CyberMeowfia Android Kernel Research

本仓库整理 Android 内核样本分析的方法、工具和案例记录，主题沿用 CyberMeowfia。研究主线是 CVE-2026-43499 与 CVE-2026-43074。内容是概念验证与方法说明：如何判断根因、绑定精确身份、选择路线、记录证据，以及如何解释成功或失败。

This repository documents methods, tools, and case records for Android kernel sample analysis, following the CyberMeowfia research line. The two routes are CVE-2026-43499 and CVE-2026-43074. It is a proof-of-concept disclosure: how to judge root cause, bind exact identity, choose a route, grade evidence, and explain success or failure.

范围 / Scope

• 文档、离线分析工具、案例矩阵、按 KMI 归档的参考源码。

• 结论绑定精确 kernel_sha256 与证据等级；同 KMI 不能替代身份核验。

• 不含设备镜像、预编译 payload 或一键执行包。

• Documentation, offline analysis tools, a case matrix, and per-KMI reference source.

• Claims bind to an exact kernel_sha256 and an evidence label. Sharing a KMI is not an identity.

• Device images, prebuilt payloads, and turnkey runners are not included.

阅读顺序 / Reading order

1. 总览 — 两条路线与 KMI 分轨 / two routes and KMI tracks
2. 范围 — 收录什么、不收录什么 / what is in and out of tree
3. 路线选择 与 KMI 分轨
4. 新样本工作流 与 工具指南
5. 案例矩阵
6. 参考源码

更细的目录说明见 docs/public/README.md。术语见 GLOSSARY.md。

原则 / Rules

研究结论必须落到可复核的样本身份。一次竞态命中、一次无崩溃、一次 syscall 返回成功，都不能单独当成闭环。根因、原语、地址域、目标写入、权限收尾和权威回读要分开记。失败和证伪与成功样本同等正式。

Claims need a checkable sample identity. A race hit, a clean boot, or a successful syscall return is not closure. Record root cause, primitive, address domain, sticky write, privilege close, and authoritative readback as separate facts. Failures and disproofs are first-class results.

许可 / License

Apache License 2.0。见 LICENSE 与 NOTICE。引用方式见 CITATION.cff。