This exploited a flaw in the USB updater system and the way it handles .zip files, allowing me to write any file anywhere as root. Unfortunately, every directory but 2 are mounted as RO and cryptographically signed, and there (seemed to be) nothing executable to overwrite on the 2 that are RW, they mostly just store cache files and user settings.

3

Also the only way to see anything is from the diagnostic logs in dealer mode, which are limited and take ~15 minutes to export to a USB. So I'd have to make 1 change, plug it in, let it run the update process for ~10 minutes, and then export the log which took another 15, and then go connect it to my PC to see if that change worked... painfully slow process lmao

1

You said this is an exploit right? are you going to show this to kia for a bounty?

1

I'm learning how to exploit rn, this is really cool

1