Root My Galaxy SM-S9180 (dm3q) S9180ZHS8FZG1 — Payload Port

Port of the CVE-2026-43499 payload (UAF → KernelSU LKM temporary root) for Samsung Galaxy S23 Ultra SM-S9180 (dm3q) running One UI 8 / S9180ZHS8FZG1.

• Kernel: 5.15.189-android13-8-33413713-abS9180ZHS8FZG1 (2026-07-05 security patch)
• Root method: CVE-2026-43499 UAF exploit + KernelSU LKM (temporary root, lost on reboot)
• Status: working — su -c id → uid=0(root) context=u:r:ksu:s0, ksud 3.2.5

Files

Key finding

Only 3 data symbols changed between FZF5 and FZG1 (all shifted +0x5c0):

All other symbols (ashmem family, init_task, prepare_kernel_cred, etc.) are unchanged. The movz migration is only 6 patches:

0x0067ec: 0xd238 -> 0xd7f8   (ashmem_fops)
0x007470: 0xf1e0 -> 0xf7a0   (anon_pipe_buf_ops)
0x00754c: 0xf1e0 -> 0xf7a0   (anon_pipe_buf_ops)
0x00765c: 0xf1e0 -> 0xf7a0   (anon_pipe_buf_ops)
0x0078ac: 0x41f8 -> 0x47b8   (kmalloc_caches)
0x007af4: 0xf1e0 -> 0xf7a0   (anon_pipe_buf_ops)

Install & run

# 1. Install the APK
adb install -r RootMyGalaxy-S9180-FZG1.apk

# 2. Launch the app and run the exploit (one attempt)
# Root is temporary: re-run the exploit after every full reboot.

Caveats

• Temporary root only (KernelSU LKM): lost on full reboot, re-obtained by re-running the exploit.
• KernelSU soft-reboot preserves root.
• Never use the in-app "update" button for modules — always install zips manually.