Beanpod TEE Pwn

The following is a basic exploit for the keyinstall TA, which maps the secure monitors memory into the TA's address space. Tested on the xiaomi redmi note 11s 5G, V816.0.4.0.TGLEUXM.

This work was presented at CCC 2025 "Not To Be Trusted - A Fiasco in Android TEEs".

Howto

1. Root a Redmi Note 11s 5G with fw version V816.0.4.0.TGLEUXM using magisk
2. upload the keyinstall folder to /data/adb/modules and reboot
3. verifiy the TA has been rolled back: md5sum /vendor/thh/ta/08110000000000000000000000000000.ta -> d10747208958e96a2b1bacd2ccfacc57 /vendor/thh/ta/08110000000000000000000000000000.ta
4. run the poc `ANDROID_NDK=$(path to ndk) DEVICE_ID=$(adb device-id) make opal
5. check the kernel log to see if the exploit worked dmesg | grep TZ_LOG