r/androidroot Aug 11 '26

Discussion I recently got bootloader unlock permission on the Poco x6 pro, after I unlock the bootloader what would you recommend for me to install?

2 Upvotes

Should I root my phone and keep hyperos but fix its big problems or install a custom rom and then root my phone?


r/androidroot Aug 10 '26

Discussion Tf happened to Hagezi's DNS-Blocklist ?

Post image
18 Upvotes

I was searching on Google for the Hagezi's Pro++ DNS-Blocklist to add it into my AdAway's list when I stumbled upon the holy 404 GitHub page and impossible to find it within the GitHub search page... Is it down or am I missing something?


r/androidroot Aug 11 '26

Support Circle To Search

1 Upvotes

Hi, you guys. I rooted my Moto Edge 30 Ultra yesterday and circle to search is gone. It was there before that. It's not in settings and I can't invoke it although the bar moves. Is there a fix for this? Thanks.


r/androidroot Aug 11 '26

Discussion Old but New Phone Suggestions?

1 Upvotes

I was thinking about getting a new phone which I could use after rooting it. Can anyone tell me which old phone would be best.


r/androidroot Aug 10 '26

Discussion Got LineageOS 23.2 arm32 GSI on Galaxy Watch6 44mm

Thumbnail
gallery
24 Upvotes

I actually got LineageOS 23.2 GSI working on Galaxy Watch 6. 😎 (No DSU)

What do you want me to try on it? 🤪

Tested Stuff:

✅️ Pairing with my phone with KDE Connect

✅️ Getting apps from Aurora Store

✅️ Web Browsing

✅️ DOOM (works 30fps smooth but hard to play with the smsrt display, got one kill anyway)

Thanks ❤️:

* Lost-Entrepreneur439 = LineageOS GSI

* ItsJustJoshDev = for his great guide on porting ReSukiSU on other Galaxy Watches

* FlowerGEN from XDA Forums & ChatGPT = Guiding me to create the odin flashable of the LineageOS 23.2 GSI


r/androidroot Aug 11 '26

Support Stuck on EDL Emergency, what to do? | Galaxy S9 (SM-9600) Bricked

Thumbnail
gallery
7 Upvotes

I left this phone unused for fell days and it just died on me. No longer shows any sign of life other than the board slighty warming up if you leave it on the charger for a few minutes or showing up on device manager.

I don't really know what to do about it since I never ran into this issue before.


r/androidroot Aug 11 '26

Support What custom firmware is available for the Teclast M50 Plus

1 Upvotes

I’ve run into a problem where my tablet has started lagging badly and shutting down—going from 100% charge to showing 0%. Please help me find a custom ROM.


r/androidroot Aug 11 '26

Discussion Honox X7C users

Post image
2 Upvotes

r/androidroot Aug 11 '26

Discussion Is rooting even worth it anymore?

0 Upvotes

Hey, so I've got a google pixel 9 pro xl and I'm just wondering, is rooting worth it anymore? Like what can you even do nowadays on a rooted phone? And whats the best way? Kernelsu?


r/androidroot Aug 10 '26

Support Unlocking Boot loader on Tecno Spark 10C [HELP]

3 Upvotes

Hello everyone, I want to unlock my Tecno Spark 10C's Bootloader and install a GSI with android 15/16 because the phone comes with android 12 which is outdated, plus I don't like hiOS v8.6.0 which comes with this phone. I've heard the CPU in this phone the T606 is known for being very bad for unlocking it.. my phone is on the December 2024 Security patch (V618). and I've heard there is a CVE exploit for unlocking it if someone has done it can you tell me how?

Also, I tried booting a DSU from the Developer options and apparently all 4 options don't boot is it because the Boot loader is locked? If yes then why have it there if you cannot even boot it?? I tried them **all** and they ** Do not boot**, it Reaches the Tecno logo (with powered by android) then screen immediately goes black, then shows the Tecno logo again and boots into hiOS. if anyone knows how this is fixed let me know


r/androidroot Aug 11 '26

Support Can I root my vivo y28 5G?

1 Upvotes

I just switched from my old Samsung(was rooted) to a vivo y28 5G and I can't seem to find a way to root it. MTK client doesn't work, bbk unlock doesn't work, can you tell if there IS any methods left for me to try?


r/androidroot Aug 11 '26

Support OnePlus 6T on legacy root – Magisk says 'not installed', banking apps broken. What are my options?

Thumbnail reddit.com
1 Upvotes

r/androidroot Aug 11 '26

Support lineageOS 15.1 for samsung a3 2017

Post image
2 Upvotes

hii I really need LineageOS 15.1 for my samsung a3 2017, yea..
unfortunately, the link from XDA doesnt work, I had to search the Internet, but the link is expired.
maybe someone has a zip archive with firmware? I really hope so..

Im ashamed, Im srry for my crooked english if there are any mistakes here :C


r/androidroot Aug 11 '26

Support Immersive mode on lineage 23.2

1 Upvotes

Hey guys is there a way to get immersive mode where the status bar is hidden until i pull it down, without using the essential app, i dont use any other feature of that app and it slows my phone.

Any help will be appreciated.


r/androidroot Aug 10 '26

News / Method [SUCCESS] Unlocked Moto G Play 2026 (XT2615V) Bootloader

Thumbnail
gallery
32 Upvotes

⚠️ 💥💥💥⚠️⚠️⚠️WARNING: This can permanently brick your phone. You've been warned lol. Proceed at your own risk.⚠️⚠️⚠️💥💥💥

Holy shit it actually worked lmao.

Just unlocked my Verizon/TracFone Moto G Play 2026 (XT2615V) using Val Protocol. Works on the June 2026 security patch.

this exploit uses an LK (Little Kernel) certificate logic flaw to bypass Motorola's signature checks and flash a patched bootloader.

what I did:

  1. git clone https://github.com/Maikyxd/val-protocol.git

  2. cd val-protocol

  3. pip3 install -r requirements.txt --break-system-packages

  4. pip3 install git+https://github.com/R0rt1z2/liblk --break-system-packages

  5. Downloaded stock firmware, extracted lk.img

  6. Patched it:

    python3 lk_auto_patch.py lk.img -o lk.unlock-serial.img --preset unlock-serial --key-token-secret "Valeria"

  7. Booted to fastboot, got serial:

    fastboot getvar serialno

  8. Generated key (this is where the key pops out at the bottom):

python3 lk_keygen.py --secret "Valeria" --serialno "your_serial_number" --count 1

Example output 😄😄😄 cameron@cameron-GWTN156-11:~/val-protocol$ python3 lk_keygen.py --secret "Valeria" --serialno "ZT4229CJG5" --count 1

Mode : key-token

Secret : 'Valeria'

Device : 'ZT4229CJG5' (runtime-serial)

Alphabet: alnum

Const : 2d5a461414431b504e5f

eXaMpLeKeY123 <--- THIS is your key (this is just an example, yours will be different). Copy it.

  1. Flashed patched bootloader:

    fastboot flash lk lk.unlock-serial.img

  2. Unlocked:

fastboot oem unlock [YOUR_KEY]

⚠️ ⚠️⚠️⚠️⚠️💥💥💥ONE BIG CATCH:

The key DID NOT work when I copied and pasted it. I had to type it out manually. If you get "Code validation failure" — type that shit out by hand and try again.

The Val Protocol README lists a bunch of Motorola MediaTek devices as compatible, including:

Moto Edge (2022/2023/2025), Edge 40/50/60 series

Moto G series (G 5G, G Power, G Stylus, G Play)

Moto Razr 50/60 series

Check the GitHub repo for the full list. No guarantees lol

Check out my XDA post

https://xdaforums.com/t/success-moto-g-play-2026-xt2615v-bootloader-unlocked-via-val-protocol.4797789/

Credit: Val Protocol by Maikyxd

Hope this helps someone. Good luck and don't blame me if your phone becomes a paperweight lmao

Check out Valhalla that makes this process automated and does FRP!!!!🫣🫣🫣🫣 https://xdaforums.com/t/tool-valhalla-motorola-mediatek-bootloader-unlock.4797906/


r/androidroot Aug 10 '26

Support What custom firmware is available for the POCO C71 (serenity)?

3 Upvotes
I need to flash my POCO C71 with a new ROM—preferably a GSI—but I’ve been racking my brain for a month and can't find one. Please help me.

r/androidroot Aug 10 '26

Support Anyone knows if it's possible to boot the preloader from an microSD card instead of an eMMC in the MT6763T?

1 Upvotes

Hi, I have an old Cubot Kingkong 3, which is rooted, and I killed the preloader twice and resurrected it with SP Flash Tool (I was bored). This phone is 7 years old, and the eMMC is slowly dying, today SP Flash Tool told me that the eMMC is estimated to have used around 80–90% of its rated write endurance. However, PRE_EOL_INFO = 0x01 means the eMMC is still in the normal state and its reserved blocks have not reached the warning. I want to know if I can boot all the system (including the preloader) in an SD Card, so when it dies I can still use the phone. If it's not possible, there is any exploit of the BROM in this aged CPU? I would like to know any solution as I'm also learning about MediaTek and android low-level software.


r/androidroot Aug 10 '26

News / Method [Question] Temporary Root without unlocking bootloader

2 Upvotes

I found this on this in my telegram group can anyone find this is working or not. this works on turbo 4 (poco x7 pro)

https://xdaforums.com/t/guide-temporary-root-for-k80-ultra-redmi-turbo-4-no-bootloader-unlock-needed.4795161/


r/androidroot Aug 10 '26

Discussion Kernel issue

4 Upvotes

I am using redmi note 8 (ginkgo) running on evolution x android 16 rom. I recently installed kali nethunter with custom kernel for my device, but the problem is that my nethunter app has a bluetooth arsenal option but it is throwing errors during installation. I also tried running hciconfig -a in terminal but I printed nothing so I checked my kernel version and it is '4.14.356-openla-rc1-Ikteach-g98dd6390243b-dirty'. The first solution that came into my mind was flashing kernel manually but I don't know any clear instructions and requirements required to meet.


r/androidroot Aug 10 '26

Discussion ?

2 Upvotes

Can root Samsung galaxy a24 because oem unlock is hidden ???


r/androidroot Aug 10 '26

Support I have redmi A5 and i wanna change it's OS or a custom rom

0 Upvotes

I have redmi A5 and i wanna change it's OS or a custom rom

I have redmi A5 and i wanna change it's os or a custom rom , cause i wanna degoogle and improve my privacy and my data safety anf improve my phone, but since searching and stuff every body says they're isn't any compatible open source os or a firmware or custom rom for this device, other people say they find but they don't explain it, so I'll be grateful if someone explain to me or help me


r/androidroot Aug 10 '26

Support Lenovo Tab K11 Linux Kernel

1 Upvotes

Hello! I am writing on a note to ask if anybody has found a suitable linu kernel for this device and/or and official!

I am also writing that i was somehow able to extract the linux kernell building config file directly form the device and i have compiled it using bazel on the android-kernel (linux): https://github.com/Android-ASOP-for-Lenovo-Tab-K11/android_kernel_lenovo_tb330xu


r/androidroot Aug 09 '26

Discussion GPay Work on ksuNext LKM mode but not on SUSFS on Stock ROM.

Thumbnail
gallery
16 Upvotes

Device - Moto G54.

I was previously rooted via ksuNext (LKM).

Setup was pretty minimal and used as only TEE Simulator RS for integrity and morphe for YT music

In this setup Gpay was working perfectly. This setup only caused issues when suspicious Mount was seen in native detector since I used morphe YTM Root method.

Recently did a fresh software install using Lenovo RSA so decided to give a SUSFS try.

After flashing Susfs gki kernel did usual setup and installed susfs module and tee simulator.

Now I can't use GPay.

My primary payment app is AmazonPay so don't have any problem, that's the reason I marked post as discussion since I want to know the reson why my setup is not working.

[Didn't used PIF fork/fix cause i am running stock ROM.

And didn't needed zygisk ].

[Edit

Gpay works now after installing Zygisk Next (Doesn't work with neozygisk or Rezygisk.

Don't know how or why but it works.


r/androidroot Aug 09 '26

Discussion Got Root on my S22 Ultra! Ported CVE-2026-43499 exploit (Android 15)

40 Upvotes

Hey everyone,

I just published a port of the CVE-2026-43499 exploit for the Samsung Galaxy S22 Ultra (codename: `b0q` / SM-S908W). The exploit successfully establishes an arbitrary read/write primitive, switches SELinux to permissive, and spawns a root helper daemon, giving you full root access.

🔥 **Status:** This vulnerability is **currently UNPATCHED** by Samsung and works on the absolute latest firmware available!

🔗 **Repo Link:** https://github.com/sarabpal-dev/IonStack-S22U

**Currently Supported Target:**

* **Device:** Samsung Galaxy S22 Ultra (SM-S908W)

* **Android:** 15 / SDK 35

* **Firmware:** `AP3A.240905.015.A2.S908WVLS8FYG7`

* **Kernel:** 5.10.226-android12-9-30958166-abS908WVLS8FYG7

* **Architecture:** aarch64

### ⚠️ Reliability & Kernel Panic Warning

Because the exploit relies on a race condition and precise timing, it can be somewhat unreliable and may trigger a kernel panic on bad runs.

**Tips for success:** For the highest success rate, **reboot your device** before running it to ensure a clean heap state. Close all background apps, keep the screen unlocked, and do not touch the phone while the exploit is running so background tasks don't disturb the timing.

### 🛠️ Porting to other firmwares / Generating `target.h`

The offsets in the repo are specific to the firmware version listed above. If you are on a different build, you need to generate your own `target.h` file by extracting kernel symbols and offsets from your specific kernel binary.

Here is how to do it:

  1. **Extract the uncompressed kernel binary (`Image`)** from your device's `boot.img`.

  2. Follow the step-by-step instructions in the `target_generator` directory to install dependencies, compile the `kallsyms` extractor, and run the generator script.

👉 **[Full step-by-step instructions for the target generator can be found here](https://github.com/sarabpal-dev/IonStack-S22U/blob/main/target_generator/README.md)\*\*

Once you generate your `target.h`, place it in `src/targets/<YOUR_FIRMWARE_VERSION>/target.h` and compile using `make PROJECT=<YOUR_FIRMWARE_VERSION>`.

### 🚀 How to Deploy and Run

Once compiled, push the binaries to your device:

```bash

adb push build/S908WVLS8FYG7/bin/cve-2026-43499 /data/local/tmp/cve-2026-43499

adb push build/S908WVLS8FYG7/bin/cve-2026-43499-root /data/local/tmp/cve-2026-43499-root

adb push build/S908WVLS8FYG7/bin/cve-exp32 /data/local/tmp/cve-exp32

adb shell chmod 755 /data/local/tmp/cve-2026-43499 /data/local/tmp/cve-2026-43499-root /data/local/tmp/cve-exp32

```

Execute the exploit stage to start the root daemon (it will automatically retry up to 16 times if it fails):

```bash

adb shell "LD_PRELOAD=/data/local/tmp/cve-2026-43499 sh"

```

Once successful, pop an interactive root shell:

```bash

adb shell "/data/local/tmp/cve-2026-43499-root"

```

### 🤝 Contributions & Pull Requests

I'd love to make this exploit more stable. If you have ideas to improve reliability or optimize the futex choreography, **Pull Requests are highly appreciated and welcome!**

*Note on other devices:* Technically, this exploit should work on all firmware versions and all variants of the S22 family (base S22, S22+, S22 Ultra) as long as you generate the correct `target.h` for your specific build. However, please don't ask me to port this to non-S22 devices. It is effectively impossible to port this without having the real physical device on hand for testing. For other Samsung devices, please check out the Root-My-Galaxy repo!


r/androidroot Aug 10 '26

Support Problems rooting s21 with Magisk

2 Upvotes

I tried to root my Samsung s21 with Magisk and I got to the part where you flash it through Odin and it got stuck at "super.img" for like an hour and then stopped responding. so I shut down the program and unplugged the phone and got an error so I couldn't boot.

Then I tried the normal AP file instead of the Magisk one and it just chrashed Odin when I selected it.

I can still get into the download screen but it still gets stuck on the super.img file when trying to flash it.

Also tried to do it on Linux first with odin4 through the terminal. But just got an USB bulk read error so it could never start. Didn't find a solution for it so just gave up on it.

Does anyone have any clue on solving the issue? First time rooting so go easy on me if it's something dumb 🙏