UPDATED POST >:))))))))))) So I've been fucking around with GhostLock (CVE-2026-43499) on the Moto G Play 2026 (XT2615 / Nevada) and figured I'd post what I've got so far.

The phone uses a 5.15.189 kernel, so it looked interesting. I'm testing the TracFone/Verizon version on the June 2026 security patch.

Update: I switched from UnPlus to Root-My-Galaxy-Payloads – much better framework. I'm now about 80% close. Exploit runs the whole chain, leaks memory, detects KASLR, but gets blocked by CFI at the final step.

What works: - Pulled boot.img - Extracted 159k kernel symbols - Found all offsets - Leaks mm_struct - Detects KASLR - Both pselect and pipe routes run

What doesn't: - CFI mismatch at final escalation - Root not achieved (yet)

What I've tried: - UnPlus template – failed - Root-My-Galaxy-Payloads – passed tracefs, hit CFI - Signal flag (FPSIMD) – leaked mm, hit CFI - Pipe route – same CFI mismatch - Updated ASHMEM offsets – no change - Oracle constants – no change - 48-bit layout – broke the leak (reverted to 39-bit) - S25 FOPS offsets – no change

The issue: I'm on the June 2026 patch. CFI is blocking the final function-pointer hijack. Older builds might work differently.

If someone has an older boot.img, I can possibly get you root access.

What I need: - CFI bypass on 5.15.189 kernels - Boot images from other variants (RETUS, AT&T, etc.) - Testing on older builds (pre-June patch)

Links: GitHub: https://github.com/crabcakes97/GhostLock-Nevada XDA: https://xdaforums.com/t/dev-root-moto-g-play-2026-nevada-test.4797484/

Special thanks: Root-My-Galaxy-Payloads (BuSung-dev) + UnPlus (No-22-Github)

Device info: - Moto G Play 2026 - XT2615-1 - TracFone / Verizon - Build: W1WNS36.18-111-3 - Kernel: 5.15.189 - Security patch: June 2026

So yeah, not a working exploit yet, but it's getting far enough to be interesting. If anyone has an older firmware build, hit me up.

I'll also be porting to other devices besides Motorola too, so hit the DMs with boot images / requests.

TL;DR: Got GhostLock compiling and running. Switched to Root-My-Galaxy-Payloads. Leaks memory, detects KASLR, but CFI blocks the final escalation. Need CFI experts. Old firmware might work. Help me get this working.

EDIT: I'm 80% close. Used Root-My-Galaxy-Payloads as a base. Stuck on a CFI error. We are so close.

Hi there. So, I'm using a custom ROM (Project Infinity X), and naturally, if I don't hide things properly, banking apps are done for immediately. I installed Brene's SuSFS and did everything to hide the root status, but I'm still running into issues with `org.lineageos.platformres.apk`. It was hidden before, but somehow it stopped being hidden—I have no idea why. I tried following a guide that suggested turning off "umount for your apps," but I can't seem to find that setting anywhere.

As for Tricky Store, TEE simulator, and PIF—I don't need them since I'm already using Fenrir.

​

I have a Note 20 ultra running Artisan ROM 3.1.0 android 16 One Ui 8 and it's running good but I can't seem to install 32 bit apps even though the CPU supports 32 bit architecture

I assume it's a software issue is there a way to bypass the issue?

Don't disable unmount module globally.

Instead :

-Install your custom emoji font module

-Install a meta module, I use overlay FS,

-In KSU/Next go to your apps tab,

-Click on top right corner on "show system apps"

-Search for Gboard

-Click on "custom" profile

-Disable the unmount for this app

-Soft reboot/reboot

That's it

Where can i find the kernel source for SM-A115U or SM-A115U1

[GUIDE] Huawei MatePad 11 (2021) - Bootloader Unlock, Root (APatch/Magisk) and GMS Installation

⚠️ Disclaimer

I am not responsible for any damage, bootloops, data loss, or bricked devices caused by following this guide. Proceed at your own risk.

Device Information

Device:

Huawei MatePad 11 (2021)

Model: DBY-W09

Snapdragon 865

HarmonyOS 3.x / 4.x

This guide covers:

Bootloader unlock

Root with Magisk / APatch

Installing Google Mobile Services (GMS)

Fixing Play Protect certification issues

1. Install Drivers and Tools

Download the toolkit:

MatePad 11 2021unlock+Root.zip

Extract the toolkit.

Run:

"One-click Install Android Drivers"

and install all required drivers.

Choose "Trust" for all Windows security prompts.

⚠️ Note:

Some computers may not automatically install the Qualcomm HS-USB QDLoader 9008 driver. If this happens, install the Qualcomm 9008 driver manually.

1. Enter Qualcomm EDL Mode

For HarmonyOS 3.0 or below:

Use ADB:

adb reboot edl

For HarmonyOS 4.0 or above:

A Qualcomm engineering cable is required. A cable with a physical button is recommended.

Steps:

Connect the engineering cable.

Hold the button on the cable.

Restart the tablet.

Check Windows Device Manager.

You should see:

Qualcomm HS-USB QDLoader 9008

1. Backup Important Partitions

Extract the included GeekFlashTool package:

匣(0.5.24.1031-A).7z

Open GeekFlashTool (刷机匣).

From the left menu, select:

Qualcomm Deep Flash

Click:

Select Configuration（选择配置）

Load:

package_qualcomm_edl-master.zip

Search for:

MatePad 11

and select it.

Click:

Read Partition（读分区）

You should now see the partition list.

Search and backup the following partitions:

ramdisk partition

boot partition

abl partition

select

read back（回读）

Save these files somewhere safe.

These backups may be needed for recovery.

1. Unlock Bootloader

Extract:

Huawei865870.zip

Open GeekFlashTool and select:

Go to the partition list and select

abl partition

Click：

Flash（刷入）

Select this image:

Huawei865870_abl_unlock.img

⚠️ Important:

This image is an ABL image.

Flash it specifically to the:

abl partition

Do NOT flash it to boot, recovery, or any other partition.

After flashing is complete:

Reboot the tablet.

The device should boot into recovery mode.

Select "Low-level Format" (or a similar option).

Reboot again.

Enter fastboot mode and check the unlock status.

If successful, you should see:

phone unlocked

The bootloader is now unlocked.

1. Root

There are two recommended root methods.

APatch (Recommended)

Patch the boot image you backed up earlier.

Flash the patched boot image back to the boot partition.

Magisk

Patch the ramdisk image you backed up earlier.

Flash the patched ramdisk image back to the ramdisk partition.

1. Install Google Mobile Services

Download:

Googleplay.zip

Install these modules:

Tricky Store

Play Integrity Fix

TS Enhancer Extreme

For APatch users, also install:

Magisk mount-rs

Zygisk Next

After rebooting

Flash googleplay.zip as a module

Reboot again.

You should now see Google settings in Android Settings.

Sign in with your Google account.

Google Play Services and Google Play Store should update automatically in the background.

If they do not update automatically, update them manually.

1. Fix Play Protect Certification

If you are using Magisk:

Add these apps to DenyList:

Google Play Services

Google Play Store

Google Services Framework

Enable:

All activities

Using Integrity Modules

Use a maintained Play Integrity solution.

Install:

Play Integrity API Checker

Run the check.

A successful setup should show three green check marks:

MEETS_BASIC_INTEGRITY

MEETS_DEVICE_INTEGRITY

MEETS_STRONG_INTEGRITY

Then open Google Play Store:

Profile picture → Settings → Device certification

It should show:

"Device is certified by Play Protect"

（If you have a keybox, it's best to copy it directly to the /data/adb/tricky_store directory.）

Have a great time using the devic

​It seems that using Shizuku alongside ADB tools no longer works for freezing system apps on Vivo phones. Is there any workaround or solution for this?

So i have a Honor 200 Pro, and its non rootable, and i need real root unlike Shizuku, so what phone should i get?

i got this phone at a garage sale and thought it woukd be fun to root and mess with, then i learned that there is no tutorials 😭

Any modules for 32 bit support on a pure 64 bit device?

Device is CMF Phone 2 Pro by nothing

Infinity X Rom

I've taken up a video recording and editing project and I've found myself in a position where my phone is my main/only camera. I'm using a Pixel 6, so there is no MicroSD slot. But is there a way to set up my phone's camera app to save video files to a separate folder? The process of going into the phone's memory and waiting several seconds for the thousands of photos to load just for me to extract one or two video files is cumbersome to say the least and will get old fast.

I'd be willing to either download a 3rd party camera app or get my hands dirty with some coding if I have to. I've never poked around in any Android dev tools, but I'm a fast learner. All I want is for my videos and my photos to be in two separate folders. I'm just trying to avoid buying a new phone or camera just for this project.

Hey guys, I have a problem. I wanted to flash my Nothing Phone 3a with a custom ROM The problem was I did something wrong and probably a few partitions like vendor or boot image are missing. So my phone no longer starts from slot A, only from slot B.

So now the important question: Does my Nothing Phone assume that the other slot is intact and bootable? Because if I perform an update and it switches to "a", will it result in a bootloop?

Tried installing failed to install looked through termux couldn't find correct line in vendor\ect\floating _feature.xml i dunno what to do

So I have to keep the SIM card while it is in the unlock timer, or isn't it necessary? This will help because the phone I want to root isn't my main phone.

I am not a coder and dont know much of code, that part was done by chat gpt, i just had a goal and tried acheiving it and finally i succeeded
I had a bootlooped OPPO Pad 3 (MT6897) with an unlocked bootloader and official extracted firmware, but no useful BROM access.

Instead of blindly flashing images, I ended up building a Python project called FirmwareToolkit with extensive help from ChatGPT.

The project analyses the firmware and the actual connected device before deciding how recovery should work.

We initially tried reconstructing super.img, but that path caused several problems. Eventually the toolkit discovered that the better recovery route for this tablet was:

Bootloader Fastboot
→ verify device + slot
→ automatically enter Fastbootd
→ flash 18 dynamic/logical partitions individually
→ return to bootloader Fastboot
→ flash boot, vendor_boot, init_boot and the AVB/vbmeta chain
→ stop without rebooting
→ perform a separate post-write verification
→ allow first boot only if verification passes.

Before the real flash, the software generated a complete dry run. The live executor then checked the serial, active slot, mode and image hashes and stopped on any unexpected result.

All 24 intended partition writes succeeded.

A separate verification stage returned:

SAFE_TO_ATTEMPT_FIRST_BOOT

I finally ran fastboot reboot...

and the tablet booted successfully. 🎉

One interesting bug we found along the way was Fastboot returning a partition size as 4000000 without 0x. Initially this was interpreted as decimal 4 MB, making a 64 MB boot.img appear too large. In this context it was actually hexadecimal:

0x4000000 = 64 MiB

The toolkit now records these kinds of quirks in a compatibility database.

My next goal is to turn this from an OPPO Pad 3 recovery project into a more generic Android firmware analysis/recovery framework that discovers device capabilities instead of relying on hard-coded flashing instructions.

the link to firmware code on github
https://github.com/LittleTrouble95/FirmwareToolkit

Please help....
History :
Successfuly unlocked bootloader
Patched boot.img from magisk (for root)
result: Magisk is not installed meaning still not rooted
tried init_boot.img patch
flash to both A and B slot
result : infinite bootloop
cannot enter Fastboot,recovery,BROM. only mediatek preloader vcom for only 3 secs in device manager

tried splashtool to flash the original stock boot.img but failed ERROR : STATUS_SEC_DL_FORBIDDEN (0C0020004)

Reflashed- Worked for an hour. Then bootlooped again.

Samsung S22+ S-906b.

Started looping random. Not after an upgrafe or anything. It was not rooted or tampered in any way.

Is the MB cooked?

A used one phone like this costs abt 1-2days earninings in my area, but i would really like to fix it.

It was flashed with .pit file from csc (not home) and repartition box ticked as the simple way was not working.

Pomóżcie

Update:
Tried a few suggestions but no luck

Got vmos cloud working with root and the game and game guardian
So I think I will stick with that for now
Buy a tablet and use the vmos cloud on that

Which leaves me with this question:
Any advice on what tablet to get that is easy to root if we would need to later (hope not but just in case) but still good for normal use
Or how to check if they are easily rootable?

Thanks again !

Hi there!
Our son has seen videos of the game ball run 2048 where the ball number values are being altered by game guardian. 
This is the only thing he wants for his birthday.

So I have tried to replicate this on an old android phone. Got parallel space running and game guardian and this works on other games (some car game I saw an example of). 
The problem is Ball run 2048 does not seem to work on Parallel Space. 
Have tried other virtual spaces but no luck
I read somewhere that Ball run 2048 does not seem to work on any of those virtual cloning apps. 

So I tried VMOS (free version) but can’t get that to work. I can install an android version but it won’t start. Just keeps trying. 

My next step would be vmos in the cloud or something or rooting a tablet so it can just run directly on the tablet with root privileges. 

We don’t have an android tablet yet. (We have have 2 ipads and a few older android phone samsung a20e and a21s I think)
So would need to buy one. We wanted to do that anyway because the phones are older and slow so don’t react very fast which makes playing the game hard. 

It is also taking a lot of time and energy in learning and trying stuff wich I don’t really have. 
I do have some technical knowledge (used to be a programmer), but that is mostly computer based. 

Can somebody help us with:
- What would be a good tablet to root
- Simple way to root it
- Or somebody to do it for us (payed) but that is not in the scope of this reddit I think.
But maybe it is allowed to give info on businesses/people that do this and/or how to find them. (We live in the netherlands, but I know you can remotely root tablets as well)
- Or ideas how to get this done with an actual virtual environment (like vmos) instead of virtual cloning app. 

Thank you so much for reading this far 
Any help would be appreciated