MediaTek DA2 exploit: heapb8

After weeks of reverse engineering and countless hours of debugging, shomy and I finally cracked the DA2 V6 exploit everyone's been talking about!

We decided to call it heapb8 ("heapbait"), because Chimera baited us into chasing the wrong vulnerability for way too long.

Full writeup with all the technical details: https://blog.r0rt1z2.com/posts/exploiting-mediatek-datwo/

Code is live in penumbra. Have fun!