Home / Series / Chaos Communication Congress / Aired Order / Season 39 / Episode 37

Not To Be Trusted - A Fiasco in Android TEEs

Trusted Execution Environments (TEEs) based on ARM TrustZone form the backbone of modern Android devices' security architecture. The word "Trusted" in this context means that **you**, as in "the owner of the device", don't get to execute code in this execution environment. Even when you unlock the bootloader and Magisk-root your device, only vendor-signed code will be accepted by the TEE. This unfortunate setup limits third-party security research to the observation of input/output behavior and static manual reverse engineering of TEE components. In this talk, we take you with us on our journey to regain power over the highest privilege level on Xiaomi devices. Specifically, we are targeting the Xiaomi Redmi 11s and will walk through the steps necessary to escalate our privileges from a rooted user space (N-EL0) to the highest privilege level in the Secure World (S-EL3).

English
  • Originally Aired December 27, 2025
  • Runtime 60 minutes
  • Production Code 2119
  • Created December 22, 2025 by
    r4m3u5
  • Modified December 27, 2025 by
    r4m3u5