eShard | Hardware & Software Security

Security investigations for critical missions, from hardware to software.

[eShard | Hardware & Software Security @eshard]

@Exori_AI Whatever you want. You can set a goal, like the exploit reaching a root shell without crashing, and give it a budget of however many runs.

[eShard | Hardware & Software Security @eshard]

The final part of our CVE-2023-20938 series: turning a Binder use-after-free into root on a Pixel 6 running Android 12.

Root turns out to be anticlimactic: a few fields in one kernel struct, set to zero.

🔗 Read part 5: https://t.co/YK6rs0DVEO

[eShard | Hardware & Software Security @eshard]

Getting ready to go on the road for the last time this year. Find us at @POC_Crew, @codeblue_jp and @hardwear_io 🔥

[eShard | Hardware & Software Security @eshard]

The last session of the year runs November 17-18, and seats are filling up.
🚨 Last chance: https://t.co/e6quolgN6d

[eShard | Hardware & Software Security @eshard]

Yes to both. The double free came from the Epoch recording alone, with nothing else used. And the suggested cleanup really does stop the crash. The agent could also have recompiled and re-run it on its own to confirm, and kept iterating if another bug showed up. It drives Epoch end to end.

[eShard | Hardware & Software Security @eshard]

Our exploit also crashed the kernel long after the real bug. Claude Code got the recording through Epoch's MCP server, with no bookmarks and no hints.
It traced the crash to a double free and named the missing cleanup step in our code.

Try it yourself: https://t.co/3zC4wL6YLe

[eShard | Hardware & Software Security @eshard]

The whole chain is in one Epoch recording. Step through it from a leaked Binder object to our own process's credentials, one pointer at a time, until the user ID flips from 2000 to 0 on a single write.

[eShard | Hardware & Software Security @eshard]

A single 2-byte instruction skip bypasses secure boot verification in the boot ROM of a widely deployed ARM router SoC, despite a constant-time compare and redundant verdict encodings.

Full write-up 👇

https://t.co/AsOMEmLLxC

[eShard | Hardware & Software Security @eshard]

@ahm3dgg Thank you! :D

[eShard | Hardware & Software Security @eshard]

@crypto_ninjas @0xor0ne Thanks!

[eShard | Hardware & Software Security @eshard]

@ahm3dgg Thank you for the feedback!

[eShard | Hardware & Software Security @eshard]

@ahm3dgg Yes, that's it :)

[eShard | Hardware & Software Security @eshard]

Test the trigger first, not the exploit. Run the UAF on the older device, spray fresh nodes, and check whether the stale read returns reused data. Binder's kernel logs can show the error path ran, but without KASAN nothing flags the UAF itself. The offsets are Pixel 6 / 5.10 only.

[eShard | Hardware & Software Security @eshard]

We’re publishing a full Android kernel exploit chain built on CVE-2023-20938, a use-after-free in Binder, on a Pixel 6 running Android 12.

🔗 https://t.co/u5duFUTXPt

[eShard | Hardware & Software Security @eshard]

@for_N5R1 Landing is the unstable part, but one epitem is enough. In one batch, 34 of 768 stale slots held an epitem at 192 sprayed, 130 at 384. We never tested past 384.

[eShard | Hardware & Software Security @eshard]

Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.

Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.

👉 https://t.co/1ZfafAV6Cb
#android #cve

[POC_Crew @POC_Crew]

Thank you for sponsoring #POC2026 as a GOLD!

eShard (@eshard) builds specialized technologies for advanced hardware and software security research. esDynamic helps researchers investigate side-channel leakage, fault injection and hardware failures, while esReverse brings together advanced capabilities for vulnerability research, malware analysis and reverse engineering — including full-system Time Travel Debugging and AI-assisted investigation.

[eShard | Hardware & Software Security @eshard]

@ahm3dgg Yes, QEMU for all systems. For IoT, we also support Unicorn emulation framework

[eShard | Hardware & Software Security @eshard]

@for_N5R1 Getting the object back is the least stable part. Landing an epitem in the freed page is a probabilistic cross-cache hit: in one test batch, 192 epitems landed ~4% of the time, 384 ~17%. Once it lands, reads are just epoll_ctl(MOD) + ioctl(FIGETBSZ): no alloc, no free.

[0xor0ne @0xor0ne]

Exploiting a use-after-free (UaF) in Android’s Binder driver (CVE-2023-20938) (@eshard)

Part 1: https://t.co/iWVoizBw7p
Part 2: https://t.co/KbPDa6Na7X
Part 3: https://t.co/c9qv8URcn8
Part 4: https://t.co/I7VPLexq4v

#infosec

[eShard | Hardware & Software Security @eshard]

Testing each part of a drone separately can miss the real weakness. This is why its hardware, firmware and radio link should be tested as one attack surface.
#drone #embeddedsecurity

https://t.co/FyYqrp9DpR