Skip to content

v3.0

Choose a tag to compare

View all tags
@zsw125 zsw125 released this 25 Oct 14:38
· 23 commits to main since this release
v3.0
dc06899

v3.0 — two-reap exploit, KernelSU without init patch.

  • Payload: stage 0 writes an 8-byte unaligned zero at selinux_state-7 (clears only enforcing, keeps initialized/policycap); stage 1 swaps task_cred. KernelSU is loaded through the runtime kallsyms loader with no init patch (KSU_CODEPATCH skip), then restores Enforcing — Wi-Fi stays healthy.
  • App v3.0 (versionCode 13): new payload embedded; the legacy Enforcing-rebound guard/recovery UI was removed (Enforcing is the normal end state now).
  • Verified cold boot on yingtian: KSU_INSMOD_OUT:[rc=0], KSU_MODULE LIVE, Enforcing, ping/nc OK, manager auto-opened, boot unchanged.
  • APK: 14,218,768 B, sha256 c80f499a6b06ddf92241aa8cb0aa8874767eccdd960e631b28dcff98e7c141dd.

Single-reap three-write attempt panicked repeatedly and is kept behind O3P_D3V3 for analysis only.

Assets 4
Loading