RootMyS24

Root without unlocking · Samsung Galaxy S24 series (S9210 / S9260 / S9280) + China Z Fold6
A security research project based on the kernel vulnerability CVE-2026-43499

Security research disclaimer: This project is intended solely for security research and maintenance of devices you own. Exploiting a kernel vulnerability for privilege escalation may cause system crashes, data loss, or a bricked device. Users assume all consequences at their own risk. Do not use it for illegal purposes.

Features

• No bootloader unlock required: no BL flashing, no rev bit increase, bootloader stays locked
• KNOX not tripped: e-fuse state remains unmodified (can be paired with KnoxPatch to restore KNOX features such as Secure Folder)
• Semi-persistent: run the app once after each reboot to reload the KernelSU driver
• KernelSU ecosystem support: Zygisk-Next / LSPosed / KnoxPatch modules, etc.
• Modern Material 3 UI: dynamic ambience header, floating navigation, multi-language

Supported Devices

Firmware with the same build number on the same platform (e3q/e1q) shares identical kernel symbols and is directly interchangeable; HK and TW variants with the same build number share the same payload. Cross-build-number adaptation requires symbol-by-symbol comparison and correction; cross-platform or major-version moves require a full re-calibration, and the vulnerability may already be fixed. See Documentation Navigation for the adaptation methodology and per-target calibration reports.

Usage

1. Install the app and choose an authorization method (since v2.5.5, wireless debugging is an experimental toggle, off by default):
   • Shizuku (default): install and start Shizuku (wireless/wired ADB authorization)
   • Wireless debugging (experimental): after enabling "Wireless Debugging Authorization" in Settings, the home screen supports notification pairing / pairing code / direct connection
2. Select the target firmware version (grouped by region: China / HK + TW), then tap "Start Root" (running with the screen off is recommended to reduce the probability of kernel races)
3. Wait for the exploit to complete; KernelSU late-load is executed automatically
4. Install KernelSU Manager (v3.2.5), force-stop it, and reopen — it displays "Working [Jailbreak Mode]"

The exploit is probabilistic — just retry after a failure/reboot (the success rate accumulates with each attempt). Success markers: exploit completed + retval=0 socket=1.

Documentation Navigation

See docs/README.md for the full documentation center.

Getting Started & Usage

• docs/release-v2.5.6.md — Latest release notes (downloads / SHA256 / system requirements / known issues / changelog)
• docs/auth-plan.md — Authorization scheme planning (status of Shizuku / wireless debugging options)
• docs/release-v2.5.5.md — v2.5.5 release notes (wireless debugging narrowed to an experimental toggle)
• docs/release-v2.2.md — v2.2 release notes (historical)

Technical Principles

• docs/technical-principles.md — This app's technical principles (vulnerability root cause / exploit chain / why no unlock is needed / risks)
• Research repository VULNERABILITY_ANALYSIS.md — Full vulnerability analysis (research notes, authoritative)

Firmware Adaptation & Calibration

• docs/adaptation-guide.md — Adaptation methodology (read this first when porting to a new device/firmware)
• docs/dze2-target-complete.md — HK DZE2 calibration report
• docs/dzg1-target-complete.md — China DZG1 calibration report
• docs/cza1-target-complete.md — HK CZA1 calibration report
• docs/oneui7-adaptation-report.md — One UI 7 (BYH7) feasibility report
• docs/byh7-target-complete.md — BYH7 calibration completion report

Run Logs & Troubleshooting

• docs/run-log-analysis.md — Line-by-line comparison and interpretation of success/failure logs
• docs/sm-s9380-rmg-root-experience.md — SM-S9380 hands-on experience archive

Research Materials

• docs/research-index.md — Complete index of research materials
• docs/blog-s9280-root.md — Blog: Rooting the China S24 Ultra without unlocking the bootloader
• samsung-root-research — Research repository (authoritative mirror of firmware / exploit engineering / calibration reports)

Technical Principles (Overview)

This app is based on the kernel vulnerability CVE-2026-43499 (rtmutex kernel-stack use-after-free): it triggers an erroneous cleanup path through a PI futex chain deadlock rollback, leaving a dangling pointer to a freed kernel stack; by reusing that stack to forge an rt_mutex_waiter, it gains physical memory read/write, then bypasses KASLR, downgrades SELinux, executes a helper program as root, and finally late-loads the KernelSU driver. No persistent partitions are modified throughout, the bootloader stays locked, and the KNOX e-fuse is not tripped.

See docs/technical-principles.md and the research repository's VULNERABILITY_ANALYSIS.md for the full technical details (root cause / exploit chain / defense bypass / source code comparison).

Notes

• Stay on the supported firmware — do not upgrade: newer firmware patches the CVE-2026-43499 vulnerability
• The exploit succeeds probabilistically: retry a few times on failure, and reboot the phone if necessary
• Keep the screen off while running (reduces the probability of crashes caused by kernel races)
• After each reboot, run "Start Root" once again to load the KernelSU driver

Build

./gradlew :app:assembleDebug    # debug APK
./gradlew :app:assembleRelease  # release APK（需自行配置签名）

The payloads (exploit / root helper / ksud) are bundled under app/src/main/assets/. The payload build chain is a developer responsibility and is outside the scope of this repository.

Dependencies & Acknowledgements

• CVE-2026-43499 security research (IonStack / NebuSec)
• Root-My-Galaxy unlock-free root reference project
• KernelSU (GPL-2.0)
• Zygisk-Next
• LSPosed (GPL-3.0)
• KnoxPatch
• Vector UI template (Material 3 / ambience)

License

GNU General Public License v3.0