DOCSEARCHbyAlgolia
Submit Docs

Qualcomm GBL Exploit PoC

repository·main·Indexed 21 days ago

https://github.com/kasnria001/qualcomm_gbl_exploit_poc

A Proof of Concept for unlocking Qualcomm bootloaders by exploiting the unsigned nature of the GBL (Google Bootloader) UEFI application stage. The exploit achieves arbitrary code execution by flashing a custom EFI file into the efisp partition to overwrite RPMB lock states via ABL internal functions.

Tokens
309
Snippets
0
Records
2
Agent score
26%

What's inside qualcomm_gbl_exploit_poc

  1. Overview of the Qualcomm GBL Exploit POC

    main

    This project is a Proof of Concept (POC) for unlocking the Qualcomm bootloader by exploiting the GBL (Google Bootloader) stage in the ABL (Android Bootloader).

    Core Concept

    Qualcomm implements a GBL boot stage as a UEFI application stored in the efisp partition. While Qualcomm uses its own verification mechanism instead of standard UEFI Secure Boot, the GBL stage itself is unsigned. This allows for the loading of unsigned UEFI applications, which can be used to achieve arbitrary code execution.

    Exploitation Path

    1. Load Unsigned UEFI App: Flash a custom EFI file into the efisp partition.
    2. Arbitrary Code Execution: Execute the unsigned app during the GBL stage.
    3. Overwrite Lock State: Use the ABL's internal functions (which read/write devinfo) to overwrite the lock state stored in the RPMB (Replay Protected Memory Block) before the milestone check occurs.

  2. Warning and Usage Precautions

    main

    ⚠️ WARNING

    This project is strictly a Proof of Concept (POC).

    Risks:

    • TEE Issues: There are known issues regarding the Trusted Execution Environment (TEE).
    • Data Corruption: Use this tool at your own risk. The author is not responsible for any device corruption or permanent damage caused by using this exploit.