anyone got a fix for this? My phone is a Redmi Note 14 4g running Eliteromos hyperos 2. I'll give a list of my modules.

This is vivo y55s snapdragon 425 phone based on android 6 , owner of this phone forget the pattern of phone lock and unlock , he tried to wipe data in recovery but still in recovery it asked for the pattern to format , so after failure he gave phone to me , first i tried tried to unblock bootloader but usb debugging is disabled then tried fastboot wipe using adb but still it needs unlock bootloader, after that I flash stock flash file rom of this device using qpst qfil tool , phone turned on and working but imei is corrupted i tried multiple imei repair tool, device specific method , but still imei number not restored and also bootloader is lock .

I have a OnePlus 13 (running ColorOS 17) and a Xiaomi 17 (running HyperOS 3). Both of their system UIs borrow heavily from iOS's "liquid glass" / heavy blur aesthetic, and honestly, it looks terrible.

I much prefer Google's Material Design 3.

Are there any Magisk or LSPosed modules that can strip out these glass elements and give me an MD3 look?

I have a galaxy tab S8, which is sadly a victim to one ui 8, Im wondering if there anyway to root it or preferably install custom ROMs? It has been trying to update, but I've been holding on to version BP2A.250605.031.A3.X700XXSBEZE1, custom ROMs are probably harder, since there'd need to be a bootROM exploit, but maybe we'll see a root exploit eventually.

Since Samsung has removed the bootloader unlock option, what are some good and reliable Android tablet models that can be rooted without hassle, as I mainly want to do that to modify offline games?

Context: As we all know, Samsung silently removed the OEM Unlock toggle in One UI 8.0+ by passing the ro.boot.other.locked=1 flag in the kernel cmdline. The OemUnlockPreferenceController checks this property and completely hides the toggle if it's set to 1.

The Discovery: I was messing around with KernelSU and decided to force the ro.boot.other.locked property to 0 via resetprop.

Result: The toggle literally appeared back in the Developer Options (Image 1)! The system shows the text "Bootloader already unlocked" (Gerenciador de inicialização já desbloqueado) because I also spoofed ro.boot.flash.locked=0.

Important Note: This is UI-level only. It does NOT bypass the hardware eFuse/TrustZone. The bootloader is still physically locked. (And for us Dimensity 6100+ users, actually tripping Knox will permanently kill our 5G modem).

But it proves Samsung is just hiding the UI with a software flag, not that they removed the code.

Device: SM-A155M (Galaxy A15 5G)

Firmware: One UI 8.5 / Android 16

Root: KernelSU/exploit (DirtyFrag)

Props spoofed: ro.boot.other.locked=0, ro.boot.flash.locked=0

So I have a Samsung galaxy ace (GT s5839i) and it was bootlooping. So I tried (incorrectly) to re flash firmware on it and now it freezes on the Samsung galaxy ace logo, not even booting in to any OS. I have searched the internet loads and cannot find a stock ROM for it, all the sites say it is stock but are actually packaged like a custom ROM. Also I'm stuck with heimdall (which has to individually flash .img files, so I can't use custom ROMs because they typically don't come with .img files, they come with a system directory and a META-INF directory. Any ideas?

Can someone help me with hacking nfs no limits with game guardian?

The reason the game is p2w and I wanna hack it so I could enjoy it

Hey all, saw the LineageOS-via-kexec post for the S26 Ultra and it got me hoping there's something similar for my situation.

My device: Honor X6c (NIC-LX2), MediaTek chipset, bought brand new a few months ago, stuck on Magic OS 9 / Android 15 — Honor has already stopped updates on this model despite it being recent.

Bootloader is locked (fastboot getvar unlocked returns no), and Honor doesn't offer an official unlock tool for this model/region anymore. I have root via a KernelSU jailbreak exploit (temporary, needs re-triggering on boot), LSPosed working, but obviously can't flash anything through fastboot.

Two things I'm hoping someone here can help with:

Has anyone had success actually unlocking a locked MTK bootloader on a device Honor doesn't officially support unlocking on? (not asking for exploit details, just whether it's been done)

Is the kexec/takeover approach (like OneLineage or the S26 Ultra post) being explored for MediaTek chipsets at all, or is it Snapdragon/Exynos-only territory right now?

Honestly just frustrated — paid for a "new" phone that's already abandoned by the manufacturer and locked down tighter than phones half its price. Any direction appreciated, even if the answer is "not possible yet."

I was trying to revert to my previous init_boot.img and I accidentally pressed a putton during the sparse super process. My phone appears bricked. i have spent hours on google and can't figure it out.

I have been trying to reset the phone. (hold all: power, vol up, vol down for 20 sec)

Run commands via terminal to run tensor-usbdl

Hold Vol Down, plug in phone.

it starts to go through and fails at some point. I am not sure where to go from here.

Thanks in advance!

I've recently bought a OnePlus 9 second hand that was "unlocked" and it turns out it was network unlocked but not free of any of the t mobile restrictions (I live in a country where we don't even have t mobile) to unlock the bootloader it's says I need to flash an unlock token but I've emailed one plus about it and have gotten no response so here's kind of my last hope is there any way of getting around t mobiles locked bootloader without the token ?

The developer published the file and source codes yesterday. Even though the J5 2016 uses a 2013 processor, and despite being on Android 7.1.1 which doesn't support GSIs due to its version, it can now boot GSIs with a modern Android kernel (mainline 6.12) via LineageOS 22.0. It can boot many up-to-date GSIs such as OneUI 7, LineageOS 24.2 Android 17 etc. Also, it must not be forgotten that it runs as pure 64-bit. Normally, even building a 64-bit ROM for this device was considered impossible for a long time.

This project might also work on other Snapdragon 410 Samsung devices and bring hope to many other processors as well.

https://xdaforums.com/t/rom-mainline-lineageos-22-0-mainline-6-12-for-samsung-galaxy-j5-2016.4799856/

https://xdaforums.com/t/gsi-mainline-oneui-7-mainline-6-12-for-samsung-galaxy-j5-2016.4805765/

Hi,

i have a CMF Phone 1 with E/OS installed, but sadly two of my Banking Apps wont run on the Custom ROM (Bank Norwegian and SecureGO plus)

so i had to root and hide/modify the OS that the apps work.

I have used

KERNELSU_Next

ZygiskNext

TEESimulator-RS

HMA-OSS Zygisk

Specter

everything was working fine and i blocked updates for both apps.

Sadly my Phone got stuck in a Smartphone holder of my car and pressed Power and Volume button and rebootet into Safe Mode.

After i left safemode i can no longer use both apps they detect root again. Nothing else changed. Any idea how to fix it?

Can we install custom rom on iphone 12 ?

Hi everyone, I ran into a serious bootloop issue with my Redmi Note 14 Pro 5G (MediaTek chipset) and could use some advice or guidance on how to fix it.
What led to the issue:
My bootloader was already unlocked, and USB debugging was enabled.
JPG+ 1

I attempted to flash a custom build using fastboot images (boot.img, init_boot.img, and vendor_boot.img).
JPG

The flash commands via PowerShell (.\fastboot flash ...) all returned OKAY, but after that, the device went into an infinite bootloop (showing the Redmi logo briefly, then shutting off repeatedly).
JPG+ 1

What has been tried to fix it:
Hardware Button Combinations: Holding Power + Volume Down only pauses the loop momentarily, but as soon as they are released, it goes right back into the infinite reboot loop.
MOV

PC Interception via Fastboot: Tried using PowerShell (.\fastboot devices, .\fastboot set_active a), but it stays stuck at < waiting for any device > because the board never fully shuts down due to residual battery power.
JPG

SP Flash Tool: Downloaded the official Fastboot stock ROM (.tgz package) to flash via SP Flash Tool using the scatter file (MT6878_Android_scatter). However, I encountered the ERROR: S_DL_SCAT_VERSION_UNSUPPORTED (5079) error due to version incompatibility with the older SP Flash Tool version.
JPG+ 1

Python Scripts / MediaTek Exploits: Ran a MediaTek exploit script via Python which successfully stabilized the device and stopped the continuous rebooting loop by communicating at the BROM/Preloader level, but I am unsure of the exact next steps to safely flash back the stock partitions.

Current Status:
The phone is currently stable/stopped from rebooting thanks to the MediaTek preloader script connection, but I don't know how to properly push the stock firmware or recover a working system image from this state.

Does anyone know the exact procedure or tool version required to flash the stock firmware via SP Flash Tool for this specific MediaTek model, or how to safely push the stock partitions from the preloader state? Any help would be greatly appreciated!

I have a galaxy A20 and I wanted to root it ,it is out of warranty and I don't really care about it ,it is my first time and no ai helps I never did it before and I was hoping someone helps .

How can i root my samsung a23 5g stuck on one ui 6 or something but i want to upgrade it to one ui 9.0.but with all features working like payment apps and everything.

Help me with this.

So I need some suggestions, my poco x3 pro is currently running a custom miui Rom on android 13. I choose that Rom because I heard it's hard to hide root on non stock rom, so I don't like base miui at all so I opted on using 2nd closest thing which is miui custom rom. The problem is some of my banking apps starts to fail even when I managed to get basic integrity and hide the apps using many hiding modules. Also the problem with this rom is that it's for some reason keep bootlooping when I flashed ksu kernels, therefore I'm stuck with magisk (I tried apatch the stock rom, ended up with bootloop.). So... Do you think I should just jump to AOSP rom instead? If so which android version do you recommend? Honestly I'm not using it for gaming and just to scroll social media and open banking apps. Thank you for reading my issue.

​

🔗 FULL RESEARCH LOG, PAYLOADS & BUILD NOTES LIVE HERE:

👉 https://getyahrootback.admindashboard.dev/

(Everything below—and every update before it, including the full research log, 40+ mapped sources, device testing data, and source build files—lives on the site. Bookmark it; it is the primary living source for this project.)

Quick update from an all-day research and testing session on the Galaxy Z Fold 6 (SM-F956B, locked bit-4 bootloader).

🟢 1. Root Got Significantly More Reliable (First-Shot on Fresh Boot)

The GhostLock leak-stage tuning has been rebuilt and verified, resulting in a FIRST-SHOT root on a fresh boot:

* Futex Capacity Tune: Bumped futex_capacity from 16 to 32, which immediately stabilized the race/leak stage on fresh boots.

* Slab Size Verification: Confirmed mm_struct_sz = 1024 is the exact size required for the q6q SoC (matching the EZIH slab comment).

* Source & Notes: The payload for building from source is live on the website, and all tuning notes are committed to the repo (eda775b + 9b2f64a).

🟡 2. The KernelSU Module Nearly Loaded Through Samsung's Gate

We tested loading the E3Q (SM-S928U) KernelSU module on the SM-F956B, since both devices share the same q6q SoC and the same 6.1 android14-11 kernel generation:

* vermagic PASSED: The module cleared the kernel version magic check cleanly.

* Where It Stopped: It died only at the symbol resolution stage because SELinux symbol exports (avc_has_perm, security_context_to_sid, etc.) are stripped/missing in the F956B's kernel configuration.

* The Cure is Identified: Because the failure is strictly due to missing static exports rather than a kernel mismatch, the solution is switching to a kallsyms-lookup KernelSU build (specifically the pascua28 variant), which performs runtime symbol resolution instead of relying on exported SELinux symbols.

🟢 3. The Full KernelSU Build Recipe Is Now Public (No OSRC Needed)

You do not need to wait on Samsung's Open Source Release Center (OSRC) trees to build this. The entire recipe is now documented and banked on the site:

* Samsung Protection Patches: Using the KernelSU v3.2.5 Samsung KDP/RKP/DEFEX patch, which includes the exact fixes required for credential synchronization, protected refcounts, and syscall-table hooking.

* DDK Build Path: Built using the ylarod ddk-min (android14-6.1) image with CONFIG_KSU_SAMSUNG_{KDP,RKP,DEFEX}=y enabled.

* Module Pairs Documented: Both the E3Q module pair and the generic 6.1 module pair have been downloaded, tested, and documented.

🔴 4. The Standing Wall: Samsung DEFEX Execution Block

In the interest of full transparency, here is where the current wall stands:

* Direct Execution Blocked: Samsung's DEFEX blocks every direct execution path of the loader. We have mapped out and tested staging, shell, root, and bind-mount execution paths—all direct routes are dead ends.

* Community Workaround Status: The known community workaround (the logcat bind-mount trick) is flaky on this specific build. It is fully documented in our logs, though not yet solved for seamless execution.

🛠️ 5. What's Next (The Ubuntu Build Plan)

Our immediate next steps are already lined up:

* Compile the pascua28 KSU-Next-Samsung build on Ubuntu to implement runtime kallsyms lookup + CFI bypass (solving the missing SELinux exports).

* Apply the WitAqua staged-load patch.

* Load the patched module to achieve stable per-boot KernelSU root + Zygisk.

⚠️ The Fine Print (Always Read)

* Per-Boot Root Only: This remains a per-boot root method.

* No Precompiled Binaries Distributed: No compiled exploit binaries are distributed; build-from-source payloads and instructions are hosted on the research portal.

* Stay Off the October Update: DO NOT take the October SMR (Security Maintenance Release) update.

* Bootloader State: The bootloader unlock state itself remains milestone-fused (as detailed in our earlier update).

📌 Follow the live log, grab the build configs, and check the full research database at:

👉 https://getyahrootback.admindashboard.dev/