Post #314
963
Channel Public Channel
MH - Subscribers
- 6.41K
- Photos
- 77
- Videos
- 14
- Links
- 76
Recent Posts 19 shown
Post #313
2.78K
mhmrdd I managed to internally use HeapSnitch (modified) vulnerability in QSEE to extract UDS As you may know Google has previously revoked this, but they reincarnated it again, and during my experiments, i figured that BCC it had did NOT involve TME or CE, and was…
HeapSnitch>> med sev?
- ❤ 9
Post #312
2.74K
I managed to internally use HeapSnitch (modified) vulnerability in QSEE to extract UDS
As you may know Google has previously revoked this, but they reincarnated it again, and during my experiments, i figured that BCC it had did NOT involve TME or CE, and was self signed, and placed directly for S-EL0 signing.
This is critical, we expected at least that it's a leaf derivation from TME.
MediaTek claims spot 2 now that NSW-EL0 can do this on QSEE.
This came as a challenge because I've been rumored that some managed to do the same and even for StrongBox.
As you may know Google has previously revoked this, but they reincarnated it again, and during my experiments, i figured that BCC it had did NOT involve TME or CE, and was self signed, and placed directly for S-EL0 signing.
This is critical, we expected at least that it's a leaf derivation from TME.
MediaTek claims spot 2 now that NSW-EL0 can do this on QSEE.
This came as a challenge because I've been rumored that some managed to do the same and even for StrongBox.
- 🔥 24
- ❤ 4
- 👍 1
Post #311
2.91K
- 👍 9
- 🤔 7
- ❤ 1
Post #310
2.61K
mhmrdd upon checking, we can see 2 potential ways: 1- run at service.d but heap is unstable due to call swarm unlike post fs data which we can ensure proper run of HeapSnitch (3) 2- figure way to migrate keys between two slots or leak dec key of blobs & build MiniMint…
Update:
-Adapted HeapSnitch to work on post-boot after vold CE storage decryption is completed.
Tradeoff:
- [IMPORTANT]: YOU temporarily lose access to your old blobs (symmetric/asymmetric) including RKP blobs hence the video.
-Adapted HeapSnitch to work on post-boot after vold CE storage decryption is completed.
Tradeoff:
- [IMPORTANT]: YOU temporarily lose access to your old blobs (symmetric/asymmetric) including RKP blobs hence the video.
- 👏 6
- ❤ 2
Post #309
2.88K
- ❤ 6
- ❤🔥 3
- 😁 1
Post #308
2.72K
Post #307
3.29K
Post #306
3.24K
mhmrdd dontreportme22.tar
Google revoked (partially) UDS, now emits 403 Perm denied
at least we know that it didn't go to 444
at least we know that it didn't go to 444
- 🔥 16
- ❤ 1
Post #305
3.08K
mhmrdd https://x.com/Weixin_WeChat/status/2102725320646554000
Too late university starts next week,
- ❤ 5
Post #304
3.01K
Post #303
2.93K
mhmrdd This is worse than a dup finding: https://issues.chromium.org/issues/544163112
#69 breaks the hearts, rip your 248k$ sir
- ❤ 4
- 😱 3
Post #302
3.16K
This is worse than a dup finding:
https://issues.chromium.org/issues/544163112
https://issues.chromium.org/issues/544163112
- ❤ 8
Post #301
3.64K
mhmrdd preview 🍖 exp was finished today, I am currently investigating an issue causing the change of locked status to swap slots which loses decryption of storage keys temporarily.
upon checking, we can see 2 potential ways:
1- run at service.d but heap is unstable due to call swarm unlike post fs data which we can ensure proper run of HeapSnitch (3)
2- figure way to migrate keys between two slots or leak dec key of blobs & build MiniMint (OhMyKeymint like) to handle asym/sym ops with leaked key
3- figure how exp can prepare leaked known heap for post runtime to exec (note that after swapping, the apps & others won't be able to recognize old keys, causing temporarily loss of app creds & logins, teaching secondary slot on new data)
1- run at service.d but heap is unstable due to call swarm unlike post fs data which we can ensure proper run of HeapSnitch (3)
2- figure way to migrate keys between two slots or leak dec key of blobs & build MiniMint (OhMyKeymint like) to handle asym/sym ops with leaked key
3- figure how exp can prepare leaked known heap for post runtime to exec (note that after swapping, the apps & others won't be able to recognize old keys, causing temporarily loss of app creds & logins, teaching secondary slot on new data)
- ❤ 20
- 👍 2
- 👎 1
Post #300
3.24K
mhmrdd I have managed internally to weaponize this over to RCE, we'd expect in future to see full exploit that allows to change bootloader status to lock when unlocked on any device running Qualcomm QSEE with a vulnerable keymaster. The same exploit can be utilized…
preview 🍖
exp was finished today, I am currently investigating an issue causing the change of locked status to swap slots which loses decryption of storage keys temporarily.
exp was finished today, I am currently investigating an issue causing the change of locked status to swap slots which loses decryption of storage keys temporarily.
- ❤🔥 19
- 👍 4
- ❤ 3
- 👎 2
- 🔥 2
Post #297
3.69K
I got access to TypeSafe & Jev is crazy!
- 🤯 16
- ❤ 3
- 🤪 1
Post #296
4.05K
mhmrdd What?
I mean more to that, there are some additional fields that were never described in docs
- 🤔 6
- ❤ 1
Post #295
3.96K
What?
- ❤ 3
Post #294
3.61K
(no comments)
- 🥴 19
- ❤ 3
About this channel
- How can I read @mhm72dd without a Telegram account?
- TGViewer shows the public web preview Telegram publishes for mhmrdd: recent posts, photos, videos and the subscriber count, with no app, login or account.
- How many subscribers does mhmrdd have?
- mhmrdd (@mhm72dd) has 6.41K subscribers on Telegram, refreshed roughly every 30 minutes.
- Does mhmrdd know I viewed it here?
- No. Public channel previews carry no viewer identity, and TGViewer has no accounts or tracking of what you look up.