RootMyS24

Root without unlocking · Samsung Galaxy S24 series (S9210 / S9260 / S9280) + China Z Fold6
A security research project built on kernel vulnerability CVE-2026-43499

English · 简体中文 · 繁體中文（台灣） · 繁體中文（香港）

Security research notice: This project is intended solely for security research and the maintenance of your own device. Privilege escalation through a kernel vulnerability carries the risk of system crashes, data loss and a bricked device. You bear full responsibility for any consequences. Do not use it for unlawful purposes.

---

Usage

The figures below are anonymised aggregates (from the App's optional run-log sharing): no IP addresses, cities or any device identifiers. The charts are generated dynamically by the project server and update automatically.

Features

• No bootloader unlock: no BL flashing, no rev-bit bump — the bootloader stays locked
• KNOX e-fuse untouched: e-fuse state is left as-is (pair with KnoxPatch to restore Secure Folder and other KNOX features)
• Semi-persistent: just run the App once after each reboot to reload the KernelSU driver
• KernelSU ecosystem: Zygisk-Next / LSPosed / KnoxPatch and other modules
• Selectable KernelSU driver version (its own tab on the device page): 3.3.0 (recommended) or 3.2.5. The version list is delivered online by the server; firmware that does not offer a given driver falls back to its own default automatically
• SELinux hiding (3.3.0 only): the manager reports SELinux status: Enforcing while the kernel is actually permissive, making the modification harder to detect. 3.2.5 lacks this and reports "Permissive"
• "Verified" marks fetched online: the tested status shown on device cards comes from the server, so it can be adjusted without shipping a new App
• Modern Material 3 UI: dynamic ambience header, floating navigation, 19 languages
• First-run guide: explains that root is temporary and does not unlock the bootloader, that a reboot restores the original state, and warns against KernelSU's permanent install (which can brick a locked device). Re-readable from the About page at any time
• Optional run-log sharing: always / ask each time / never — changeable in Settings, used to diagnose failures on new firmware
• Debug mode: tap the version number seven times in Settings to test log-endpoint connectivity, view the machine identifier, or replay the first-run guide

Supported devices

Model	Firmware	Kernel	Status
SM-S9280 (China DZF2)	S9280ZCS6DZF2	6.1.145	Verified working (baseline)
SM-S9280 (China DZH3)	S9280ZCS6DZH3	6.1.145	Verified working (KernelSU 3.3.0)
SM-F9580 (China Z Fold6)	shares the DZF2 payload	same GKI build	Verified by a Coolapk user
SM-S9280 (HK/TW DZE2)	S9280ZHS6DZE2	6.1.145	Verified working (HK/TW share one payload)
SM-S9280 (China DZG1)	S9280ZCS6DZG1	6.1.145	Merged into the DZF2 payload (since v2.5.6)
SM-S9280 (HK/TW DZH3)	S9280ZHS6DZH3	6.1.145	Merged into the DZE2 (overseas) payload
SM-S9280 (HK/TW CZA1)	S9280ZHS4CZA1	6.1.128	Calibrated (shared by HK/TW)
SM-S9260 (TW DZG1)	S9260ZHS6DZG1	6.1.145	Verified on a single device (HK/TW DZE2 payload, see issue #3)
SM-S9210 (China BYH7, One UI 7)	S9210ZCU4BYH7	6.1.99	Calibrated, awaiting device verification
SM-S9310/S9360/S9380 (China S25, One UI 8.5)	S9310ZCSCCZG1	6.6.98	Calibrated (Android 15 kernel, separate payload)

Firmware sharing the same platform (e3q/e1q) and the same build number has identical kernel symbols and can be used interchangeably; HK and TW builds of the same number share one payload. Across build numbers every symbol must be compared and corrected; across platforms or major versions a full recalibration is required — and the vulnerability may already be patched. See the documentation for the adaptation method and per-target calibration reports.

The China DZF2 payload covers DZE2–DZH3 since v3.5.0 (same 6.1.145 kernel line); the overseas DZE2 payload covers DZE2–DZG1.

KernelSU driver version

The device page has a dedicated "KernelSU driver version" tab. Switching it only decides which KernelSU driver gets loaded — the exploit payload itself is independent of the version.

Version	Notes
3.3.0 (32601)	Recommended. Supports SELinux hiding — the manager reports SELinux status: Enforcing while the kernel is actually permissive
3.2.5 (32525)	Fallback. Root works fine, but it cannot hide SELinux modifications; the manager reports "Permissive"

The version list is delivered online by the server (the first entry is the current recommendation), and each version only applies to firmware that offers that driver — other firmware falls back to its own default and says so below the tab.

The driver only trusts a KernelSU Manager with the official signature. Install the official v3.3.0; a manager signed with any other key shows "Not installed", and the home screen then offers only a "Jailbreak" button instead of "Working [Jailbreak mode]".

How to use

1. Install the App and pick an authorisation method (wireless debugging is an experimental toggle, off by default, since v2.5.5):
   • Shizuku (default): install and start Shizuku (wireless or wired ADB authorisation)
   • Wireless debugging (experimental): enable "Wireless debugging authorisation" in Settings and use notification pairing / pairing code / direct connect from the home screen
2. Pick the target firmware (grouped by region: China / HK-TW), choose a version under "KernelSU driver version" (3.3.0 by default), then tap "Start Root" (running with the screen off is recommended — it lowers the chance of a kernel race)
3. Wait for the exploit to finish; KernelSU late-load runs automatically
4. Install the official KernelSU Manager v3.3.0; the home screen then shows "Working [Jailbreak mode] · version 32601-2"