Zhuowei Zhang

Mostly bad puns. It's pronounced "joe-way". Happy to explain jokes.
he/him, opinions are my own. https://zhuoweizhang.net

Public Key

npub1cppa6rw8av0n2zjc6yarum7k0nmtkka4d7qas3ndy0sqpjfz9u0sx9e7uy

NIP-05 Address

zhuowei@notnow-dev.mostr.pub

Profile Code

nprofile1qqsvqs7aphr7k8e4pfvdzw37dlt8ea4mtw6klqwcgekj8cqqey3z78cpz4mhxue69uhhyetvv9ujuerfw36x7tnsw43q563e6v

Publishing to

relay.ditto.pub

Author Public Key

npub1cppa6rw8av0n2zjc6yarum7k0nmtkka4d7qas3ndy0sqpjfz9u0sx9e7uy

Show more details

Last Notes

2026-02-10 03:36:17 UTC

This Torment Nexus uses cookies

2026-02-01 02:38:29 UTC

Gen Alpha smashes the stack with "gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg"... (0x67676767)

2025-08-26 02:27:32 UTC

https://en.wikipedia.org/wiki/List_of_fictional_horses
> Please help clean up the lists by removing items

2025-08-24 21:01:18 UTC

- reply

@nprofile…zvhv Fun fact: this domain wasn't originally intended as my Mastodon name; I originally got it when I tried to build a GeForce Now proxy.

2025-08-24 18:46:56 UTC

When self-hosting Bluesky and Mastodon, is it better to use the same username for both or separate domains?
Is it confusing to have both @zhuowei@notnow.dev and @zhuowei.notnow.dev? Should I use a different domain for my Bluesky account?

2025-08-24 18:10:01 UTC

- reply

@nprofile…36vp people "wise beyond their years" entering college:

2025-08-24 18:01:05 UTC

Legitimately mad that I am closer in age to the wise, old mentor from this novel than the hotheaded young protagonist

2025-08-24 14:59:38 UTC

- reply

@nprofile…vejh Nothing measures up to VB6

2025-08-23 05:31:01 UTC

- reply

(ok fine so I'm exaggerating, but it's not like anyone here's read the md5sum(47874ddf8196bcc6d0ede42b7e79eab2) series by md5sum(0cdeecb65c0a428497c89f8d0d3a2d5f))

2025-08-23 05:27:37 UTC

The Perfect Cinnamon Roll in this novel: "I cannot stand this injustice: no, I must sacrifice myself today!"
Me, who read the sequel already and knows what would happen if you'd just waited one more day:

2025-08-22 18:34:28 UTC

Idea: auto-playing video ads in PDFs

2025-08-21 04:30:23 UTC

Who named it "Windows Recall" and not "NTLLM"

2025-08-21 00:37:48 UTC

Is there a resource oriented fuzzer like Syzkaller for non-kernels?

2025-08-16 08:22:59 UTC

- reply

Obviously I don't expect the fancy new Linux GUI/GPU support to work - I assume only non-protected VM can share GPU memory? But protected VMs can boot to a terminal just fine...

2025-08-16 08:06:58 UTC

Android Authority / @nprofile…82xg says the Samsung Galaxy Fold 7 doesn’t support Android’s Terminal app because it only supports protected VMs, not unprotected VMs (unlike the Flip 7)
https://androiddev.social/@MishaalRahman/114870295312207051
However, polygraphene’s guide for VMs on Snapdragon points out that protected VMs are signed with testkeys - which anyone can download from AOSP: https://github.com/polygraphene/gunyah-on-sd-guide/blob/main/PVMFW.md
So… could you modify the Terminal app to run with a protected VM instead?

2025-08-16 04:10:05 UTC

- reply

@nprofile…89u7 No: CVE-2025-21479 only affects - as far as I can tell - Adreno 7xx, so only Snapdragon XR2 Gen 2. (But you should turn off auto-updates anyway in case some other root drops.)

2025-08-15 14:32:33 UTC

If you have a Meta Quest 3/3S and want to root it, take it off Wi-Fi RIGHT NOW and disable updates:
adb shell pm disable-user --user 0 com.oculus.updater
The latest update patches CVE-2025-21479.

2025-08-11 03:06:39 UTC

I want to multi-boot Android, but Android only supports at most dual-booting (main + one GSI).
Does this mean that, if I want to dual boot more than one OS, I'd have to disable hardware Gatekeeper/KeyMint?
https://source.android.com/docs/core/ota/dynamic-system-updates#gatekeeper-hal
https://cs.android.com/android/platform/superproject/main/+/main:system/core/gatekeeperd/gatekeeperd.cpp;l=161;drc=32e1c70f275991ec7fe4d4a2d6e3eeba2a172540

2025-08-10 23:12:47 UTC

- reply

On my physical Android 14 device, I can't enter a pin after my hacked up userspace reboot - Gatekeeper errors out with `resp->status: -5338`. Oh, well. I was going to replace the data partition with my own, anyways.

2025-08-10 21:03:47 UTC

- reply

This didn't work on a physical device until I realized that I have to prefix every command with `/system/bin/bootstrap/linker64`, since apexes are unmounted before shutdown on physical devices, including the linker.

2025-08-09 06:35:48 UTC

Mildly amused that I can get Android to do a userspace reboot by:
overwriting init’s RebootSystem function with an execve() by writing to /proc/1/mem
do a reboot, causing init to exec into my trampoline
dmctl delete userdata
rm -r /dev/__properties__
exec runcon "u:r:kernel:s0" /system/bin/init selinux_setup
(Yes, Android 11-14 had a built-in userspace reboot, but it doesn’t restart init and vold.
And yes, modders have been userspace rebooting Android since 2011.)

2025-08-02 23:52:10 UTC

https://notnow.dev/media/6b189db2-d595-48db-8472-855c467921bf/build_environment.png

2025-08-01 00:42:01 UTC

24-karat gold LabViewView

2025-07-30 05:37:06 UTC

- reply

@nprofile…vejh spend less on div64_mine_

2025-07-30 00:00:13 UTC

- reply

@nprofile…ayvy This was intended to reference people being trained by AI to perform Turing tests via em-dashes, but if you can rebrand your dog as an ACI (Artificial Canine Intelligence) you'll get $1T in seed-stage funding

2025-07-29 23:50:45 UTC

None of you seem to understand:
I'm not being trained by you—
you're being trained by me!

2025-07-29 05:36:56 UTC

- reply

This YouTube video confirms the factory firmware is the June 2025 firmware: https://youtu.be/ZwAMqwtDAB0?t=573

2025-07-29 05:05:53 UTC

- reply

Fold 7s seem to be manufactured starting in June 2025 (https://www.ebay.com/itm/297502911519 - Y6 in the serial means 2025-06, according to https://technastic.com/check-manufacturing-date-samsung-devices/), so the June update is probably the factory firmware.
I was hoping for an April security update or earlier, since previous Samsung phones's factory firmwares are usually 3 months out of date (https://us.community.samsung.com/t5/Galaxy-S25/S25-Ultra-Firmware-Question/td-p/3127640), but alas...

2025-07-29 04:20:03 UTC

- reply

(But seriously, though, all the demo Galaxy Fold 7 devices I've seen had the June 2025 security update; I don't know if that's the factory firmware or the day-1 update)

2025-07-29 03:48:28 UTC

- reply

@nprofile…4pjf The only unlockable US market device in the last 10 years was the Galaxy S10 5G for Sprint (https://www.xda-developers.com/5g-samsung-galaxy-s10-sprint-bootloader-unlock/)

2025-07-29 02:46:57 UTC

Which security update does the Fold 7 ship with? Asking for a friend.
(ok I'm joking, I don't know how to root phones...)
https://mastodon.social/@verge/114933183378108790

2025-07-28 07:19:24 UTC

- reply

I'd like to add you to my professional network on IPv6

2025-07-28 07:13:54 UTC

Today I learned most people look upon digital signatures as dark magic, the same way I think of networking

2025-07-26 22:01:50 UTC

- reply

(I'm mostly joking: I'm not a security researcher and don't know how to best fuzz a hypervisor. I assume you just point syzkaller at it and hope?)

2025-07-26 21:55:01 UTC

I am this close to shoving Gunyah into a fuzzer to hunt for zero-days, just to get its friggin’ debug logs!
(Yes, I know I can afford to pay $400 for a Snapdragon dev board with Secure Boot off, but I refuse out of principle. Also, shipping takes too long)

2025-07-26 20:58:54 UTC

- reply

The bad news is that Gunyah still fails to configure on a physical Snapdragon device:
[ 177.716436] call: 0
[ 177.716544] ret: 0
[ 177.716549] vmid: 45
[ 177.716551] gh_vm_mgr: gh_vm_start: here1
[ 178.729413] about to mem share
[ 179.742759] about to assign 67 entries
[ 180.767741] survived ram assign
[ 181.769440] done pre mem share
[ 182.783493] survived mem share
[ 183.796078] gh_vm_mgr: gh_vm_start: mem
[ 184.809414] gh_rm_vm_configure: vmid 45 auth_mech 0 mem_handle 0 image_offset 0 image_size 0 dtb_offset 1f0000 dtb_size 1000
[ 184.809431] misc gunyah: Failed to configure VM: -22
[ 184.810322] gh_vm_mgr: Failed to reclaim memory parcel for label 0: -22
[ 184.810358] misc gunyah: Failed to deallocate vmid: -22
[ 187.524535] healthd: battery l=99 v=4459 t=32.0 h=2 st=2 c=498791 fc=5106000 cc=0 chg=a

2025-07-26 20:37:32 UTC

- reply

I'm guessing the IRQ alloc fails because the device tree is wrong:
[RM]Warning: interrupts "config" property looks like a phandle (0x1), but should be a path
... so does this mean nobody actually tested Gunyah's sample code/dtb?
https://android.googlesource.com/kernel/common/+/refs/heads/android14-6.1/samples/gunyah/sample_vm.dts

2025-07-26 20:25:09 UTC

What do you mean the Switch 2 is back in stock and I can get one delivered in four days?!
(No, I will not be purchasing one, but, still, what)

2025-07-26 20:17:49 UTC

- reply

Thankfully the issue is really stupid: the Gunyah VM sample code doesn't pad the device tree to 0x1000, so the mapping fails due to alignment.
https://android.googlesource.com/kernel/common/+/refs/heads/android14-6.1/samples/gunyah/gunyah_vmm.c
https://github.com/quic/gunyah-resource-manager/blob/1b23ceb0dfa010b3b6b5a5f7a4ec1e95b93ab99d/src/utils/address_range_allocator.c#L211
So now I can get through VM_INIT, but it now fails allocating an IRQ:
https://gist.github.com/zhuowei/07e93be759722e98a75633b8a6823b27

2025-07-26 20:10:39 UTC

AI alignment research (testing the Android ChatGPT app on a device with 16K page size)

2025-07-26 19:55:52 UTC

The good news is that my Gunyah VM in QEMU reproduces the exact same error I see on device, even when I’m using the known good QEMU setup instructions from Gunyah’s Getting Started guide.
Also the bad news.
# ./gunyah_vmm -i gunyah_vmm -d sample_vm.dtb
[ 63.349802] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=93 'gunyah_vmm'
survived set user mem region
survived GH_VM_SET_DTB_CONFIG
[RM]allocated vmid=128
[RM]VM_ALLOCATE: 3 vmid=128, ret=0
[RM]MEM_APPEND VM 3 H 0 ret 0
[RM]VM_CONFIG_IMAGE: from:3 vmid:128 auth:0 mp:0 img: 0/0 dt: 0x45f0000/0x41e
[RM]NOTIFY_VM_STATUS: to: 3 [128: 1/0/0]
[RM]VM_INIT: from:3 vmid:128
[RM]Error: src/utils/address_range_allocator.c 238: 1
[RM]map_dtb: memparcel_map_rm failed
[RM]map_dtb(73334784, 1054) : failed, ret=1
[RM]DTB: offset:0x45f0000, size:0x41e
[RM]Error: failed to map device tree
[RM]NOTIFY_VM_STATUS: to: 3 [128: 8/0/0]
[ 65.712662] gh_rsc_mgr hypervisor:qcom,resource-manager-rpc@0000000000000000: RM rejected message 5600000b. Error: 10
[ 65.713530] misc gunyah: Failed to initialize VM: -22
GH_VM_START failed: Invalid argument
[RM]NOTIFY_VM_STATUS: to: 3 [128: 10/0/0]
[RM]NOTIFY_VM_STATUS: to: 3 [128: 11/0/0]
/ # [RM]MEM_RECLAIM VM 3 H 0 ret 0
[RM]VM_DEALLOCATE: 3 vmid=128, ret=0

2025-07-26 18:13:39 UTC

- reply

(context: https://mastodon.social/@jk/114919358000059581)

2025-07-26 18:09:50 UTC

Mastodon’s current viral post is about a job interview where university GPA and 15 years of experience don’t matter if you can’t impress one guy with your high school grades.
Every “gifted” kid who peaked in high school: finally

2025-07-26 16:37:02 UTC

If you wish to make an apple pie from scratch, you must first compile LLVM

2025-07-26 16:33:50 UTC

Year of AGIinux on the Desktop

2025-07-21 01:42:11 UTC

- reply

I've never heard of a working Kexec on Android devices (kexec-hardboot doesn't count; it needs bootloader to be unlocked in the first place). I guess the Fire 7 is an exception - maybe MediaTek chipsets can kexec?

2025-07-21 01:39:55 UTC

Trying to trace the history of kexec-as-kernel-module implementations:
- chaosmaster built kexec as a module for the Amazon Kindle Fire 7 (2015) in 2015: https://github.com/chaosmaster/ford_kexec
- amonakov wrote a new version in 2018, not specific to the Fire 7:
https://github.com/amonakov/kexec-module
- fabianishere ported amonakov's version from Linux 3.8 to 4.x kernels in 2021 and made it build without requiring full kernel source:
https://github.com/fabianishere/kexec-mod
Any other kexec-as-a-module implementations?

2025-07-21 00:55:14 UTC

- reply

@nprofile…vvn7 I saw someone was selling an Ayo Odin 2, and I had no idea it existed: I didn't know you could get a Snapdragon 8 Gen 2 with secure boot off for cheap.
I ended up getting a different Snapdragon test device, then I found hypervisor Resource Manager logs are only available with secure boot off (https://github.com/quic/gunyah-resource-manager/blob/981e1e69df7baeeb241d19cb83072f713c3ed1db/src/resource-manager.c#L261) and now I regret it

2025-07-21 00:25:46 UTC

Someone convince me not to spend $400 on a Snapdragon 8 Gen 2 device with Secure Boot off

2025-07-20 22:48:14 UTC

It is the year 2025 and I still have a kernel without hugepages support

2025-07-20 22:33:05 UTC

- reply

@nprofile…jefk Context: I'm trying to get virtualization working on this phone (since I need a showcase for "things you can only do on a rooted phone"... mostly because I bought this device specifically to root it, but don't know what to do with it when rooted.)

2025-07-20 19:55:05 UTC

Once again, my project have reached the stage where I beg everyone I've ever met, from kindergarden to the present day, for help, because I have no idea what to do next.
... so about 15 minutes in.

2025-07-20 19:47:56 UTC

- reply

@nprofile…vejh The Resource Manager only exposes logs on devices with security disabled (https://github.com/quic/gunyah-resource-manager/blob/981e1e69df7baeeb241d19cb83072f713c3ed1db/src/resource-manager.c#L261), and you're the only person I've heard of with a device of that generation with secure boot off....

2025-07-20 19:44:32 UTC

- reply

@nprofile…vejh The Android 12 kernel should have the TrustZone log module (drivers/firmware/qcom/tz_log.c).
My test device also uses a 5.10 kernel and has this (not compiled by default, but I was able to build and load it fine - not sure if other devices have this built-in)

2025-07-20 19:27:00 UTC

@nprofile…vejh Sorry to bother you. I'm working on running VMs on the Gunyah hypervisor on Snapdragon 8 Gen 2-era devices.
(They have Gunyah, but they predate Android Virtualization Framework on Android 14, so the built-in kernel support only supports VMs defined in the device tree with signed boot image. Although it appears to be possible to skip authentication...)
I've backported the Gunyah kernel module from Android 14's common kernel, but it fails when calling Gunyah Resource Manager with VM_CONFIG_IMAGE.
You have a rooted PFD headset with a Snapdragon XR2 Gen 2: have you tried playing with the hypervisor on it? Since it's unfused, do you have access to `/proc/tzdbg/rm_log`?

2025-07-20 19:10:44 UTC

I just realized that the author of the guide for running VMs on Qualcomm Snapdragon devices (https://github.com/polygraphene/gunyah-on-sd-guide) is also the original author of ALVR.
... leave some cool stuff for the rest of us

2025-07-19 15:54:15 UTC

- reply

(and by "wish me luck", I mean "get your F key ready when I inevitably brick my phone")

2025-07-19 15:53:47 UTC

Backporting a kernel module from Android's Linux 6.1 common kernel to my phone's Linux 5.10. Wish me luck?

2025-07-18 08:29:12 UTC

- reply

@nprofile…r54s To be honest, File doesn't change often anyways; do you really need an autogenerated file...

2025-07-18 08:18:27 UTC

- reply

@nprofile…r54s my understanding of your original post is that you're either
- making getFile() return a CustomFile extends File that overrides delete() to throw error - in which case I was surprised you can subclass File
- or making getFile() return a CustomFile that doesn't extend File, but has the same methods and forwards them to an internal File. (In which case https://stackoverflow.com/questions/30344715/automatically-delegating-all-methods-of-a-java-class says there are already tools to automate making these; e.g. Lombok has the `@Delegate` annotation.).

2025-07-18 08:08:49 UTC

- reply

@nprofile…r54s I'm mildly surprised that File isn't final...

2025-07-18 07:10:02 UTC

- reply

@nprofile…eqa5 New revenue idea for Broadcom: pay per EFI_RNG_PROTOCOL invocation

2025-07-18 05:37:14 UTC

- reply

@nprofile…apwk yeah, but you're real hardware; you'd think a VM can just... generate some random numbers and stick them into the VM...

2025-07-18 05:36:32 UTC

- reply

@nprofile…eqa5
Other people have observed "EFI_RNG_PROTOCOL unavailable" during verbose boot.
- VMWare doesn't provide a device tree, only ACPI - I checked
- and based on that message, doesn't provide entropy in UEFI either
- And the M2 doesn't support RNDR. https://stackoverflow.com/a/77045721
EFI_RNG_PROTOCOL is actually mandatory for Windows certification, so I guess VMWare Fusion's UEFI isn't compliant... Does this disable kASLR on Windows, then, too?
https://github.com/MicrosoftDocs/windows-driver-docs/blob/staging/windows-driver-docs-pr/bringup/uefi-requirements-that-apply-to-all-windows-platforms.md

2025-07-18 04:44:10 UTC

Arm64 Linux on VMWare Fusion always fails to initialize kASLR with "KASLR disabled due to lack of seed". why

2025-07-16 12:21:35 UTC

Building a Linux module for arm64 on my arm64 machine, using a cross compiler built for x86_64 under qemu_user emulation.
Look, Android doesn't provide an arm64 builld of clang for its kernel; what am I supposed to do

2025-07-15 05:38:42 UTC

- reply

@nprofile…eqa5 ok, so the only reason to have a rooted device is to do reverse engineering so you can root more devices?
... uh

2025-07-15 04:51:33 UTC

OK, what can I do on a rooted Android device that I can't do on a regular device?

2025-07-15 04:30:48 UTC

Has anyone tried backporting the Gunyah support from Snapdragon 8 Gen 3 to a Snapdragon 8 Gen 2 kernel? It runs the same hypervisor, after all...

2025-07-13 16:21:20 UTC

Are Google Project Zero's sample code licensed under any open source license?
Their code on GitHub are Apache licensed (https://github.com/googleprojectzero), but the proof-of-concepts in their issue tracker do not contain license files or banners (https://project-zero.issues.chromium.org/issues?q=componentid:1638259).
e.g. Ian Beer's original MacDirtyCow sample code has no license file or banner (https://project-zero.issues.chromium.org/issues/42451497)

2025-07-13 16:04:16 UTC

@nprofile…4nyj Hello: I'm so sorry to bother you. I've been following your Project Zero blog post on Qualcomm Adreno GPU exploitation (https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html).
Do you happen to remember if your Adrenaline proof-of-concept code was ever released under an open source license?
I know Project Zero usually releases code under the Apache 2 license, but the code at https://project-zero.issues.chromium.org/issues/42451155 did not contain a license header or text.
Thank you so much for your time, and thank you so much for your Adreno writeup and sample code: it was really helpful for understanding CVE-2025-21479.

2025-06-25 07:31:10 UTC

I just came up with the worst project idea ever: (No, I will not be doing this. Nobody should do this):
- re-implement the kernel part of a Windows Nvidia/AMD GPU driver
- translate the calls to Linux's kernel drivers
- stick it into QEMU so it can implement Microsoft's Hyper-V / WSL GPU virtualization
It's only 400 completely undocumented ioctls that change every driver version!

2025-06-23 05:00:58 UTC

- reply

I suspect the $500 Quest 1 (OLED screen, nice head strap, 2 headphone jacks) was intended to be succeeded by the $1,500 cut-no-corners Quest Pro (also OLED screen, even fancier head strap, built-in headphones!! and 2 headphone jacks)
That got crushed by the Quest 2, which cut every corner to get to $300 (LCD screen (which looks terrible in loading screens with solid black backgrounds), worst head strap ever, 1 headphone jack)
The Quest 3 sands the rough edges off those corners for $500 (better LCDs but still no match for OLED, better headstrap but not as nice as Quest 1’s, 1 headphone jack), and you know what, fine.

2025-06-23 04:47:28 UTC

Meta (Facebook/Oculus) Quest 3 review:
It’s a downgrade from the Quest 1 in every metric -
- screen, ergonomics, UX design, number of headphone jacks -
except the only one that matters: how much I score in Synth Riders.
So I have to begrudgingly admit: it’s worth it.
But turn off the auto-update, in case Facebook accidentally bricks a bunch of devices again.
Granted, this was because Facebook made the Quest 1 too good. When Ars Technica reviewed the Quest 2, they found it was a huge downgrade over the Quest 1. The Quest 3 is a slight upgrade over the Quest 2.

2025-06-22 20:32:54 UTC

@nprofile…r54s stupid question: what's the point of custom firmware on headsets? What can I, as a user, do with a rooted / bootloader unlocked device?
Like, with the Quest 1, I can imagine rooting it to overclock the screen from the 72hz to the 90hz (which Carmack the screen is capable of).
But Quest 3, Vision Pro, etc are already pretty good: I can't think of a worthwhile to run out, buy a Quest 3, and setup adb just in case someone figures out how to root one...

2025-06-22 02:56:46 UTC

- reply

All right: I think I'm done playing with CVE-2025-21479.
It's surprisingly easy to trigger - reusing Adrenaline's code just worked for physical memory read/write.
However, my attempt is quite fragile:
- requires kernel offsets
- the physical memory spray sometimes doesn't hit the targetted address
- and running it with the screen on sometimes causes the device to freeze then reboot
I don't have the experience required to turn it into a reliable root, but I'll write up a blog post with what I learned so far.

2025-06-21 21:21:40 UTC

- reply

OK, got KSMA working: https://github.com/zhuowei/cheese/blob/ksma-demo/cheese.c
So now, with a patched Adreno 630 GPU firmware that disables access checks on `CP_SMMU_TABLE_UPDATE`, I can map the kernel into userspace and patch the kernel.
... anyone want to try this against an actual Adreno 7xx device?

2025-06-21 20:31:07 UTC

- reply

If you're wondering, Felix Cloutier's popular HTML conversion of the x86 manual (https://www.felixcloutier.com/x86/) is done with a Python script (https://github.com/fay59/x86doc) that uses pdfminer to extract text and graphics, then use cursed heuristics to detect and convert tables.

2025-06-21 20:07:59 UTC

- reply

Also, mildly amused that the Arm Architecture Reference Manual is compiled from LaTeX: go download the PDF from https://developer.arm.com/documentation/ddi0487/latest/ and look at the properties in your PDF viewer.

2025-06-21 19:57:06 UTC

I'm trying to figure out how this developer converted the Armv8-a Architecture Reference Manual from PDF to Markdown.
Did they do it by hand?!
https://github.com/codingbelief/arm-architecture-reference-manual-for-armv8-a

2025-06-21 03:17:04 UTC

- reply

Update: tried spraying pagetable and tried patching kernel and neither worked. (although patching SELinux enforce state did work. Mostly.)
I think I'll try KSMA instead: that's just one write, and I don't have to deal with the GPU afterwards.

2025-06-20 21:24:32 UTC

- reply

Copied Adrenaline's GPU arbitrary write code and it just worked... at least on my Adreno 630 device modified to introduce the bug. Haven't tested on a real Adreno 7xx device yet.
https://github.com/zhuowei/cheese/tree/writedemo
Although I have no experience with GPUs, so I wonder if it's easier to use the GPU arb physical rw to give me a CPU arb rw instead, e.g. by doing mmap to spray pagetables and overwriting one of them.

2025-06-20 17:43:27 UTC

- reply

@nprofile…f8ag @nprofile…vejh I haven't updated Pleroma since the day I set it up in 2021, so I can't edit posts and have to delete+repost them. Sorry about the duplicate posts: I'll upgrade as soon as possible.

2025-06-20 17:30:00 UTC

- reply

@nprofile…vejh If you want to stop tracking, just play Beat Saber on expert

2025-06-20 17:28:08 UTC

- reply

@nprofile…vejh I want to stop tracking, says VR controller while playing Beat Saber

2025-06-20 07:19:44 UTC

- reply

Stupid hack: patch to allow unprivileged apps to run CP_SMMU_TABLE_UPDATE on my Pixel 3 XL’s GPU.
I wanted to play around with CVE-2025-21479, where Adreno 7xx firmware fails to check for privileges when running GPU commands.
However, I don’t have an Adreno 7xx device, only an Adreno 6xx, which is not affected by the issue.
So I just patched out the entire access check.
https://github.com/worthdoingbadly/patch-a630

2025-06-20 03:46:56 UTC

Intentionally patching CVE-2025-21479 into my Pixel 3 XL (Snapdragon 845 / Adreno 630), since I don't have an Adreno 7xx device handy

2025-06-19 22:48:25 UTC

Made a proof-of-concept for CVE-2025-21479 that causes a GPU fault on Snapdragon devices with Adreno 7xx GPU:
https://github.com/zhuowei/cheese
<2>[146532.566695][ T933] kgsl kgsl-3d0: GPU PAGE FAULT: addr = 4000031004 pid= 0 name=(null) drawctxt=1111638594 context pid = 0
<2>[146532.566756][ T933] kgsl kgsl-3d0: context=gfx3d_user TTBR0=0x1234567841414141 (write unknown fault)
<2>[146532.566783][ T933] kgsl kgsl-3d0: FAULTING BLOCK: CP

2025-06-19 22:18:15 UTC

- reply

Added a README to my attempt at a [CVE-2025-21479](https://docs.qualcomm.com/product/publicresources/securitybulletin/june-2025-bulletin.html) proof-of-concept, summarizing the research so far:
https://github.com/zhuowei/cheese

2025-06-19 21:18:47 UTC

- reply

Does anyone here have a patched Snapdragon device (Samsung S22/S23/S24/S25 with the May security patch or newer)? Does my proof-of-concept trigger on your device?

2025-06-19 20:34:57 UTC

- reply

OK, I tested on a Snapdragon 8s Gen 3 (SM8635, Adreno 735), and it returns `0, 0`.
(...after I fixed it by copying the cp_wait_for_me/cp_wait_for_idle commands from Project Zero's adrenaline)
On my Snapdragon 845 (Adreno 630), the modified code still returns `41414141 42424242`.
If I remove the CP_SMMU_TABLE_UPDATE call, the Snapdragon 8s Gen 3 also returns `41414141 42424242`, so it looks like the `CP_SMMU_TABLE_UPDATE` call is in fact triggering CVE-2025-21479.

2025-06-19 19:54:26 UTC

If you have a Qualcomm device with Adreno 7xx GPU (Snapdragon 8 Gen 1 / XR2 Gen 2 and newer), mind running https://github.com/zhuowei/cheese/blob/main/cheese.c ?
I’m trying to figure out if CVE-2025-21479 only affects A7xx.
I implemented my best guess at how to trigger the issue.
On Snapdragon 845 / Adreno 630, the program executes correctly and prints
41414141 42424242.
I think on A7xx and above, it should error out and print
0 0
instead.

2025-06-19 18:37:36 UTC

Huh: if IOCTL_KGSL_MAP_USER_MEM exists, why can’t Freedreno’s Turnip use it to implement VK_EXT_external_memory_host on Android kernels?

2025-06-16 07:26:15 UTC

- reply

@nprofile…r54s Also, while you're here: do I need to get a Quest 3 and set it up with adb before the next security update comes out, in case someone finds a root exploit, or is that kinda premature?

2025-06-16 06:53:09 UTC

- reply

@nprofile…r54s I also compiled Freedreno/Turnip - I need to check if my Pixel 3XL even supports kgsl.
Worst case, I'll just mod Turnip to let me put stuff into command buffers.

2025-06-16 06:50:27 UTC

- reply

@nprofile…r54s I'm trying to ask the GPU's command processor to write to 0x41414141 so I can see a crash, just to see if I can even get any of the kilroy/Adrenaline code to work at all ... and it's not working at all. I haven't gotten to the point of trying any exploits or anything...

2025-06-16 06:43:20 UTC

- reply

@nprofile…r54s In theory, if you segfault the GPU, you should get "kgsl-3d0: GPU PAGE FAULT" in the Android logcat as well as the dmesg, without root...

2025-06-16 06:12:26 UTC

- reply

@nprofile…r54s I did end up temp rooting my Pixel 3XL just for `dmesg` (... it's been so long since I rooted a phone that this is the first time I ever used Magisk), but it didn't help.
I tried segfaulting the GPU with a CP_MEM_WRITE to 0x41414141 but I didn't get an error in dmesg.

2025-06-16 06:02:52 UTC

- reply

@nprofile…r54s I don't know enough either - but I'm hoping CVE-2025-21479 is simple enough that I could figure it out...
... wait, aren't most XR devices Snapdragon? Don't you have adb access to those?

2025-06-16 05:44:59 UTC

- reply

Nope, that wasn't it: it also didn't work on my Pixel 3XL.