diyiqiuye/cve-2025-21479-fx5pTemporary root for OPPO Find X5 Pro (PFEM00) via CVE-2025-21479 + KernelSU LKM late-load (cloud-buildable)
RAM-only temp root for OPPO Find X5 Pro PFEM00 (kernel 5.10.198-android12-9, ColorOS, locked bootloader) via CVE-2025-21479 (Adreno KGSL) → KernelSU v3.3.0 LKM late-load. 中文：README_zh.md
Chain: KGSL physical R/W → disarm OEM guard, SELinux permissive, kptr_restrict=0 → capset patch grants full caps → ksud late-load (official KernelSU LKM android12-5.10) → KernelSU manager me.weishu.kernelsu. Everything is gone after reboot; nothing is flashed.
Own device, security research only. The exploit writes kernel memory: a bad run reboots the device.
Get the bundle from Releases (exploit_guard, su0, ksud, oneclick_root.sh), put it in one folder, run with adb on the PC:
bash oneclick_root.sh # run chain + verification
bash oneclick_root.sh shell # then drop into a uid=0 shell
bash build.sh # Android NDK r28c (or set ANDROID_NDK_HOME), aarch64, API 31
Every push builds on GitHub Actions and uploads a bundle artifact; v* tags publish to Releases.
One binary serves every supported firmware: per-version data lives in profiles/<kver>.env, auto-loaded by oneclick_root.sh from uname -r (profile first, built-in versions fall back to compiled defaults; unsupported kernels print instructions and exit — follow them to derive a profile with the bundled GUI tool).
Kernel (uname -r prefix) | Firmware | Status |
|---|---|---|
| 5.10.198 | older ColorOS (920file era) | built-in ✅ |
| 5.10.168 | 14.0.0.81(CN01) | built-in ✅ |
To support another firmware (the Release bundle ships tools/, nothing to install):
# GUI: double-click tools/offset_tool.exe (or .pyw) -> pick boot.img -> compute -> save next to oneclick_root.sh
# CLI:
py -3 tools/offset_tool.pyw --cli boot.img --save . # extract kernel -> symbols -> offsets -> profiles/<kver>.env
How it works: the exploit parses kallsyms at runtime (_text/init_cred/commit_creds are all looked up dynamically); only three bootstrap constants are baked in (idmap_pg_dir rel _text, init_task/selinux_state rel idmap_pg_dir). swapper−idmap=0x5000 and the struct offsets (real_cred/cred=0x778/0x780, …) are invariant across android12-5.10 (the tool verifies them automatically). Any constant can also be overridden directly via CHEESE_* env vars.
src/cheese.c exploit (single TU: KGSL primitive, guard patch, SELinux/kptr, capset patch)
src/adrenaline.h KGSL ioctl interface (Project Zero Adrenaline)
src/kallsyms_lookup.c kallsyms helpers
src/su0.c uid=0 helper
scripts/oneclick_root.sh PC-side one-click chain (detects kernel, loads profiles/<kver>.env)
profiles/ per-kernel offset data (env format)
tools/offset_tool.exe/.pyw visual offset calculator (pick boot.img -> compute -> write profile / update script)
tools/dumpsyms.c/.exe dump symbols from a kernel Image (reuses the exploit's kallsyms parser)
tools/derive_profile.sh firmware Image -> new version profile (CLI variant)
tools/verify_offsets.py verify struct offsets (needs capstone)
build.sh local build
GPL-3.0 — see LICENSE. © 2026 diyiqiuye. Derived from public CVE-2025-21479 research code; respective upstream notices apply.