TB320FC Kernel Root — CVE-2025-21479

English | 简体中文

In-memory kernel privilege escalation for the Lenovo Legion Y700 2023 (TB320FC), exploiting CVE-2025-21479 (Qualcomm Adreno GPU SMMU vulnerability), with full root management provided by ReSukiSU.

No bootloader unlock. No flashing. No PC required for activation.

⚠️ For authorized security research on devices you own. See Disclaimer.

Target Device

All offsets and behavior in this project are tuned for the following device. Do not expect it to work on other models/ROMs without retuning (see exploit/device_info.txt).

Verified working as of 2026-09 on the above firmware.

Features

Screenshots

RootActivator (activated)	ReSukiSU (working, 2 modules)

Left: RootActivator after successful activation — SELinux Enforcing, kernelsu loaded, su available. Right: ReSukiSU manager — LKM mode working with 2 modules (NeoZygisk + Vector).

How It Works

RootActivator APK
   │
   ├─ libcheese.so ── KGSL SMMU exploit (CVE-2025-21479)
   │     1. Adreno 730 microcode access-check flaw (SDS packet mistaken for RingBuffer)
   │     2. Fake CP_SMMU_TABLE_UPDATE overwrites GPU TTBR0 → arbitrary physical R/W
   │     3. Zero selinux_state.enforcing; dump kernel from fixed PA 0xA8000000,
   │        parse kallsyms from the raw image (SM8475 has no physical KASLR)
   │     4. Patch __do_sys_capset with an escalation shellcode
   │        (prepare_kernel_cred(0) + commit_creds + clear TIF_SECCOMP);
   │        forked child calls capset() → uid 0 + full caps
   │
   └─ libksud.so (ReSukiSU) ── late-load mode
         1. kernelsu.ko loaded from ksud's embedded assets with manual relocation
            (does not rely on kernel symbol exports)
         2. install → /data/adb/ksu (ksud/busybox/bootctl)
         3. su channel online: /system/bin/su → kernel hook redirect → u:r:ksu:s0
         4. setenforce 1 — Enforcing restored, policy rules already injected by the ko

Notable engineering points

• Qualcomm GKI trims kernel symbol exports. 77 symbols required by upstream KernelSU are missing, so a plain insmod kernelsu.ko fails. ReSukiSU's late-load resolves symbols itself and loads fine.
• CPU affinity fix in cheese. With multiple cores, patched kernel text can be executed with stale instructions on another core (I-cache coherence), causing a panic. Pinning the process to one core makes the exploit far more reliable.
• Load sensitivity. During the post-boot initialization storm (5-10 min) the failure rate is significantly higher. See docs/TROUBLESHOOTING.md.

Quick Start

1. Get RootActivator

Build from source (see Building) or grab the APK from the GitHub Releases page (not stored in the repo).

2. Install ReSukiSU manager

Download from ReSukiSU Releases and install the manager APK.

3. Activate

1. After boot, wait 5-10 minutes (the tool auto-detects system load and waits if needed)
2. Open RootActivator → tap Activate Root
3. Wait 3-4 minutes (progress is shown in the built-in log)
4. When done, open the ReSukiSU manager and grant root to your apps (Shizuku, terminals, ...)

4. (Optional) Xposed module support

1. Install NeoZygisk (via ReSukiSU manager → Modules → install from storage)
2. Install Vector (Xposed framework)
3. After root is active, start the injector on the device (activation does not do this):
   root@kitploit:~

   su -c 'sh /data/adb/modules/zygisksu/post-fs-data.sh'
   

4. Details in docs/VECTOR.md

Repository Layout

├── LICENSE / CHANGELOG.md
├── README.md / README.zh-CN.md
├── exploit/            cheese exploit (CVE-2025-21479, ported to TB320FC)
│   ├── source/         cheese.c / kallsyms_lookup.c / adrenaline.h
│   ├── device_info.txt Target device parameters (offsets, verified facts)
│   └── build.sh        Build script (requires Android NDK)
├── app/                RootActivator (Kotlin, hand-rolled build, no Gradle)
│   ├── src/            MainActivity.kt (single file, code-only UI)
│   ├── res/            launcher icon (mipmap-xxxhdpi)
│   ├── AndroidManifest.xml
│   ├── debug.keystore  debug signing key used by the public APK
│   ├── build.py        Build script (kotlinc + d8 + aapt2 + apksigner)
│   └── README.md       App documentation
├── tools/              Helper scripts
│   ├── fetch_assets.py         Host: prepare native assets (exploit + ksud)
│   ├── neozygisk_setup.sh      On-device: NeoZygisk + Vector (see VECTOR.md)
│   ├── status_check.sh         On-device: root / module snapshot
│   └── check_mods.sh           On-device: module inspection helper
├── docs/               Documentation (English)
│   ├── ARCHITECTURE.md         Deep dive into both chains
│   ├── TROUBLESHOOTING.md      Failure handling, success-rate data
│   └── VECTOR.md               Xposed (NeoZygisk + Vector) setup
└── screenshots/        On-device PNG evidence

Building

exploit (Android NDK)

cd exploit
NDK=/path/to/android-ndk ./build.sh
# Produces ./cheese (arm64) → used as app/native/libcheese.so

RootActivator APK

cd app
python ../tools/fetch_assets.py    # prepare native assets
python build.py                    # requires kotlinc + Android build-tools
# Produces RootActivator.apk

Environment variables accepted by the build (see app/build.py for details): KOTLIN_HOME, ANDROID_BUILD_TOOLS, ANDROID_JAR, KEYSTORE, JAVA_HOME. fetch_assets.py additionally needs RESUKISU_APK (path to a ReSukiSU arm64 APK) to extract libksud.so.

Limitations

• Re-activation required after every reboot (in-memory approach, nothing persists)
• ~20-40% activation failure rate (inherent to the exploit; a failure reboots the device with no data loss — just retry)
• adb root is not available (adbd cannot run as root in production builds)
• Xposed requires NeoZygisk; never use ksud soft-reboot — it hangs the system (use NeoZygisk's ptrace injection instead)

Disclaimer

This project is provided for security research and educational purposes only, and only for devices you own or are explicitly authorized to test. You are solely responsible for any consequences and legal implications. The exploit may reboot the device; in rare cases data loss is possible — back up important data first.

Credits

• zhuowei/cheese — original CVE-2025-21479 exploit (Zhuowei Zhang)
• ReSukiSU — KernelSU fork with late-load mode
• NeoZygisk — ptrace zygote injection
• Vector — Xposed framework
• hawkes — adrenaline.h (KGSL command definitions)

License

MIT