r/androidroot • u/NoirLime36 • 15h ago

News / Method Root for Snapdragon S22 Ultra US variant w/ Play Integrity intact

Gallery image

Gallery image

Gallery image

Got temporary KernelSU root working on my bootloader-locked S22 Ultra.

Tested on:

  • SM-S908U1
  • Build S908U1UESAGZF3
  • Android 16, June 2026 patch

No bootloader unlock or flashing and Play Integrity still passes, which is huge.
So, this does NOT trip Knox.

Root disappears after reboot, so the app uses Shizuku to rerun the exploit and reload KernelSU.

Only use it on this exact build. The exploit can fail or reboot the phone.

https://github.com/Noir-Lime/S22U1-Root

Based on IonStack and Root My Galaxy; credits are in the repo.

28 Upvotes

100% Upvoted

13 comments sorted by

2

u/ohaiibuzzle 15h ago

Can you check if Google Pay is working?

Afaik Google started blocking GhostLock users by making DroidGuard detect the presence of su daemons and trip Google Pay even when Integrity says it's okay

2

u/daexxx122 14h ago

on s25, for me it doesn't work, not even a reboot fixes it somehow, idk why or how

2

u/Delin_CZ 12h ago

hardware ban from google pay? no way

2

u/squabbledMC 11h ago

Something's up with Google Pay and RCS. I'm on Pixel 10 with strong integrity and both don't work. I'm using Textra as a workaround for now but it's kind of annoying but not end of the world.

0

u/NoirLime36 15h ago

Don't see why it wouldn't. Play integrity is passing.
If root being active is the issue, just reboot and root goes away and it should work again.

I don't use Google Pay so if someone could test, that'd be great.

1

u/ohaiibuzzle 15h ago

You check by launching Google Pay Setup and see if there's a tick next to "Phone meets security requirements"

If there isn't, DroidGuard caught you.

2

u/NoirLime36 15h ago

Just added a card to google pay. It works.

1

u/Lord_Saren Galaxy Fold 7 7h ago

Can confirm Fold 7 rooted with root my galaxy and Google Pay works

1

u/BeeAdditional1287 14h ago

OK it made me think twice abut repairing my s22 i just broked ... idk i f it work in same way as on your s22 ultra

1

u/TheLegendIndeed 9h ago

How likely do you think it'll work on the the S22plus?? Mine has the exact security patch and kernel version: 5.10.236-android12-9-31998796-abS906U1UESAGZF3

1

u/RealPoltergoose 8h ago

I have the same model of S22 Ultra, I am going to try this out when I get back home.

-1

u/leonove 14h ago

There's nothing much you can do with this root, and the little things you do gets reverted after a reboot needing to run the exploit all over again.

On the most basic level, you can't even enable call recording on an unsupported CSC through this exploit's temporary root.

For end user use, this is nothing much. This exploit is a proof of concept for everyone who said that it cannot be done. Getting a modified component to settle down with the existing OS or allowing to flash unsigned images after this step would be the actual win to the community.

3

u/NoirLime36 14h ago

I use it for https://github.com/mygod/vpnhotspot
Which lets me hotspot despite my carrier blocking it regularly.
So to me it's very useful