Prison Break Season 6: Defeating the Mitigations Adopted by Android OEMs
summary
Disclosure of multiple OEM kernel protections and concrete bypasses: decrypt OTA images by reversing the recovery to recover an AES-ECB key extracted from recovery binary, extract static kernel symbols, and correlate them with leaked dmesg/boot messages (or trigger leaks) to compute KASLR offsets. Use gadgets and victim function-pointer calls to read/write kernel memory without changing addr_limit, flip a UID compare into a no-op and clear page-table write-protect bits to restore syscall tables. Demos target four vendors—four device demos yielding root shells—and all bypasses run reliably on tested builds.
AI-written summary · about
chapters (28)
- 0:00Start
- 2:55The evolution of official mitigations
- 3:27Shellcode
- 4:11The kptr_restrict
- 4:30Defeat kptr_restrict
- 4:57black hat PXN (Privileged Execute Never)
- 5:32black hat PAN (Privileged Access Never)
- 6:53Common root flow on Android
- 7:48Case study 1 randomized thread_info
- 8:12kti_offset internals
- 10:23Case study 2
- 11:17The addr_limit checking
- 11:38How to bypass it.
- 12:46blackhat Secrets in system call table
- 13:08Code flow on hooked system calls
- 14:16How kernel hooks system call tables
- 15:39blackhat Page table walk in user space
- 17:26Erase the UID checking
- 18:14ROM encryption
- 19:34Retrieving kernel symbol table statically
- 21:17Unzip the ozip ROM
- 21:48Analysis of the ozip file
- 22:58Recovery reversing
- 24:26black hat Decryption & extract kallsyms
- 35:11Bypass KASLR
- 37:00Demo
- 37:53Suggestions
- 39:32Conclusion
related talks
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
42mAndroid: Protecting the Kernel
48mSecuring the System: A Deep Dive into Reversing Android Pre-Installed Apps
36mPhysical Attacks Against Smartphones
31mAnti-Forensics: Reverse Engineering a Leading Phone Forensic Tool
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps
30mSecurity-Enhanced Android
53mAndroid: He protec, but he also attac