xiaohj233/ghostlock-x200-appvivo X200 设备端一键 root App（Shizuku 授权 shell 域执行，CVE-2026-43499）
Current release: 1.1.0. Download release · Changelog
A one-tap on-device root App for vivo X200, based on the GhostLock (CVE-2026-43499) kernel vulnerability: no flashing, no bootloader unlocking, no data wiping. After running, you get temporary root, which is lost after a reboot; just reopen the App and tap once to root again.
This is the phone-side entry point paired with ghostlock-x200-root (the PC toolchain), sharing the same privilege-escalation chain. It can be used after authorization via Shizuku (supports wireless debugging bootstrap), no computer or adb required.
Legal and safety notice (please read first)
This repository is intended solely for security research and educational purposes, and may only be used on devices that you own or for which you have obtained explicit written authorization. Using this tool on someone else's device without authorization may violate local laws and regulations. Using this tool may cause abnormal device reboots, data corruption, system anomalies, voided warranties, and other consequences; please assess the risks yourself. The author assumes no responsibility for any direct or indirect damages, nor for any misuse. Continuing to read or use this repository indicates that you understand and agree to bear all risks and responsibilities yourself.
su -c id in a terminal; it should output uid=0(root)Note: after booting, please wait about 4 minutes before running; the root process may trigger a kernel reboot (it recovers automatically, with no risk of bricking).
Known issue in 1.1.0: after the first completion, step 9 may wait for a long time and show that verification failed, but the functionality may actually already be available. A verification timeout of about 120 seconds is still in place for now; result detection and messaging will be improved later. If the functionality is actually working, please check the manager status first to avoid running the full process again.
需要 ghostlock-x200-root（v1.3.5）提供提权链资产，以及 NDK r21e、Android SDK build-tools 36 / android-35、JDK 11。
bash runner/build_runner.sh # 编译 runner
bash tools/make_payload.sh <ghostlock-x200-root 路径> # 组装提权链资产
bash tools/build_app.sh /root/androidsdk # 产出 APK
The frontend artifacts (app/src/main/assets/www) are distributed with the repository; the binary source files (runner) must be compiled before rebuilding, see docs/DESIGN.md and docs/NEW_DEVICE.md for details.
Dual-repository dependency: compiling the privilege-escalation chain assets with this repository's
tools/make_payload.shrequires theprebuilt/(glt_esync / ksud / w2host) andmodules/*.kofrom ghostlock-x200-root. You must first clone the main project, then runmake_payload.shwith the main project root directory as the argument; otherwisebuild_app.shwill reportERR: payload missingat the first step.
For details on the underlying principles and device compatibility scope, see the PC version repository documentation: Architecture, Usage Instructions; for details on this repository, see docs/DESIGN.md.
app/ Android App（Java 壳 + Shizuku 集成）
runner/ 提权链编排器（C）
exploit/ 提权链原生程序源码
tools/ 构建脚本
vendor/ Shizuku API 依赖（AAR，构建时自解压）
Licensed under Apache-2.0 (LICENSE, copyright attribution xiaohj233). The privilege escalation chain assets and source code are derived from ghostlock-x200-root (including third-party code such as IonStack/KernelSU; see NOTICE for full attribution).