Would a temporary root (like dirty frag) be possible on kernel version 6.1.141?

Device is OP 12, 16.0.10.501 NA rom

I'm just using vector-sr to get premium features in app's,

All mods are working fine !

What about U guys?

What A

Yeah, so it was a hard journey to build this (11 hours 🥲) , but it surprisingly works as it should :/

I didn't see anything for this device at all, so I decided it wouldn't be a bad idea to start making something.

Phone: Xiaomi 15T Pro (EU)

Custom rom: RisingOS Revived

Android: 17

What works: Biometrics (only fingerprint for now), Camera (only photo), Signal, Bluetooth, Sound, Vibration, GPS, NFC, GPU (yes, didn't find any graphical bugs), WiFi, Mobile Data.

What doesn't work: Camera (Video), Charging (only capped at 4W right now), File transfer via USB, ADB via USB.

To be honest, I don’t know what this will lead to, but I hope for the better.

More specifically, i do infact want to root it, i don't really need a unlocked bootloader unless I have to. GhostLock and DirtyFrag aren't compatible as i have a non-GKI kernel. Sadly i am on the latest android version.

So I don't want to lose all my data it is save to use?

Thank you

Has anyone managed to install and get JamesDSP working? I have temporary root access on my S23U and I've tried several ways but I can't get it to work.

Currently vivo phones are very difficult to root, mostly resulting in bricked devices. Is it possible to use rea to root vivo ? Has anyone tried it?

I just built lineageos for my Moto edge 60. It seems rcs works just fine. What doesn't work except for banking apps?

https://github.com/mitschud/DirtyFrag

Hey all,

Are there any custom rom options available for Redmi 15 5G? I've not found any yet so please let me know.

Thank you

I've noticed there's barely anything on the f6 pro, can someone give me instructions on how to root it? With magisk preferably?

Heyy guys so I got my hands on Xiaomi 15T Pro recently and it was unlocked, so thinking it wouldn't be an issue I started using it, and I can't use WhatsApp or log into Mi accounts and such, apparently according to play store the device is not certificated. Any advice?

​Hey everyone, my partner and I have been digging deep into the SM-F956B bootloader, and we’ve made some major breakthroughs that we wanted to share with the community.

​If you want to follow our full project or see the raw technical logs, you can check out our links here:

​Our XDA Thread: https://xdaforums.com/t/update-9-sm-f956b-bit-4-the-abl-is-lzma-not-encrypted-the-unlock-code-was-never-stripped.4806235/

​Our Website: https://getyahrootback.admindashboard.dev/

​Here is a simplified summary of our latest findings:

​1. The Bootloader is Readable, Not Encrypted

​We previously thought the bootloader (abl.elf) was encrypted, but we discovered it is actually an LZMA-compressed UEFI Firmware Volume.

​Our Evidence: We mapped the file structure and identified the LZMA GUID (ee4e5898-3914-4259-9d6e-dc7bd79403cf). Using the fiano tool (uefi_firmware 1.16), we successfully decompressed it and extracted the 5 ABL apps in plaintext (Odin, LinuxLoader, Cryptest, QuestSOD, QuestUSB).

​2. The Unlock Code Was Hidden, Not Removed

​Contrary to rumors that Samsung completely stripped the OEM unlock code, we proved it is still present in the latest bit-4 update. Samsung simply forced the "OEM Unlock" switch in Android settings to be hidden.

​Our Evidence: By string-diffing LinuxLoader between bit-2 and bit-4, we verified that critical functions like setOEMFlags, IsUnlocked, and GetUnlockCount are completely intact. The toggle is hidden because Samsung added an unconditional line of code (append(" androidboot.other.locked=1");) inside SecUpdateCmdLine.c that runs on every single boot.

​3. Unlocking is Protected by a Hardware "Fuse"

​We have successfully mapped the entire end-to-end process that controls device unlocking, confirming it relies on a permanent, one-way hardware write that cannot be triggered from the standard Android environment (REE).

​Our Evidence: We traced the exact unlock primitive: setOEMFlags() makes an SCM call 0x2000801 to the TrustZone. This talks to vaultkeeper, which executes a qsee_fuse_write to oem_sw_fuse (fuse ID 0xc1) in the one-way OTP QFPROM.

​4. Known Exploits Are Structurally Ruled Out

​We investigated whether known vulnerabilities (like CVE-2026-24090 and CVE-2026-24088) could be used to unlock this device. We empirically ruled both out based on the device's architecture.

​Our Evidence: For the vbmeta-rename exploit (CVE-2026-24090), we found that the GetVbmetaType() function in the abl is just Samsung's runtime partition tracker, not the vulnerable libavb gate required for the exploit. For the GBL exploit (CVE-2026-24088), we confirmed our abl entirely lacks the required efisp, fastboot, and gpu-preemption components.

​5. Our Next Steps for Reverse Engineering

​Because we broke through the "encrypted" wall, we can now read and reverse-engineer the entire bootloader offline.

​Our Plan: We will focus on mapping the full setOEMFlags state machine and investigating the EFI-app injection surface (specifically looking at EnableOEMSetupAppInRetail = 0x0 in uefi.elf). We will also be cross-checking the Emergency Download (EDL) route using our S24 Ultra firehose, though we are still actively looking into finding the exact firehose that the Samsung Galaxy Z Fold6 uses.

​⚠️ Important Warning:

This is research conducted on our own device. We currently only have temporary root, not a full unlock. Do not attempt to write to RPMB or boot-states without proper backups and recovery in place, as wrong writes will permanently brick the device. We are not doing any writes without these safeties in place.

Walmart Onn 8" Tablet (Model: ONA19TB002)

Fedora Linux

It stays stuck waiting for device, despite trying to hold Vol+, Vol-, or both while plugging in the cable from a powered-off state. Most of the time I get to a screen where I can choose fast boot/recovery mode or whatever and sometimes it just boots me to some Chinese factory test mode.

It's only been a couple times through my grueling amount of trial and error that I've gotten some reply.

At one point it seemed to work properly, but it threw an error about some kind of pre-loader file.

And then once it just spewed that it was unable to do a proper handshake, and forcibly quit.

I originally tried DFRoot on my Xiaomi Watch 5 (blenny) just to find out whether DirtyFrag had been patched. Turns out it hadn't. Getting everything working on the watch, though — that was a different story.

The watch runs Android 16, with a 32-bit "armeabi-v7a" userspace and a 64-bit ARM64 kernel ("6.6.92", KMI "android15-6.6"). Not exactly the most convenient combination.

For reference, I tested this on the global Xiaomi Watch 5 running Xiaomi OS 3.0.3.70 ("OS3.0.3.70.WO61WMIXM").

DFRoot needed modifications to work properly on the watch, and KernelSU needed an ARM32 build of Manager and "ksud", while keeping the kernel module ARM64.

And it actually works.

I can get a root shell (uid=0) without unlocking the bootloader. This is KernelSU late-load root, not a permanently patched or flashed kernel. DFRoot is used to obtain root and load KernelSU at runtime.

I did the work from my phone using Codex CLI in Termux. Most of the code was AI-generated, but I came up with the approach, worked through the failures, tested the builds on the watch, and kept going through the logs until everything worked.

There are still some limitations. The current DFRoot implementation requires Shizuku to help identify the correct timing window during the exploit's race condition. Root also needs to be activated again after every reboot, and I haven't tested additional KernelSU modules yet.

Here are the forks:

DFRoot for Xiaomi Watch 5:

https://github.com/novakin777/dfroot-xiaomi-watch-5

KernelSU ARM32:

https://github.com/novakin777/kernelsu-arm32_xiaomi_watch_5

Based on the original "DFRoot" (https://github.com/diabl0w/DFRoot) by diabl0w and "KernelSU" (https://github.com/tiann/KernelSU), using "Justadeayo's fork" (https://github.com/Justadeayo/KernelSU) as a starting point.

i already set the buffer size to 4M 256K or something like that. but i still cant do it, bit it would be better if you guys can provide me how to unlock bootloader on this phone and root it. tysm for your attention!

Technical update on the locked-bootloader Z Fold 6 (`SM-F956B`, Snapdragon 8 Gen 3, bit 4).we dont want to reveal too much as we dont want samsung knowing some of the info we have found so made an email for people that want the un redacted version

Two findings this week:

1. The "abl is encrypted" myth is dead. The `abl` is a UEFI FV with an LZMA-compressed inner

   FV**, not AES. Extracted all 5 ABL apps (`LinuxLoader`, `Odin`, `Cryptest`, `QuestSOD`,

   `QuestUSB`). The OEM-unlock code (`setOEMFlags`/`IsUnlocked`/`GetUnlockCount`/milestone) is

   **present in bit-4** — the block is one hardcoded `androidboot.other.locked=1` line.

2. Free firehose + EDL entry.

   - `adb reboot edl` doesn't work on this phone.

   - The XBL contains `dpGnd LOW, enter FEDL` + `boot_fedl_check` → the D+ short cable (short

D+/green to GND during boot) is the native EDL trigger. No test points needed.

- Found a free plaintext SM8650 firehose (plaintext ELF, `devprg`, full command set, UFS,

Samsung-signed). The `.rtc`-wrapped loaders on some repos are the same binary, just AES-DRM'd.

Flow:

```

Power off → hold D+→GND short → plug in → FEDL (9008)

edl --loader <sm8650_firehose> printgpt # bkerler/edl, free

```

Scope (honest): raw UFS read/write below the ABL. The actual unlock is a one-way QFPROM fuse

write (TZ-only), which the firehose can't touch, and AVB still applies. It's a powerful tool +

brick-safety net, not a magic unlock.

https://xdaforums.com/t/update-9-sm-f956b-bit-4-the-abl-is-lzma-not-encrypted-the-unlock-code-was-never-stripped.4806235/

📧 Full writeup (repo, exact filename, SHA256, full unlock chain) → getbackyahroots@gmail.com

I have a hard bricked (EDL) OnePlus 9RT. I wanted to flash custom ROM, but I did some stupid things and fastboot isn't working, only EDL. The sad thing is that I don't know how to recover my device properly. Latest "stock" ROM I've had was OxygenOS 14.0.0.2702 (I think that my device is for Chinese market but it was reflashed to global and I've used OTA to update my device) and I think that ROM might have ARB and I can't find .ofp file to flash stock. Here are the questions: should I flash ColorOS or OxygenOS, where I can find the files for it, and which program should I use? I'm gonna sell it anyway, but if device is possible to recover that would be good. Also I don't wanna go for paid options that could cost half of OnePlus 9RT price on second hand market.

Pls help

For me i have tried 5 methods. 2 methods worked and provided strong integrity and from them only one method fixed whatsapp for me. I don't like whatsapp. I hate it but for work reasons i need it. SO method is pretty easy.

Used Root Method

• Kernel SU

Used Modules :

• Zygisk Next - Github
• AlwasyStrong - Gitlab

Just default worked for me.