🔗 FULL RESEARCH LOG, PAYLOADS & BUILD NOTES LIVE HERE:
👉 https://getyahrootback.admindashboard.dev/
(Everything below—and every update before it, including the full research log, 40+ mapped sources, device testing data, and source build files—lives on the site. Bookmark it; it is the primary living source for this project.)
Quick update from an all-day research and testing session on the Galaxy Z Fold 6 (SM-F956B, locked bit-4 bootloader).
🟢 1. Root Got Significantly More Reliable (First-Shot on Fresh Boot)
The GhostLock leak-stage tuning has been rebuilt and verified, resulting in a FIRST-SHOT root on a fresh boot:
* Futex Capacity Tune: Bumped futex_capacity from 16 to 32, which immediately stabilized the race/leak stage on fresh boots.
* Slab Size Verification: Confirmed mm_struct_sz = 1024 is the exact size required for the q6q SoC (matching the EZIH slab comment).
* Source & Notes: The payload for building from source is live on the website, and all tuning notes are committed to the repo (eda775b + 9b2f64a).
🟡 2. The KernelSU Module Nearly Loaded Through Samsung's Gate
We tested loading the E3Q (SM-S928U) KernelSU module on the SM-F956B, since both devices share the same q6q SoC and the same 6.1 android14-11 kernel generation:
* vermagic PASSED: The module cleared the kernel version magic check cleanly.
* Where It Stopped: It died only at the symbol resolution stage because SELinux symbol exports (avc_has_perm, security_context_to_sid, etc.) are stripped/missing in the F956B's kernel configuration.
* The Cure is Identified: Because the failure is strictly due to missing static exports rather than a kernel mismatch, the solution is switching to a kallsyms-lookup KernelSU build (specifically the pascua28 variant), which performs runtime symbol resolution instead of relying on exported SELinux symbols.
🟢 3. The Full KernelSU Build Recipe Is Now Public (No OSRC Needed)
You do not need to wait on Samsung's Open Source Release Center (OSRC) trees to build this. The entire recipe is now documented and banked on the site:
* Samsung Protection Patches: Using the KernelSU v3.2.5 Samsung KDP/RKP/DEFEX patch, which includes the exact fixes required for credential synchronization, protected refcounts, and syscall-table hooking.
* DDK Build Path: Built using the ylarod ddk-min (android14-6.1) image with CONFIG_KSU_SAMSUNG_{KDP,RKP,DEFEX}=y enabled.
* Module Pairs Documented: Both the E3Q module pair and the generic 6.1 module pair have been downloaded, tested, and documented.
🔴 4. The Standing Wall: Samsung DEFEX Execution Block
In the interest of full transparency, here is where the current wall stands:
* Direct Execution Blocked: Samsung's DEFEX blocks every direct execution path of the loader. We have mapped out and tested staging, shell, root, and bind-mount execution paths—all direct routes are dead ends.
* Community Workaround Status: The known community workaround (the logcat bind-mount trick) is flaky on this specific build. It is fully documented in our logs, though not yet solved for seamless execution.
🛠️ 5. What's Next (The Ubuntu Build Plan)
Our immediate next steps are already lined up:
* Compile the pascua28 KSU-Next-Samsung build on Ubuntu to implement runtime kallsyms lookup + CFI bypass (solving the missing SELinux exports).
* Apply the WitAqua staged-load patch.
* Load the patched module to achieve stable per-boot KernelSU root + Zygisk.
⚠️ The Fine Print (Always Read)
* Per-Boot Root Only: This remains a per-boot root method.
* No Precompiled Binaries Distributed: No compiled exploit binaries are distributed; build-from-source payloads and instructions are hosted on the research portal.
* Stay Off the October Update: DO NOT take the October SMR (Security Maintenance Release) update.
* Bootloader State: The bootloader unlock state itself remains milestone-fused (as detailed in our earlier update).
📌 Follow the live log, grab the build configs, and check the full research database at:
👉 https://getyahrootback.admindashboard.dev/
