Getting root on OnePlus 15 from an untrusted app

发生了什么
Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.
摘要按规则整理自下方来源原文

Chaining an AtlasService binder command injection and an olc2 HAL binder method into uid 0 with all Linux capabilities from a plain installable app on OxygenOS 16.
摘要按规则整理自下方来源原文