Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2019-2215-markw — Exploit for CVE-2019-2215 to gain temporary root on Xiaomi MIUI devices, enabling bootloader unlock and system modifications. | Kitploit
Tools/GitHubGitHub/begitdj/cve-2019-2215-markw
Android SecurityPrivilege EscalationExploit FrameworksExploitationMobile SecurityPayload DevelopmentBinary Exploitation
GitHubbegitdj/cve-2019-2215-markw

cve-2019-2215-markw

Exploit for CVE-2019-2215 to gain temporary root on Xiaomi MIUI devices, enabling bootloader unlock and system modifications.

View Repository
15 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Bad Binder for markw

[!CAUTION] Everything you do is at your own risk. I am not responsible for your broken device.

Adapted with Deepseek V4 Flash

Made for the latest Global MIUI 10.

Overview

Main goal: Get temp root on latest official miui

Root can be used for flashing custom aboot(which is what I did) for unlocking without mi account and other tasks like debloating.

Using

  1. Compile bhsu98.c using NDK cross compiler for arm64 or use prebuild binary from repository
  2. Run it using cve-2215-root.sh

Please note: The exploit is probabilistic. It doesn't guarantee rooting on the first try, and it might take up to 10 attempts to succeed. Don't open issues if the exploit isn't working immediately — just reboot and try again.

Unofficial Unlock

You can unlock device using method from this thread

  1. Download _Patch_Locked_Bl.zip from thread or repository
  2. Unpack it
  3. Find emmc_appsboot.mbn (it's custom aboot) from subfolders
  4. Place it to device using adb push
  5. From root shell run
root@kitploit:~
dd if=/path/where/you/pushed/aboot of=/dev/block/bootdevice/by-name/aboot bs=4096
  1. Again but for abootbak
root@kitploit:~
dd if=/path/where/you/pushed/aboot of=/dev/block/bootdevice/by-name/abootbak bs=4096
  1. Sync it using sync command from root
  2. Reboot to fastboot and run "fastboot oem unlock-go"

P.S: I recommend to check checksum of file but it's optional

Download Tool