Android Kernel Exploitation: Binder

Master the internals of Android's Binder IPC mechanism, including its core data structures (binder_proc, binder_thread, binder_node), transaction flows, and lifetime management, building the foundation needed for kernel-level exploitation work.

Analyze a real use-after-free vulnerability in the Binder driver, from its root cause in misaligned offsets_size handling to the exploitation primitives it enables, including leaks and arbitrary read/write. Using Time Travel Debugging, you'll trace kernel crashes, reverse-engineer heap states, and debug complex race conditions and double-free scenarios.

Build a complete exploit chain for local privilege escalation: trigger the use-after-free via a two-process Binder setup, craft exploitation primitives such as leaks and arbitrary read/write, and overwrite credential structures to escalate privileges.

Use Time Travel Debugging to stabilize the exploit, identifying and resolving issues such as heap-spray evictions or double-free. The final exploit is validated in a controlled Android 12 (aarch64) emulator environment with vulnerable kernel images.