GhostLock X200 (App)

An on-device one-click root App for the vivo X200, based on the GhostLock (CVE-2026-43499) kernel vulnerability: no flashing, no bootloader unlock, no data wipe. Running it grants temporary root, which is lost after reboot; simply reopen the App to root again with one click.

This is the mobile-side entry point paired with ghostlock-x200-root (the PC toolchain), sharing the same privilege escalation chain. It can be used after authorization via Shizuku (supports wireless debugging bootstrap), no PC adb required.

Legal and Safety Notice (please read first)

This repository is intended solely for security research and educational purposes, and may only be used on devices that you own or for which you have obtained explicit written authorization. Using this tool on someone else's device without authorization may violate local laws and regulations. Using this tool may result in unexpected device reboots, data corruption, system anomalies, warranty voidance, and other consequences; please assess the risks yourself. The author assumes no liability for any direct or indirect damages, nor for any misuse. By continuing to read or use this repository, you acknowledge and agree to bear all risks and responsibilities at your own discretion.

Usage

1. Install and launch Shizuku (Android 16 requires GitHub build 13.6.0+)
2. Open this App and follow the prompts to grant Shell permissions
3. Tap "Start Root" and wait for each stage to complete (about 1-2 minutes)
4. Verify: run su -c id in a terminal; it should output uid=0(root)
5. Root is lost after reboot; repeat steps 1-3

Note: wait about 4 minutes after boot before running; the rooting process may trigger a kernel reboot (it can recover automatically, with no brick risk).

Building

Requires ghostlock-x200-root (v1.3.5) to provide the privilege escalation chain assets, as well as NDK r21e, Android SDK build-tools 36 / android-35, and JDK 11.

bash runner/build_runner.sh                                # build the runner
bash tools/make_payload.sh <ghostlock-x200-root path>      # assemble privilege escalation chain assets
bash tools/build_app.sh /root/androidsdk                   # produce the APK

The frontend artifacts (app/src/main/assets/www) are distributed with this repository; the binary source files (runner) must be compiled before rebuilding, see docs/DESIGN.md and docs/NEW_DEVICE.md for details.

Dual-repository dependency: this repository's tools/make_payload.sh requires the prebuilt/ (glt_esync / ksud / w2host) and modules/*.ko from ghostlock-x200-root when compiling the privilege escalation chain assets. You must clone the main project first, then run make_payload.sh with the main project root directory as the argument; otherwise build_app.sh will report ERR: payload missing at the first step.

For details on the underlying principles, device adaptation scope, etc., see the PC repository documentation: Architecture, Usage; for this repository's details, see docs/DESIGN.md.

Directory Structure

app/      Android App (Java shell + Shizuku integration)
runner/   Privilege escalation chain orchestrator (C)
exploit/  Privilege escalation chain native program source
tools/    Build scripts
vendor/   Shizuku API dependency (AAR, self-extracted at build time)

License and Attribution

Licensed under Apache-2.0 (LICENSE, copyright attribution xiaohj233). The privilege escalation chain assets and source originate from ghostlock-x200-root (including third-party code such as IonStack/KernelSU; full attribution in NOTICE).

Acknowledgements

• NebuSec / CyberMeowfia — IonStack (CVE-2026-43499)
• tiann/KernelSU — KernelSU
• RikkaApps/Shizuku — shell domain execution
• Furry-Xiyi/WinUIonWeb — WinUI frontend components