Happy to share the public release of a PoC for Carbonara, a 2023 MediaTek DA1 exploit that has been used by multiple tools over the past few years but never before had a public release / information / reference.

The PoC is called penumbra, and it was fully developed from scratch by shomy! Make sure to check it out: https://github.com/shomykohai/penumbra! It also includes a great documentation.

She reverse engineered a paid GSM tool and, with a bit of help from me to understand the exploit mechanics, produced both the PoC and clear documentation explaining how the exploit works.

As a bonus, here's an MTKClient pull request that adds support for Carbonara, making the exploit available to other SoCs that aren't currently supported by penumbra.

Once again, huge thanks to shomy for the original research and implementation!