2022 - Hara-Kirin: Dissecting Huawei Mobile Devices by Maxime Peterlin & Alexandre Adamski
Security researchers examine technical aspects of 2022 - Hara-Kirin: Dissecting Huawei Mobile Devices by Maxime Peterlin & Alexandre Adamski.
Summary
Why Huawei devices matter
Maxime Peterlin and Alexandre Adamski of Impalabs walk through privileged components on Huawei mobile devices, motivated by the vendor's large market share and limited public research on high-end Kirin platforms. They cover boot chain, a security hypervisor, and TrustZone implementation.
Boot chain exploitation
Starting with a P30 Lite (Kirin 710), they recovered an signed but unencrypted X-loader from firmware updates. An X-modem USB recovery flaw allowed unverified payload addresses, yielding arbitrary write and code execution because boot-CPU memory was RWX. Emergency download mode via a test-point short enabled the attack path.
Hypervisor enforcement
Huawei's hypervisor keeps a read-only copy of task credentials to detect privilege escalation on syscalls or file access, restricts executable pages to kernel and module code at EL1, and hides critical peripheral memory from EL0/EL1. It enforces policy through a second stage of address translation beyond the kernel's virtual-to-intermediate mapping.
Related talks
Black Hat·48 min
Presenters detail vulnerability discovery and exploitation in Mobile Device Mismanagement.
IEEE Symposium on Security and Privacy·23 min
Security researchers examine technical aspects of SmarPer: Context-Aware and Automatic Runtime-Permissions for Mobile Devices.
Black Hat·39 min
Industry experts analyze emerging threats surrounding Fingerprints On Mobile Devices: Abusing And Leaking.