NebuSec/CyberMeowfia

> Thanks for the reply!
>
> I just tried Live PWN multiple times. Every time, after clicking "OK" twice, a few logs appear, and then the phone quickly reboots.
>
> In previous versions, the reboots seemed to happen only occasionally, but in the current release, it happens almost every single time.
>
> Looking forward to your next update!

Same here: Please see .

try [VIVO-OTA-Tracker](https://github.com/mytiantian001/VIVO-OTA-Tracker)

Have you got any lead

> Did you try?

yes，i tried but there a deviation in vivo iqoo so i blocked. we need to analyze corresponding firmware files

Did you try?

Thanks for the reply!

I just tried Live PWN multiple times. Every time, after clicking "OK" twice, a few logs appear, and then the phone quickly reboots.

In previous versions, the reboots seemed to happen only occasionally, but in the current release, it happens almost every single time.

Looking forward to your next update!

Hi, we’re trying to address this issue with the following commit: https://github.com/NebuSec/CyberMeowfia/commit/1a10c4e500238c2bc0a46833c4caf728740f3aee

It has now been deployed. Please try again, and if you still don’t see any effect, feel free to let us know.

Thanks again for your feedback!

> +1 I wonder where the offsets is taken from

If you have KASLR bypass, this will be very useful :) also, you can extract vmlinux, use pahole, but for debug might need ghidra

> > I have been very curious about this exploit, and I want to experience this on my secondary phone (Motorola tab 60 neo), but it always ends up in rebooting.
> > It would be great if you add a guide or a tool to add new device support.
> > Thank you.
>
> can you submit logs? specifically: `/proc/last_kmsg` or `/sys/fs/pstore/console-ramoops*` and the kernel version of your device, `config.gz` (from `/proc`) or upload your kernel/boot.img

My tab is neither rooted nor bl unlocked, I just extracted boot.img from the firmware.

Target: Moto Pad 60 Neo (XT2575-3)
Build: XT2575-3_ROW_OPEN_USER_M1317.3_W_ZUI_17.5.10.109_ST_260605
SoC: MT8755 (Dimensity 6300)
Kernel: 5.15
Patch: 2026-06-05

Here I uploaded boot image : https://pixeldrain.com/u/xCAAJLrG
Let me know if there is anything I can do.

> In fact, your request actually pushed us to order a Pixel 9, so once it arrives, we’ll be able to release the exploit you’re looking for. 😉

Can you please provide an example of the exploit for android linux 5.x, maybe even 4.x if possible?

> I have been very curious about this exploit, and I want to experience this on my secondary phone (Motorola tab 60 neo), but it always ends up in rebooting.
> It would be great if you add a guide or a tool to add new device support.
> Thank you.

can you submit logs? specifically:
`/proc/last_kmsg` or `/sys/fs/pstore/console-ramoops*`
and the kernel version of your device, `config.gz` (from `/proc`)
or upload your kernel/boot.img

> +1 I wonder where the offsets is taken from

As far I know, It will need either a rooted device, to extract offsets or Decompiling the boot image in Ghidra or something.

+1
I wonder where the offsets is taken from

> Hi, and yes. we’re working on it. We’re planning to release support for the entire Pixel 10 series soon, as we already have all the exploits ready. We’re also actively working on the Pixel 9 series right now.
>
> In fact, your request actually pushed us to order a Pixel 9, so once it arrives, we’ll be able to release the exploit you’re looking for. 😉

Awesome, thank you!!! :)

Hi, and yes. we’re working on it. We’re planning to release support for the entire Pixel 10 series soon, as we already have all the exploits ready. We’re also actively working on the Pixel 9 series right now.

In fact, your request actually pushed us to order a Pixel 9, so once it arrives, we’ll be able to release the exploit you’re looking for. 😉