zenyxx-xd/rootmyvivo-exploitGhostLock (CVE-2026-43499) exploit fork for RootMyVivo Neo — iQOO Neo 11 (PD2520, SM8750, 6.6.89). For authorized research on own devices only.
A fork of boxiaolanya2008/CVE-2026-43499-Neo11Plus, reworked for RootMyVivo. Everything that broke the phone after rooting is gone; the exploit core keeps its proven timing.
| Directory | Device | Kernel | Offset source |
|---|---|---|---|
PD2520-BP2A.250605.031.A3 | iQOO Neo 11 | 6.6.89 | kallsyms+BTF of our own boot.img, hardware-verified |
PD2520-A-16.0.28.2 | iQOO Neo 11 | 6.6.127 | kallsyms from boot_b |
I2401-16.1.22.2 | iQOO 13 (India) | 6.6.89 | AmarnathCJD/IQOO13-Root |
PD2426-BP2A.250605.031.A3 | iQOO Neo10 Pro | 6.6.89 (gf2) | sgswzglwlx/vivo-root-build |
PD2415-BP2A.250605.031.A3 | vivo X200 | 6.6.89 (b57) | xiaohj233/ghostlock-x200-root — same binary fits the Neo10 Pro on b57 |
PD2405-AP3A.240905.015.A1 | vivo X200 Pro | 6.6.89 | CyberMeowfia |
A new device = a new directory under src/targets/: target.h (offsets) + root.c (our proven endgame, copied verbatim).
| Component | Why |
|---|---|
| Wallpaper swap + system_server kill | source of "spontaneous" soft reboots and replaced wallpapers |
| io-daemon on port 39555 | only the debug kernelapp needed it |
| tmpfs overlay on /apex/com.android.virt | hung zygote on soft reboot (black screen) |
| Boot service 10-neo11-su.sh | the app handles persistence now |
| Other devices' offset tables | we have our own, one directory per target |
The exploit core (futex PI UAF → pselect fake lock → heap spray → pipe physrw → root) and the posture (panic_on_oops=0, kptr_restrict, AVC poisoning) are untouched.
Added on top of upstream: safety_quiesce (waits for loadavg < 4 before the PI route), a cred-guard (canonical-address check before writes), and a retry loop of up to 3 runs in fresh forks. Env knobs: RMV_ATTEMPTS, RMV_RETRY_DELAY.
Where panics come from: INIT_STACK_ALL_ZERO wipes the stack and kills the fake waiter — mitigated by quiesce+retry; a garbage target after a failed reclaim — cred-guard; stock panic_on_oops=1 — posture switches it off right after root, before that only carefulness saves you.
Windows, NDK r29:
build_ports.bat # all ports
build_ports.bat I2401-16.1.22.2 # one target
build-win.bat # PD2520 6.6.89
Building on-device via Termux works too — see the Makefile.
Output: build/<target>/bin/preload.so (~140 KB). Run with: LD_PRELOAD=$PWD/preload.so /system/bin/true from the shell domain.
Everything is derived automatically through P0_DATA_ALIAS_CONST from P0_PHYS_OFFSET and P0_KERNEL_PHYS_LOAD. Qualcomm SM8750: 0x80000000/0xa8000000. MediaTek Dimensity 9400: 0x80000000/0x80000000. A wrong value doesn't panic — the slide just won't converge.
The CVE is fixed in 6.1.175 / 6.6.140 / 6.12.86. But compatibility isn't just the version: where rt_mutex_waiter lands on the do_futex stack depends on the PGO/LTO profile. See the detailed breakdown at JoinChang/ghostlock-oneplus: OPLUS 6.1 builds inline do_futex and the exploit is impossible, vivo 6.1 keeps it alive. Check the frame before attempting a port.
Authorized research and your own devices only.