GhostKey — CVE-2026-98260 One-Click Privilege Escalation Tool

GhostKey 是一款面向 已授权安全研究 / 自用设备 的 Android 一键提权（privilege escalation）工具。它基于 Shizuku + NDK Native 实现，把提权所需的 Native exploit、内核偏移表与 OTA boot 镜像解析能力打包进一个独立 APK，用户在手机上点击即可触发，无需 PC、无需命令行。

⚠️ Security and Legal Responsibility This repository is intended solely for security research in authorized environments and legitimate testing on devices you own. Without explicit authorization from the device owner, performing privilege escalation, obtaining root, or bypassing system restrictions on someone else's device may violate local laws and regulations as well as platform terms of service. By using this tool, you acknowledge that you understand and personally assume all legal risks arising from its use. The author is not responsible for any misuse. Files compiled from this repository have a chance of rebooting during the injection phase.

Features

One-Click ROOT: Complete the privilege escalation process with a single tap on your phone—no computer connection or adb commands required.
Shizuku Integration: Obtain an adb shell context through Shizuku as the entry point for privilege escalation.
Pure APK + NDK Native: The exploit's C source code is compiled into libcve98260.so along with the APK via NDK/CMake.
Built-in Kernel Offset Table: Multiple kernel profiles are distributed with the APK and matched precisely by uname -r; when no match is found, users are guided to import the corresponding boot.img for automatic parsing.
OTA boot Image Parsing: Built-in BootImageParser / ImgToProfile / KallsymsExtractor support deriving kernel symbols and offsets from boot images.
KernelSU Integration: KsuResolver / KsudStage handle integration with KernelSU.
Tiered Run Logs: Each privilege escalation run is grouped and displayed by runId; failure diagnostics (FailureDiagnoser) provide targeted guidance for exit codes (e.g., KASLR resolution failure exit=2).
Terminal Panel: Real-time echo of exploit execution logs and stage status.

Tech Stack and Build Environment

Item	Version
`compileSdk` / `targetSdk`	35
`minSdk`	31
Kotlin	1.9+ (JVM target 17)
NDK / CMake	CMake 3.22.1, `ANDROID_STL=none`
Shizuku	13.1.5
Jetpack Compose	BOM 2024.10.00 (Material3)
Target ABI	`arm64-v8a` (64-bit only)
Artifact naming	`GhostKey-<version>-arm64-v8a-release.apk`

Current version: 1.1.4 (versionCode 17, package name com.GhostKey.app).

Build

本仓库采用 release 构建（开启 minify + shrinkResources，产物约 5.8 MB）。请勿使用 assembleDebug——旧 debug 密钥与 release 不同，覆盖安装需先卸载。

1. Prepare Signing Password

The signing key is located at app/keystore/release.keystore (ignored by .gitignore, will not enter the repository). The password is injected via one of the following two methods; do not write it back into the source code:

Method A: Append to local.properties (recommended; this file is already ignored)
```
CVE98260_STORE_PASSWORD=你的密码
CVE98260_KEY_PASSWORD=你的密码
```

Method B: Environment variables

export CVE98260_STORE_PASSWORD=你的密码
export CVE98260_KEY_PASSWORD=你的密码

2. Build the release APK

./gradlew assembleRelease

Output path: app/build/outputs/apk/release/GhostKey-1.1.5-arm64-v8a-release.apk

Directory structure (core modules)

app/src/main/
├── kotlin/com/GhostKey/app/
│   ├── Cve98260Application.kt        # Application 入口
│   ├── data/                       # 内核 profile 加载/解析/存储
│   │   ├── Profile.kt              # 内核 profile 数据模型
│   │   ├── BuiltinProfileCatalog.kt# 内置偏移表
│   │   ├── ProfileRepository.kt    # 精确 release 匹配（无回退）
│   │   ├── AssetConfigLoader.kt    # assets 配置加载
│   │   ├── LegacyProfileConverter.kt
│   │   ├── ProfileImportManager.kt # 用户导入 boot.img
│   │   ├── RunLogStore.kt         # 运行日志分档存储
│   │   ├── UserProfileStore.kt
│   │   └── ota/                   # BootImageParser / ImgToProfile / KallsymsExtractor
│   ├── device/                    # DeviceBinding / KernelProbe / PrivilegeGate
│   ├── engine/                    # ExploitEngine / FailureDiagnoser
│   ├── ksu/                       # KsuResolver / KsudStage
│   ├── model/                     # KernelProfile / ShizukuStatus / StageTracker ...
│   ├── native/                    # KernelProfileSerializer / NativeContract
│   ├── shizuku/                   # Cve98260UserService / ShizukuPermissionManager
│   ├── ui/                        # Compose 界面（MainScreen / LogViewerScreen / SettingsScreen）
│   └── viewmodel/                 # ExploitViewModel
├── aidl/com/GhostKey/app/shizuku/ # Shizuku 跨进程接口
├── cpp/                           # Native exploit（CMake 构建为 libcve98260.so）
└── assets/ksu/                    # ksud 二进制

Usage Flow (Overview)

Install and activate Shizuku on the device, and grant authorization to this app.
Install the KernelSU manager (used to receive privilege escalation results).
Open GhostKey; the app will detect the kernel version and match it against the built-in offset table. If there is no match, export boot.img from the device and import it for automatic parsing.
Tap privilege escalation to view terminal logs and stage status in real time; if it fails, troubleshoot based on the targeted diagnostics from FailureDiagnoser (calibration A/B, profile matching, tracefs sampling, etc.).
Privilege escalation grants temporary root, which becomes invalid after the device reboots.

Supported Devices

The built-in kernel profiles cover multiple 5.15 / 6.1 / 6.6 / 6.12 / 6.18 series kernels. Example verified models:

OPPO Find X8 Ultra (PKJ110) — kernel 6.6.118-android15-...

For specific kernel profiles, refer to app/src/main/kotlin/com/GhostKey/app/data/BuiltinProfileCatalog.kt and the respective *.profile resources.

Version Convention

Artifacts are uniformly named GhostKey-<ver>-release.apk and then delivered to dist/ (this directory is ignored by .gitignore and is not committed to the repository).

License

For authorized security research and testing on your own devices only. Any use beyond the authorized scope is not covered by the license.

Most Popular

CVE-2026-98260-GhostKey