https://kiperz.dev/tags/native/ Recent content in Native on kiperZ Hugo -- 0.147.7 en Tue, 14 Jul 2026 00:00:00 +0000 https://kiperz.dev/writeups/3-2-1-0-click-1/ Tue, 14 Jul 2026 00:00:00 +0000 https://kiperz.dev/writeups/3-2-1-0-click-1/ <blockquote> <p>CTF Shutlock 2026 · pwn Android</p></blockquote> <p><code>CSMS</code> is an Android messenger: a central server, and on the victim side (the <code>spylock</code> account) a client app (<code>ctf.shutlock.csms</code>) that <strong>fetches its new messages on its own, every 10 s</strong>, which makes the attack <em>0-click</em>.</p> <p>The challenge hands us plenty to work with: the app&rsquo;s APK, the <strong>C source</strong> of its native layer (<code>csms.c</code>, <code>csms_mem.c</code>) and a live infra (the server and an Android emulator running the victim). Every incoming message flows through Java, pure plumbing, then into a <strong>template engine written in C</strong> (<code>libcsms.so</code>); that is where, inside a homemade allocator, the bug that gives us code execution hides.</p>