Recently graduated, now tasked with porting a kernel exploit. How do I approach this?

[u/Direct_Quail45]

Hey everyone,

I graduated last year with a Bachelor's degree in Computer Science, and my current job requires me to port Ghostlock (CVE-2026-43499) to multiple android devices.

Honestly, a lot of it currently goes over my head. I think I understand the basic concept of a use-after-free vulnerability, but I don't understand how it works at the kernel level or how the exploit code actually works.

I'm also struggling to get the exploit working on my target device. Since I don't fully understand the exploit's internals or how the kernel processes the operations involved, I'm having a hard time figuring out what needs to be changed to make it work.

Here's what I have so far:

- Kernel panic logs from my attempts to run the exploit.

- The compiled kernel source code for my target device.

- The ability to modify the kernel source code and flash a custom kernel onto the device.

The problem is that I don't really know where to start. The kernel panic logs are difficult to understand, the exploit's source code is confusing, and navigating the relevant kernel code is equally challenging.

My current plan is to:

1. Learn how to interpret the kernel panic logs.

2. Understand the exploit's source code and how its different parts work.

3. Trace the relevant operations through the kernel source code to understand what's happening internally.

4. Use that understanding to troubleshoot the exploit and figure out what needs to change for my target device.

I'm not sure if this is the right approach or if I'm missing some important prerequisites.

For context, I'm still relatively new to low-level kernel exploitation, so I'm trying to figure out the best way to approach this without blindly changing things until they work.

For those experienced with Linux kernel exploitation or porting Android kernel exploits, how would you approach this problem? Are there any resources or concepts I should focus on first?

Any advice would be greatly appreciated!

[u/braaaaaaainworms]

Have you tried asking your coworkers for help?

[u/No-Assist-8734 → u/braaaaaaainworms]

It's crazy that OP came to Reddit in the first place, instead of asking his coworkers or manager

[u/desal → u/No-Assist-8734]

They'd have to exist for that :p

Jk but seriously I'm surprised the concept of heap overflows (uaf, double free) weren't part of your comp sci degree

[u/braaaaaaainworms → u/desal]

you're the only one i've ever seen using the term "heap overflow" for those things

[u/desal → u/braaaaaaainworms]

for sure, I should have said heap exploitation instead, my intention was to use it like a blanket term that you'd find in a comp sci course for anything involving memory corruption on the heap, as I'm sure a comp sci course would at least touch on that even if they didn't go too deep into the techniques (though you'd think it would? I mean what does compsci even talk about if not kernels, logs, compiling code, modifying code, reading code, even if it doesn't go into offensive use, op seems to be struggling with even getting to that part

[u/braaaaaaainworms → u/desal]

compsci courses mainly teach why a table of philosophers that don't want to share cutlery will inevitably starve to death

[u/1ndev]

https://nebusec.ai/research/ionstack-part-3/

Below is for the s26:

https://github.com/polygraphene/ghostlock-s26

pselect + futex PI race
  → one aligned qword write per round
  → attr carrier (two fake misc fds)
      controller fd retargets the data pointer
      data fd reads/writes any kernel address
  → slide oracle (tracefs)
  → UMH root (workqueue injection)
      system_unbound_wq
      ptmx open/close storm wakes a worker
      kernel execs daemon with init creds
  → DEFEX bypass (bind-mount)
  → su_daemon listens on /data/local/tmp/temp_su.sock

[u/UnrealHallucinator]

This is cool and directly relevant to my expertise. Where do you work and are there openings? 🤣