Gabriel2392/SVE-2026-3546

What it is

This repository is a research proof-of-concept for unsigned code loading against Samsung's S-LK (Secure Boot) implementation. It re-signs bootloader and PIT files, builds a custom loader, then fuses Secure Boot KEY2 and flashes the re-signed bootloader on the s5e8825 platform. The AUTH demo GIF shows the resulting boot flow Demo.

The README states the vendor's KEY2 slot is fused, so the device ends up trusting the re-signed images. It targets security researchers and reverse engineers working on Samsung boot chains, not general users. The author explicitly limits support to s5e8825.

Quick start

Prerequisites: Python 3, clang, aarch64-linux-gnu binutils, and USB access to the phone requirements. Install the Python dependencies and build the Android resigner:

python3 -m pip install -r requirements.txt
cargo build --release --manifest-path android-resigner/Cargo.toml

The signer has its own usage notes in android-resigner/README.md. Then run the four documented stages in order:

./sign_bl.py BL.tar.md5 device.pit
./resolve.py BL_RESIGNED.tar.md5
./build_loader.sh BL_RESIGNED.tar.md5 device_RESIGNED.pit
./flash_and_fuse.py

The first step produces BL_RESIGNED.tar.md5 and device_RESIGNED.pit signing step; the third outputs loader.bin, loader.elf and loader/bundle.bin loader build; the final script flashes and fuses run step. Treat BL.tar.md5, device.pit and the phone identity as user-supplied values.

Constraints and risks

• Platform support is limited to s5e8825; the offset resolution step only covers that platform, and other platforms are left to the user offset step.
• The final step fuses Secure Boot KEY2, which is a one-way hardware change. Flashing a re-signed bootloader after fusing ties the device to those images; recovery paths are not documented.
• No license is declared in the repository metadata.
• The README carries a disclaimer that the work is for research and the user bears responsibility for device damage disclaimer.
• The repository does not describe supported firmware versions, device models, or a rollback procedure, so verify the target environment before running anything.

HotRepo's take

The project appeared on HotRepo's new-repository board on 2026-11-05 in the Rust language list, with 6 stars and 1 fork gained during a roughly two-hour growth window starting at 20:45 UTC, and 106 stars at the last observation. There is no all-language daily rank record, so the data only supports a short-window fact rather than a trend. For a boot-chain security PoC that permanently fuses keys and has no declared license, that level of attention is worth reading as interest in the technique rather than evidence of safe or reproducible use.