live

graphs + artifacts

The boot chain and the unlock plan, drawn. The blueprint files themselves are downloadable below.

the boot chain — every locked door

// the boot chain — every locked door, in order 1. BootROM key burned in silicon — untouchable 2. XBL (RISC-V security chip) decrypts the bootloader + burns fuses 3. ABL — CRACKED ✔ encrypted on disk — we pulled the plaintext from live RAM 4. TrustZone OS (tz.mbn) the secure world — runs the TAs 5. keymaster (the vault) keys + the unlock state in RPMB vbmeta (Verified Boot) the signed hash-tree certificate GPT (partition table) the 24090 target — the crypto flaw lives in how it parses entries libQSEEComAPI the door to the secure world Android (us) uid=0 on a locked bootloader MINK descriptor the per-app TEE ticket — the last puzzle piece we are forging unlock state (RPMB) "ANDROID-BOOT!" — the prize verifies decrypts loads hosts stores keys certifies the flaw talks through the prize

CVE-2026-24090 — the unlock, stage by stage

// CVE-2026-24090 — the unlock exploit, stage by stage 1. rename vbmeta vbmeta → xbmeta (GPT surgery, backed up) 2. boot → NO_AVB the milestone check skips AVB = not required 3. load keymaster TA qseecom LOAD_APP (the MINK door) 4. READ 0x202 read the device state (zero risk — done next) 5. WRITE 0x203 flip is_unlocked (needs approval!) 6. reboot → UNLOCKED needs the right TA name

the MINK chain — opened, verified live

// the MINK chain — the secure-world door, opened (verified live) /dev/smcinvoke the SMC-invoke transport chmod 666 = gate opened libminkdescriptor the client env (the CBOR descriptors) AppLoader (obj 3) loads the keymaster TA image CKMHal (0x96) GET_VERSION answered: Keymaster 5.3 READ 0x202 executed: ret=0 rsp -15 = the gate the milestone set by the normal AVB2 boot = the TA refuses vbmeta-rename the NO_AVB boot = the milestone never called 1 2 3 4 5 6

the blueprint files

abl.elf.encrypted2.3 MBthe bootloader, encrypted at restabl.elf2.3 MBthe SAME bootloader, decrypted — pulled live from RAMxbl_s.melf1.0 MBthe RISC-V security-chip firmware (anti-rollback brain)tz.mbn3.9 MBthe TrustZone OS imagekeymint.mbn0.4 MBthe boot keymaster TA (the 24090 target)vaultkeeper.mbn1.0 MBthe VaultKeeper TA (the boot-lock state)uefi.elf2.9 MBthe UEFI firmware (the DXE drivers came from here)gpt-primary.bin20.0 MBthe full partition table (byte-exact backup)vbmeta-backup.img0.1 MBthe Verified Boot metadata (backup copy)keymaster.img1.0 MBthe keymaster partition dumplibQSEEComAPI.so0.1 MBthe secure-world door library we reverse-engineered