OPPO Find X6 Pro GhostLock Adaptation Project

Overview

This project conducts adaptation research for the CVE-2026-43499 (GhostLock) vulnerability on the OPPO Find X6 Pro (PGEM10).

Based on the original exploit architecture from NebuSec CyberMeowfia, referencing adaptation ideas from oppo-ghostlock.

Device Information

Item	Value
Device	OPPO Find X6 Pro (PGEM10)
Chip	Snapdragon 8 Gen 2 (SM8550)
Kernel	Linux 5.15.149-android13 #1 SMP PREEMPT
Build Date	Thu Feb 13 2025
Android	15 (ColorOS 15.0)
ROM Version	PGEM10_15.0.0.600(CN01)
PAC	CONFIG_ARM64_PTR_AUTH_KERNEL=y
BTI	CONFIG_ARM64_BTI_KERNEL=y
KASLR	CONFIG_RANDOMIZE_BASE=y
VA_BITS	39
VA Offset	P0_PAGE_OFFSET = 0xffffff8000000000

Project Results Summary

✅ Completed

❌ Blocked

Project Structure

oppo-pgem10-ghostlock/
├── README.md                      # This file
├── 问题描述.md                     # Detailed problem analysis
├── docs/
│   ├── architecture.md            # Architecture design and call chain
│   └── adaptation-guide.md        # PAC kernel adaptation guide
├── reports/
│   ├── offsets.md                 # IDA offset verification report
│   ├── kaslr.md                   # KASLR analysis report
│   └── summary.md                 # Final summary
├── src/
│   ├── kaslr_perf.h               # Perf KASLR reusable module
│   └── kaslr_perf.c               # Perf KASLR implementation
└── analysis/
    └── chains/                     # Call chain analysis scripts

Key Configuration Differences (PGEM10 vs Pixel 10)

CONFIG_ARM64_PTR_AUTH_KERNEL=y    # ← Core difference: PAC directly causes frame expansion
CONFIG_ARM64_BTI_KERNEL=y         # BTI further increases overhead
CONFIG_SHADOW_CALL_STACK=y        # SCS increases stack frame
CONFIG_VMAP_STACK=y               # Stack can be remapped
CONFIG_KASAN_HW_TAGS=y            # Compile-time enabled
CONFIG_ARM64_VA_BITS=39           # 39-bit VA (not 48-bit)

Root Cause of Block: PAC Stack Frame Expansion

Function                   Pixel 10 (No PAC)    PGEM10 (With PAC)
__arm64_sys_futex         0x90              0x4C0
do_futex                  0x70              0x420
futex_wait_requeue_pi     0x1A0             0x1B0
─────────────────────────────────────────────────
futex chain total depth   0x300             0xA70  ← 3.5 times
pselect stack depth       0x620             0x620
Overwrite possible?       ✅ YES            ❌ NO (0xA70 > 0x620)

Call chain analysis confirms: 0 call chains in the kernel have depth ≥ 0x800 (2048B). Maximum single frame: 0x1F0 (496B).

References

Original project: https://github.com/NebuSec/CyberMeowfia
OPPO Find N2 adaptation: https://github.com/pubglite55/oppo-ghostlock
NebuSec research: https://nebusec.ai/research/ionstack-part-2/
Kernel source: https://github.com/oppo-source/android_kernel_oppo_sm8550
Common kernel source: https://github.com/oppo-source/android_kernel_common_oppo_sm8550

Perf KASLR bypass	✅	Core breakthrough — obtain current KASLR slide in <1s via perf_event_open + callchain sampling
MM_STRUCT_SZ Fix	✅	Corrected from 0x500 to 0x400 (1024B), KernelSnitch succeeds immediately
IDA Offset Full Verification	✅	All critical symbols/structures/functions cross-verified via IDA
FUTEX_CMP_REQUEUE_PI	✅	GhostLock UAF trigger successful
ashmem Verification	✅	C ashmem available, type confusion path theoretically feasible
Call Chain Analysis	✅	Confirmed no call chain depth ≥ 0x800 in the kernel
Kernel Config Scan	✅	Complete attack surface assessment

SLIDE Stack Overwrite	❌	PAC causes futex chain stack frame to expand to 0xA70, pselect only 0x620
fops Overwrite	❌	Requires SLIDE, blocked by PAC
type confusion	❌	Depends on fops overwrite
Pipe physrw	❌	Depends on type confusion
Root	❌	Depends on the above chain

oppo-pgem10-ghostlock

Most Popular