iiinova — where your digital self keeps evolving

David Buchanan @retr0.id · 13/05/2026

oh nice I missed this, does it include 9a too?

Reposted by David Buchanan

David Buchanan @retr0.id · 31/03/2026

have you seen the new supply chain vuln? don't update tubu. it's literally on heebee. they got poodee's deps. they infiltrated dippy. roll back weeno. disable scripts in ~/.gumpyrc. it's in poob. do not install poob. do not update poob. uninstall poob right now. poob has it in for you.

262845850

David Buchanan @retr0.id · 11/05/2026

could be from customers attempting their own installs and then sending them in to get fixed (and then being told they're beyond repair)

110

David Buchanan @retr0.id · 11/05/2026

I think I slightly look down on people who use vscode but I also use vscode myself

121695

David Buchanan @retr0.id · 11/05/2026

now the bread is portable

0100

David Buchanan @retr0.id · 11/05/2026

A bit of both I guess?

020

David Buchanan @retr0.id · 11/05/2026

anyway I guess this is proof that a full Play Integrity bypass is within "weekend project" territory. this approach does not exploit any bugs or rely on leaked key material, so it cannot be patched.

418217

Reposted by David Buchanan

David Buchanan @retr0.id · 10/05/2026

injected frida-gadget via slightly modified AndKittyInjector

2957

David Buchanan @retr0.id · 11/05/2026

no, just me remembering that C2PA exists

190

David Buchanan @retr0.id · 10/05/2026

injected frida-gadget via slightly modified AndKittyInjector

2957

David Buchanan @retr0.id · 10/05/2026

I just migrated into dumpstate which has, afaict, the most permissive selinux policy

1370

David Buchanan @retr0.id · 10/05/2026

it's very funny to me that you can't mmap an anonymous+exec page, but you can map an executable file just fine and then overwrite it with your own code. all these mitigations are very annoying, but they are only an annoyance.

1450

David Buchanan @retr0.id · 10/05/2026

aaaand there it is, root shell in pid 1 context (which isn't the best selinux context but hey, it's root)

59112

David Buchanan @retr0.id · 10/05/2026

If I have a play integrity bypass, what's the best way to demo it?

0190

David Buchanan @retr0.id · 10/05/2026

Do the 3.x betas use the same play integrity + remote c2pa signing flow that the final release will use, just with a "non-trusted" signer?

100

David Buchanan @retr0.id · 10/05/2026

frida fails with opaque permission errors so I think I probably will need a root shell before I can try frida

110

David Buchanan @retr0.id · 10/05/2026

yup, although I really do want that root prompt just for style points, so now I'm writing a ptrace shellcode injector heh

120

David Buchanan @retr0.id · 10/05/2026

now we're cooking - thinking about it, I can probably use this to inject shellcode into pid1 and spawn myself a root shell that way

2281

David Buchanan @retr0.id · 10/05/2026

however it looks like ptrace_attach does a different (inlined?) check, so I need to patch that too!

1160

David Buchanan @retr0.id · 10/05/2026

I gave up on getting a root shell, since that isn't my real goal here. I just want to be able to inject code into other processes. I patched ptrace_may_access in kernel .text to always return true, so now I can access anything that would normally be gated on that - e.g. /proc/pid/maps.

1190

David Buchanan @retr0.id · 10/05/2026

claude's exploit did not work so I'll have to use my brain oldschool style (claude seems repeatedly confused by physical vs virtual address spaces)