unplus

UnPlus

CVE-2026-43499 (Futex PI UAF) kernel arbitrary-address-write exploit core logic code, used to bypass SELinux and gain root.

This repository only contains the core exploit logic source (src/) and the single-binary packager (wrapper/). src/target.h is a template; you must fill in parameters for your own device before it can run (see "Device Adaptation" below).

Build

Core logic (src/)

# Environment requirements: Android NDK r29+ (API 35, aarch64)
export ANDROID_NDK_ROOT=/path/to/android-ndk

# Build pure logic artifacts
make
# → build/unplus            (exploit binary)
# → build/unplus_preload.so (preload library)

The artifacts are two ELFs, with no external binaries embedded.

Single-binary packaging (wrapper/)

To package the exploit and external payloads (magiskpolicy / ksud / kernelsu.ko) into a one-shot single binary, prepare these external payloads yourself and package with wrapper/:

# 1. First build the src/ artifacts (see above)
# 2. Generate payload data (payload_data.h is not in the repo; it is generated by the user and contains the external binary byte stream)
cd wrapper
python3 embed_payloads.py \
  --unplus ../build/unplus \
  --preload ../build/unplus_preload.so \
  --magiskpolicy <path> \
  --ksud <path> \
  --kernelsu <path> \
  --out payload/
# 3. Compile the single binary
make    # → wrapper/build/unplus

Source structure

src/
├── target.h          Device parameter template (◆ FILL IN marked places require your device values)
├── offset.h          Routing glue for target.h (injected via -DTARGET_CONFIG_H)
├── unplus.h          Orchestration header + shared declarations (includes derived macros like P0 alias / data_addr)
├── main.c            Entry orchestration
├── stage1.c          Write 1/2: SELinux off + cred overwrite
├── root.c            Android root landing (SELinux golden repair + sepolicy + KSU allowlist)
├── slide.c           KASLR leak
├── fops.c            configfs/fops routing + kernel base derivation
├── route.c           PI futex routing thread
├── direct_write.c    Direct read primitive
├── pipe_direct.c     Direct pselect write
├── pipe_physrw.c     Pipe physrw primitive
├── util.c            Utility functions
├── utils.h           Generic utilities (logging, procfs paths)
├── kernelsnitch.h    Architecture layer (ARM64/x86 identity-map)
├── futex_hash.h      Kernel jhash port (generic)
└── timeutils.h       Architecture-layer timing (ARM/x86/AMD)

Device Adaptation

src/target.h contains two categories of constants:

Marked with ◆ FILL IN: device/kernel-specific; you must fill in your own values. The template uses 0xDEADBEEF... placeholders; it compiles but will crash when run.
Unmarked: GKI 6.6 invariants (struct field offsets), usually no need to change.

Changing device = fill in the ◆ FILL IN section. For what each field is and how to obtain it, see Appendix: Field Descriptions.

Appendix: Field Descriptions

The ◆ FILL IN fields in target.h are grouped by purpose:

General experience: all *_OFF offsets can be obtained by using kallsyms_lookup_name on a rooted device to get the symbol address and subtracting KIMAGE_TEXT_BASE. TARGET_PCPU_* and TARGET_SELINUX_GOLDEN are runtime/dump values and cannot be obtained from a static image.

License

WTFPL — Do What The Fuck You Want To Public License.

Acknowledgements

CyberMeowfia team — pipe physrw privilege escalation framework
Community device adaptation references

Build identity	`BUILD_VARIANT_LABEL`、`BUILD_FINGERPRINT`	Arbitrary identifier strings for logging. Fill in your device's build fingerprint
Memory layout	`KIMAGE_TEXT_BASE`、`P0_PHYS_OFFSET`、`VMEMMAP_START` etc.	Kernel virtual/physical memory layout. arm64 VA39 usually has defaults; verify via IKCONFIG / kallsyms / `/proc/iomem`
ASHMEM	`ASHMEM_IOCTL_OFF` ... `ASHMEM_MISC_FOPS_OFF`	ashmem driver fops member + misc symbol offsets. `kallsyms_lookup_name("ashmem_fops")` etc.
CONFIGFS / PIPE / VFS	`CONFIGFS_READ_ITER_OFF`、`ANON_PIPE_BUF_OPS_OFF`、`KMALLOC_CACHES_OFF` etc.	configfs read/write, splice, pipe_buf_ops, kmalloc_caches offsets. Look up via kallsyms
SELinux	`SELINUX_ENFORCING_OFF`、`SELINUX_BLOB_SIZES_OFF`、`SECURITY_HOOK_HEADS_OFF`	selinux_state / selinux_blob_sizes / security_hook_heads offsets. `SELINUX_ENFORCING_OFF` is the kernel build matching anchor; must be exact
Core kernel symbols	`INIT_TASK_OFF`、`INIT_CRED_OFF`、`ENTRY_TASK_PERCPU_OFF` etc.	init_task / init_cred / entry_task / __per_cpu_offset / root_task_group offsets. Look up via kallsyms; `ENTRY_TASK_PERCPU_OFF` is the offset of `__entry_task` within the percpu section
Per-CPU runtime	`TARGET_PCPU_BASE_ADDR`、`TARGET_PCPU_UNIT_SIZE`	Runtime addresses of per-CPU chunks (after KASLR), changing every boot. Must be dumped at runtime; `UNIT_SIZE` depends on CPU count
SLIDE (KASLR leak)	`SLIDE_NFULNL_LOGGER_OFF`、`SLIDE_RANDOM_BOOT_ID_DATA_OFF` etc.	Kernel data symbol offsets used for the KASLR leak (nfulnl_logger / boot_id data etc.). Look up via kallsyms
SELinux golden	`TARGET_SELINUX_GOLDEN`	16-byte boolean template of the beginning of `selinux_state`, stable across reboots but unique per device. Must be dumped from your device's selinux_state. byte0 is the enforcing bit; the caller writes 0x00 for permissive
pipe inode info	`PIPE_INODE_INFO_*`、`PIPE_HEAD_OFF` etc.	pipe_inode_info struct layout; usually stable within the same GKI family, verify when changing kernel builds