{"vulnerability": "cve-2020-0041", "sightings": [{"uuid": "9dde1951-039e-43d8-a875-83ed5d66d683", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:16.000000Z"}, {"uuid": "2148fcca-fab2-4d14-b0a6-3e6fd164ef04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "7e39c7bd-82aa-498d-8656-a438218c5c57", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971159", "content": "", "creation_timestamp": "2024-12-24T20:25:08.508748Z"}, {"uuid": "3225a144-8730-4236-b3c1-11975db0b577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971160", "content": "", "creation_timestamp": "2024-12-24T20:25:09.409563Z"}, {"uuid": "bd42db3e-a687-45f8-a5b2-eb8b29d9e0ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971161", "content": "", "creation_timestamp": "2024-12-24T20:25:10.328904Z"}, {"uuid": "425e278a-fedc-4b3e-856a-e9e3fe8f4fd9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:44.000000Z"}, {"uuid": "be65b0a6-8543-48c0-b00a-dbacc51ce123", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "MISP/ab0b745f-bbd5-338e-8b92-97dd0c757e9d", "content": "", "creation_timestamp": "2025-08-31T03:01:00.000000Z"}, {"uuid": "f18fc533-3aee-4775-9c0b-827161086939", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://gist.github.com/prof-hac/76f2a4b0a2937cff2ca4b95dc94a2d2c", "content": "", "creation_timestamp": "2026-03-27T23:02:22.000000Z"}, {"uuid": "95a21f07-1ae1-4085-8021-be21c700d5f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2020-0041", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/802bcf12-49ed-4a0a-b948-3bf2d4cf30fc", "content": "", "creation_timestamp": "2026-02-02T12:28:34.611014Z"}, {"uuid": "856c5d5e-5e13-46cb-97b0-8795e86fbce8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/R0_Crew/1471", "content": "Analysis of Latest Android Binder vulnerability (CVE-2020-0041)\n\nArticle:\nhttps://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html\n\nSlides:\nhttps://www.synacktiv.com/ressources/thcon2020_binder.pdf\n\n#re #expdev #android #cve #mobile #darw1n", "creation_timestamp": "2020-03-31T00:02:42.000000Z"}, {"uuid": "bbfc5d03-36f1-4dcf-a0be-25fa34e16af2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/antichat/8056", "content": "Analysis of Latest Android Binder vulnerability (CVE-2020-0041)\n\nArticle:\nhttps://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html\n\nSlides:\nhttps://www.synacktiv.com/ressources/thcon2020_binder.pdf\n\n#re #expdev #android #cve #mobile #darw1n", "creation_timestamp": "2020-03-12T04:37:48.000000Z"}, {"uuid": "2359e1e6-6d5e-4816-a578-7aaf0e517d6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://t.me/arpsyndicate/954", "content": "#ExploitObserverAlert\n\nCVE-2020-0041\n\nDESCRIPTION: Exploit Observer has 40 entries related to CVE-2020-0041. In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel\n\nFIRST-EPSS: 0.000810000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2023-12-03T14:29:05.000000Z"}, {"uuid": "73faeeb0-0dc4-44c1-87ea-e999960e2126", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/techpwnews/671", "content": "Blue Frost security: Exploiting CVE-2020-0041 \u2013 Part 2: Escalating to root\n\nFrom last month\u2019s CVE, excerpt from XDA-Developers.com page: [\u2026]Moreover, Android Verified Boot 2.0 may kick in and brick your phone if you try to make permanent changes to protected partitions such as boot, system, and vendor without an unlocked bootloader. That being said, the exploit is currently available in its compiled form, while the developer [\u2026]...\n\nContinue reading at Firmware  Security", "creation_timestamp": "2020-05-15T20:10:52.000000Z"}, {"uuid": "62ec3ec5-b72b-4e75-912d-34dc3de9de32", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/hackersmeet0/1150", "content": "Analysis of Latest Android Binder vulnerability (CVE-2020-0041)\n\nBlogpost: https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html\nSlides: https://www.synacktiv.com/ressources/thcon2020_binder.pdf", "creation_timestamp": "2026-08-03T02:07:05.267096Z"}, {"uuid": "5a53665c-7ddc-402e-afbe-74d4316fda2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/androidMalware/720", "content": "Analysis of Latest Android Binder vulnerability (CVE-2020-0041)\n\nBlogpost: https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html\nSlides: https://www.synacktiv.com/ressources/thcon2020_binder.pdf", "creation_timestamp": "2020-03-10T21:31:51.000000Z"}, {"uuid": "9c4ad563-40be-4e15-8b3c-9c60ac9d8cc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/androidMalware/749", "content": "Exploiting CVE-2020-0041 - Part 1: Escaping the Chrome Sandbox\nhttps://labs.bluefrostsecurity.de/blog/2020/03/31/cve-2020-0041-part-1-sandbox-escape/", "creation_timestamp": "2020-04-01T11:52:50.000000Z"}, {"uuid": "bea42815-459a-48f5-b431-770bee3529a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/1349", "content": "#exploit\n1. CVE-2020-12828:\nAnchorFree VPN SDK <1.3.3 - Unrestricted Upload of File with Dangerous Type/ Privilege Escalation\nhttps://0xsha.io/posts/zombievpn-breaking-that-internet-security\n]-> PoC: https://github.com/0xsha/ZombieVPN\n\n2. CVE-2020-0041:\nPart 1 - Escaping the Chrome Sandbox\nhttps://labs.bluefrostsecurity.de/blog/2020/03/31/cve-2020-0041-part-1-sandbox-escape/\nPart 2 - Escalating to root (LPE exploit)\nhttps://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root\n]-> PoC: https://github.com/bluefrostsecurity/CVE-2020-0041", "creation_timestamp": "2024-10-31T02:10:22.000000Z"}, {"uuid": "d60cfcbf-645a-4f93-93a3-2b9bf92ac892", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://gist.github.com/KRW0090/166c655e59c71f63be65acf67641b33d", "content": "# SH-03M (docomo\u30ad\u30c3\u30ba\u30b1\u30fc\u30bf\u30a4) Root\u5316\u8abf\u67fb\u30ce\u30fc\u30c8\n\n> \u672c\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306f\u3001NTT docomo\u306e\u30ad\u30c3\u30ba\u30b1\u30fc\u30bf\u30a4 **SH-03M**\uff08\u30b7\u30e3\u30fc\u30d7\u88fd / Snapdragon 210 / MSM8909\uff09\u306e root \u53d6\u5f97\u3092\u8a66\u307f\u305f\u8abf\u67fb\u306e\u5168\u8a18\u9332\u3067\u3059\u3002\n> \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u7814\u7a76\u30fb\u6559\u80b2\u76ee\u7684\u3067\u4f5c\u6210\u3057\u307e\u3057\u305f\u3002\u8a18\u8f09\u5185\u5bb9\u3092\u5b9f\u6a5f\u3067\u518d\u73fe\u3059\u308b\u969b\u306f\u81ea\u5df1\u8cac\u4efb\u3067\u304a\u9858\u3044\u3057\u307e\u3059\u3002\n\n## \u514d\u8cac\u4e8b\u9805\n\n- \u672c\u30c9\u30ad\u30e5\u30e1\u30f3\u30c8\u306f\u8abf\u67fb\u8a18\u9332\u3067\u3042\u308a\u3001root\u5316\u306e\u300c\u6210\u529f\u624b\u9806\u300d\u3067\u306f\u3042\u308a\u307e\u305b\u3093\uff08\u73fe\u6642\u70b9\u3067 root \u53d6\u5f97\u306b\u306f\u81f3\u3063\u3066\u3044\u307e\u305b\u3093\uff09\u3002\n- \u8a18\u8f09\u306e\u64cd\u4f5c\u306f\u7aef\u672b\u3092\u7834\u640d\u30fb\u6587\u93ae\u5316\u3055\u305b\u308b\u53ef\u80fd\u6027\u304c\u3042\u308a\u307e\u3059\u3002\u5b9f\u65bd\u306f\u81ea\u5df1\u8cac\u4efb\u3067\u3059\u3002\n- eSIM \u3092\u5229\u7528\u3057\u3066\u3044\u308b\u7aef\u672b\u3067\u306f\u3001\u30ea\u30ab\u30d0\u30ea\u30fc\u30e2\u30fc\u30c9\u304b\u3089\u306e\u521d\u671f\u5316\u306b\u3088\u308a eSIM \u60c5\u5831\u304c\u5931\u308f\u308c\u3001\u518d\u767a\u884c\u304c\u5fc5\u8981\u306b\u306a\u308b\u5834\u5408\u304c\u3042\u308a\u307e\u3059\u3002\n\n---\n\n## 1. \u7aef\u672b\u6982\u8981\n\n| \u9805\u76ee | \u5024 |\n|---|---|\n| \u578b\u756a | SH-03M\uff08docomo \u30ad\u30c3\u30ba\u30b1\u30fc\u30bf\u30a4\uff09 |\n| SoC | Qualcomm Snapdragon 210 / 212\uff08**MSM8909**, 32bit ARM\uff09 |\n| GPU | Adreno 304\uff08KGSL \u30c9\u30e9\u30a4\u30d0\uff09 |\n| RAM | 889 MB\uff08\u5b9f\u6e2c\uff09 |\n| ROM | 8 GB eMMC |\n| Android | 8.1.0 (SDK 27, OPM1.171019.026) |\n| \u30ab\u30fc\u30cd\u30eb | Linux 3.18.71-perf\uff082023\u301c2025 \u5e74\u518d\u30d3\u30eb\u30c9\uff09 |\n| \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30d1\u30c3\u30c1 | 2019-08-01 |\n| \u30ea\u30ea\u30fc\u30b9 | 2020-01-17 |\n\n### \u30d5\u30a1\u30fc\u30e0\u30a6\u30a7\u30a2\uff08\u78ba\u8a8d\u3057\u305f4\u53f0\u306e\u5b9f\u6a5f\uff09\n\n| \u30b7\u30ea\u30a2\u30eb\u672b\u5c3e | \u30d3\u30eb\u30c9 | \u30d3\u30eb\u30c9\u65e5 | \u5099\u8003 |\n|---|---|---|---|\n| 2C0503416 | 00WW_2_240 | 2025-05-29 | 1\u53f0\u76ee |\n| C140100594 | 00WW_2_230 | 2025-01-20 | 2\u53f0\u76ee |\n| C1302866 | 00WW_2_220 | 2023-03-23 | 3\u53f0\u76ee\uff08\u30ea\u30ab\u30d0\u30ea\u30fc\u3067\u521d\u671f\u5316\uff09 |\n| C110401206 | 00WW_2_220 | 2023-03-23 | 4\u53f0\u76ee |\n\n\u3059\u3079\u3066\u306e\u30d5\u30a1\u30fc\u30e0\u306f `ro.build.user=cm`, `ro.build.host=cm-build-40-18`, `ro.build.flavor=OE6_00WW_FIH-user` \u3067\u3001**\u500b\u4eba/\u5de5\u5834\u304c\u30d3\u30eb\u30c9\u3057\u305f\u30ab\u30b9\u30bf\u30e0ROM** \u3068\u63a8\u5b9a\u3055\u308c\u308b\u3002\n\n### \u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u72b6\u614b\n\n```\nro.build.type=user\nro.debuggable=0\nro.secure=1\nro.adb.secure=1\nro.boot.flash.locked=1\nro.boot.verifiedbootstate=green\nro.boot.veritymode=enforcing\nro.boot.securityfused=true\nro.oem_unlock_supported=true  (\u3060\u304c unlock \u4e0d\u53ef)\nselinux=Enforcing\n/data = f2fs + dm-crypt\n```\n\n---\n\n## 2. \u8a66\u884c\u3057\u305f\u30eb\u30fc\u30c8\u3068\u7d50\u679c\u30b5\u30de\u30ea\n\n| # | \u30eb\u30fc\u30c8 | \u7d50\u679c | \u8a73\u7d30 |\n|---|---|---|---|\n| 1 | \u30d6\u30fc\u30c8\u30ed\u30fc\u30c0\u30fc\u30a2\u30f3\u30ed\u30c3\u30af (fastboot oem) | **\u4e0d\u53ef** | `oem unlock` \u304c `oem unlock is not allowed`\u3002`flashing get_unlock_ability` = 0 |\n| 2 | EDL (9008) + firehose \u66f8\u304d\u8fbc\u307f | **\u4e0d\u53ef** | \u7f72\u540d\u4ed8\u304d firehose \u304c\u5b58\u5728\u3057\u306a\u3044\uff08PK_HASH \u4e0d\u4e00\u81f4\uff09 |\n| 3 | \u65e2\u77e5\u30ab\u30fc\u30cd\u30eb CVE (binder\u7cfb) | **\u4fee\u6b63\u6e08\u307f** | CVE-2019-2215 / 2020-0041 / 2020-0423 \u306f\u30b7\u30e3\u30fc\u30d7\u30bd\u30fc\u30b9\u3067\u4fee\u6b63\u78ba\u8a8d |\n| 4 | kgsl SVM \u8106\u5f31\u6027 (11261/33107) | **32bit\u3067\u306f\u4e0d\u53ef** | 64bit\u524d\u63d0\u306e\u30e9\u30c3\u30d7\u30a2\u30e9\u30a6\u30f3\u30c9\u624b\u6cd5\u304c32bit\u3067\u6570\u5b66\u7684\u306b\u6210\u7acb\u3057\u306a\u3044 |\n| 5 | kgsl dmabuf UAF (11239) | **\u975e\u8a72\u5f53** | kernel 3.18 \u306f\u65b0 ION ABI (4.12+) \u3067\u306f\u306a\u304f\u975e\u8a72\u5f53 |\n| 6 | \u30b7\u30b9\u30c6\u30e0\u30a2\u30d7\u30ea\u6a29\u9650\u6607\u683c | **\u4e0d\u53ef** | \u5f37\u6a29\u9650\u306f signature \u4fdd\u8b77\u3002\u7121\u4fdd\u8b77 Provider \u306f\u4f4e\u5f71\u97ff\u306e\u307f |\n| 7 | \u30ab\u30fc\u30cd\u30eb\u30e2\u30b8\u30e5\u30fc\u30eb\u30ed\u30fc\u30c9 | **\u4e0d\u53ef** | `insmod` \u304c\u975eroot\u3067\u62d2\u5426 |\n| 8 | adb root | **\u4e0d\u53ef** | production builds |\n| 9 | \u30ea\u30ab\u30d0\u30ea\u30fc\u30e2\u30fc\u30c9\u521d\u671f\u5316 | **\u6210\u529f** | \u4fdd\u8b77\u8005\u30d1\u30b9\u30ef\u30fc\u30c9\u89e3\u9664\u306b\u306f\u6709\u52b9\uff08root\u5316\u3068\u306f\u7121\u95a2\u4fc2\uff09 |\n\n---\n\n## 3. \u30d6\u30fc\u30c8\u30ed\u30fc\u30c0\u30fc\u89e3\u6790\n\n### 3.1 Download mode\uff08fastboot \u30d7\u30ed\u30c8\u30b3\u30eb\uff09\n\n`adb reboot bootloader` \u3067\u5165\u308b\u30e2\u30fc\u30c9\u3002USB \u306f `0489:C009` \u3068\u3057\u3066\u8a8d\u8b58\u3055\u308c\u308b\u3002\n\n- \u6a19\u6e96 fastboot \u5b9f\u88c5\uff08\u9577\u3055\u30d7\u30ec\u30d5\u30a3\u30c3\u30af\u30b9\u7121\u3057\u306e\u751f\u30b3\u30de\u30f3\u30c9\uff09\u3067\u5fdc\u7b54\u3059\u308b\n- `getvar:all` \u304c\u52d5\u4f5c\u3057\u3001\u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u60c5\u5831\u30fbunlock \u72b6\u614b\u3092\u8fd4\u3059\n- Google \u6a19\u6e96\u306e `fastboot.exe` \u306f VID 0489 \u3092\u8a8d\u8b58\u3057\u306a\u3044\u305f\u3081\u3001libusb \u7d4c\u7531\u306e\u81ea\u4f5c\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\u3067\u30a2\u30af\u30bb\u30b9\n\n**\u4e3b\u306a getvar \u7d50\u679c:**\n\n```\nversion: 0.5\nunlocked: no\nsecure: yes\nvariant: OE6 eMMC\nkernel: lk\nproduct: MSM8909\n```\n\n### 3.2 OEM \u30b3\u30de\u30f3\u30c9\n\n\u8a8d\u8b58\u3055\u308c\u308b\u30b3\u30de\u30f3\u30c9\uff08\u4e00\u90e8\uff09:\n\n| \u30b3\u30de\u30f3\u30c9 | \u7d50\u679c |\n|---|---|\n| `oem device-info` | `Device unlocked: false, tampered: false, critical unlocked: false` |\n| `oem lock-state info` | `Device already : locked!` |\n| `oem unlock-go` / `oem unlock` | `oem unlock is not allowed` |\n| `flashing get_unlock_ability` | `get_unlock_ability: 0` |\n| `oem off-mode-charge 0` | OKAY\uff08\u66f8\u304d\u8fbc\u307f\u7cfb\u306f\u4e00\u90e8\u52d5\u4f5c\uff09 |\n\n**\u7d50\u8ad6:** docomo \u7aef\u672b\u306e\u8a2d\u8a08\u3069\u304a\u308a\u3001`get_unlock_ability=0` \u3067\u3042\u308a\u516c\u5f0f\u30a2\u30f3\u30ed\u30c3\u30af\u4e0d\u53ef\u3002devinfo \u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u306e `unlock_ability` \u66f8\u304d\u63db\u3048\u306b\u306f root \u304c\u5fc5\u8981\uff08\u5faa\u74b0\uff09\u3002\n\n### 3.3 EDL (9008) \u30e2\u30fc\u30c9\n\n`adb reboot edl` \u3067 **\u771f\u306e Qualcomm 9008 EDL** \u306b\u5165\u308c\u308b\u3053\u3068\u3092\u78ba\u8a8d\uff08\u30b3\u30df\u30e5\u30cb\u30c6\u30a3\u5831\u544a\u3068\u7570\u306a\u308b\u91cd\u8981\u306a\u767a\u898b\uff09\u3002\n\n- USB: `05C6:9008`\n- Sahara \u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u6210\u529f\uff08HWID / PK_HASH / \u30b7\u30ea\u30a2\u30eb\u53d6\u5f97\u53ef\uff09\n\n**\u53d6\u5f97\u3057\u305f\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u60c5\u5831:**\n\n```\nHWID:     0x0096e10000380000 (MSM8909, OEM=0x3800=Sharp)\nPK_HASH:  0eed6924 362cf06a 1ce75b3c 57aabca4 360f7eb5 0dc6d59b ddfc4117 e6cff0ad\nSerial:   0x234c46e0\n```\n\n**firehose \u63a2\u7d22\u7d50\u679c:**\n- bkerler/edl \u306e `root_cert_hash` \u306b `0eed6924` \u306f\u542b\u307e\u308c\u305a\uff08fused \u30c7\u30d0\u30a4\u30b9\u78ba\u5b9a\uff09\n- temblast \u306e\u5168\u30b3\u30ec\u30af\u30b7\u30e7\u30f3\uff082000+\uff09\u306b\u3082 `0eed6924` \u7f72\u540d\u306e\u30ed\u30fc\u30c0\u30fc\u306f\u5b58\u5728\u3057\u306a\u3044\n- \u6c4e\u7528 MSM8909 \u30ed\u30fc\u30c0\u30fc\uff08SecTools \u30c6\u30b9\u30c8\u7f72\u540d\uff09\u306f\u7f72\u540d\u691c\u8a3c\u3067\u62d2\u5426\n\n**\u7d50\u8ad6:** \u30bb\u30ad\u30e5\u30a2\u30d6\u30fc\u30c8\u6709\u52b9 + \u5c02\u7528\u7f72\u540d\u9375\u306e firehose \u304c\u975e\u516c\u958b\u306e\u305f\u3081\u3001EDL \u66f8\u304d\u8fbc\u307f\u306f\u4e0d\u53ef\u80fd\u3002\n\n---\n\n## 4. \u30ab\u30fc\u30cd\u30eb CVE \u8abf\u67fb\n\n\u30b7\u30e3\u30fc\u30d7\u516c\u5f0f OSS \u30bd\u30fc\u30b9\uff08V1.350 / V2.110\uff09\u3068\u5b9f\u6a5f\u30ab\u30fc\u30cd\u30eb\u3092\u7167\u5408\u3002\n\n### 4.1 binder \u7cfb\uff08\u5168\u3066\u4fee\u6b63\u6e08\u307f\uff09\n\n| CVE | \u5185\u5bb9 | \u30b7\u30e3\u30fc\u30d7\u30bd\u30fc\u30b9\u3067\u306e\u4fee\u6b63 |\n|---|---|---|\n| CVE-2019-2215 | binder UAF (POLLFREE) | V1.350 \u304b\u3089 `wake_up_poll(&thread->wait, POLLHUP \\| POLLFREE)` \u3042\u308a |\n| CVE-2020-0041 | binder OOB write | `off_start = ALIGN(tr->data_size, ...)` \u3042\u308a |\n| CVE-2020-0423 | binder UAF (\u30ec\u30fc\u30b9) | `binder_dequeue_work_head_ilocked` \u4f7f\u7528\u3067\u4fee\u6b63 |\n\n### 4.2 kgsl\uff08GPU\uff09\u7cfb\n\n| CVE | \u5185\u5bb9 | \u672c\u7aef\u672b\u3067\u306e\u8a55\u4fa1 |\n|---|---|---|\n| CVE-2020-11261 | SVM \u9818\u57df\u306e\u7bc4\u56f2\u30c1\u30a7\u30c3\u30af\u4e0d\u5099 | \u30bd\u30fc\u30b9\u4e0a\u306f\u672a\u4fee\u6b63\u3060\u304c\u3001**32bit \u3067\u306f global range (0xf8000000) \u306b\u30e6\u30fc\u30b6\u30fc\u304c\u5230\u9054\u4e0d\u53ef**\u306e\u305f\u3081\u5b9f\u7528\u4e0d\u53ef |\n| CVE-2023-33107 | gpuobj_import \u6574\u6570\u30aa\u30fc\u30d0\u30fc\u30d5\u30ed\u30fc | \u30bd\u30fc\u30b9\u4e0a\u306f\u672a\u4fee\u6b63\u3060\u304c\u3001**32bit size_t \u3067\u306f\u30e9\u30c3\u30d7\u304c\u6570\u5b66\u7684\u306b\u4e0d\u53ef\u80fd** |\n| CVE-2020-11239 | dmabuf import UAF | **kernel 3.18 \u306f\u65b0 ION ABI (4.12+) \u975e\u8a72\u5f53** |\n\n### 4.3 \u5b9f\u6a5f\u3067\u306e kgsl \u52d5\u4f5c\u78ba\u8a8d\n\n`/dev/kgsl-3d0` \u306f **rw-rw-rw-**\uff08\u5168\u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u3001\u901a\u5e38\u306e Android \u3067\u306f\u7570\u4f8b\uff09\u3002\n\nNDK (r21e) \u3067 ARM32 \u30af\u30ed\u30b9\u30b3\u30f3\u30d1\u30a4\u30eb\u3057\u305f\u81ea\u4f5c\u30d7\u30ed\u30fc\u30d6\u3067\u78ba\u8a8d:\n\n```\nKGSL_PROP_VERSION: drv=3.14 dev=3.1\nKGSL_PROP_DEVICE_INFO: chip_id=0x3000400 (Adreno 304)\n```\n\n- `IOCTL_KGSL_GPUOBJ_IMPORT` (KGSL_USER_MEM_TYPE_ADDR + USE_CPU_MAP) \u306f\u6210\u529f \u2192 SVM \u633f\u5165\u304c\u52d5\u4f5c\n- `TASK_SIZE = 0xC0000000` \u3067\u3001global range \u306b\u306f\u30e6\u30fc\u30b6\u30fc\u304c mmap \u4e0d\u53ef\n- \u5de8\u5927\u30b5\u30a4\u30ba\u306f `memdesc_sg_virt` \u306e\u5272\u308a\u5f53\u3066\u3067 ENOMEM\n\n---\n\n## 5. \u30b7\u30b9\u30c6\u30e0\u30a2\u30d7\u30ea\u89e3\u6790\n\ndocomo OSV (FOTA) \u30a2\u30d7\u30ea\u3092\u542b\u3080\u5168 priv-app \u3092\u53d6\u5f97\u3057\u3001jadx / baksmali \u3067\u89e3\u6790\u3002\n\n### 5.1 \u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3\u4fdd\u8b77\u30ec\u30d9\u30eb\n\n| \u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3 | \u4fdd\u8b77\u30ec\u30d9\u30eb |\n|---|---|\n| FOTA_REBOOT | signature |\n| OSV_REGISTRY | signature |\n| ACCESS_CONTENT_PROVIDER | signatureOrSystem |\n| RECV_PARENT_APP_EDITING_MSG | signature / signatureOrSystem |\n| KIDS_COMMON_PHRASE | signature |\n\n**\u5f37\u6a29\u9650\u306f\u5168\u3066\u7f72\u540d\u4fdd\u8b77**\u3055\u308c\u3066\u304a\u308a\u3001\u5916\u90e8\u30a2\u30d7\u30ea\u304b\u3089\u306e\u596a\u53d6\u306f\u4e0d\u53ef\u3002\n\n### 5.2 \u7121\u4fdd\u8b77\u30b3\u30f3\u30dd\u30fc\u30cd\u30f3\u30c8\n\n- `KidsHome` \u306e `ClockSettingProvider`\uff08authorities: jp.co.sharp.android.kids.kidshome.setting\uff09\u2014 exported, \u7121\u4fdd\u8b77\n- `schedule` \u306e `WidgetProvider` \u2014 exported, \u7121\u4fdd\u8b77\n\n\u3044\u305a\u308c\u3082\u6642\u8a08/\u30b9\u30b1\u30b8\u30e5\u30fc\u30eb\u8a2d\u5b9a\u306e\u307f\u3067\u3001\u6a29\u9650\u6607\u683c\u306b\u306f\u4f7f\u3048\u306a\u3044\u3002\n\n### 5.3 docomo OSV \u30a2\u30d7\u30ea\n\n- DEX \u7121\u3057\u3001\u30cd\u30a4\u30c6\u30a3\u30d6 OMA-DM \u30a8\u30f3\u30b8\u30f3\uff08`libdmclientengine.so`\u3001\u5bcc\u58eb\u901a\u7cfb\uff09\n- FOTA \u306f\u8a8d\u8a3c\u4ed8\u304d\u30fb\u6697\u53f7\u5316\u30c0\u30a6\u30f3\u30ed\u30fc\u30c9\n- \u30a2\u30c3\u30d7\u30c7\u30fc\u30c8\u306f\u5dee\u5206 OTA \u3067\u3042\u308a\u3001firehose (EDL programmer) \u306f\u542b\u307e\u308c\u306a\u3044\n- **FOTA \u304b\u3089\u306e root \u5316\u6750\u6599\u53d6\u5f97\u306f\u4e0d\u53ef**\n\n---\n\n## 6. \u5b9f\u6a5f\u3067\u4f7f\u3048\u308b\u30c4\u30fc\u30eb\u30fb\u60c5\u5831\n\n### 6.1 fastboot \u81ea\u4f5c\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\uff08libusb\uff09\n\nSH-03M \u306e Download mode (`0489:C009`) \u306f Google fastboot \u304c\u8a8d\u8b58\u3057\u306a\u3044\u305f\u3081\u3001Python + libusb \u3067\u30a2\u30af\u30bb\u30b9\u3059\u308b\u3002\n\n```python\nimport usb.core, usb.util\nfrom usb.backend import libusb1\nbackend = libusb1.get_backend(find_library=lambda x: \"libusb-1.0.dll\")\ndev = usb.core.find(idVendor=0x0489, idProduct=0xC009, backend=backend)\n# \u751f\u30b3\u30de\u30f3\u30c9\u9001\u4fe1\uff08getvar/oem \u306f\u9577\u3055\u30d7\u30ec\u30d5\u30a3\u30c3\u30af\u30b9\u7121\u3057\uff09\n```\n\n### 6.2 EDL (9008) \u30af\u30e9\u30a4\u30a2\u30f3\u30c8\n\nbkerler/edl \u304c\u305d\u306e\u307e\u307e\u4f7f\u3048\u308b\u3002Sahara \u30cf\u30f3\u30c9\u30b7\u30a7\u30a4\u30af\u3067 HWID/PK_HASH \u3092\u53d6\u5f97\u53ef\u80fd\u3002\n\n```\npython edl.py --debugmode printgpt\n```\n\n\uff08firehose \u304c\u7121\u3044\u305f\u3081\u3001\u5148\u3078\u306f\u9032\u3081\u306a\u3044\uff09\n\n### 6.3 \u30ea\u30ab\u30d0\u30ea\u30fc\u30e2\u30fc\u30c9\uff08\u4fdd\u8b77\u8005\u30d1\u30b9\u30ef\u30fc\u30c9\u89e3\u9664\uff09\n\n1. **\u96fb\u6e90\u30dc\u30bf\u30f3\uff08\u4e0a\u90e8\uff09** \u3068 **\u30de\u30ca\u30fc\u30ad\u30fc\uff08\u53f3\u5074\uff09** \u3092\u540c\u6642\u306b10\u79d2\u4ee5\u4e0a\u9577\u62bc\u3057\n2. docomo \u30ed\u30b4\u8868\u793a\u3067\u96fb\u6e90\u30dc\u30bf\u30f3\u304b\u3089\u6307\u3092\u96e2\u3059\n3. 1\u56de\u632f\u52d5\u5f8c\u3001\u30de\u30ca\u30fc\u30ad\u30fc\u3092\u62bc\u3057\u305f\u307e\u307e\u96fb\u6e90\u30dc\u30bf\u30f3\u3092\u7d20\u65e9\u304f3\u56de\u62bc\u3059\n4. \u30ea\u30ab\u30d0\u30ea\u30fc\u30e1\u30cb\u30e5\u30fc\u8868\u793a \u2192 \u300cWipe data/factory reset\u300d\u2192\u300cFactory Reset\u300d\u2192\u300cOK\u300d\n\n\u203b \u5168\u30c7\u30fc\u30bf\uff08eSIM \u542b\u3080\uff09\u304c\u6d88\u3048\u308b\u3002\u4fdd\u8b77\u8005\u30d1\u30b9\u30ef\u30fc\u30c9\u4e0d\u660e\u306e\u7aef\u672b\u306e\u521d\u671f\u5316\u306b\u6709\u52b9\u3002\n\n---\n\n## 7. Fuzzing\uff08\u9032\u884c\u4e2d\uff09\n\n\u672a\u516c\u958b\u8106\u5f31\u6027\u306e\u63a2\u7d22\u3068\u3057\u3066\u3001\u4ee5\u4e0b\u3092\u8a08\u753b\u30fb\u5b9f\u884c\u4e2d\u3002\n\n### 7.1 \u5bfe\u8c61\u30c9\u30e9\u30a4\u30d0\n\n| \u30c7\u30d0\u30a4\u30b9 | \u30d1\u30fc\u30df\u30c3\u30b7\u30e7\u30f3 | \u512a\u5148\u5ea6 |\n|---|---|---|\n| `/dev/kgsl-3d0` | rw-rw-rw-\uff08\u5168\u30a2\u30af\u30bb\u30b9\u53ef\uff09 | \u2605\u2605\u2605 |\n| `/dev/binder` | rw-rw-rw- | \u2605\u2605 |\n| `/dev/diag` | system:fota \u6240\u6709 | \u2605\uff08\u8981\u6a29\u9650\u78ba\u8a8d\uff09 |\n| `/dev/ion` | rw-rw-r-- | \u2605 |\n\n### 7.2 \u65b9\u91dd\n\n- kernel 3.18 / 32bit ARM \u5411\u3051\u306e syzkaller \u306f\u30bb\u30c3\u30c8\u30a2\u30c3\u30d7\u304c\u91cd\u3044\u305f\u3081\u3001**\u81ea\u4f5c\u306e\u8efd\u91cf ioctl fuzzer** \u3092\u512a\u5148\n- \u5404\u30c9\u30e9\u30a4\u30d0\u306e ioctl \u306b\u5909\u7570\u5165\u529b\u3092\u9001\u308a\u3001**\u30af\u30e9\u30c3\u30b7\u30e5 (kernel panic / watchdog / reboot)** \u3092\u691c\u77e5\n- \u30af\u30e9\u30c3\u30b7\u30e5\u691c\u77e5\u6642\u306f pstore / last_kmsg \u304b\u3089\u30ed\u30b0\u3092\u56de\u53ce\u3057\u3001\u539f\u56e0\u3092\u89e3\u6790\n- \u767a\u898b\u3057\u305f\u8106\u5f31\u6027 \u2192 exploit \u5316\uff08\u9577\u671f\uff09\n\n### 7.3 \u9032\u6357\u30fb\u6210\u679c\n\n**\u5b9f\u884c\u6e08\u307f fuzzer\uff08\u81ea\u4f5c\u3001NDK\u3067ARM32\u30af\u30ed\u30b9\u30b3\u30f3\u30d1\u30a4\u30eb\uff09:**\n\n| fuzzer | \u5bfe\u8c61 | \u7d50\u679c |\n|---|---|---|\n| kgsl_fuzz | \u30e9\u30f3\u30c0\u30e0ioctl | 10\u4e07\u56de\u30af\u30e9\u30c3\u30b7\u30e5\u306a\u3057 |\n| kgsl_fuzz2 | drawctxt+gpuobj+GPU_COMMAND | \u6709\u52b9\u306a\u72b6\u614b\u3067\u306e\u63a2\u7d22 |\n| kgsl_fuzz3 | \u6709\u52b9\u72b6\u614b+\u5909\u7570\u5f15\u6570 | **GPUOBJ_ALLOC\u3067\u30af\u30e9\u30c3\u30b7\u30e5** |\n| kgsl_fuzz_case | \u30b1\u30fc\u30b9\u5206\u96e2 | **\u30b1\u30fc\u30b95\uff08GPUOBJ_ALLOC\uff09\u3067\u30af\u30e9\u30c3\u30b7\u30e5\u7279\u5b9a** |\n| kgsl_alloc_* | \u30af\u30e9\u30c3\u30b7\u30e5\u5883\u754c\u63a2\u7d22 | \u3057\u304d\u3044\u5024\u7279\u5b9a |\n| kgsl_fuzz4 | fence/event | \u30af\u30e9\u30c3\u30b7\u30e5\u306a\u3057\uff08fence\u306f\u5805\u7262\uff09 |\n\n**\u767a\u898b\u3057\u305f\u30af\u30e9\u30c3\u30b7\u30e5\uff08DoS\uff09:**\n\n`IOCTL_KGSL_GPUOBJ_ALLOC` \u3067 `size >= 0x16000000`\uff08\u7d04352MB\uff09\u3092\u6307\u5b9a\u3059\u308b\u3068**\u30ab\u30fc\u30cd\u30eb\u304c\u30af\u30e9\u30c3\u30b7\u30e5\u3057\u7aef\u672b\u304c\u518d\u8d77\u52d5**\u3059\u308b\u3002\n\n- \u518d\u73fe\u6027: \u9ad8\uff08\u8907\u6570\u56de\u78ba\u8a8d\uff09\n- \u3057\u304d\u3044\u5024: `0x15000000`\uff08336MB\uff09\u6210\u529f / `0x16000000`\uff08352MB\uff09\u30af\u30e9\u30c3\u30b7\u30e5\n- \u6027\u8cea: **OOM/\u30e1\u30e2\u30ea\u67af\u6e07\u306b\u3088\u308b\u30ab\u30fc\u30cd\u30eb\u30d1\u30cb\u30c3\u30af\u3068\u63a8\u5b9a**\uff08DoS\uff09\n- \u6a29\u9650\u6607\u683c\u3078\u306e\u5229\u7528: **\u975e\u73fe\u5b9f\u7684**\uff08\u30e1\u30e2\u30ea\u7834\u58ca\u3067\u306f\u306a\u304f\u67af\u6e07\u306e\u305f\u3081\uff09\n\n**kgsl \u8abf\u67fb\u3067\u5224\u660e\u3057\u305f\u4e8b\u5b9f:**\n- `/dev/kgsl-3d0` \u306f `rw-rw-rw-`\uff08\u5168\u30a2\u30af\u30bb\u30b9\u53ef\u3001\u901a\u5e38\u306eAndroid\u3067\u306f\u7570\u4f8b\uff09\n- \u30c9\u30e9\u30a4\u30d0: KGSL 3.14 / Adreno 304\n- SVM \u633f\u5165\uff08USE_CPU_MAP\uff09\u306f\u52d5\u4f5c\u3059\u308b\u304c\u300132bit\u3067\u306f\u30e9\u30c3\u30d7\u4e0d\u53ef\n- drawctxt \u4f5c\u6210\u306b\u306f `PREAMBLE | NO_GMEM_ALLOC` \u306e\u4e21\u30d5\u30e9\u30b0\u304c\u5fc5\u9808\n\n**fuzzing\u306e\u9650\u754c:**\n- \u30af\u30e9\u30c3\u30b7\u30e5\u30ed\u30b0\uff08pstore/last_kmsg\uff09\u306f\u975eroot\u3067\u8aad\u3081\u306a\u3044\n- \u30af\u30e9\u30c3\u30b7\u30e5\u306e\u305f\u3073\u306b\u7aef\u672b\u518d\u8d77\u52d5\uff08\u7d041\u5206\uff09\u304c\u767a\u751f\u3057\u3001\u63a2\u7d22\u52b9\u7387\u304c\u4f4e\u3044\n- \u30a2\u30af\u30bb\u30b9\u53ef\u80fd\u306a\u30c7\u30d0\u30a4\u30b9\u306f kgsl \u306e\u307f\uff08diag/ion/adsprpc \u306fSELinux\u5236\u9650\uff09\n\n---\n\n## 8. \u7d50\u8ad6\n\n**SH-03M\uff08docomo\u30ad\u30c3\u30ba\u30b1\u30fc\u30bf\u30a4\uff09\u306eroot\u5316\u306f\u3001\u672c\u8abf\u67fb\u306e\u7bc4\u56f2\u3067\u306f\u5b9f\u73fe\u624b\u6bb5\u304c\u78ba\u8a8d\u3067\u304d\u306a\u304b\u3063\u305f\u3002**\n\n### \u8a66\u884c\u3057\u305f\u5168\u30eb\u30fc\u30c8\u3068\u6700\u7d42\u7d50\u679c\n\n| \u30eb\u30fc\u30c8 | \u6700\u7d42\u7d50\u679c |\n|---|---|\n| \u30d6\u30fc\u30c8\u30ed\u30fc\u30c0\u30fc\u30a2\u30f3\u30ed\u30c3\u30af | \u62d2\u5426\uff08unlock_ability=0\uff09 |\n| EDL + firehose | \u5c02\u7528\u7f72\u540d\u9375\u304c\u975e\u516c\u958b\u3067\u4e0d\u53ef\u80fd |\n| \u65e2\u77e5\u30ab\u30fc\u30cd\u30ebCVE | \u5168\u3066\u4fee\u6b63\u6e08\u307f |\n| \u30b7\u30b9\u30c6\u30e0\u30a2\u30d7\u30ea\u6607\u683c | signature\u4fdd\u8b77\u3067\u4e0d\u53ef |\n| kgsl fuzzing | DoS\u306e\u307f\u767a\u898b\u3001root\u6607\u683c\u306b\u975e\u73fe\u5b9f\u7684 |\n| \u30ab\u30fc\u30cd\u30eb\u30e2\u30b8\u30e5\u30fc\u30eb | \u975eroot\u3067\u4e0d\u53ef |\n\n### \u6839\u672c\u7684\u306a\u8981\u56e0\n\n1. **\u30bb\u30ad\u30e5\u30a2\u30d6\u30fc\u30c8 + \u7f72\u540d\u4ed8\u304d\u30d6\u30fc\u30c8\u30ed\u30fc\u30c0\u30fc**\uff08PK_HASH `0eed6924` \u306e\u5c02\u7528\u9375\u304c\u975e\u516c\u958b\uff09\n2. **\u4e3b\u8981\u306a\u65e2\u77e5CVE\u304c\u5168\u3066\u4fee\u6b63\u6e08\u307f**\uff08\u30b7\u30e3\u30fc\u30d7\u304c2019\u5e74\u6642\u70b9\u3067binder\u7cfb\u3092\u4fee\u6b63\uff09\n3. **\u5f37\u56fa\u306aSELinux\u30dd\u30ea\u30b7\u30fc**\uff08kgsl\u4ee5\u5916\u306e\u653b\u6483\u9762\u3092\u906e\u65ad\uff09\n4. **32bit ARM\u306e\u5236\u7d04**\uff0864bit\u524d\u63d0\u306eexploit\u624b\u6cd5\u304c\u591a\u6570\u5229\u7528\u4e0d\u53ef\uff09\n\n### \u6b8b\u308b\u53ef\u80fd\u6027\uff08\u672a\u5b9f\u65bd\uff09\n\n- **\u30bc\u30ed\u30c7\u30a4\u7684\u8106\u5f31\u6027\u306e\u9577\u671f\u7684\u306a\u63a2\u7d22**\uff08\u6570\u9031\u9593\u301c\u6570\u30f6\u6708\u898f\u6a21\u306e\u7814\u7a76\uff09\n- **root\u6a29\u9650\u3092\u5fc5\u8981\u3068\u3057\u306a\u3044\u4ee3\u66ff\u624b\u6bb5**\uff08ADB\u3067\u306e\u30ab\u30b9\u30bf\u30de\u30a4\u30ba\u7b49\uff09\n\n## 9. \u4ed8\u9332: \u4f5c\u6210\u3057\u305f\u30c4\u30fc\u30eb\n\n\u672c\u8abf\u67fb\u3067\u4f5c\u6210\u3057\u305f\u30c4\u30fc\u30eb\uff08\u3059\u3079\u3066\u9694\u96e2\u74b0\u5883\u3067\u958b\u767a\u30fb\u30c6\u30b9\u30c8\uff09\uff1a\n\n- `kgsl_probe.c` - KGSL\u30d0\u30fc\u30b8\u30e7\u30f3/\u30c7\u30d0\u30a4\u30b9\u60c5\u5831\u53d6\u5f97\n- `kgsl_cve_test*.c` - CVE\u30c8\u30ea\u30ac\u30fc\u691c\u8a3c\n- `kgsl_fuzz*.c` - kgsl ioctl fuzzer\uff084\u4e16\u4ee3\uff09\n- `kgsl_alloc_*.c` - \u30af\u30e9\u30c3\u30b7\u30e5\u5883\u754c\u63a2\u7d22\n- `fb_*.py` - fastboot \u81ea\u4f5c\u30af\u30e9\u30a4\u30a2\u30f3\u30c8\uff08Download mode\u7528\uff09\n\n---\n\n## 10. \u53c2\u8003\u30ea\u30f3\u30af\n\n- \u30b7\u30e3\u30fc\u30d7 OSS \u516c\u958b: https://k-tai.sharp.co.jp/support/developers/oss/sh03m/index.html\n- bkerler/edl: https://github.com/bkerler/edl\n- temblast loaders: https://www.temblast.com/ref/loaders.htm\n- CVE-2020-11261: https://securitylab.github.com/advisories/GHSL-2020-374-kgsl/\n- CVE-2020-11239: https://securitylab.github.com/advisories/GHSL-2020-375-kgsl/\n- CVE-2023-33107 RCA: https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2023/CVE-2023-33107.html\n", "creation_timestamp": "2026-08-03T18:50:47.895731Z"}, {"uuid": "6a0926f9-483d-4489-b04d-d4a565c89693", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/hackersmeet0/1150", "content": "Analysis of Latest Android Binder vulnerability (CVE-2020-0041)\n\nBlogpost: https://www.synacktiv.com/posts/exploit/binder-analysis-and-exploitation-of-cve-2020-0041.html\nSlides: https://www.synacktiv.com/ressources/thcon2020_binder.pdf", "creation_timestamp": "2026-08-02T14:14:52.324218Z"}, {"uuid": "c617759d-431e-4411-9575-ab36a4993c0b", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/988b34d5-9cfc-4ba9-b7cc-d2446037a6b8", "content": "", "creation_timestamp": "2026-06-19T12:47:54.395609Z"}, {"uuid": "e315c35e-07b1-499b-a5d5-e11eacb3e0d6", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a2847225-8d01-4956-9d5f-b5fadb467ee2", "content": "", "creation_timestamp": "2026-06-23T14:04:49.301795Z"}, {"uuid": "6abbd190-6f08-4b21-b157-a39cf8837024", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "seen", "source": "https://t.me/reverseame/20", "content": "https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/", "creation_timestamp": "2026-07-18T15:00:05.899621Z"}, {"uuid": "dd6a416b-886d-489f-9d9c-2c851582ebf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-0041", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/20", "content": "https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/", "creation_timestamp": "2026-07-19T00:00:11.141791Z"}]}