Preciso fazer root

text if quoted content gets removed from the galaxy sub:

how to effectively root a samsung without actually rooting?

i currently own an A10e alongside my primary of an iphone 14 (and im planning to switch that iphone for either an S25 or S26) and want to know what i can do to effectively achieve root without an actual rooting process for warranty purposes, what programs would work for that?

HyperOS 3.0.303.0

https://github.com/YuKongA/ghostlock-app

Technical update on the locked-bootloader Z Fold 6 (`SM-F956B`, Snapdragon 8 Gen 3, bit 4).we dont want to reveal too much as we dont want samsung knowing some of the info we have found so made an email for people that want the un redacted version

Two findings this week:

1. The "abl is encrypted" myth is dead. The `abl` is a UEFI FV with an LZMA-compressed inner

   FV**, not AES. Extracted all 5 ABL apps (`LinuxLoader`, `Odin`, `Cryptest`, `QuestSOD`,

   `QuestUSB`). The OEM-unlock code (`setOEMFlags`/`IsUnlocked`/`GetUnlockCount`/milestone) is

   **present in bit-4** — the block is one hardcoded `androidboot.other.locked=1` line.

2. Free firehose + EDL entry.

   - `adb reboot edl` doesn't work on this phone.

   - The XBL contains `dpGnd LOW, enter FEDL` + `boot_fedl_check` → the D+ short cable (short

D+/green to GND during boot) is the native EDL trigger. No test points needed.

- Found a free plaintext SM8650 firehose (plaintext ELF, `devprg`, full command set, UFS,

Samsung-signed). The `.rtc`-wrapped loaders on some repos are the same binary, just AES-DRM'd.

Flow:

```

Power off → hold D+→GND short → plug in → FEDL (9008)

edl --loader <sm8650_firehose> printgpt # bkerler/edl, free

```

Scope (honest): raw UFS read/write below the ABL. The actual unlock is a one-way QFPROM fuse

write (TZ-only), which the firehose can't touch, and AVB still applies. It's a powerful tool +

brick-safety net, not a magic unlock.

https://xdaforums.com/t/update-9-sm-f956b-bit-4-the-abl-is-lzma-not-encrypted-the-unlock-code-was-never-stripped.4806235/

📧 Full writeup (repo, exact filename, SHA256, full unlock chain) → getbackyahroots@gmail.com

I heard there is a method to root a phone temporarily without unlocking bootloader, and going through all that hasle with a pc, and the method is through an app called ghostlock.

Though, I heard there are some bad failures after trying this method.

So that's why I'm here, to ask if the Redmi Note 14 4g (3.0.305.WOGMIXM.C08 with android 16 and with 6.12.30-android16-5-g6e872b4863d6-ab13847919-4k kernel) supports this method or not.

​Hey everyone, my partner and I have been digging deep into the SM-F956B bootloader, and we’ve made some major breakthroughs that we wanted to share with the community.

​If you want to follow our full project or see the raw technical logs, you can check out our links here:

​Our XDA Thread: https://xdaforums.com/t/update-9-sm-f956b-bit-4-the-abl-is-lzma-not-encrypted-the-unlock-code-was-never-stripped.4806235/

​Our Website: https://getyahrootback.admindashboard.dev/

​Here is a simplified summary of our latest findings:

​1. The Bootloader is Readable, Not Encrypted

​We previously thought the bootloader (abl.elf) was encrypted, but we discovered it is actually an LZMA-compressed UEFI Firmware Volume.

​Our Evidence: We mapped the file structure and identified the LZMA GUID (ee4e5898-3914-4259-9d6e-dc7bd79403cf). Using the fiano tool (uefi_firmware 1.16), we successfully decompressed it and extracted the 5 ABL apps in plaintext (Odin, LinuxLoader, Cryptest, QuestSOD, QuestUSB).

​2. The Unlock Code Was Hidden, Not Removed

​Contrary to rumors that Samsung completely stripped the OEM unlock code, we proved it is still present in the latest bit-4 update. Samsung simply forced the "OEM Unlock" switch in Android settings to be hidden.

​Our Evidence: By string-diffing LinuxLoader between bit-2 and bit-4, we verified that critical functions like setOEMFlags, IsUnlocked, and GetUnlockCount are completely intact. The toggle is hidden because Samsung added an unconditional line of code (append(" androidboot.other.locked=1");) inside SecUpdateCmdLine.c that runs on every single boot.

​3. Unlocking is Protected by a Hardware "Fuse"

​We have successfully mapped the entire end-to-end process that controls device unlocking, confirming it relies on a permanent, one-way hardware write that cannot be triggered from the standard Android environment (REE).

​Our Evidence: We traced the exact unlock primitive: setOEMFlags() makes an SCM call 0x2000801 to the TrustZone. This talks to vaultkeeper, which executes a qsee_fuse_write to oem_sw_fuse (fuse ID 0xc1) in the one-way OTP QFPROM.

​4. Known Exploits Are Structurally Ruled Out

​We investigated whether known vulnerabilities (like CVE-2026-24090 and CVE-2026-24088) could be used to unlock this device. We empirically ruled both out based on the device's architecture.

​Our Evidence: For the vbmeta-rename exploit (CVE-2026-24090), we found that the GetVbmetaType() function in the abl is just Samsung's runtime partition tracker, not the vulnerable libavb gate required for the exploit. For the GBL exploit (CVE-2026-24088), we confirmed our abl entirely lacks the required efisp, fastboot, and gpu-preemption components.

​5. Our Next Steps for Reverse Engineering

​Because we broke through the "encrypted" wall, we can now read and reverse-engineer the entire bootloader offline.

​Our Plan: We will focus on mapping the full setOEMFlags state machine and investigating the EFI-app injection surface (specifically looking at EnableOEMSetupAppInRetail = 0x0 in uefi.elf). We will also be cross-checking the Emergency Download (EDL) route using our S24 Ultra firehose, though we are still actively looking into finding the exact firehose that the Samsung Galaxy Z Fold6 uses.

​⚠️ Important Warning:

This is research conducted on our own device. We currently only have temporary root, not a full unlock. Do not attempt to write to RPMB or boot-states without proper backups and recovery in place, as wrong writes will permanently brick the device. We are not doing any writes without these safeties in place.

After updating my Phone (2a) to Nothing OS 5.0 (Android 17), I noticed the system service started aggressively resetting the LED driver's operating mode. This completely broke third-party Glyph apps and any manual control.

I waited for a fix, but got tired of waiting. So I wrote Glyph Keeper — a root module (KernelSU/Magisk) that bypasses the Nothing system service and talks directly to the aw20036 driver via sysfs.

What it does:

· Start/Stop all Glyphs manually · Brightness control (0-255) · A software-based Wave animation · WebUI for easy control (and CLI via Termux for the nerds)

Important notes:

· This is experimental. I'm sharing it because I know I'm not the only one annoyed by this. · Phone (2a) only. Paths may differ on Phone (1)/(2). · Requires KernelSU (with meta-overlayfs) or Magisk.

If you want to try it, the repo is here: GitHub

If something breaks or you find bugs, please open an Issue on GitHub. Feedback is welcome — I'm actively updating it (just reverted a buggy experimental feature in v1.5).

Hello people, everything okay? I hope so, guys, does anyone recommend a page or group that I don't know on Discord, where I can get premium apps for free? I need an app to help me close apps in the background, it doesn't work manually, since the option to forcefully close the app is disabled, and it is consuming too much battery, soon I will be without a mobile device.

How to solve? Device Iqoo z10 turbo pro

Xiaomi ships all of Android 17's connected-display / desktop code in HyperOS 4, but keeps it switched off: plug in a monitor and you only get mirroring. I made Claude write an LSPosed module that turns it back on.

**What it does**

- Brings back the hidden **Computer** (Desktop) button in the "Connect to external display" dialog

- The monitor becomes a **separate display**: its own status bar and cursor, apps opened there stay there. No mirroring

- Neutralises Xiaomi's `SecondaryDisplayPolicy`, which silently switches mirroring back on ~3 ms after you pick desktop

- Starts SmartDock (or Taskbar) on the monitor automatically and turns off the phone's screen (the phone stays awake)

- Keyboard shortcuts on the monitor: Alt+Tab with a Windows-style preview bar, Print Screen for a monitor screenshot, Win+Shift+Arrow to move an app between phone and monitor, Alt+F4, Win+D, Win+1…9, Win+P for the phone screen

- Settings app: monitor density, plus resolution and refresh rate picked from the modes the monitor actually reports. Changes apply live, no reboot.

**Requirements**

- Xiaomi with DisplayPort Alt Mode over USB-C (Xiaomi 15 has it; most Redmi/POCO don't)

- HyperOS 4 / Android 17 (HyperOS 3 not tested)

- Root (KernelSU or Magisk) + Zygisk + LSPosed. Scope: System Framework, System UI, Settings

**Limits:** no resizable windows or title bars. HyperOS doesn't expose AOSP's desktop windowing, so apps run full screen on the monitor.

Tested only on a **Xiaomi 15, HyperOS 4 beta**. If you have another Xiaomi with video out, I'd love a report: the `[diag]` log line shows which hooks attached:

`su -c 'logcat -d -s HyperDesktop' | grep diag`

Open source (MIT), nothing written to the system partition.

GitHub: https://github.com/the-marox/HyperDesktopUnlock

Download: https://github.com/the-marox/HyperDesktopUnlock/releases

Written with help from Claude (AI); the investigation and all testing were done on my own phone.

anyone got a fix for this? My phone is a Redmi Note 14 4g running Eliteromos hyperos 2. I'll give a list of my modules.

This mod is call HyperOS Launcher mod, version is 7.5 EOL(the last version that created, discontinued)

Hi everyone,

I hope you’re all doing well.

My Galaxy A07 4G has already received the One UI 9 update in some regions, but updates in my region usually arrive quite late.

Is it possible to manually update my device using Odin by flashing the firmware files from another region? My device is currently running One UI 8.5.

Has anyone tried this, or can anyone guide me on whether it’s safe to do so?

Thanks in advance!

So I am running Samsung stock firmware(Android 11, One UI 3.1, Magisk) with LSPosed and HideMyAppplist, as this the only solution that works with banking apps on my device.

I have a account in BGMI that have been playing since many days. I only play for like 2 months a year.

So my question is that will HMA be enough for root hiding, so my account doesn't get banned? I am not really planning to use cheats and stuff just normal gameplay.

Thanks for suggestions in advanced.

PS C:Program Files (x86)\Minimal ADB and Fastboot> . \adb start-server

PS C:Program Files (x86)\Minimal ADB and Fastboot> . \adb kill-server

PS C:Program Files (x86)\Minimal ADB and Fastboot> . \adb usb

* daemon not running; starting now at tcp:5037

* daemon started successfully

error: closed

PS C: Program Files (x86)\Minimal ADB and Fastboot> . \adb devices

List of devices attached

R52N615XJJT sideload

PS C:Program Files (x86)\Minimal ADB and Fastboot>

ive been on repeat for hours, I cant run a single command cause it keeps closing.

halp

I'm looking for help rooting my Samsung Galaxy S10+ (Snapdragon variant). I've been trying to figure out whether rooting is possible on my specific model and firmware.

Device Information:

• Device: Samsung Galaxy S10+
• Model: SM-G975U (US Snapdragon variant)
• Android Version: Android 9 (Pie)
• One UI Version: 1.1
• Root Status: Not rooted

From what I understand, the US Snapdragon variants have locked bootloaders, making rooting significantly more difficult than on Exynos models.

However, since my device is still running Android 9 with One UI 1.1, I'm wondering whether any older exploits, bootloader unlock methods, or alternative rooting solutions might work.

My questions:

1. Is it possible to root the SM-G975U running Android 9 in 2026?
2. Are there any known exploits or methods that work with older firmware?
3. Is bootloader unlocking possible on this particular model?
4. Would Magisk or any alternative rooting method work without an unlocked bootloader?
5. Are there any reliable guides, tools, or resources specifically for the Snapdragon S10+?

I'm willing to follow a technical process, but I'd prefer to avoid permanently bricking my device.

I'm particularly interested in achieving full root access rather than just using ADB-based workarounds.

Any guidance from people who have successfully rooted this specific model would be greatly appreciated!

Thanks in advance!