GhostLock APK

Standalone APK: CVE-2026-43499 GhostLock kernel privilege escalation + execution as Shizuku shell identity.

Prerequisites

• Honor AAK-AN00 / MagicOS 10 / Linux 6.6.89 / 4KB page
• Shizuku installed and started via adb (adb shell sh /sdcard/Android/data/moe.shizuku.privileged.api/start.sh)
• USB debugging authorized

How it works

1. Shizuku UserService: After the APK starts, it requests a UserService from Shizuku. When Shizuku is started via adb, the UserService runs as shell uid=2000 and has write permission to /data/local/tmp/.
2. Release the exploit binary: The ghostlock bundled in the APK (CVE-2026-43499 GhostLock privilege escalation ELF) is written to /data/local/tmp/a/ghostlock via the Shizuku channel.
3. Execute privilege escalation: Run ghostlock as shell, trigger the kernel vulnerability → gain root → drop su.

Build

# 1. 下载 Shizuku API
curl -L -o app/libs/shizuku-api.aar \
  https://github.com/RikkaApps/Shizuku-API/releases/download/v13.5.4/shizuku-api-13.5.4.aar

# 2. 放入 ghostlock 二进制
# cp /path/to/ghostlock app/src/main/assets/ghostlock

# 3. 构建
./gradlew assembleRelease

CI

GitHub Actions auto-build: on push to the main branch or manual workflow_dispatch trigger.

Disclaimer

This tool is for security research purposes only. Users assume all risks.