c4psu13 c4psu13 / mali-pagecache-root · GitLab
Project ID: 88037053
*
*
- * Visual Studio Code
- IntelliJ IDEA
*
- A workspace is a virtual sandbox environment for your code in GitLab.
No agents available to create workspaces. Please consult Workspaces documentation for troubleshooting.
| Name | Last commit | Last update | | --- | --- | --- |
| [docs](https://gitlab.com/c4psu13/mali-pagecache-root/-/tree/main/docs?ref_type=heads "docs") | [Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319)](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/f0b479cec5cb7ce3bc707d779e55c470fbe697fe "Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319) ") | 3 days ago |
| [exploit](https://gitlab.com/c4psu13/mali-pagecache-root/-/tree/main/exploit?ref_type=heads "exploit") | [Add autonomous root chain, scripts and post-root backup](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/873fc81af8e08a44d8205641c6ff0c5c20a5b633 "Add autonomous root chain, scripts and post-root backup - auto_root.c: single-binary exploit chain (CVE-2022-22706 + direct cred modification + hardening + SELinux re-enforcement) - scripts/root.sh: ADB tethered root automation - scripts/post_root.sh: post-root backup hook (APKs, app data, WiFi, settings, package lists) - Updated Makefile, exploit/README.md and top-level README.md ") | 3 days ago |
| [kernel](https://gitlab.com/c4psu13/mali-pagecache-root/-/tree/main/kernel?ref_type=heads "kernel") | [Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319)](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/f0b479cec5cb7ce3bc707d779e55c470fbe697fe "Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319) ") | 3 days ago |
| [scripts](https://gitlab.com/c4psu13/mali-pagecache-root/-/tree/main/scripts?ref_type=heads "scripts") | [Add autonomous root chain, scripts and post-root backup](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/873fc81af8e08a44d8205641c6ff0c5c20a5b633 "Add autonomous root chain, scripts and post-root backup - auto_root.c: single-binary exploit chain (CVE-2022-22706 + direct cred modification + hardening + SELinux re-enforcement) - scripts/root.sh: ADB tethered root automation - scripts/post_root.sh: post-root backup hook (APKs, app data, WiFi, settings, package lists) - Updated Makefile, exploit/README.md and top-level README.md ") | 3 days ago |
| [.gitignore](https://gitlab.com/c4psu13/mali-pagecache-root/-/blob/main/.gitignore?ref_type=heads ".gitignore") | [Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319)](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/f0b479cec5cb7ce3bc707d779e55c470fbe697fe "Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319) ") | 3 days ago |
| [LICENSE](https://gitlab.com/c4psu13/mali-pagecache-root/-/blob/main/LICENSE?ref_type=heads "LICENSE") | [Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319)](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/f0b479cec5cb7ce3bc707d779e55c470fbe697fe "Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319) ") | 3 days ago |
| [PROVENANCE.md](https://gitlab.com/c4psu13/mali-pagecache-root/-/blob/main/PROVENANCE.md?ref_type=heads "PROVENANCE.md") | [Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319)](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/f0b479cec5cb7ce3bc707d779e55c470fbe697fe "Initial release: CVE-2022-22706 page-cache root for TCL Android TV (Realtek RTD1319) ") | 3 days ago |
| [README.md](https://gitlab.com/c4psu13/mali-pagecache-root/-/blob/main/README.md?ref_type=heads "README.md") | [Add autonomous root chain, scripts and post-root backup](https://gitlab.com/c4psu13/mali-pagecache-root/-/commit/873fc81af8e08a44d8205641c6ff0c5c20a5b633 "Add autonomous root chain, scripts and post-root backup - auto_root.c: single-binary exploit chain (CVE-2022-22706 + direct cred modification + hardening + SELinux re-enforcement) - scripts/root.sh: ADB tethered root automation - scripts/post_root.sh: post-root backup hook (APKs, app data, WiFi, settings, package lists) - Updated Makefile, exploit/README.md and top-level README.md ") | 3 days ago |
TCL 50C721 rooting toolkit[](https://gitlab.com/c4psu13/mali-pagecache-root#tcl-50c721-rooting-toolkit)
Full root exploit chain and post-root toolkit for **tethered root, SELinux Permissive, ad blocking, debloat and automated backup** on one TCL Android TV firmware. This is firmware-specific research and tooling, **not a universal TCL root tool or a supported installer**.
Tested scope[](https://gitlab.com/c4psu13/mali-pagecache-root#tested-scope)
| | | | --- | --- | | TV | TCL QLED 50C721 / BeyondTV6 | | Firmware | V8-R51MT02-LF1V903, build AR10 | | Android / kernel | Android 11 / 4.14.198+ | | SoC / GPU | Realtek RTD1319 / Mali-G31 (Bifrost, kbase r28p0) | | Userspace | 32-bit ARMv7 | | Reported security patch | 2024-03-05 | | Historical result | ADB shell with uid=0; SELinux Permissive |
Only this model/firmware combination has a recorded successful result. Exact SoC identification and Mali driver revision are inconsistent across the original records; see compatibility limits. No fresh rooting test was performed while preparing this source release.
What it does[](https://gitlab.com/c4psu13/mali-pagecache-root#what-it-does)
Exploit chain (auto_root)[](https://gitlab.com/c4psu13/mali-pagecache-root#exploit-chain-auto_root)
The autonomous root binary (`auto_root.c`) achieves uid=0 from an unprivileged app context in under 2 seconds:
1. **Phase 1 — CVE-2022-22706** (Mali GPU page-cache write): Imports a MAP_SHARED mapping of libc.so's `__cxa_atexit` page as a GPU user buffer via `KBASE_IOCTL_MEM_IMPORT`. Uses `mremap(MREMAP_FIXED)` to replace the file mapping. Writes 112-byte Thumb-2 shellcode over `__cxa_atexit` in the page cache (on-disk file unmodified — dm-verity protected).
2. **Phase 3 — Natural trigger**: Every new C++ process calls `__cxa_atexit()` during CRT init, executing the shellcode. A privileged domain (audioserver, rtkm_scene) maps physical page `0x1DE7000` via `/dev/rtkmem` and writes `selinux_state.enforcing = 0`.
3. **Phase 4a — Direct credential modification**: With SELinux Permissive, walks the kernel `task_struct` linked list via physical memory reads through `/dev/rtkmem`. Finds our process by matching `comm[]`, overwrites cred struct with `uid=0` and full capabilities from `init_cred`. Clears `TIF_SECCOMP` to bypass the zygote's BPF seccomp filter.
4. **Phase 4b — System hardening**: Bind-mounts ad-blocking hosts, drops iptables rules blocking telemetry IPs, disables 28 bloatware packages, grants `APP_AUTO_START` for boot persistence, deactivates shellcode, re-enforces SELinux to Enforcing.
Standalone stages[](https://gitlab.com/c4psu13/mali-pagecache-root#standalone-stages)
The two standalone programs (`root_cve22706.c`, `libc_rtkmem_patch2.c`) implement the same CVE-2022-22706 page-cache write primitive as separate tethered-root stages, useful for manual ADB rooting and understanding the exploit primitively.
Scripts[](https://gitlab.com/c4psu13/mali-pagecache-root#scripts)
- **`scripts/root.sh`** — ADB automation: connects to TV, runs both standalone stages, verifies root + SELinux state.
- **`scripts/post_root.sh`** — Post-root hook called by `auto_root` after hardening. Creates full device backups: sideloaded APKs, app data, WiFi config, all settings, package lists. Auto-prunes to 5 most recent backups.
Included[](https://gitlab.com/c4psu13/mali-pagecache-root#included)
- Technical summary: chain, side effects and evidence limits.
- Native source and build notes: autonomous root + two standalone stages; no prebuilt executables.
- Compatibility limits: what must be established before considering another device.
- Recovery notes: model-specific historical USB recovery and warnings.
- Kernel source excerpt: supporting analysis, not a build dependency.
No APK or reproducible APK application project is included; there is no install-once automatic-boot release here. The autonomous root binary is designed to be called from an APK's native code, but the APK wrapper is not part of this release.
Quick start[](https://gitlab.com/c4psu13/mali-pagecache-root#quick-start)
```
Build (requires Android NDK)
cd exploit && make
Push to TV
adb connect <TV_IP>:5555 adb push bin/auto_root /data/local/tmp/ adb push bin/root_cve22706 /data/local/tmp/ adb push bin/libc_rtkmem_patch2 /data/local/tmp/
Option A: Run the autonomous chain (includes hardening + backup)
adb shell /data/local/tmp/auto_root
Option B: Manual two-stage root via script
bash scripts/root.sh <TV_IP> ```
Before considering use[](https://gitlab.com/c4psu13/mali-pagecache-root#before-considering-use)
Use only on hardware you own or are explicitly authorized to assess. Review all C files and every firmware-specific assumption first. Preserve data and obtain a known matching recovery image and procedure independently. Do not expose ADB to an untrusted network. Rebooting removes the volatile patches (page-cache, bind mounts, iptables), but package disables and `APP_AUTO_START` persist.
**Do not flash patched boot or vbmeta images based on this project.** Two historical attempts bootlooped; neither a persistent-root method nor a universal recovery guarantee was established.
License[](https://gitlab.com/c4psu13/mali-pagecache-root#license)
MIT for all original code. The kernel excerpt (`kernel/mem.c`) retains its GPL-2.0 license and copyright notices. See LICENSE and provenance for attribution and upstream references.