vivo iQOO Neo 9 Root Research (CVE-2025-21479)

This project is the result of local privilege escalation research based on CVE-2025-21479 (a Qualcomm Adreno A7xx GPU firmware logic vulnerability), the target device is the vivo iQOO Neo 9 (Snapdragon 8 Gen 2 / Adreno 740 / A7xx series GPU).

The repository only keeps directly usable binary artifacts: the exploit program, the KernelSU kernel module, user-space tools, test kernel modules, and the corresponding jailbreak tool: the KSUOneTap apk. Releases mainly publish the jailbreak tool.

⚠️ Disclaimer This project is intended solely for security research and learning purposes. Please test only on devices you own. Do not use the related techniques and artifacts on any unauthorized devices or for illegal purposes; all consequences arising therefrom shall be borne by the user. Except for the jailbreak tool, the exploit used in this repository is outdated; the new version already supports OriginOS4

1. Vulnerability Background (CVE-2025-21479)

CVE-2025-21479 is a privilege check logic flaw in the firmware microcode of Qualcomm Adreno A7xx series GPUs:

Since A7xx, the GPU instruction buffer hierarchy was expanded from 4 levels to 5 levels (with the addition of IB3), but the firmware microcode still determines the privilege level using level AND 0x3;
When executing at the lowest privilege level (SDS / IB4), 4 AND 3 == 0, which is misjudged as the highest-privilege RB level, thereby allowing privileged instructions such as CP_SMMU_TABLE_UPDATE;
Attackers can use this to reconfigure the GPU level-one page table, obtaining an arbitrary physical memory read/write primitive, thereby bypassing protections such as KASLR, tampering with kernel data (such as selinux_state), and completing privilege escalation.
Fix: Qualcomm June 2025 security bulletin (GPU firmware v675 → v676, mask changed from 0x3 to 0x7).
Scope of impact: devices equipped with Adreno A7xx GPUs (such as Snapdragon 8 Gen 1/2) whose security patch predates the fix.

The exploit chain of this project: GPU arbitrary physical memory read/write → KASLR leak → set SELinux to permissive → inline hook to establish a root daemon (rootd), and on this basis load KernelSU (kernelsu-vivo.ko) to achieve long-term root management.

2. Directory Structure

├── exploit/                    # 漏洞利用与客户端工具
│   ├── exploit_vivo_neo9       # 主利用程序（自包含，含 rootd 守护进程，每次开机运行一次）
│   ├── exploit_vivo_neo9_ndk   # NDK 重新编译的利用程序（精简版）
│   ├── exploit_vivo_neo9_ndk13 # NDK 13 编译的利用程序（精简版）
│   ├── exploit0_selinux_only   # 仅做 SELinux permissive 的变体（不注入 rootd）
│   └── client/                 # rootd 客户端工具（部署到 /data/local/tmp 使用）
│       ├── rootc               # root 命令客户端：通过文件通道与 rootd 通信执行命令
│       ├── u0                  # 真 root (euid=0) 执行器，绕过 euid=2000 受限接口
│       ├── su                  # su 增强版包装脚本（rootc/u0 双模式，见下文）
│       └── shim.so             # 共享库 shim（配合宿主进程注入执行）
├── kernel-module/
│   └── kernelsu-vivo.ko        # 适配 vivo 内核的 KernelSU 内核模块（作者 weishu）
├── userspace/                  # KernelSU 用户态工具
│   ├── ksud                    # KernelSU 守护进程（负责加载/管理 kernelsu.ko）
│   ├── su_ksu                  # KernelSU 的 su 二进制（由 su_patched.c 编译）
│   ├── asuid                   # 以指定 Android UID 执行命令的工具（asuid <uid> <cmd...>）
│   ├── ksu_feature_probe       # KernelSU 功能探测工具
│   ├── ksu_probe / ksu_probe2  # KernelSU 特性/环境探测工具
│   └── su_test2                # su 功能测试工具
├── test-modules/               # 内核测试/辅助模块（供调试与软重启兼容使用）
│   ├── ksu_testmod.ko          # KernelSU 测试模块
│   ├── proctest.ko / puretest.ko # 进程相关测试模块
│   ├── unpatch/unpatch.ko      # 恢复 cap_bprm_creds_from_file（软重启兼容）
│   └── vrpatch/vrpatch.ko      # 中和 vr.ko 的 root 检测（软重启兼容）
├── KSUOneTap.apk               # 一键注入 APK（内嵌利用程序 + kernelsu-vivo.ko + ksud + su + 部署脚本）
├── resukisu-manager.apk        # KernelSU 管理器 APK（ReSukiSU，用于授权管理）
└── README.md

3. Supported Environments

Item	Description
Target device	vivo iQOO Neo 9
SoC / GPU	Snapdragon 8 Gen 2 / Adreno 740 (A7xx series, firmware version affected by CVE-2025-21479)
Kernel	`5.15.178-gaacdc35637c4-dirty` (vivo customized, aarch64, supports `mod_unload` / `modversions`)
Architecture	All ELF files are 64-bit aarch64 (Android)
Security patch	Must be before the GPU firmware fix (v676), otherwise the vulnerability is no longer exploitable

Tip: GPU exploitation is probabilistic (depends on memory spraying); if it fails once, you can retry or retry after a reboot.

4. Usage

Method 1: One-tap (KSUOneTap.apk)

Install and open KSUOneTap.apk on the target device (requires a Shizuku environment to provide permissions);
The app will use the built-in deploy_onedevice.sh to complete: deploy the exploit program → run the exploit to obtain root → load kernelsu-vivo.ko → start ksud → install su_ksu;
Install resukisu-manager.apk as the KernelSU manager for root authorization management.

Method 2: Manual Process

Using adb as an example:

# 1. 推送并运行利用程序（每次开机运行一次）
adb push exploit/exploit_vivo_neo9 /data/local/tmp/
adb shell 'chmod 755 /data/local/tmp/exploit_vivo_neo9; /data/local/tmp/exploit_vivo_neo9'

# 2. 成功后：SELinux 置为 permissive，rootd 守护进程在 /data/local/tmp 就绪（rootd_ready.txt）
#    推送客户端工具
adb push exploit/client/su exploit/client/rootc exploit/client/u0 /data/local/tmp/
adb shell 'chmod 755 /data/local/tmp/su /data/local/tmp/rootc /data/local/tmp/u0'

# 3. 使用 su（默认 rootc 模式；需 euid=0 时加 --u0）
adb shell
su -c 'id'
su --u0 -c 'id'

# 4. 加载 KernelSU 模块并启动守护进程
adb push kernel-module/kernelsu-vivo.ko userspace/ksud userspace/su_ksu /data/local/tmp/
adb shell '/data/local/tmp/ksud'
#    之后以 su_ksu 作为 KernelSU 的 su 使用

5. Component Description

5.1 exploit Chain

After the exploit program runs, it obtains arbitrary physical memory read/write through the vulnerability, scans and leaks the kernel base address (KASLR bypass);
Performs an RMW write to selinux_state, setting SELinux to permissive;
Patches the kernel kprobe_dispatcher to disable vr.ko's kprobe detection (vivo anti-root monitoring);
Establishes a rootd daemon in /data/local/tmp (rootd_cmd / rootd_out / rootd_ready.txt file channel) for clients to request command execution.

5.2 su / rootc / u0 Clients

rootc (default mode): rootc <command> or rootc B64:<base64>, handed to rootd via the file channel for execution with euid=2000 + full capabilities (this design is intended to circumvent vr.ko's anti-root restrictions);
u0 mode: su --u0 -c "command", executed as euid=0 true root, used to call interfaces that require true root;
su script: su is a wrapper script that by default injects PATH=/data/local/tmp:$PATH to facilitate invoking tools by short names, supports parameters such as -c/--command, --u0/-0, -s/--shell, --no-path, and is compatible with stdin interaction;
shim.so: a shared library injected into a host process via LD_PRELOAD to execute custom code.

5.3 KernelSU (kernel-module + userspace)

kernelsu-vivo.ko: KernelSU kernel module compiled for this vivo kernel (5.15.178) (vermagic fully matches the kernel);
ksud: KernelSU daemon, responsible for loading kernelsu.ko (automatically matched by KMI version), managing su and authorization;
su_ksu: KernelSU's su program, used with the manager for root authorization;
asuid: executes commands with a specified UID (asuid <uid> <cmd...>), used for testing/privilege-dropping scenarios;
Probe tools: ksu_feature_probe, ksu_probe, ksu_probe2, su_test2 are used to detect KernelSU features and the runtime environment.

vivo_iqoo_neo_9_root_research_on_CVE-2025-21479

Más Populares