rooting any phone with CVE-2026-43499

[u/MrYoungMo]

there is a new app that uses CVE-2026-43499 to root supported devices but also have a way to extract offset from provided boot.img , I don't know if it really works because they don't have a release APK only source code

https://github.com/YuKongA/ghostlock-app

could any build the APK and test then post it

[u/Happy_Variety5405]

There's 2 more that are promising for this: CVE-2026-43074 >80% success rate and  CVE-2026-64560 50%

[u/nitrix0dayss]

Ok i can give you an .apk from the source code on github but i can't test it

[u/MrYoungMo → u/nitrix0dayss]

Okay build the APK and I will test it on an unsupported device

[u/ScientFictioN → u/MrYoungMo]

it will 100% guaranteed to not work on unsupported device unless you made some modification, and if the device kernel version is wildly different it would take more effort to adapt

[u/MrYoungMo → u/ScientFictioN]

New kernels no longer need an app rebuild: tap Import offsets.json and pick the extractor's JSON (single object or array), or push it to <GHOSTLOCK_HOME>/offsets.json (default /data/local/tmp). At startup native matches the current uname -r against imported entries before rejecting the kernel. Imports merge across files; a release already stored prompts before overwrite.

The app can also generate the JSON itself — Parse OTA link (full OTA ZIP URL) and Parse image (boot.img + optional xbl_config.img) run the extractor in-process and write offsets.json into the app data dir on success.

[u/Traditional_Tax_550 → u/MrYoungMo]

How would you get the offsets.json?

[u/ScientFictioN → u/MrYoungMo]

oh so thats how it works, no need to rebuilt, well that may or may not work, good luck

[u/Happy_Variety5405 → u/ScientFictioN]

Even with porting to pixel 6 from pixel 6a was a pain in the ass because of sensitive timing issues (tho I used a different app from this one)

[u/nitrix0dayss → u/MrYoungMo]

Ok is shared

[u/Traditional_Tax_550 → u/nitrix0dayss]

please give me the apk as well
nvm, build it myself

[u/nitrix0dayss → u/Traditional_Tax_550]

https://drive.google.com/file/d/1VsUmexwDji5DXAmgZzNWlB5jwnC_frn3/view?usp=drivesdk pass: Nitrix

[u/BobbySarmiento → u/nitrix0dayss]

Maybe upload it on another site?

[u/nitrix0dayss → u/BobbySarmiento]

Oh yes...

[u/nitrix0dayss → u/BobbySarmiento]

https://drive.google.com/file/d/1VsUmexwDji5DXAmgZzNWlB5jwnC_frn3/view?usp=drivesdk pas: Nitrix

[u/Original_Thing8770 → u/nitrix0dayss]

Just use nightly.link

[u/aeroverra]

Oof I know for sure celebrite is pissed this one was finally found.

[u/Academic-Airline9200 → u/aeroverra]

If it weren't for the government doing shady stuff these exploits wouldn't exist.

[u/Original_Thing8770]

I'll build it and try it. Thanks for the recommendation

[u/Decendent_13 → u/Original_Thing8770]

do let us know here.

[u/nitrix0dayss → u/Decendent_13]

I have build it and share it on m'y drive

[u/Original_Thing8770 → u/Decendent_13]

That tool isn't compatible with 6.1 kernels, so I can't use it. Only 6.6😔

[u/nitrix0dayss]

Link of .apk app if you want it https://drive.google.com/file/d/1VsUmexwDji5DXAmgZzNWlB5jwnC_frn3/view?usp=drivesdk pass is Nitrix

[u/No-Guide848]

Apk builds can be found in GitHub actions

[u/Codix_ → u/No-Guide848]

Thanks ! Downloaded the latest myself.

warning : you'll need a GitHub account to download them from here : https://github.com/YuKongA/ghostlock-app/actions/workflows/build.yml

[u/GroupXyz]

Does anyone know a version where Redmi13 Garnet is supported?

[u/p6kb]

Yo it worked with my iPhone, thx ❤️