Berk Cem Göksel

Fuzzing the ARM64 kernel natively with syzkaller and QEMU

2026-07-09T00:00:00+00:00

In the last post I brought up an Ampere Altra as a headless ARM64 host. Now I put it to work. This is my setup for fuzzing an ARM64 Linux kernel with syzkaller under QEMU, all of it native. The big win over doing this from an x86 box is that nothing gets cross-compiled. The kernel, syzkaller and the guest all build straight on the host.

Prerequisites

ARM64 Linux host, tested on Ubuntu 24.04
KVM support, check with ls /dev/kvm
GCC 13+, tested with gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0

Dependencies

sudo apt update
sudo apt install -y git make gcc flex bison libssl-dev libelf-dev bc \
    qemu-system-arm debootstrap libgmp-dev libmpfr-dev

Go

wget https://dl.google.com/go/go1.23.6.linux-arm64.tar.gz
sudo tar -C /usr/local -xzf go1.23.6.linux-arm64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
echo 'export GOPATH=$HOME/go' >> ~/.bashrc
source ~/.bashrc
go version

Build syzkaller

git clone https://github.com/google/syzkaller.git "$SYZKALLER"
cd "$SYZKALLER"
make TARGETOS=linux TARGETARCH=arm64

The binaries land in bin/linux_arm64/.

Build the kernel

Clone and start from defconfig:

git clone --depth=1 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git "$KERNEL_SRC"
cd "$KERNEL_SRC"
make defconfig

Now turn on what syzkaller needs. I use scripts/config rather than hand editing .config:

# Coverage
scripts/config -e KCOV
scripts/config -e KCOV_INSTRUMENT_ALL
scripts/config -e KCOV_ENABLE_COMPARISONS

# Debug info
scripts/config -e DEBUG_INFO
scripts/config -e DEBUG_INFO_DWARF4
scripts/config -e DEBUG_FS

# KASAN, software tag-based is faster on ARM64 than generic
scripts/config -e KASAN
scripts/config -e KASAN_SW_TAGS
scripts/config -d KASAN_GENERIC

# If your CPU has MTE you can use hardware tag-based KASAN, which is faster still
# scripts/config -e KASAN_HW_TAGS

# Virtio, required for QEMU and faster than emulated hardware on ARM64
scripts/config -e VIRTIO
scripts/config -e VIRTIO_PCI
scripts/config -e VIRTIO_BLK
scripts/config -e VIRTIO_NET
scripts/config -e VIRTIO_MMIO

# 9P for syzkaller file transfer
scripts/config -e NET_9P
scripts/config -e NET_9P_VIRTIO

# Networking
scripts/config -e CONFIGFS_FS
scripts/config -e SECURITYFS

# Optional, disable KASLR for easier debugging
scripts/config -d RANDOMIZE_BASE

Regenerate and build:

make olddefconfig
make -j$(nproc)

The image is at arch/arm64/boot/Image. Note that it is Image, not the bzImage you get on x86.

Create the disk image

syzkaller ships a helper for this:

cd "$SYZKALLER/tools"
./create-image.sh

That gives you a Debian image with SSH set up:

trixie.img, the disk image
trixie.id_rsa, the SSH key

Move them somewhere sensible:

mkdir -p "$IMG_DIR"
mv trixie.img trixie.id_rsa "$IMG_DIR/"

Test the VM by hand first

Before letting syzkaller drive, make sure a single VM boots. This is where the ARM64 differences bite:

#!/bin/bash
KERNEL=$KERNEL_SRC
IMAGE=$IMG_DIR

qemu-system-aarch64 \
    -m 2G \
    -smp 2 \
    -cpu host \
    -machine virt,gic-version=3 \
    -kernel $KERNEL/arch/arm64/boot/Image \
    -append "console=ttyAMA0 root=/dev/vda earlyprintk=serial net.ifnames=0" \
    -drive file=$IMAGE/trixie.img,format=raw,if=virtio \
    -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
    -net nic,model=virtio \
    -enable-kvm \
    -nographic \
    -pidfile vm.pid

What changes from an x86 command line:

-cpu host and -machine virt,gic-version=3 are needed for KVM
console=ttyAMA0 instead of console=ttyS0
if=virtio for the disk, faster than emulated IDE or SATA here
model=virtio for the NIC, faster than e1000
the kernel is Image, not bzImage

Then check SSH works:

ssh -i "$IMG_DIR/trixie.id_rsa" -p 10021 root@localhost

syzkaller config

Create arm64.cfg:

{
    "target": "linux/arm64",
    "http": "0.0.0.0:56700",
    "workdir": "/mnt/ramdisk/workdir",
    "kernel_obj": "/path/to/linux",
    "image": "/mnt/ramdisk/workdir/trixie/trixie.img",
    "sshkey": "/path/to/image/trixie.id_rsa",
    "syzkaller": "/path/to/syzkaller",
    "reproduce": true,
    "procs": 4,
    "type": "qemu",
    "vm": {
        "count": 52,
        "kernel": "/path/to/linux/arch/arm64/boot/Image",
        "cpu": 2,
        "mem": 2048,
        "qemu_args": "-machine virt,gic-version=3 -cpu host -enable-kvm",
        "cmdline": "console=ttyAMA0 root=/dev/vda earlyprintk=serial net.ifnames=0"
    }
}

This is where the 128 core machine pays off. To size the fleet:

count, number of VMs, roughly (total_cores / cpu_per_vm) - overhead
cpu, vCPUs per VM
procs, fuzzing processes per VM, roughly match cpu
mem, RAM per VM in MB

On the 128 core, 256GB box that works out to:

52 VMs times 2 CPUs is 104 cores
52 VMs times 2GB is 104GB of RAM
80GB ramdisk for the workdir
the rest left as headroom for the host

Point the workdir and image paths at the ramdisk from the previous post so this heavy I/O never touches the SSD.

Run it

cd "$SYZKALLER"
bin/syz-manager -config=arm64.cfg

The dashboard is at http://<server-ip>:56700.

KASAN variants on ARM64

ARM64 gives you a few KASAN modes. Fastest first:

Hardware tag-based, CONFIG_KASAN_HW_TAGS, needs ARMv8.5-A MTE
Software tag-based, CONFIG_KASAN_SW_TAGS, my default on ARM64
Generic, CONFIG_KASAN_GENERIC, slowest but most compatible

Check for MTE:

cat /proc/cpuinfo | grep -i mte

If MTE is there, use HW_TAGS. Otherwise SW_TAGS.

Extracting syscalls

Only needed if you touch the descriptions:

cd "$SYZKALLER"
bin/syz-extract -sourcedir=$KERNEL_SRC -arch=arm64 <syscall_file.txt>

USB fuzzing

To fuzz the USB subsystem, add to the kernel config:

scripts/config -e USB
scripts/config -e USB_GADGET
scripts/config -e USB_DUMMY_HCD
scripts/config -e USB_RAW_GADGET
scripts/config -e SND_USB_AUDIO

And in the syzkaller config:

"enable_syscalls": [
    "syz_usb*"
],
"cmdline": "console=ttyAMA0 root=/dev/vda dummy_hcd.num=4 net.ifnames=0"

Troubleshooting

VM fails to boot, or “failed to read from qemu: EOF”. Run the manual QEMU command above, confirm virtio is built in with grep VIRTIO .config, and check KVM permissions with ls -la /dev/kvm.

No coverage in your target subsystem. Make sure it is built into the kernel and not a module, confirm KCOV with grep KCOV .config, and check the syscalls are listed under enable_syscalls.

syz-extract complains about KASAN_SHADOW_SCALE_SHIFT. A known issue on bleeding-edge kernels, 6.17 and up. Use a stable kernel, 6.12 LTS works well, update syzkaller, or just test anyway since the extract errors may not matter.

Slow boot waiting on entropy. ARM64 QEMU can stall here. Install haveged in the guest image or add random.trust_cpu=on to the kernel cmdline.

KVM permission denied. Add yourself to the kvm group:

sudo usermod -aG kvm $USER
newgrp kvm

That is a full ARM64 fuzzing pipeline with no cross-compilation anywhere. Native host, native kernel, native syzkaller, and a VM count that actually uses the hardware.

Bringing up an Ampere Altra as a headless ARM64 fuzzing server

2026-07-09T00:00:00+00:00

Most of my kernel fuzzing runs on ARM64 targets, and cross-compiling everything from an x86 box gets old fast. I wanted a native ARM64 machine with enough cores to run a large fleet of QEMU VMs under syzkaller. The answer was an Ampere Altra on an ASRock Rack board. This post covers taking it from a bare board to a running Ubuntu host, all of it headless over the BMC.

The hardware

Motherboard: ASRock Rack ALTRAD8UD-1L2T
CPU: Ampere Altra, 128 cores, Neoverse-N1
RAM: 256GB, 8x 32GB DDR4 RDIMMs
Storage: 2x 1TB NVMe, one for Ubuntu and one kept for Windows
GPU: NVIDIA RTX 5060 Ti

128 cores and 256GB is the whole point. It lets me run around 50 VMs with 2 vCPUs each and still leave headroom for the host.

Getting into the BMC without a monitor

The board has no VGA that I care about, so everything goes through the BMC. There is a debug serial header on the bottom-left of the board. Pinout, left to right:

Rx, wire this to your adapter Tx
Tx, wire this to your adapter Rx
3.3V
NC, no pin
GND

Use a 3.3V USB-TTL adapter at 115200 8N1.

Default BMC credentials:

Username: root
Password: 0penBmc (that is a zero, not the letter O)

The BMC is a DHCP client on the MGMT port. Once it boots, find its address:

ip addr

The web UI then lives at https://<BMC_IP>. There are also SSH consoles on a few ports, which is what I actually use day to day:

Port 2200: Console
Port 2201: TF-A console
Port 2202: SCP console, SMpro and PMpro logs
Port 2203: Host console, UEFI and OS

Firmware first

I moved from BMC 2.07 / BIOS 2.06 to BMC 3.06 / BIOS 3.06 before doing anything else. Grab both from the ASRock Rack Beta Zone for the board.

The order matters. BMC first, then BIOS.

Upload the BMC .tar in the web UI under Operations, Firmware
Wait for the BMC to reboot, around 5 minutes
Upload the BIOS .tar
Power cycle the host so the BIOS takes effect

Installing Ubuntu 24.04 over virtual media

Write the arm64 server ISO to a USB stick, or skip the stick entirely and mount it as virtual media. I did the latter.

wget https://cdimage.ubuntu.com/releases/24.04/release/ubuntu-24.04-live-server-arm64.iso

In the web UI, go to Operations, Virtual Media, add the ISO and click Start. Then power cycle the host from the BMC console:

obmcutil poweroff
obmcutil poweron

Watch the host console on port 2203 and spam ESC for the boot menu if it does not pick the ISO on its own.

A few install choices that saved me pain:

Skip network during install and configure it later
Do not pick the HWE kernel, it wants network
Enable the OpenSSH server
Install onto one NVMe and leave the other alone

Network after install

Since I skipped it during setup, I drop in a small netplan config:

sudo nano /etc/netplan/01-netcfg.yaml

network:
  version: 2
  ethernets:
    enP3p3s0f0:
      dhcp4: true

sudo netplan apply

NVIDIA driver

sudo apt update
sudo apt install nvidia-driver-580-open
sudo reboot
nvidia-smi

Ramdisk for syzkaller

Syzkaller does heavy I/O on its workdir and I would rather not grind an SSD to dust. I keep the workdir on a tmpfs ramdisk and back it up on a schedule and around reboots.

Mount it and make room for the workdir:

sudo mount -t tmpfs -o size=80G tmpfs /mnt/ramdisk
mkdir -p /mnt/ramdisk/workdir

The backup script at /usr/local/bin/backup-ramdisk.sh:

#!/bin/bash
rsync -a --no-owner --no-group /mnt/ramdisk/workdir/ /path/to/syzkaller/backup/
echo "$(date): Backup completed" >> /path/to/ramdisk-backup.log

sudo chmod +x /usr/local/bin/backup-ramdisk.sh

A cron job every 6 hours, via sudo crontab -e:

0 */6 * * * /usr/local/bin/backup-ramdisk.sh

Since a ramdisk is gone after a reboot, I restore it on boot with a service at /etc/systemd/system/ramdisk-restore.service:

[Unit]
Description=Restore ramdisk after boot
After=local-fs.target

[Service]
Type=oneshot
ExecStartPre=/bin/mount -t tmpfs -o size=80G tmpfs /mnt/ramdisk
ExecStart=/usr/bin/rsync -a /path/to/syzkaller/backup/ /mnt/ramdisk/workdir/
ExecStartPost=/usr/bin/rsync -a /path/to/image/ /mnt/ramdisk/workdir/trixie/

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable ramdisk-restore.service

And a matching one that flushes the ramdisk back to disk on shutdown, at /etc/systemd/system/ramdisk-backup.service:

[Unit]
Description=Backup ramdisk before shutdown
DefaultDependencies=no
Before=shutdown.target reboot.target halt.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-ramdisk.sh

[Install]
WantedBy=halt.target reboot.target shutdown.target

sudo systemctl daemon-reload
sudo systemctl enable ramdisk-backup.service

Fix ownership after boot and make sure the user can touch KVM:

sudo chown -R $USER:$USER /mnt/ramdisk
sudo usermod -aG kvm $USER

Commands I keep reaching for

Power control from the BMC:

obmcutil poweroff
obmcutil poweron
obmcutil state

Temperature, because 128 cores under load get warm:

sudo apt install freeipmi-tools
sudo ipmi-sensors | grep -i temp

Ramdisk usage:

df -h /mnt/ramdisk

That is the machine ready. The next post covers building the ARM64 kernel and running syzkaller across the VM fleet natively, no cross-compilation involved.

Building the Pixel 8 kernel with MTE, KASAN and KCOV

2026-04-28T00:00:00+00:00

For my fuzzing environment I use a stack of Pixel8 devices which run under KASAN + KCOV. Recently I had to update my devices to the latest kernel version which broke my build. Google’s documentation is great to have, but not very specific when it comes to the details and you mostly end up with a bootloop. This post covers compiling the Pixel 8 kernel and booting it on the current latest Pixel 8 version.

The Pixel 8 supports MTE. That means we can enable KASAN_HW_TAGS, drastically reducing the overhead brought by KASAN_GENERIC or KASAN_SW_TAGS. However mind that KASAN_VMALLOC will be disabled, and the last time I checked was only supported on KASAN_GENERIC. For my fuzzing work, I need MTE and KCOV to be enabled, and KASLR disabled simply because it makes comparing crash reports easier and removes some overhead. I also disable SELinux for my own convenience, which may not make sense depending on which context you’re fuzzing from.

KASAN_HW_TAGS itself is upstream work by Andrey Konovalov (xairy) and Vincenzo Frascino. Here is the: introducing commit on git.kernel.org.

If you’re interested in debugging the Pixel kernel via GDB with GEF enabled, you can refer to xairy’s article.

For more background on enabling MTE on the Pixel 8, see also Kees Cook’s post.

Downloading the relevant factory image

Version mismatch between the factory image and your custom kernel will boot-loop with no useful diagnostics, so flash a good baseline first.

Go to https://developers.google.com/android/images, grab the Pixel 8 (shiba) factory image for Android 16 (CP1A.260405.005), extract, run the bundled flash-all.sh. Enable developer options and OEM unlocking through the phone afterwards.

https://dl.google.com/dl/android/aosp/shiba-cp1a.260405.005-factory-XXXXXXXX.zip

Downloading and compiling the kernel

repo init -u https://android.googlesource.com/kernel/manifest -b android-gs-shusky-6.1-android16
repo sync -c --no-tags

(uname -r will report 6.1.124-android14-11... once you boot. That’s the GKI ABI version, not the platform branch.)

Create private/google-modules/soc/gs/build.config.slider.khwasan with the configs we want; this fragment runs after defconfig and overrides via scripts/config.

append_cmd POST_DEFCONFIG_CMDS update_slider_khwasan_config

function update_slider_khwasan_config() {
  ${KERNEL_DIR}/scripts/config --file ${OUT_DIR}/.config \
    -e CONFIG_KASAN \
    -e CONFIG_KASAN_HW_TAGS \
    -d CONFIG_KASAN_SW_TAGS \
    -e CONFIG_KASAN_INLINE \
    -e CONFIG_KASAN_PANIC_ON_WARN \
    -e CONFIG_KCOV \
    -e CONFIG_PANIC_ON_WARN_DEFAULT_ENABLE \
    -d CONFIG_RANDOMIZE_BASE \
    --set-val CONFIG_FRAME_WARN 0 \
    -d CONFIG_SHADOW_CALL_STACK \
    -e CONFIG_SECURITY_SELINUX_BOOTPARAM
  (cd ${OUT_DIR} && \
   make O=${OUT_DIR} "${TOOL_ARGS[@]}" ${MAKE_ARGS} olddefconfig)
}

Export it in private/google-modules/soc/gs/BUILD.bazel:

exports_files(["build.config.slider.khwasan"])

Append nokaslr to chosen.bootargs in private/devices/google/zuma/dts/zuma.dtsi.

Edit build_shusky.sh and change the last line to:

exec tools/bazel run \
    ${parameters} \
    --config=stamp \
    --lto=none \
    --config=shusky \
    --gki_build_config_fragment=//private/google-modules/soc/gs:build.config.slider.khwasan \
    --sandbox_debug \
    --kasan \
    --//build/kernel/kleaf:use_prebuilt_gki=false \
    //private/devices/google/shusky:zuma_shusky_dist "$@"

We set --//build/kernel/kleaf:use_prebuilt_gki=false here because the --use_prebuilt_gki=false alias set on the command line fails to override the same value set in device.bazelrc. In that case the GKI keeps coming from the prebuilt, throwing an error.

Compile:

./build_shusky.sh

Patching SELinux to stay permissive

androidboot.selinux=permissive and enforcing=0 on the cmdline are not enough on a user build. Android init writes 1 to /sys/fs/selinux/enforce after policy load, effectively setting it back to enforcing.

If you’re lazy like me, you can just patch aosp/security/selinux/selinuxfs.c:sel_write_enforce:

new_value = !!new_value;

if (new_value)
    new_value = 0;

old_value = enforcing_enabled(state);

Note: A better way would be to add this functionality to the UAF test driver I’ll talk about below, so we can set/unset enforcing whenever we need. That being said, I’m pretty sure there are more legitimate ways to achieve this.

UAF test driver

To test if KASAN works and actually produces a crash report, I’ve added a driver which we can use to trigger a UAF.

Drop private/google-modules/misc/uaftest/{uaftest.c,Makefile,Kconfig,BUILD.bazel} and add "//private/google-modules/misc/uaftest" to private/devices/google/zuma/BUILD.bazel:kernel_ext_modules.srcs.

The driver registers both /dev/uaftest and /proc/uaftest.

/dev/uaftest is on mode 0666 in source, but Android ueventd downgrades it to 0600. For /proc/uaftest procfs respects the mode bits and ueventd doesn’t mess with them. While we’re at it let’s add a “give root” function so that we don’t have to deal with magisk.

private/google-modules/misc/uaftest/uaftest.c:

// SPDX-License-Identifier: GPL-2.0-only

#include <linux/cred.h>
#include <linux/fs.h>
#include <linux/init.h>
#include <linux/ioctl.h>
#include <linux/kernel.h>
#include <linux/miscdevice.h>
#include <linux/module.h>
#include <linux/proc_fs.h>
#include <linux/slab.h>
#include <linux/uaccess.h>

#define UAFTEST_MAGIC 'U'
#define UAFTEST_IOC_UAF_READ    _IO(UAFTEST_MAGIC, 1)
#define UAFTEST_IOC_UAF_WRITE   _IO(UAFTEST_MAGIC, 2)
#define UAFTEST_IOC_DOUBLE_FREE _IO(UAFTEST_MAGIC, 3)
#define UAFTEST_IOC_OOB_READ    _IO(UAFTEST_MAGIC, 4)
#define UAFTEST_IOC_GIVE_ROOT   _IO(UAFTEST_MAGIC, 100)

#define UAFTEST_BUF_SZ 128

static noinline u8 uaftest_uaf_read(void)
{
	u8 *p = kmalloc(UAFTEST_BUF_SZ, GFP_KERNEL);
	u8 v;

	if (!p)
		return 0;
	memset(p, 0xa5, UAFTEST_BUF_SZ);
	kfree(p);
	/* deliberate UAF read; KASAN/MTE should fire here */
	v = READ_ONCE(p[16]);
	return v;
}

static noinline void uaftest_uaf_write(void)
{
	u8 *p = kmalloc(UAFTEST_BUF_SZ, GFP_KERNEL);

	if (!p)
		return;
	kfree(p);
	WRITE_ONCE(p[32], 0x41);
}

static noinline void uaftest_double_free(void)
{
	u8 *p = kmalloc(UAFTEST_BUF_SZ, GFP_KERNEL);

	if (!p)
		return;
	kfree(p);
	kfree(p);
}

static noinline u8 uaftest_oob_read(void)
{
	u8 *p = kmalloc(UAFTEST_BUF_SZ, GFP_KERNEL);
	u8 v;

	if (!p)
		return 0;
	v = READ_ONCE(p[UAFTEST_BUF_SZ]);   /* one past end */
	kfree(p);
	return v;
}

static int uaftest_give_root(void)
{
	struct cred *new = prepare_creds();
	if (!new)
		return -ENOMEM;
	new->uid.val  = new->gid.val  = 0;
	new->euid.val = new->egid.val = 0;
	new->suid.val = new->sgid.val = 0;
	new->fsuid.val = new->fsgid.val = 0;
	return commit_creds(new);
}

static long uaftest_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case UAFTEST_IOC_UAF_READ:
		pr_warn("uaftest: triggering UAF read\n");
		(void)uaftest_uaf_read();
		return 0;
	case UAFTEST_IOC_UAF_WRITE:
		pr_warn("uaftest: triggering UAF write\n");
		uaftest_uaf_write();
		return 0;
	case UAFTEST_IOC_DOUBLE_FREE:
		pr_warn("uaftest: triggering double-free\n");
		uaftest_double_free();
		return 0;
	case UAFTEST_IOC_OOB_READ:
		pr_warn("uaftest: triggering OOB read\n");
		(void)uaftest_oob_read();
		return 0;
	case UAFTEST_IOC_GIVE_ROOT:
		pr_warn("uaftest: GIVE_ROOT requested by uid=%u pid=%d\n",
			from_kuid(&init_user_ns, current_uid()),
			task_pid_nr(current));
		return uaftest_give_root();
	default:
		return -ENOTTY;
	}
}

static const struct file_operations uaftest_fops = {
	.owner          = THIS_MODULE,
	.unlocked_ioctl = uaftest_ioctl,
	.compat_ioctl   = uaftest_ioctl,
	.llseek         = noop_llseek,
};

static struct miscdevice uaftest_dev = {
	.minor = MISC_DYNAMIC_MINOR,
	.name  = "uaftest",
	.fops  = &uaftest_fops,
	.mode  = 0666,
};

static const struct proc_ops uaftest_proc_ops = {
	.proc_ioctl        = uaftest_ioctl,
	.proc_compat_ioctl = uaftest_ioctl,
	.proc_open         = simple_open,
	.proc_lseek        = noop_llseek,
};

static struct proc_dir_entry *uaftest_proc;

static int __init uaftest_init(void)
{
	int rc;

	pr_warn("uaftest: ENGINEERING TEST MODULE — do not ship\n");
	rc = misc_register(&uaftest_dev);
	if (rc)
		return rc;
	/* ueventd downgrades /dev/uaftest to 0600. /proc/uaftest keeps
	 * the mode we set here, giving the shell user a way in. */
	uaftest_proc = proc_create("uaftest", 0666, NULL, &uaftest_proc_ops);
	if (!uaftest_proc) {
		misc_deregister(&uaftest_dev);
		return -ENOMEM;
	}
	return 0;
}

static void __exit uaftest_exit(void)
{
	if (uaftest_proc)
		proc_remove(uaftest_proc);
	misc_deregister(&uaftest_dev);
}

module_init(uaftest_init);
module_exit(uaftest_exit);

MODULE_DESCRIPTION("Test driver to check if KASAN is working");
MODULE_LICENSE("GPL v2");

And the userspace trigger, private/google-modules/misc/uaftest/uaftest_trigger.c:

// SPDX-License-Identifier: GPL-2.0-only

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <unistd.h>

#define UAFTEST_MAGIC 'U'
#define UAFTEST_IOC_UAF_READ    _IO(UAFTEST_MAGIC, 1)
#define UAFTEST_IOC_UAF_WRITE   _IO(UAFTEST_MAGIC, 2)
#define UAFTEST_IOC_DOUBLE_FREE _IO(UAFTEST_MAGIC, 3)
#define UAFTEST_IOC_OOB_READ    _IO(UAFTEST_MAGIC, 4)
#define UAFTEST_IOC_GIVE_ROOT   _IO(UAFTEST_MAGIC, 100)

static const struct {
	const char *name;
	unsigned long cmd;
	const char *desc;
} CMDS[] = {
	{ "uaf-read",    UAFTEST_IOC_UAF_READ,    "kmalloc -> kfree -> read (UAF read)" },
	{ "uaf-write",   UAFTEST_IOC_UAF_WRITE,   "kmalloc -> kfree -> write (UAF write)" },
	{ "double-free", UAFTEST_IOC_DOUBLE_FREE, "kmalloc -> kfree -> kfree" },
	{ "oob-read",    UAFTEST_IOC_OOB_READ,    "read one byte past kmalloc end" },
	{ "give-root",   UAFTEST_IOC_GIVE_ROOT,   "set current task creds to uid 0" },
};

static void usage(const char *prog)
{
	size_t i;
	fprintf(stderr, "usage: %s <command>\n  commands:\n", prog);
	for (i = 0; i < sizeof(CMDS)/sizeof(CMDS[0]); i++)
		fprintf(stderr, "    %-12s  %s\n", CMDS[i].name, CMDS[i].desc);
}

int main(int argc, char **argv)
{
	int fd, rc;
	size_t i;
	unsigned long cmd = 0;

	if (argc != 2) {
		usage(argv[0]);
		return 2;
	}
	for (i = 0; i < sizeof(CMDS)/sizeof(CMDS[0]); i++) {
		if (!strcmp(argv[1], CMDS[i].name)) {
			cmd = CMDS[i].cmd;
			break;
		}
	}
	if (!cmd) {
		usage(argv[0]);
		return 2;
	}

	/* /dev/uaftest gets 0600 root by ueventd; /proc/uaftest is 0666. */
	fd = open("/proc/uaftest", O_RDWR);
	if (fd < 0)
		fd = open("/dev/uaftest", O_RDWR);
	if (fd < 0) {
		fprintf(stderr, "open /proc/uaftest or /dev/uaftest: %s\n", strerror(errno));
		return 1;
	}

	if (cmd == UAFTEST_IOC_GIVE_ROOT) {
		rc = ioctl(fd, cmd, 0);
		if (rc < 0) {
			fprintf(stderr, "ioctl: %s\n", strerror(errno));
			return 1;
		}
		printf("uid=%u euid=%u — exec a shell to keep it: exec /system/bin/sh\n",
		       getuid(), geteuid());
		execl("/system/bin/sh", "sh", (char *)NULL);
		perror("execl");
		return 1;
	}

	rc = ioctl(fd, cmd, 0);
	if (rc < 0) {
		fprintf(stderr, "ioctl: %s\n", strerror(errno));
		return 1;
	}
	printf("ok — check `dmesg` for the KASAN report\n");
	return 0;
}

Cross-compile the trigger with the NDK in the kernel tree:

prebuilts/ndk-r23/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android31-clang \
    -static -O2 -o uaftest_trigger \
    private/google-modules/misc/uaftest/uaftest_trigger.c

Setting boot cmdline parameters on Pixel devices

/proc/cmdline after first boot has kasan=off and arm64.nomte appended after our dts cmdline, which kills runtime KASAN and MTE. kasan=off is in the vendor_cmdline field of vendor_boot.img’s header; arm64.nomte is appended by the bootloader.

For arm64.nomte there’s a bootloader knob:

fastboot oem mte on

For kasan=off you have to edit vendor_boot.img. My kernel build didn’t produce one so I pulled it from the matching factory image:

unzip image-shiba-cp1a.260405.005.zip vendor_boot.img init_boot.img vbmeta.img

python3 tools/mkbootimg/unpack_bootimg.py --boot_img vendor_boot.img --out vb

The vendor command line args value is logged to stdout by unpack_bootimg.py. Strip kasan=off and rodata=on, append enforcing=0 kasan=on, repack.

NEW_CMDLINE='fips140.load_sequential=1 exynos_drm.load_sequential=1 \
g2d.load_sequential=1 samsung_iommu_v9.load_sequential=1 swiotlb=noforce \
disable_dma32=on earlycon=exynos4210,0x10870000 console=ttySAC0,115200 \
androidboot.console=ttySAC0 printk.devkmsg=on cma_sysfs.experimental=Y \
rcupdate.rcu_expedited=1 rcu_nocbs=all rcutree.enable_rcu_lazy swiotlb=1024 \
cgroup.memory=nokmem sysctl.kernel.sched_pelt_multiplier=4 \
at24.write_timeout=100 log_buf_len=1024K android_arch_task_struct_size=512 \
bootconfig enforcing=0 kasan=on'

python3 tools/mkbootimg/mkbootimg.py \
    --header_version 4 --pagesize 0x800 \
    --vendor_cmdline "$NEW_CMDLINE" \
    --base 0x0 \
    --kernel_offset 0x10008000 --ramdisk_offset 0x11000000 \
    --tags_offset 0x10000100 --dtb_offset 0x11f00000 \
    --ramdisk_type platform --ramdisk_name '' \
        --vendor_ramdisk_fragment vb/vendor_ramdisk00 \
    --ramdisk_type none --ramdisk_name '16K' \
        --vendor_ramdisk_fragment vb/vendor_ramdisk01 \
    --vendor_bootconfig vb/bootconfig \
    --vendor_boot vendor_boot_new.img

Console/serial

P.S. If you have a SuzyQ cable or a USB cereal and would like to dump bootloader and kernel logs to tty, do it here — append your serial console params to NEW_CMDLINE above before repacking, or set them via fastboot oem uart after flashing:

fastboot oem uart enable
fastboot oem uart config 3000000

Flashing

fastboot -w --disable-verification
fastboot oem disable-verification
fastboot flash boot              out/shusky/dist/boot.img
fastboot flash dtbo              out/shusky/dist/dtbo.img
fastboot flash vendor_kernel_boot out/shusky/dist/vendor_kernel_boot.img
fastboot flash vendor_boot       vendor_boot_new.img
fastboot flash vbmeta            vbmeta.img

fastboot oem uart enable
fastboot oem uart config 3000000
fastboot oem mte on

fastboot reboot fastboot
# wait until `fastboot getvar is-userspace` says yes

fastboot flash vendor_dlkm out/shusky/dist/vendor_dlkm.img
fastboot flash system_dlkm out/shusky/dist/system_dlkm.img
fastboot reboot

vendor_dlkm and system_dlkm are logical partitions inside super and can only be resized from fastbootd, hence the bounce.

Verifying it works

adb shell getenforce
adb shell cat /proc/uaftest
adb push uaftest_trigger /data/local/tmp/
adb shell chmod +x /data/local/tmp/uaftest_trigger
adb shell /data/local/tmp/uaftest_trigger uaf-read

dmesg report (read it after give-root):

[  229.126588] uaftest: triggering UAF read
[  229.127765] BUG: KASAN: invalid-access in uaftest_uaf_read+0x6c [uaftest]
[  229.128456] Read at addr f9ffff88e6653610 by task uaftest_trigger/13318
[  229.128485] Pointer tag: [f9], memory tag: [fe]
[  229.132481] Hardware name: ZUMA SHIBA MP based on ZUMA (DT)
…

If you’re seeing something like the above, that means KASAN and MTE are doing their job.

Root via the driver

adb root won’t work on a user build (ro.debuggable=0), and production Android does not ship su or sudo in $PATH (userdebug builds do). Luckily, our driver’s GIVE_ROOT ioctl gives us root inside an existing shell:

adb shell /data/local/tmp/uaftest_trigger give-root
# uid=0(root) gid=0(root)

I created a su script for convenience:

#!/system/bin/sh
exec /data/local/tmp/uaftest_trigger give-root

adb push su /data/local/tmp/su
adb shell chmod +x /data/local/tmp/su
adb shell /data/local/tmp/su -c id

/data/local/tmp isn’t on $PATH, so either always type the full path or export PATH=/data/local/tmp:$PATH per session.

Note: adbd itself runs as shell because the system image has ro.debuggable=0. adb push to read-only partitions still fails as a non root user. If this bothers you use Magisk to patch init_boot.img from the factory image and flash it.

Setting Up Pixel 8/9 for Android App Reversing and Mobile Security Testing

2026-01-22T00:00:00+00:00

This post aims to serve as a guide on how to set a Pixel device up for Android security testing. I’ve tested this on both the Pixel 8 and the Pixel 9. The steps are identical for both.

This covers flashing stock Pixel OS, rooting with Magisk, and getting Burp Suite working for traffic interception.

Prerequisites

Pixel 8 (codename: shiba) or Pixel 9 (codename: tokay)
Ubuntu 22.04 (or similar Linux distro)
USB cable
adb and fastboot installed: sudo apt install android-tools-adb android-tools-fastboot

Step 1: Download Factory Image

Get the latest factory image from https://developers.google.com/android/images

Pixel 8: look for shiba
Pixel 9: look for tokay

Google factory images are named like shiba-bp4a.251205.006-factory-*.zip. Don’t confuse with GrapheneOS images which use format shiba-install-*.zip.

Step 2: Enable Developer Options and OEM Unlocking

On the phone:

Settings → About phone → tap “Build number” 7 times to enable Developer Options
Settings → System → Developer options → USB debugging → ON
Settings → System → Developer options → OEM unlocking → ON

Note: If OEM unlocking is greyed out, connect to WiFi/mobile data and wait ~24 hours (Google’s anti-theft measure).

Step 3: Extract Factory Image

cd ~/Downloads
unzip shiba-*.zip  # or tokay-*.zip for Pixel 9
cd shiba-*         # or tokay-* for Pixel 9

For Pixel 8, extract the inner image zip:

unzip image-shiba-*.zip

For Pixel 9, the images come extracted already.

Make the flash script executable:

chmod +x flash-all.sh

Step 4: Unlock Bootloader and Flash

Reboot into fastboot mode using the hardware buttons (Power + Volume Down), then:

fastboot flashing unlock

Confirm on device with volume keys + power. This wipes everything.

Once back at fastboot:

fastboot devices
./flash-all.sh

Do not re-lock the bootloader since we need it unlocked for Magisk.

Step 5: Post-Flash Setup

After the phone boots:

Skip through initial setup
Re-enable Developer Options (tap Build number 7 times)
Re-enable USB Debugging

Step 6: Install Magisk

Magisk is a systemless root solution that modifies the boot image to provide root access while passing SafetyNet checks. It allows installing modules that modify the system without actually touching the system partition.

Download the latest Magisk APK from https://github.com/topjohnwu/Magisk/releases

adb install Magisk-*.apk

Allow notifications when prompted. Useful for superuser prompts.

Step 7: Patch init_boot Image

Important: Pixel 8 on Android 13+ uses init_boot.img for the ramdisk, not boot.img.

Push the init_boot image to the phone:

adb push init_boot.img /sdcard/Download/

On the phone:

Open Magisk app
Tap Install
Select Select and Patch a File
Navigate to Downloads and select init_boot.img

Note: You can also extract boot.img from a rooted device using dd, but for fresh installs use the init_boot.img from the factory zip. Just make sure it matches your flashed version.

Step 8: Flash Patched Image

List the patched file:

ls /sdcard/Download/

Pull it:

adb pull /sdcard/Download/magisk_patched-*.img .

You can test by booting the image directly without flashing:

adb reboot bootloader
fastboot boot magisk_patched-*.img

If Magisk shows as installed, flash it permanently:

adb reboot bootloader
fastboot flash init_boot magisk_patched-*.img
fastboot reboot

Step 9: Verify Root

adb shell
su

You should see a superuser prompt on the phone. Grant access and you’ll have a root shell.

Step 10: Configure Magisk

In Magisk app, go to Settings and configure:

Zygisk → ON (enables code injection into apps, needed for DenyList)
Enable Zygisk DenyList (hide root from specific apps)
Enable DNS over HTTPS
Hide the Magisk app → enter a custom name → add shortcut icon when prompted

Reboot the phone. After reboot, verify Zygisk shows Yes in Magisk home screen.

Step 11: Install Burp CA Certificate

Android 14+ has read-only system partitions protected by dm-verity. We’ll use a Magisk module to install the CA cert as a system certificate.

Export Burp Certificate

In Burp Suite: Proxy → Proxy settings → Import/Export CA Certificate → Export → Certificate in DER format → save as cacert.der

Convert and Hash the Certificate

openssl x509 -inform DER -in cacert.der -out cacert.pem
hash=$(openssl x509 -inform PEM -subject_hash_old -in cacert.pem | head -1)
mv cacert.pem $hash.0

Install MagiskTrustUserCerts Module

Download from https://github.com/NVISOsecurity/MagiskTrustUserCerts/releases

adb push MagiskTrustUserCerts.zip /sdcard/Download/

In Magisk app: Modules → Install from storage → select the zip → reboot

Install Certificate as User Cert

adb push $hash.0 /sdcard/Download/

On phone: Settings → Security & Privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate → Install anyway → select your .0 file from Downloads

Reboot the phone. The MagiskTrustUserCerts module will promote the user certificate to system trust.

Step 12: Configure Proxy

Option A: WiFi Proxy

On phone: Settings → Network & internet → Internet → tap your WiFi network → Edit → Advanced options → Proxy → Manual

Set proxy hostname to your Burp machine’s IP and port 8080.

Option B: ADB Reverse (for VM setups)

If Burp is running in a VM, redirect USB to the VM first:

QEMU/virt-manager: Virtual Machine → Redirect USB device → select Pixel
VirtualBox/VMware: Configure USB passthrough in VM settings

Stop adb on host first if running:

adb kill-server

In the VM:

adb devices
adb reverse tcp:8080 tcp:8080

On phone, set proxy to 127.0.0.1:8080.

Important: Disable any VPN on the phone. VPN overrides proxy settings.

Step 13: Test

Open browser on phone. Traffic should appear in Burp’s HTTP history.

Troubleshooting

Magisk shows “N/A” after flashing: Make sure you’re flashing init_boot not boot on Pixel 8
Can’t remount system: Android 14+ uses dm-verity, use Magisk modules instead
No traffic in Burp: Check VPN is disabled, proxy settings are correct, and Burp is bound to all interfaces (0.0.0.0)
Certificate not trusted: Ensure MagiskTrustUserCerts module is installed and phone was rebooted