79 Followers
73 Following
74 Posts
Android bug hunter, driver assistance systems (ADAS) testing at work, ported PRoot to Android/Termux, mostly lurker, they/he
GitHubhttps://github.com/michalbednarski
@natsuki That's really cool, thank you
@natsuki That being said, cleanUpAfterExploitation() doesn't actually fully clean, as if it were it'd be possible to run exploit multiple times without reboot, however it was good enough to submit to Google and published version is pretty much same as originally submitted

@natsuki Not sure what actual answer is, but updateApplicationInfo is not part of usual app startup, so it wasn't thoroughly tested

I guess PoC triggers unusual path of creating new ClassLoader during updateApplicationInfo, and it was intended to always update mAppComponentFactory, so factory is created twice in this (uncommon) path, but I think there's no harm in that, as AppComponentFactory is supposed to be stateless

So we've got

1. Call to method that may but usually doesn't create mAppComponentFactory
2. Explicit (intended) re-creation of mAppComponentFactory

GitHub - michalbednarski/AbxOverflow: Writeup and exploit for CVE-2024-34740, integer overflow in Android's BinaryXmlSerializer to system_server file write and then to system_server code execution from normal installed app

Writeup and exploit for CVE-2024-34740, integer overflow in Android's BinaryXmlSerializer to system_server file write and then to system_server code execution from normal installed app - michal...

GitHub

Two different approaches to debugging a software problem:

The Sudoku approach: stare at the limited set of clues you have, and think harder and harder about them until you find a way to deduce something useful.

The Minesweeper approach: don't even try to figure out the solution from only the clues you have right now. Instead, focus on finding a way to acquire another clue, and then using that to get another, and so on. Eventually you've collected so many clues that the answer is obvious.

Sometimes the Sudoku approach is necessary, because you've got all the clues you're ever going to get. But I think my new motto is "Never Sudoku a problem when you can Minesweeper it."

I was today years old when I learned that, in #Wireshark, you can define columns that source their values from multiple fields, for example:

tcp.dstport || udp.dstport

Discussing my old Android bug, CVE-2023-21092, missing packageName against uid check for BIND_EXTERNAL_SERVICE leading to arbitrary startActivity()

https://github.com/michalbednarski/IntentsLab/issues/6

Regarding CVE-2023-21092, the bug in BIND_EXTERNAL_SERVICE · Issue #6 · michalbednarski/IntentsLab

Hello Michal, I noticed you were acknowledged for an interesting bug CVE-2023-21092 (patch). Description of this bug says it can "register broadcast receivers using system app's privileges". My ana...

GitHub
i made a video about cohost css crimes!!
https://www.youtube.com/watch?v=LkMtiwitg-w
css crimes

YouTube

Suppose you're using less(1) to view a config file that has lots of commented-out explanations and defaults:

less /etc/ssh/ssh_config

It's hard to really see which lines are in effect and which are just comments, especially without syntax highlighting.

But! You can use less's filtering capabilities to only display lines that start with a character that's not a hash symbol. Type "&" and enter a regular expression, then hit return. For example:

&^[^#]

Enter an empty regex to stop filtering.

Finally found how to solve problem with local variables not being visible when debugging Java code inside Android system_server

When building AOSP, disable debugger-breaking optimizations by removing "services_java_defaults" from "java_library" section inside services/Android.bp

https://cs.android.com/android/platform/superproject/main/+/main:frameworks/base/services/Android.bp;l=191;drc=06fcabde6a3625f4080ac6b71fce894948eee955