Root618 · CVE-2026-98260 (PMX110 / PYB110)

Root618 is a one-click LKM (Loadable Kernel Module) jailbreak tool for the OPPO Find X10 Pro Max (PMX110) and OnePlus 16 (PYB110). The Android side is native Java (no Gradle: direct compilation with aapt2 + javac + R8), while the kernel side achieves privilege escalation through the UAF of CVE-2026-98260 and forged cred page placement, then loads the KernelSU-family LKM matching the selected manager and completes "coronation" (the manager and the kernel mutually claim each other).

App name: Root618
Package name: com.azir.pmx110jb
Current stable version: 1.5.12 (versionCode 10512, R8 obfuscated release build)
Supported variants (manager + matching LKM): official (official KernelSU), finasu (FinaSU), sukisu (SukiSU Ultra), next (KernelSU Next)

Directory Structure

app/
  AndroidManifest.xml        清单（package com.azir.pmx110jb，label Root618）
  VERSION                    版本号（构建脚本读取）
  src/com/azir/pmx110jb/     Android 端 Java 源码
    Main.java                主界面 + 全链编排（PMX 单链 / PYB 快速链 / 修复 / 计时自检）
    Shell.java               Stellar / Shizuku 授权通道（shell uid=2000）
    Safer.java  Diag.java    安全组件停用与诊断导出
    Payloads.java            assets/p/*.bin 的 AES 解密与落盘
    JB16App.java BootReceiver.java
  res/                       布局、图标（PMX110）、字符串
  assets/mgr/                四档管理器的配套 LKM 与 ksud（official/finasu/sukisu/next）
  payload-src/               内核侧与脚本侧载荷源码（C / sh），由 tools/pack-payloads.ps1 打包
tools/pack-payloads.ps1      载荷 AES-128-CBC 打包（输出 assets/p/*.bin）
build-m3.ps1                 常规构建（aapt2 + javac + d8 + apksigner）
build-release.ps1            混淆发行构建（同上 + R8 shrink/obfuscate + mapping）
release/                     已签名发行 APK 与 R8 mapping
docs/                        设计与运维修记

Build

Dependencies (Windows, PowerShell 5.1):

JDK 17, Android SDK build-tools (aapt2, zipalign, apksigner)
R8 (the lib/d8.jar bundled with build-tools contains com.android.tools.r8.R8)
AndroidX / Material AARs placed in m3libs/ (consumer-proguard is not loaded automatically outside AGP; the build script already keeps them manually)

# 1) 打包载荷（需要 app/payload-src 下的二进制与源码）
powershell -ExecutionPolicy Bypass -File tools\pack-payloads.ps1

# 2) 常规构建（产出 dist\op16root-m3.apk）
powershell -ExecutionPolicy Bypass -File build-m3.ps1

# 3) 混淆发行构建（产出 dist\JB16-<version>-release.apk + mapping）
powershell -ExecutionPolicy Bypass -File build-release.ps1 -VersionCode 10512 -VersionName 1.5.12

Obfuscation strategy (release.pro inside build-release.ps1): only rename com.azir.pmx110jb.** (own code), keep all third-party code (androidx / material / roro.stellar.**, etc.) with -keep, to avoid missing consumer-proguard outside of AGP causing reflection classes to be stripped; Main / JB16App / BootReceiver retain their class names (referenced by the manifest), while members are still obfuscated; output the ProGuard mapping for crash stack restoration, and the SourceFile attribute has been stripped.

How it works (brief)

Authorization channel: Execute commands as shell(uid=2000) via Stellar (or Shizuku); the app itself does not request root.
Privilege escalation (kp_timer): pmx_fake triggers the UAF of CVE-2026-98260, writes a forged cred page into the freed page, and tgkill races to SIGKILL the victim within the exec window; on success, the child process runs as uid=0.
Deploy module: The child process fills in the addresses of the UNDEF slots of the selected tier's LKM according to the local symbol table (prep_patch), then loads it with finit_module; ksud subsequently installs /system/bin/su.
Coronation: ksud dynamic set-apk writes the signature digest of the manager APK into the kernel configuration, so that the manager and the kernel recognize each other.
Cleanup: When the su channel is available, restore SELinux to Enforcing and clean up temporary payloads.

PMX110 uses "single chain + up to 5 retries", PYB110 uses "fast chain (fastChain())", and both share the same payload and coronation logic.

Disclaimer

This project is intended solely for compatibility research on your own devices and maintenance of your own devices. Flashing and kernel module loading carry irreversible risks (bricking, data loss, voided warranty, triggering of vendor security components). Please assess and back up before use; all consequences are borne by the user. The bundled assets/mgr/* are public build artifacts of the respective upstream projects (KernelSU / FinaSU / SukiSU Ultra / KernelSU Next), and copyright belongs to their respective authors, under their respective licenses.

License

The code of this project is released under MIT, see LICENSE. For third-party components, see NOTICE.md.

Most Popular

CVE-2026-98260-PMX110-Root618-Jailbreak