A92C1`;
   • SP points to a valid plane.
4. The same daemon decodes JT_LOG.mp4. The forged release reaches jumpto, which restores the registers and makes the controlled log/assert call.

This is an end-to-end ROP demonstration in the target process, not PC/SP-only evidence.

Threat model and limits

• Model A: an application decodes the crafted file and the researcher can observe the output and adapt the following stage. It is not a zero-click exploit.
• The runner uses apvscan as the read-only leak oracle for release and the two GOT reads. The hdr10-plus-info output leak was validated separately in the research notes; the runner does not claim that the file alone exfiltrates those values to a remote party.
• The proof is native code execution in media.swcodec, not a sandbox escape or kernel LPE.
• artifacts/JT_LOG.mp4 is pointer/layout-specific evidence. Regenerate it per run; do not expect it to be universal.
• Reliability is layout-dependent. The runner retries with a fresh daemon and reports every failure instead of claiming a fixed success rate.

Layout

• scripts/pipeline_logprint.py — leak/oracle, generation, attack and evidence capture.
• scripts/build_device.sh — installs the runtime files on the device.
• scripts/run.sh — starts the full chain.
• gen/ — payload generator and Thumb3 source/dex.
• scanner/ — apvscan source and prebuilt arm64 binary.
• artifacts/ — reference MP4s and the successful tombstone.
• docs/ — English and Italian blog drafts plus build-specific offsets.

Italiano (sintesi)

Il pacchetto dimostra una chiamata nativa controllata in media.swcodec, non solo il controllo di PC/SP. Il percorso è: fresco decoder → derivazione degli indirizzi → jumpto → __android_log_assert con il nonce RCE-7F3A92C1 nel tombstone. Non è una dimostrazione zero-click né un escape dal sandbox: è una prova ROP nel processo codec, con i limiti e il modello minaccioso sopra descritti.