Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2025-21479-FX5P — Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable) | Kitploit
Tools/GitHubGitHub/diyiqiuye/cve-2025-21479-fx5p
Android SecurityPrivilege EscalationExploitationMobile App PentestingReverse EngineeringPost-ExploitationMobile SecurityPayload DevelopmentBinary Exploitation
GitHubdiyiqiuye/cve-2025-21479-fx5p

CVE-2025-21479-FX5P

Temporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable)

6h 50m agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
View Repository

CVE-2025-21479 · OPPO Find X5 Pro (PFEM00) temporary root

RAM-only temp root for OPPO Find X5 Pro PFEM00 (kernel 5.10.198-android12-9, ColorOS, locked bootloader) via CVE-2025-21479 (Adreno KGSL) → KernelSU v3.3.0 LKM late-load. 中文：README_zh.md

Chain: KGSL physical R/W → disarm OEM guard, SELinux permissive, kptr_restrict=0 → capset patch grants full caps → ksud late-load (official KernelSU LKM android12-5.10) → KernelSU manager me.weishu.kernelsu. Everything is gone after reboot; nothing is flashed.

Own device, security research only. The exploit writes kernel memory: a bad run reboots the device.

Usage

Get the bundle from Releases (exploit_guard, su0, ksud, oneclick_root.sh), put it in one folder, run with adb on the PC:

root@kitploit:~
bash oneclick_root.sh          # run chain + verification
bash oneclick_root.sh shell    # then drop into a uid=0 shell

Build

root@kitploit:~
bash build.sh    # Android NDK r28c (or set ANDROID_NDK_HOME), aarch64, API 31

Every push builds on GitHub Actions and uploads a bundle artifact; v* tags publish to Releases.

Layout

root@kitploit:~
src/cheese.c             exploit (single TU: KGSL primitive, guard patch, SELinux/kptr, capset patch)
src/adrenaline.h         KGSL ioctl interface (Project Zero Adrenaline)
src/kallsyms_lookup.c    kallsyms helpers
src/su0.c                uid=0 helper
scripts/oneclick_root.sh PC-side one-click chain
build.sh                 local build

License

GPL-3.0 — see LICENSE. © 2026 diyiqiuye. Derived from public CVE-2025-21479 research code; respective upstream notices apply.

Download Tool