Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
meizu21-ghostlock-root — MEIZU 21 locked-bootloader runtime root via CVE-2026-43499 and KernelSU late-load | Kitploit
Tools/GitHubGitHub/ymh001/meizu21-ghostlock-root
Android SecurityPrivilege EscalationExploitationMobile App PentestingPost-ExploitationMobile SecurityPayload Development
GitHubymh001/meizu21-ghostlock-root

meizu21-ghostlock-root

MEIZU 21 locked-bootloader runtime root via CVE-2026-43499 and KernelSU late-load

View Repository
1 day agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

MEIZU 21 GhostLock Root

Runtime root for the MEIZU 21 with a locked bootloader, based on GhostLock / CVE-2026-43499.

This repository contains only the device-specific offsets, the prebuilt ARM64 payload, and scripts required to reproduce the setup. It does not contain Flyme OTA packages, boot.img, vendor APKs, or proprietary firmware.

Supported target

The offsets and payload are tied to this exact configuration:

root@kitploit:~
Device:        MEIZU 21 (meizu21 / M2461)
System:        Flyme 12.6.0.0A
Android:       16
Fingerprint:   meizu/meizu_21_CN/meizu21:16/BQ2A.251016.001-BP2A.250605.031.A3/1763702019:user/release-keys
Kernel:        6.1.25-android14-11-maybe-dirty
Security:      2025-12-05
Bootloader:    locked
SELinux:       Enforcing

Do not use these offsets on another kernel or Flyme build.

What this method does

  1. Uses GhostLock to obtain temporary root through CVE-2026-43499.
  2. Starts a detached root command worker.
  3. Installs KernelSU manager and runs ksud late-load --kmi android14-6.1.
  4. Leaves KernelSU active until reboot.

It does not unlock the bootloader, flash a partition, or clear user data.

Requirements

  • USB debugging enabled and adb available.
  • Internet access to download the pinned KernelSU release.
  • The MEIZU 21 connected and authorized.

Quick start

root@kitploit:~
./bootstrap.sh

The script checks the kernel release and refuses to run on a different build.

Root command channel

After bootstrap, use either KernelSU's standard su or the fallback command queue:

root@kitploit:~
./scripts/rootctl.sh 'id'
./scripts/rootctl.sh 'cat /sys/fs/selinux/enforce'

Direct KernelSU access:

root@kitploit:~
adb shell su -c id

Reboot behavior

This is runtime root for a locked bootloader. A full reboot removes KernelSU and returns SELinux to its normal enforcing state. Modules under /data/adb/modules remain on the data partition, but KernelSU must be late-loaded again with ./bootstrap.sh before they become active.

ksud soft-reboot can restart Android userspace without dropping the loaded KernelSU module.

Files

  • bootstrap.sh: end-to-end host-side automation.
  • device/offsets.json: offsets derived from the matching official firmware.
  • payloads/ghostlock-arm64: prebuilt ARM64 GhostLock payload.
  • scripts/root-hook.sh: bootstrap hook executed as temporary root.
  • scripts/root-worker.sh: detached command worker.
  • scripts/rootctl.sh: send commands to the detached root worker.
  • docs/technical-notes.md: extraction and validation details.

Build provenance

The prebuilt payload was built from GhostLock commit 9ee07a8276220cdb4c3948b5feed8b1a3bfbf7f8 with the small dry-run patch in patches/ghostlock-dry-run.patch.

root@kitploit:~
b613923561fe37f7523b253c70dc120a22cbb9a14ee85c01f78047285fc90c25  payloads/ghostlock-arm64
f098dbfbfe6493b6f9dba6656f0147499d471283deb688a0b07d34816913d665  device/offsets.json

Warning

This is a kernel exploitation project. A failed race may reboot the device or cause temporary instability. Run it only on a device you own or are authorized to test. Keep backups before experimenting with KernelSU modules or system changes.

Download Tool