qualcomm-gbl-exploit-checker

Check if your ABL image is vulnerable to the Qualcomm GBL bug

How does it work:

1. The script scans the input file for UEFI structures using the uefi-firmware package
2. When it finds them, it looks up certain error strings that exist only on patched images:

// patched: fastboot oem set-gpu-preemption
if ((AsciiStrLen(arg) != 1) || (arg[0] != '0' && arg[0] != '1')) {
	FastbootFail("Set GPU HW Preemption: Invalid Argument, Value must be 1 or 0");
	return;
}

// patched: fastboot oem set-hw-fence-value
if ((AsciiStrLen(arg) != 1) || (arg[0] != '0' && arg[0] != '1')) {
    AsciiStrnCatS (Resp, sizeof (Resp), "invalid input (must be 0 or 1)",
                  AsciiStrLen ("invalid input (must be 0 or 1)"));
    FastbootFail (Resp);
    return;
}

• If these strings exist in the input image, the script assumes the ABL is 100% patched.
• If these strings don't exist in the input image or they were modified/stripped by the OEM, additional opcode analysis is done to check if the underlying validation logic exists

How to use:

1. Install python requirements

pip install -r requirements.txt

2. Prepare your firmware images from the internet
3. Run check.py against the image

╭─user@hostname
╰─$ python check.py abl_xiaomi_17_vulnerable.elf     
(x) Patch string not found for [set-gpu-preemption], doing opcode analysis
(x) No patch logic found for [set-gpu-preemption], ABL is vulnerable
(x) Patch string not found for [set-hw-fence-value], doing opcode analysis
(x) No patch logic found for [set-hw-fence-value], ABL is vulnerable
(x) 
(x) STATUS: VULNERABLE

╭─user@hostname
╰─$ python check.py abl_xiaomi_17_patched.elf   
(x) Found patch string for [set-gpu-preemption], ABL is patched
(x) Found patch string for [set-hw-fence-value], ABL is patched
(x) 
(x) STATUS: PATCHED

Usage

usage: check.py [-h] [-q] file

Check ABL images for the GBL bug

positional arguments:
  file         ABL image to check

options:
  -h, --help   show this help message and exit
  -q, --quiet  Suppress output, and report status through exit codes

• When --quiet is used, will exit with 0 if vulnerable and 1 if patched

Projects related to this vulnerability:

• Temporary KernelSU root
• Temporary Magisk root

Commits that have patched this:

• Febuary 2026 - QcomModulePkg: Fix propagation of untrusted input into kernel cmdline
• January 2026 - QcomModulePkg: add check for set-hw-fence-value command

Requirements

• Python 3.8 or newer
• Installed uefi_firmware pip package