Post B6V1MutsInP5u5Kwi0 by borup@masto.hackers.town
 (DIR) More posts by borup@masto.hackers.town
 (DIR) Post #B5oIj9HkqJrcJSPsMy by astraleureka@social.treehouse.systems
       0 likes, 3 repeats
       
       I deobfuscated the #copyfail exploit and fixed up the payload to run under Alpine: https://astr.al/notes/2026-04-29_copyfail/
       
 (DIR) Post #B5p9CFPcL00hKTI5Ue by princesse@eldritch.cafe
       0 likes, 0 repeats
       
       @astraleureka but those precious bytes! it's not 732 bytes anymore!!!! /sarcasm (thank you :neofox_heart: )
       
 (DIR) Post #B5xNYEWZGxaBZLbCLo by astraleureka@social.treehouse.systems
       1 likes, 0 repeats
       
       to whomever has been downloading this and using it directly for rooting stuff: lol fuck you
       
 (DIR) Post #B5xNnliEA86gqNSbiq by astraleureka@social.treehouse.systems
       1 likes, 0 repeats
       
       netcraft: blog posts are not a crime please stop sending abuse reports
       
 (DIR) Post #B5xSuZALhvwLjIftuS by hyc@mastodon.social
       0 likes, 0 repeats
       
       @astraleureka Nice. I still need to write an arm64 version to see if I can root my Android phones now.
       
 (DIR) Post #B5xT4x3Xjt9KigRYi8 by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @hyc It is confirmed working on aarch64 targets, I'm sure just fixing up the ASM stub would suffice. Max stub length is somewhere around 8K on 4K-page machines I believe, but that's more than enough
       
 (DIR) Post #B5xTQWK5oRoGBBT9d2 by hyc@mastodon.social
       0 likes, 0 repeats
       
       @astraleureka yes, have to rewrite the ASM of course. The other unknowns are if Android kernels customarily included this crypto option, and whether I can find any setuid binaries on the system image.
       
 (DIR) Post #B5xTrgoSv4hyX2dBlg by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @hyc ah that's a good point; I think modern Android has mostly eschewed setuid bins in favor of fscaps, plus zygote-derived processes set no_new_privs. Old custom ROMs used to ship setuid su for end users to access, but it's been some time since I've rooted an android device - I am unsure of how that tends to look these days. If you are successful I'd be very interested to hear what you find :D
       
 (DIR) Post #B5xVNMXFwjxErZFSIS by hyc@mastodon.social
       0 likes, 0 repeats
       
       @astraleureka a quick sniff around with adb shell shows I don't even have read access to the directory entries of anything sensitive. Oh well.
       
 (DIR) Post #B5xVe31TkMVxGjLBxY by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @hyc that makes sense. as much as google messes up security in other ways, they have done a decent amount of work locking down the base system with selinux and fscaps
       
 (DIR) Post #B5xZxUVaBDjbpfwrOy by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       fwiw I have broken the downloadable version of the PoC, and included a comment showing what's been changed. Annoying that this is necessary, but it should hopefully be enough to keep the skids from directly downloading this from my servers 😔
       
 (DIR) Post #B6Uvux2CH3Yody4iXI by ska@social.treehouse.systems
       0 likes, 0 repeats
       
       @astraleureka @hyc They're pretty good when it comes to protecting their stuff against the user, less so when it's about protecting the user against malware. 🤔
       
 (DIR) Post #B6V1MutsInP5u5Kwi0 by borup@masto.hackers.town
       0 likes, 0 repeats
       
       @astraleureka thank you!This helped my understanding of the problem quite a bit.
       
 (DIR) Post #B6V1Mv5ZbIlGUMoHwW by astraleureka@social.treehouse.systems
       0 likes, 0 repeats
       
       @borup you're very welcome. there was no sensible reason for the researcher to code golf their proof of concept, nobody cares if it is 730 bytes or 4KiB