Make KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features
summary
Explains adapting Kernel Space Mirroring Attack (KSMA) ideas from CPU MMU features to GPU MMUs on Android devices, investigating whether GPU MMU behavior can be abused for rooting. Covers GPU MMU internals relevant to exploitation despite missing public architecture manuals and demonstrates a GPU-based KSMA exploitation technique targeting Android 13-era mitigations.
AI-written summary · about
chapters (7)
- 0:00Introduction and agenda
- 2:06Kernel memory management
- 8:41GPU memory management
- 14:26GPU MMU reverse engineering
- 20:58Exploitation via OpenCL
- 26:39Case study: Pixel 7 root
- 34:28Conclusion and Q&A
related talks
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
27mUSMA: Share Kernel Code With Me
41mUnifying Android and Mainline Kernel Graphics Stack
42mAndroid: Protecting the Kernel
40mEvils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
37mRunning Android on the Mainline Graphics Stack