u/AltruisticPumpkin245

So I got locked out of my GitHub, because I recently reset my spare phone I was using for stuff. It reset my Aegis too, meaning I can't get into my GitHub. Would use GitHub's ways of getting in, but the 'More Options' button doesn't do anything, so I'm locked out of GitHub now. Go to Google, it just gives me articles that have nothing to do with what I searched. So I'm locked out of my GitHub now, and I hate Google.

Do better Google, Shadowdev-Vita.

So yeah, I've never posted here before, but I thought it'd be a good idea to write up a report on Android Oreo - Go Edition security, as I've been messing with it in WebADB for a while.

Note: This was all done with a UID 2000 status, did not have root for any of the below mentions.

Vulnerability 1 - Race Conditions (worked twice, by the way!) From WebADB, you are able to run $ reboot recovery, and it works! The CPU (Exynos 7870) completely ditches it's "First Come, First Served" rule, and lets these commands work perfectly.

Vulnerability 2: Command Substition - The phone accepts and runs commands embedded in $ ( ), and I used this to test a lot of my other vulnerabilities. Like, I ran $ (reboot), $ (reboot download), and I did manage to get $ (reboot sideload) to work, but on my second try, even without substition, it didn't work for some reason?

Vulnerability 3: pm disable gives you more priveleges than it really should: Using pm disable in the shell allows you to disable a lot more than you should be able to, resulting in me permanently disabling the Watchdog (tried everything to get it back up) and I also broke a Java script in Settings, and found out that the Watchdog and Emergency Launcher are paired - disabling one disables the other. Also, I ran some checks to see what I disabled, and it said I disabled the browser, even though it's what I'm currently typing on, and also, the phone says otherwise.

Vulnerability 4: RAM-eating scripts run in the browser (tested before I killed the Watchdog): So, I wrote a script that eats RAM for another project, and it ran - took, like, a minute to throw an "Aw, Snap!" on both tries, but I'm surprised that the Watchdog didn't see the process was rapidly eating RAM, and kill it, like what the PS4 does on WebKit (BYPASSED).

But the thing is, I didn't do a single thing to bypass it on the A2 Core. It just... ran. But I did learn if you have another app open, it does crash, though.

List of things I broke:

1. Settings binary - throwing "lock must not be null" hex dumps.
2. Watchdog - with pm disable, now none of the methods to pull it up work.

Forced reboots when something breaks - with the Watchdog gone, this doesn't work anymore - refuses to KP, as well.

Current efforts: I have a hex dump of /system/bin/sh, was looking through it, 'til I got my laptop taken - won't get into that.

Bye for now, Shadowdev-Vita.