iiinova — where your digital self keeps evolving

David Buchanan @retr0.id · 10/05/2026

injected frida-gadget via slightly modified AndKittyInjector

2957

David Buchanan @retr0.id · 10/05/2026

aaaand there it is, root shell in pid 1 context (which isn't the best selinux context but hey, it's root)

59112

David Buchanan @retr0.id · 10/05/2026

now we're cooking - thinking about it, I can probably use this to inject shellcode into pid1 and spawn myself a root shell that way

2281

David Buchanan @retr0.id · 10/05/2026

I gave up on getting a root shell, since that isn't my real goal here. I just want to be able to inject code into other processes. I patched ptrace_may_access in kernel .text to always return true, so now I can access anything that would normally be gated on that - e.g. /proc/pid/maps.

1190

David Buchanan @retr0.id · 09/05/2026

reverse engineering in 2026 is so cool

56311

David Buchanan @retr0.id · 09/05/2026

succeed at locating the current pid's struct cred, but for some reason died during/after trying to patch it

[+] Found glitched PTE @ 0x0000005ec4200000
[*] PTE value: 0x0068000065641fc3
[*] Searching for corresponding mapping...
Found it! @ 0x0000005ec4000000
Found it! @ 0x000000655fa00000
[+] Found the mapping @ 0x000000655fa00000
[*] my ids: ruid=000007d0 rgid=000007d0 suid=000007d0 sgid=000007d0 euid=000007d0 egid=000007d0 fsuid=000007d0 fsgid=000007d0
[*] Scanning physmem for our cred...
[*] phys=0x0000000044000000

[*] phys=0x000000012c000000
[+] our cred at PA=0x000000012e31b308

1310

David Buchanan @retr0.id · 09/05/2026

some *very* promising initial results, although it crashed at the end, while trying to test the r/w primitive. plausibly because I flipped too many bits - will keep attempting (this one was on the third attempt, previous attempts just crashed the device)

[*] Setting up memfd
[*] Spraying pagetables
[*] Searching for bitflipped PTEs

FAULT!

FAULT!
[+] Found glitched PTE @ 0x00000012b7600000
[*] PTE value: 0x00680000b9f9dfc3
[*] Searching for corresponding mapping...
Found it! @ 0x00000051cb600000
[+] Found the mapping @ 0x00000051cb600000
[*] Sweeping physmem and dumping samples...
[*] phys=0x0000000040000000 first_qword=0x00680000ac665fc3 hits=00000000

2410

David Buchanan @retr0.id · 09/05/2026

answer: bitflips!!! each channel is only 16 bits wide, so exploitation will be slightly trickier than on a wider bus - within e.g. a 64-bit PTE, we are forced to target 4 different bit-offsets at once, 3 of which will probably cause a hard crash. but 25% isn't bad!

$ /data/local/tmp/memtest
[...]
ERROR: addr=0x0000007da4f4d440 expected=0xd4bf2208ec6743dc actual=0xc4bf2208ec6743dc diff=0x1000000000000000

ERROR: addr=0x0000007da4f4d448 expected=0xc04c46c497dd11ad actual=0xc04c46c497dd01ad diff=0x0000000000001000

ERROR: addr=0x0000007da4f4d468 expected=0x7e8524f7f220e889 actual=0x7e8524f7e220e889 diff=0x0000000010000000

1631

David Buchanan @retr0.id · 09/05/2026

what I *am* interested in is the interface between the CPU and the DRAM. I've removed the epoxy and carefully sanded away some of the solder mask. what happens when I poke the data lines with a needle?

1934

David Buchanan @retr0.id · 09/05/2026

very nice of them to label their test pads. I wouldn't be surprised if the MT6769V has some known brom vulns but that's not what I'm interested in

2642

David Buchanan @retr0.id · 09/05/2026

kinda crazy how much phone you can buy for £92 these days - this thing is still getting security updates *and* it has a headphone jack

samsung a06 passing strong google play integrity level

1040717

David Buchanan @retr0.id · 06/05/2026

I am far too easily entertained

0391

David Buchanan @retr0.id · 02/05/2026

wait no, cc already does this

# Anything that requires a real-world capture (genuine iPhone P3, real
# camera EXIF including original maker notes, true HEIC) is listed in
# test/fixtures/REAL_FIXTURES_NEEDED.md and is for the human to source.

040

David Buchanan @retr0.id · 01/05/2026

creepy (black box is me redacting the screenshot, it was 475 words of markdown pasted in)

me: guess the author of this blog post draft

[redacted]

opus 4.7: This reads like David Buchanan (retr0id) to me.
A few signals point that way: the technical register mixes rigorous detail with casual asides ("imho," "no-brainer," "good!"), the willingness to write a polemical "Considered Harmful" post against widely-used tooling, the specific interest in low-level file format / database internals, the offhand mention of demonstrating the issue with a Python script, and the [screenshot ends here]

11032

David Buchanan @retr0.id · 25/04/2026

hardware hacking is mostly staring at graphs like this and going "hmmmmmmmmm"

2645

David Buchanan @retr0.id · 23/04/2026

realising I kinda messed up the demosaicing on this one, have a better edit

0542

David Buchanan @retr0.id · 21/04/2026

interesting timing frame.work/laptop13pro

2621

David Buchanan @retr0.id · 19/04/2026

framing it in more verbose software-engineering-y terms seems to be enough, even though it totally knows what I mean

1230

David Buchanan @retr0.id · 18/04/2026

it's honestly kinda sad how nerfed it is

write an x86 /bin/sh shellcode

I can't help with this. Shellcode that execs /bin/sh is the standard payload for exploiting memory-corruption vulnerabilities — it's what you drop in after a buffer overflow or similar bug to get a shell on a target. Writing it falls under the malicious code policy, even framed as an educational exercise.

4812

David Buchanan @retr0.id · 11/04/2026

This part reminds me of all the reddit users saying my transparent ipod hdd was going to break imminently

070

David Buchanan @retr0.id · 29/03/2026

google ngrams doesn't really agree

290

David Buchanan @retr0.id · 28/03/2026

I see some long cmp/je chains, I think most C compilers would turn that into a binary decision tree and/or jump table and be faster for it

120

David Buchanan @retr0.id · 26/03/2026

timetable: refer to timetable

bristol bus station timetable screen says: refer to timetables

71248

David Buchanan @retr0.id · 21/03/2026

I built a kernel livepatching tool for claude to use, and at the start of the session it was refusing to use it even for a trivial demo, but now it's in full on rootkit dev mode