gpu-aeg — agentic team for n-day GPU/kernel LPE exploit development

Authorized security research only. This is a scaffolded multi-agent system that automates n-day (known CVE + patch) Local-Privilege-Escalation exploit development for Android GPU/kernel drivers, starting with ARM Mali CSF on Pixel. It is for the project that already rooted a Pixel 8 Pro via Mali CVE-2025-6349, as a methodology/automation tool.

It maps a 13-component exploit-dev lifecycle (docs/lifecycle-decomposition.md, the contract) onto a team of expert agents, and drives them with a durable harness that walks the lifecycle decision graph and the device-in-the-loop campaign. The n-day premise is the enabler: a detailed CVE/patch lifts LLM exploitation success ~7%→87% (Fang et al.) — the patch is the description.

Architecture (hybrid)

The working exploit already is a hybrid (in-process inner loop + durable host campaign loop + stats); this formalizes it.

 ┌────────  Claude Agent SDK harness  (aeg/, durable Python; loads ../.claude config) ─────────┐
 │ ORCHESTRATOR (deterministic): walks §4 graph · CHAIN_FAIL cap=3 · host reboot loop          │
 │   ├─ PLANNER (LLM)  = android-kernel-gpu-exploit-dev    ├─ device-campaign-runner (module)  │
 │   ├─ VERIFIER (LLM) = exploit-progress-verifier         ├─ trace-parse (module)             │
 │   │    (scoped to the WEAK oracles: C10 KCFI, C03)      └─ T-ORACLE (byte-exact, never LLM) │
 │   └─ EXPERT SUBAGENTS — one per component (C01–C13) + patch-diff-analyst + ida-re-analyst    │
 └─────────────────────────────────────────────────────────────────────────────────────────────┘
              ▲ reads/writes │ runs/<cve>/campaign/  (blackboard: records + §4 state + evidence)

• Two granularity axes. Authoring = one expert agent per component (max granularity). Runtime advances only at observable oracle boundaries, so the blind segment C04→C05→C06→C07(+C12a) is ONE runtime step = a single on-device binary returning UAF_RC_OK/CHAIN_FAIL (oracle = the Step-6 max_tbl≥1 scan). There is no shell-readable mid-segment signal — inventing intra-segment handoffs would be the "soliloquizing" failure mode, so we don't.
• Anti-soliloquizing. The graph advances only on real evidence: an on-device binary's exit-code / fsync'd result file, or a host-pulled, deterministically-parsed trace. Byte-exact oracles are computed by aeg/oracle.py, never by an LLM.

Repo layout

.claude/
  agents/        17 agents: C01..C13 + patch-diff-analyst + ida-re-analyst + 2 reused (Planner/Verifier)
  skills/        t-patch t-offset t-trace t-run t-struct t-oracle t-recon t-sepol t-dmesg t-memstate
  commands/      aeg-run  aeg-ablate  aeg-status
  settings.json  permissions + device-safety hook + IDA MCP tool allow-list + ToB plugins
  hooks/         device_safety.sh (blocks fastboot flash / raw block writes unless AEG_ALLOW_REFLASH=1)
  agent-memory/  cross-engagement facts (seeded from the prior root: offsets, thrashers, bug facts)
aeg/             graph.py (§4) · oracle.py (T-ORACLE) · blackboard.py · campaign_runner.py
                 agents.py (SDK glue) · orchestrator.py · cli.py
config/targets/  cve-2025-6349.yaml (ground-truth fixture) · cve-2025-0072.yaml (P3)
docs/            lifecycle-decomposition.md  (the contract: components, oracles, §4 graph, §5 consistency)
tests/           test_graph.py · test_oracle.py
runs/            per-campaign blackboard (gitignored)

The existing exploit project (/mnt/ssd/pixel/exploit, factory image, mali_pixel.ko) is referenced read-only via config/targets/*.yaml — never modified or copied.

Install

pip install -e .                     # claude-agent-sdk, anthropic, pyyaml
export ANTHROPIC_API_KEY=...         # used by the harness (model claude-opus-4-8)
cp config/settings.example.yaml config/settings.yaml   # then edit (gitignored)

• IDA Pro MCP (used by ida-re-analyst / patch-diff-analyst) — reuse your existing setup; its tools are allow-listed in .claude/settings.json.
• Device — adb on PATH; a tethered Pixel (or set device.serial). The t-trace characterization path needs a rooted dev device (su); the shipped exploit runs unprivileged.

Usage

# offline sanity (no device, no API) — walks the whole decision graph
python3 -m aeg.cli run --cve CVE-2025-6349 --dry-run

# real run: walk the lifecycle, drive the device campaign
python3 -m aeg.cli run    --cve CVE-2025-6349
python3 -m aeg.cli status --cve CVE-2025-6349
python3 -m aeg.cli ablate --cve CVE-2025-6349 --artifact all

Inside Claude Code (repo as project, or the plugin installed): /aeg-run CVE-2025-6349, /aeg-ablate CVE-2025-6349 offsets, /aeg-status CVE-2025-6349.

Manual verification (you run these — not part of building the team)

The team is built; device-in-the-loop verification is yours to run:

1. MVP = ablate & regenerate CVE-2025-6349. aeg ablate blanks a human-derived artifact (offsets / race window / grooming params / recon / class) and has the responsible agent regenerate it, scored by its oracle and against the DEV_LOG ground truth. This tests the agents, not just the harness.
2. Campaign. aeg run walks the graph and runs an N≥20-trial reboot campaign; success = real getuid()==0 / u:r:kernel:s0 (≈80%/invocation parity to the prior root).
3. Cost is reboot-dominated (~60–90s/trial; a 20-trial oracle ≈ 30–45 min). Set budgets in config/settings.yaml.

Run the offline unit tests anytime:

python3 tests/test_graph.py && python3 tests/test_oracle.py     # or: pytest -q

Agent roster (17)

Component agents			Roles
C01 recon-fingerprint	C06 primitive-normalizer	C11 dataonly-endgame	Planner: android-kernel-gpu-exploit-dev
C02 context-groomer	C07 primitive-amplifier	C12 reliability-racewin	Verifier: exploit-progress-verifier
C03 vulnclass-taxonomist	C08 infoleak-kaslr	C13 verify-postexploit	Front-end: patch-diff-analyst
C04 bug-trigger-author	C09 arbrw-engineer		RE: ida-re-analyst
C05 heap-groomer	C10 mitigation-selector

Each component agent owns its spec in docs/lifecycle-decomposition.md, treats that component's machine-checkable oracle as its definition of done, and never reports an oracle result it didn't measure.

Device safety

Layered: in-exploit CHAIN_FAIL cap=3 → t-run consecutive-boot watchdog → factory fastboot reflash blocked by .claude/hooks/device_safety.sh unless a human sets AEG_ALLOW_REFLASH=1. The hook also blocks raw block-device writes / mkfs. System partitions are never written.

Research basis

Hierarchy beats single-agent and backtracking belongs in code (HPTSA); a dedicated Verification loop (PwnGPT, CVE-Genie); kernel n-day repro is hard, ~50% on KernelCTF (K-Repro); patch/CWE+location input is decisive (Fang, AXE); force real tool interaction to avoid hallucinated observations (EnIGMA); persistent task-graph memory (PentestGPT). The AEG scaffolding (identify→runtime-info→generate→verify; control-flow vs data-oriented) follows the arXiv:2502.04953 survey.

Status & roadmap

Built: the full team + workflow (this repo). Verification is manual (above).

Phase	Goal	Metric
P1 (MVP)	spine + CVE-2025-6349 regression (ablation)	≈80%/invocation + ≥1 artifact regenerated to oracle-PASS
P2	full roster; ablate all C01–C09	≥60% of C01–C09 regenerated to oracle-PASS
P3	generalize C01–C04 to CVE-2025-0072	≥50% trigger reproduction
P4	full chain to root on the second n-day	≥1 verified root run

Install as a plugin

Components live under .claude/ (project layout) so the repo works directly and via the Agent SDK. .claude-plugin/plugin.json provides plugin identity; for a marketplace-style install where components are expected at the plugin root, symlink/move agents skills commands to root (trivial) — the canonical home stays .claude/.