GhostLock-X200 v1.0

⚠️ Legal and Safety Notice (please read first)

This repository is intended exclusively for security research and educational purposes, and may only be used on devices that you own or for which you have obtained explicit written authorization. Unauthorized use of this tool on other people's devices may violate local laws and regulations. Using this tool may result in unexpected device reboots, data corruption, system anomalies, voided warranties, and other consequences — please assess the risks yourself. The author assumes no liability for any direct or indirect damages, nor for any misuse. By continuing to read or use this repository, you acknowledge that you understand and agree to bear all risks and responsibilities yourself.

A temporary root toolchain for the vivo X200 (PD2415 / Dimensity 9400 / b57 kernel), based on the CVE-2026-43499 (GhostLock) kernel vulnerability: no Bootloader unlock required, no firmware flashing required, and no data wipe. After execution you obtain temporary root, which is lost after reboot.

Features • Supported Devices • Differences from Other Projects • Quick Start • How It Works • Directory Structure • License

Features

• No Bootloader unlock, no firmware flashing, no data wipe triggered
• Temporary root: gone after reboot, nothing written to system partitions
• One-shot script root.ps1: auto-detects device and kernel, auto-installs missing dependencies, auto-generates offsets
• Offsets extracted live from the device (kallsyms + BTF + disassembly), no hardcoded addresses
• Includes a permissive_restore kernel module to fix KernelSU network/hotspot anomalies on this device under enforcing mode (see "Differences from the same-origin project" below)
• Source code, build scripts, and prebuilt kernel modules are provided in the repository, with per-file license annotations

Supported Devices

Prerequisite: kernel < 6.6.140 (CVE-2026-43499 unpatched) and built as 6.6.89-android15-8-gb57af212129c. Untested models/builds require your own verification. Full instructions are in Usage Guide.

Quick Start

# After downloading the Release assets into the package:
powershell -ExecutionPolicy Bypass -File root.ps1

Detailed procedures (one-shot script, dependency installation, manual scripts, parameter table, FAQ) are in Usage Guide docs/USAGE.zh-CN.md.

How It Works

Seven-stage chain: permissive (SELinux) → kptr → KASLR base → dynamic offsets → ko relocation → cred leak + CAPSROOT → load permissive_restore/kernelsu → restore permissive after 25s. See docs/ARCHITECTURE.zh-CN.md for the architecture and component descriptions.

Directory Structure

├── root.ps1                # One-shot script (auto-installs dependencies/generates offsets)
├── docs/                   # ARCHITECTURE / FILE_MAP (per-file mapping) / USAGE
├── exploit/                # On-device exploit (glt / w2host; includes verbatim and derivative IonStack source)
├── modules/
│   ├── permissive_restore/ # Original kernel module in this repository (GPL-2.0-only)
│   └── kernelsu/           # Official KernelSU v3.2.5 kernel module (GPL-2.0-only)
├── tools/                  # scripts (main chain scripts) + offset_tools (dynamic offset tools)
├── refs/                   # Upstream reference table (version-pinned)
├── LICENSES/               # SPDX license texts (REUSE)
├── LICENSE / NOTICE / THIRD_PARTY_NOTICES.md / SOURCE-URLS.md
└── REUSE.toml

The purpose, origin (COPIED / DERIVED / LOCAL), and license of every file are described in docs/FILE_MAP.zh-CN.md.

License and Sources

• Original project code: Apache-2.0 (see LICENSE / NOTICE); modules/permissive_restore/ is GPL-2.0-only;
• exploit/ contains verbatim and derivative code from NebuSec/CyberMeowfia IonStack (Apache-2.0, commit pinned), as well as adaptation references from boxiaolanya2008/Neo11Plus and YuKongA/ghostlock-app (Apache-2.0);
• modules/kernelsu/kernelsu.ko is the official KernelSU v3.2.5 release asset android15-6.6_kernelsu.ko (GPL-2.0-only) after vermagic adaptation: only the vermagic string in .modinfo was rewritten to match the X200 b57 kernel, no code was changed (reproduction script modules/kernelsu/patch_vermagic.py; SHA256 and sources are in THIRD_PARTY_NOTICES.md / SOURCE-URLS.md);
• prebuilt/ksud (Release asset) is the unmodified libksud.so from the official APK (GPL-3.0-or-later).

Full list is in NOTICE, THIRD_PARTY_NOTICES.md, SOURCE-URLS.md.

Acknowledgements

• NebuSec / CyberMeowfia — IonStack original research (CVE-2026-43499)
• tiann/KernelSU — KernelSU v3.2.5
• boxiaolanya2008/CVE-2026-43499-Neo11Plus, YuKongA/ghostlock-app, p2p3p/GhostLock-for-OnePlus — adaptation and architecture references