vivo/iQOO Temporary Root Toolkit

No bootloader unlocking, no flashing needed, temporary root (lost on reboot). Core principle: CVE-2026-43499 (futex PI UAF) kernel exploit + temporary KernelSU loading.

Supported devices (App version)

Directory structure

The repository only hosts source code and scripts; binary artifacts such as APK, zip, payload .so, ksud etc. are not included in the repository.

Privilege escalation workflow (high success rate method)

1. Reboot the phone (critical: pristine boot_id)
2. Push the privilege escalation payload (automatically detects the model and selects the corresponding so)
3. Run the privilege escalation: on detecting injection output → automatically turn off the screen → wait 5 seconds and turn the screen on (may repeat once)
4. After it finishes → phone soft reboot = success indicator
5. Reconnect → verify root (uid=0 means success) → load KernelSU

Limitations and risks

• Temporary root: must be re-run after every cold boot (about 1-2 minutes), lost on reboot
• Kernel >= 6.6.140 has patched the CVE, not usable (script automatically rejects)
• After a failure you must reboot the phone and try again; repeated attempts without rebooting are ineffective
• Does not write system partitions, does not modify bootloader, no brick risk (worst case: kernel panic, recovered by reboot)

Build

# Signature keystore and password are provided via environment variables (not published with the repo)
export IQOO_KEYSTORE=/path/to/your.keystore
export IQOO_KS_PASS=your-keystore-password
python build_final.py out.apk

Disclaimer

This tool is for learning and security research only; use it only on your own devices. Users must bear all risks and legal responsibilities themselves.

Third-party components

See IQOO临时root工具箱(1)/THIRD_PARTY.md (GhostLock-X200 chain: Apache-2.0 / GPL-2.0-only; KernelSU: GPL-2.0-only).