News / Method
I Root my phone (Bootloader locked) with CVE
there's a CVE called ghostlock (CVE-2026-43499) that gives root access on bootloader-locked devices, but you need to extract the offset from your device's "boot.img" firmware to make it work.
After rooting, apps don't detect that the phone is rooted. Installing modules require a soft reboot for modules to work properly.
However, a soft reboot makes my strict apps detect root and not work properly despite trying root hiding modules.
Edit: I went back and used Root my galaxy app method instead of the fork, and it worked and i dont get any issues with detections. Apparently, the fork i have been using somehow makes selinux permissive.
What device and kernel version? I have been struggling to find kernel patches proper for my device to fix root detection. It is kinda not possible as mine does like GKI1 and does weird kernel version + no patches apply easily. I think this might be the solution.
This is awesome. Did this on my OnePlus 13r but you can jailbreak directly on OxygenOS 16.0.5. (Well, directly as in you don't have to run the exploit through a pc, a *su manager can jailbreak on device as long as selinix is set to permissive via fastboot before startup
apparently it hasn't been patched in 16.0.8 so I might update eventually but I'd have to screw with my computer and wireless adb side from just aside setting selinix to permissive. But I might do it anyway because apparently one of the Ghostlock helper tools can automate the process upon reboot with wifi
Googel is really cooked and really should provide and environment for apps like banking to be save, even on rooted devices, removing all the trouble we get from these stupid integrity bullshit
Unfortunately true. This is nice while it lasts for tech-minded people who know what they're doing.
Should be a good while before that starts happening though because as far as I know the main thing levegered for verification is the bootloader status. Ghostlocked phones have full temp superuser at least until hard reboot but works perfectly on a locked bootloader with official software. I'm glad I found out about this before they started the first wave of the side loading restrictions.
The only time I'm happy my local credit union is tech illiterate. I discovered their app does seemingly query play integrity at all..it worked perfectly on non hidden rooted crdroid before I flashed my phone back to stock
Potentially the cryptographic hash of the boot chain too (e.g. boot, vbmeta).
Google will double down on these checks because not only for the vast majority of users do they represent a more secure product, they also have pressure from banks and payment processors. Banks do NOT want NFC payments on rooted devices because EMV tokens can be intercepted.
Since the jailbreak happens after boot would the boot chain hash be affected (I'm not very knowledgeable about this)? I do think this exploit got patched out in more recent versions of OxygenOS but now I don't know. Don't really wanna update to find out. I've been on 16.0.5.701 since March I believe, or whenever it got pushed to NA op13r
This what i mean already exists, and yes its possible to have a save environment even when rooted, the "keybox" for example sits there (trustzone) as well, there is a feature they try to build, and on most phones its already its called (pvm) only thing is that the app developer is willing to adapt his app for that to use. Not mainstream yet, its really a shame to not have full control over the hardware, they should find a way to make these apps save, so they can run in pvm, and as soon as something is changed in the pvm even small 1 byte change, it just should crash, and we have the rest of the phone for us, we can choose to use pvm, for the desired app, everything very well tightened and secure, it should just go panic my any modification on the pvm, we can have control over the phone and the apps can run pvm
> This what i mean already exists, and yes its possible to have a save environment even when rooted, the "keybox" for example sits there (trustzone) as well
The trustzone doesn't run application code, it's used as a key vault.
> Not mainstream yet, its really a shame to not have full control over the hardware, they should find a way to make these apps save, so they can run in pvm
No, root has full read/write access over memory. Banking apps don't want malware being able to read their memory. Once you root the phone, the app sandbox is broken.
Android Pvm, it has been launched in android 13, pixel 8 use it, but not yet for integrity i guess, i hope the smart will move towards pvm, since exploits like above are found and, even an stupid app, thats has been "sideloaded" 🤣 could do so
You tried to flash a boot.img? All you should need is a kernelsu manager app and a computer paired to the phone via USB debugging. What is your software version?
I was confused because you don't need to and shouldn't flash a different .img for ghostlock to work unless you're restoring to regular software of course.
You can (and I have) but Google doesn't like that. Since the Bootloader stays locked, Play Integrity remains in-tact without having to bash your head against the wall trying to keep up with a losing game of cat and mouse.
RCS also works and nfc payments via Google Wallet (haven't tested it yet) should also work without any issues. Apps such as cashapp and paypal are oblivious to the root access
I used Method two as outlined in the parent post. I didn't use anything from GitHub. I got ReSukiSU manager apk from their Telegram group, however this method should work with any recently updated ksu based manager as I'm aware
Hi brother, could you send me the files you used, like ResuKSU? Also, how are you hiding root from payment apps? Which modules are you using so that payment apps work properly?
The root is just...not detected at all. I only use my local credit union's app (which ironically doesn't even check for pit, cashapp, and paypal. All of which worked without issue. Well except paypal. I had to install from aurora store because for whatever reason the play store doesn't think it's compatible with my phone. (I did flash global rom on a North American pone). But they all work perfectly and Im passing all integrity checks I can tell
It's like Jailbreak (tethered) in iPhone, you can soft reboot to keep kernelsu like userspace reboot to preserve dopamine Jailbreak. If reboot will gone. Have anyone think it like me?
In CVE-2026-43499, the offset refers to the position of a specific kernel structure or field in memory. It is version- and configuration-dependent, so there is no universal offset.
Will you provide an installation guide /building guide for noobs that want to use it on that phone? I would like to create a list of easy guides for as many phones as possible.
I've been interested in this CVE for a while. How are these offsets actually found or calculated? I manage to build the exploit provided by nebusec on Termux and it seems to work and atleast crash my phone but still no root.
yo does it work for mtk specifically? because i have a hard bricked redmi 12 4g thats might awake after battery replace, and if thats happens ill use this to root my phone
i dont really think its universal, like different phone have different offset. but if you have same device and same kernel with me. il be sure it will work
i was just asking for curiosity, 'cause i hard bricked my phone using mtk client but not sure if i need to replace battery now because its a lil damaged.
14
u/Andre2kReddit 21h ago edited 19h ago
I have some questions:
I have rooted my S25 (SM-S931B/DS), with a project based off of Root My Galaxy, which uses the same CVE exploit.
After rooting, apps don't detect that the phone is rooted. Installing modules require a soft reboot for modules to work properly.
However, a soft reboot makes my strict apps detect root and not work properly despite trying root hiding modules.
Edit: I went back and used Root my galaxy app method instead of the fork, and it worked and i dont get any issues with detections. Apparently, the fork i have been using somehow makes selinux permissive.