witaqua-tools/root-my-deviceKSU installer for supported firmware with CVE-2026-43499
A fork of BuSung-dev/Root-My-Galaxy, under the Apache License 2.0 — see LICENSE and Credits.
Root My Device is a one-click installer for explicitly supported firmware builds. The application itself is kept separate from device offsets, native exploit payloads, and KernelSU build artifacts.
The device feed and native payloads are maintained in
Root-My-Device-Payloads.
Every push to its main branch builds the payloads and publishes them as a
GitHub release under a tag unique to that run. The app resolves that
repository's releases/latest, reads the targets-v2.json asset from it, and
downloads every artifact named in it — so the set of payloads it installs is
immutable once published, and nothing is committed as a binary.
The app automatically selects an exact match for the kernel release, full build display ID, SDK, ABI, and page size. Advanced mode can select a profile manually and presents separate kernel-release and build warnings.
A profile stays out of the feed until the app's own route has completed on that device, and the feed is what the app reads — so the run that would establish whether that route works has nothing to download. Debug mode is for that case: a separate switch from advanced mode, off by default, that reads the payload out of a folder on the device. Turning it on reveals the folder to point it at, which holds three files at its top level:
profile.json
cve-2026-43499-app.release.so
ksud
The two artifacts are what the payload repository builds, and those names are
the defaults. A daemon carried under the ksud-<id> name that repository's
releases use has to be renamed, or named in the manifest as kernelsu.name
(exploit.name for the payload).
profile.json carries only what cannot be taken from the device, under the
feed's own key names:
{
"profileId": "xig07-jp-OS3.0.7.0.WNEJPKD",
"kernelsu": { "kmi": "android14-6.1", "managerPackage": "me.weishu.kernelsu" }
}
Those three fields are required. Every field the feed matches a device on —
kernel release, build display ID, SDK, ABI, page size — comes from this device
instead, since a local profile is not matched against anything. Naming
kernelRelease or buildDisplay anyway is optional and checked against the
device, which is what makes it safe to keep several targets' folders side by
side.
None of the checks a downloaded payload gets apply here, and the app says so. A
run from a folder is marked as one in the log, in the overview, and as
local:<folder> in its history entry, so no finished run can be read afterwards
as a feed run.
Requirements:
The APK contains one native program that is not built from this repository's own source, so clone with submodules:
git clone --recurse-submodules https://github.com/Witaqua-tools/Root-My-Device
# or, in an existing checkout
git submodule update --init payloads
$env:JAVA_HOME='C:\Program Files\Android\Android Studio\jbr'
.\gradlew.bat :app:assembleDebug
Output:
app/build/outputs/apk/debug/app-debug.apk
lib/arm64-v8a/libcve43499root.so in the APK is not a library — it is the
bootstrap helper, an executable the app runs with ProcessBuilder out of
nativeLibraryDir. It is what loads a downloaded payload, and afterwards what
serves su over a socket once the payload has made it root.
It is compiled from source by app/src/main/cpp/CMakeLists.txt,
not committed as a binary. The source is not here, though: the payload's
standalone route execs the same program from a fixed path, so the payload
repository has to build it too, and it stays the one copy. This repository
reaches it through the payloads submodule, whose pinned commit is the record
of exactly which revision an APK was built from.
That means two builds of one source, deliberately. The payload repository pins
NDK 29 at API 35 because its exploit payload is a fixed-size blob whose
toolchain is part of its identity; here CMake uses this module's ndkVersion
at minSdk. The helper depends on neither — it is the same program either way,
and the copy the app ships is the one built here.
Two things about it are load-bearing and easy to undo by accident: it must be
an executable (add_executable plus -pie, so it has a PT_INTERP that a
shared library would not), and it must be named lib*.so with
jniLibs.useLegacyPackaging = true, because that is what gets extracted into
nativeLibraryDir as a real file with the execute bit set. Both are commented
where they are set.
Use only on devices you own or are explicitly authorized to test.
A fork of Root-My-Galaxy by BuSung-dev, which keeps the original Apache License 2.0 — see LICENSE.
This application downloads and runs what Root-My-Device-Payloads publishes — itself a fork of Root-My-Galaxy-Payloads by BuSung-dev.
Nothing a payload is owed is in this repository, and nothing of it is repeated here. KernelSU — what a successful run loads — each core's upstream, the source those cores descend from, and the licence terms of everything built there are credited in the payload repository's README, which is where a payload-side credit belongs and where those artifacts are built.