GhostLock for POCO F8 Ultra / REDMI K90 Pro Max — Global & Taiwan Variant (myron, WPMTWXM)

GhostLock (CVE-2026-43499) kernel exploit port for the global/Taiwan firmware of the POCO F8 Ultra / REDMI K90 Pro Max (codename myron, Snapdragon 8 Elite Gen 5 / SM8850).

Target: HyperOS OS3.0.6.0.WPMTWXM — kernel 6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k

English summary below.

Why this port is needed

Same phone, same codename — but the international/Taiwan build (WPMTWXM, i.e. the POCO F8 Ultra) and the mainland China build (WPMCNXM) do not share the same kernel binary:

• The CN build tracks Google's official GKI branch (abogki*); the TW build is Xiaomi's own integration branch
• The two sides have different git commits, 7 different config options, and everything is built with +pgo +bolt +lto — any code difference scrambles the whole symbol layout
• Measured in practice: init_task/init_cred differ by 0x10000, selinux_state by 0x120c8 (not a fixed offset)

Data-only exploits like GhostLock need the exact addresses of a specific build, so every payload computed for the CN build is invalid on the international build. This repo supplies the offset table the international build was missing.

Contents

• offsets/myron_tw/offsets.h — the complete target for TW 3.0.6.0 (for use with JoinChang/ghostlock-oneplus)
• scripts/device_step1.sh — post-root ABL backup + unlock EFI flashing script
• Prebuilt ghostlock binaries (arm64) are in Releases

Verified analysis results

1. Static kallsyms extraction is correct: cross-validated by reading the binary back against _text as the base — init_task.comm="swapper", init_cred.usage=4, and init_uts_ns.release match uname character-for-character. Reliable offsets can be obtained without rooting a device.
2. Struct layout is identical to the CN build (BTF-verified): task_struct is 5184 bytes, cred@0x900, pi_blocked_on@0xA18, etc., matching upstream STRUCT_OFFSETS_6_12.
3. Stack layout feasibility: futex_wait_requeue_pi (frame 0x1c0, waiter@sp+0x80) and core_sys_select (frame 0x1b0, stack_fds@sp+0x18) are exactly the same as on the verified-working Xiaomi 17 (pudding) → PSELECT_SHIFT=0.
4. selinux_state.enforcing is at +0 and at +2, so a single-byte write won't corrupt policycap.

Build

git clone https://github.com/JoinChang/ghostlock-oneplus.git
cd ghostlock-oneplus
cp /path/to/this-repo/offsets/myron_tw/offsets.h src/devices/myron_tw/offsets.h
# 在 src/devices/offsets.h 的 #include 清單加一行:
#   #include "myron_tw/offsets.h"
make NDK_CC=<你的 NDK>/toolchains/llvm/prebuilt/*/bin/aarch64-linux-android35-clang

Usage

adb shell uname -r
# 必須是 6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k,否則程式會拒絕執行

adb push ghostlock /data/local/tmp/e
adb shell chmod 755 /data/local/tmp/e
adb shell /data/local/tmp/e

• On success → root shell + SELinux permissive (soft root, lost on reboot)
• Failed and rebooted = didn't win the race; just rerun. If it keeps panicking, try tweaks like PSELECT_SHIFT=-1
• Don't let the device take an OTA — after an update the kernel is replaced, the offsets break, and the new version may already have patched the vulnerability

Follow-up (BL unlock)

Once rooted, the international device can be unlocked via the ABL replacement method (no official quota needed): back up abl_a/b → flash the unlock EFI → fastboot-flash the stock ABL + spoof → restore. The stock ABL is taken from the abl.img of your own TW 3.0.1.0 ROM (this repo does not host Xiaomi proprietary firmware files). scripts/device_step1.sh is the on-device part of this flow. This flow does not wipe user data.

Credits

• Nebula Security — original GhostLock research and PoC
• JoinChang/ghostlock-oneplus — the basis for this port
• Porting experience from the Coolapk community

English Summary

The global firmware of the POCO F8 Ultra (REDMI K90 Pro Max) ships a different kernel build than the CN firmware (different branch, config, and PGO/BOLT layout), so all community-published GhostLock offsets — computed on CN ogki kernels — miss on global devices. This repo provides the missing target offsets for OS3.0.6.0.WPMTWXM (6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k), statically extracted from the official OTA package and cross-validated (kallsyms + BTF + in-image reads), plus a prebuilt binary in Releases. Struct layouts are identical to the CN build; only symbol addresses differ. Stack-frame layout matches the verified-working Xiaomi 17 (pudding).

Use only on your own device. The vulnerability is public (kernelCTF-mandated disclosure); this port exists so global-variant owners can root their own phones.

Disclaimer

For authorized security research on your own devices only. No guarantees of any result; use at your own risk.