Make KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features

Learn how to root Android devices by exploiting the GPU MMU features, highlighting the art of rewriting color addresses, managing virtual addresses, and leveraging the GPU MMU to reprogram memory allocation.

Key takeaways

The root cause of the bug is a rewrite of the color address as L0.
The GPU MMU has four level page table directors, similar to the CPU MMU.
A valid block descriptor is used to describe a block of memory with the same virtual address on both the CPU and GPU.
The GPU MMU uses a key-based via region and a self-aligned region, which can be used to flush the corresponding region of mmu cache.
To manage the virtual addresses, the GPU driver utilizes a reference counter to represent the spatial stator.
The flex attribute indicates the permissions for reading, writing, and executing, which are similar to the attribute fields of CPU page table entries.
Pages are managed by a key-based context, which contains 32 mempools and has its own shrinker.
The GPU memory management is achieved by using a side-channel approach, which can avoid triggering out of memory.
The GPU MMU can set up regions of memory with the same virtual address on both the CPU and GPU, and the GPU can parallelly search for a valid block descriptor.
The bug as a case study has been detailed, and the technique has been used to root Android devices.
To utilize the GPU version of the KASMA explaining technique, crafting a valid block entry is a necessary step.
The GPU MMU can be used to reprogram the GPU’s memory allocation and reclaim.
The GPU memory management has undergone significant evolution, and certain features of the GPU MMU may need to be leveraged.
To manage the virtual addresses and physical pages, shaping the GPU via layout can be used.
The GPU MMU has a key-based via region and a self-aligned region, which can be used to flush the corresponding region of mmu cache.
The GPU can parallelly search for a valid block descriptor, and the GPU MMU can set up regions of memory with the same virtual address on both the CPU and GPU.
The GPU memory management is achieved by using a side-channel approach, which can avoid triggering out of memory.
The GPU MMU can be used to reprogram the GPU’s memory allocation and reclaim.
The GPU memory management has undergone significant evolution, and certain features of the GPU MMU may need to be leveraged.
The GPU MMU can be used to flush the corresponding region of mmu cache, which can avoid triggering out of memory.

Make KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features

More talks