Knockin' On MediaTek ADSP's Door

This course presents a reverse-engineering study of MediaTek’s audio DSP firmware and proprietary Android interface. It examines the custom Tensilica architecture and vulnerabilities that may enable privilege escalation, eavesdropping, or concealed malicious code.

Syllabus

Introduction
Research Goal
Research Methodology
Test PC Code
EP Message
Memory
Kernel Lock
Android to Audio DSP
Create Audio EP Message
Research
Audio DSP Image
RAM Partition
Tensilic Extensions
Disassembly
Object Dump
Audio Tasks
Android Kernel Lock
Task Audio Demon
Open Audio Buffer
What we have
Parameters
Program File
Summary
Questions