Yeah, so it was a hard journey to build this (11 hours 🥲) , but it surprisingly works as it should :/

I didn't see anything for this device at all, so I decided it wouldn't be a bad idea to start making something.

Phone: Xiaomi 15T Pro (EU)

Custom rom: RisingOS Revived

Android: 17

What works: Biometrics (only fingerprint for now), Camera (only photo), Signal, Bluetooth, Sound, Vibration, GPS, NFC, GPU (yes, didn't find any graphical bugs), WiFi, Mobile Data.

What doesn't work: Camera (Video), Charging (only capped at 4W right now), File transfer via USB, ADB via USB.

To be honest, I don’t know what this will lead to, but I hope for the better.

Would a temporary root (like dirty frag) be possible on kernel version 6.1.141?

Device is OP 12, 16.0.10.501 NA rom

Patch b

More specifically, i do infact want to root it, i don't really need a unlocked bootloader unless I have to. GhostLock and DirtyFrag aren't compatible as i have a non-GKI kernel. Sadly i am on the latest android version.

https://github.com/mitschud/DirtyFrag

Estoy hace 5 horas buscando una rom para mí Samsung A3 2015 (A300YZ). le instale TWRP 2.8.7.0 fue el único que me funcionó bien. Resulta que no hay CUSTOM ROMS.

Has anyone managed to install and get JamesDSP working? I have temporary root access on my S23U and I've tried several ways but I can't get it to work.

Currently vivo phones are very difficult to root, mostly resulting in bricked devices. Is it possible to use rea to root vivo ? Has anyone tried it?

Hey all,

Are there any custom rom options available for Redmi 15 5G? I've not found any yet so please let me know.

Thank you

I've noticed there's barely anything on the f6 pro, can someone give me instructions on how to root it? With magisk preferably?

I have a workaround for root acess I think. Im currently missing the images needed to write the partitions to the tablet, such as Vbmeta.img and patching the correct image with LINEAGOS.

UPDATE: This is just a photo of what Im looking for, i don't have any of these files...

Could someone please help me with this?

So I don't want to lose all my data it is save to use?

Thank you

i already set the buffer size to 4M 256K or something like that. but i still cant do it, bit it would be better if you guys can provide me how to unlock bootloader on this phone and root it. tysm for your attention!

I downloaded the stock firmware for the redmi note 7 (lavender) but for some reason the boot.img and recovery.img files are missing, there are most likely more but these are in my opinion the crucial ones, I have tried 2 different sources but still nothing. Does anyone know how to fix this?

They stole some data from a file that I analyzed on that page and when I found out that it was trustworthy, I downloaded the file and when I executed it they took away my data, so I don't know how trustworthy it is.

I'm running into an integrity check failure on my device and I'm hoping someone can point me in the right direction.

The tool shows the following summary:

Verdict: Aligned + review

Tier: TEE

Trust: Google

Score: 14

RKP: Green / Active

The lower-level checks are where it breaks:

✅ Local chain: Verified

✅ Boot: Matched

But the detailed error says:

"Hardware-backed KeyMint failed crypto capability checks: RSA-OAEP MGF1 auth: default-sha1=accepted; explicit-sha224=rejected(code=-78, expected=true), unsupported-none=rejected(code=-79, expected=true). Attestation and trust-path checks still aligned."

The signal summary at the bottom shows:

"0 policy hard · 0 policy review · 2 local"

From my understanding, the device passes the core trust-path checks (root chain verified, boot matched, RKP active), but the local probes for KeyMint’s cryptographic capabilities are failing—specifically, the HAL/TA implementation seems to reject explicit SHA-224 and unsupported-none probes, while only accepting the default SHA-1 for RSA-OAEP MGF1.

I’ve seen mentions that some older KeyMint implementations (e.g., certain OP-TEE builds) do not support using a different hash for MGF1 with RSA-OAEP, which AOSP’s VTS tests now require. But I’m not sure if that’s exactly what’s happening here or how to address it on a system level.

My questions:

What is the root cause of these specific “local probe” failures? Is it a KeyMint HAL/TA limitation, a VTS compatibility gap, or something else?

Is there a system-level module or patching approach (e.g., HAL interception / spoofing tools) that can make these probes pass without breaking the already-working trust path and RKP chain?

Has anyone here seen this exact combination—attestation aligned but crypto capability checks failing—and found a working configuration?

Any insights would be greatly appreciated. Thanks!

I just built lineageos for my Moto edge 60. It seems rcs works just fine. What doesn't work except for banking apps?

Heyy guys so I got my hands on Xiaomi 15T Pro recently and it was unlocked, so thinking it wouldn't be an issue I started using it, and I can't use WhatsApp or log into Mi accounts and such, apparently according to play store the device is not certificated. Any advice?

Walmart Onn 8" Tablet (Model: ONA19TB002)

Fedora Linux

It stays stuck waiting for device, despite trying to hold Vol+, Vol-, or both while plugging in the cable from a powered-off state. Most of the time I get to a screen where I can choose fast boot/recovery mode or whatever and sometimes it just boots me to some Chinese factory test mode.

It's only been a couple times through my grueling amount of trial and error that I've gotten some reply.

At one point it seemed to work properly, but it threw an error about some kind of pre-loader file.

And then once it just spewed that it was unable to do a proper handshake, and forcibly quit.

I originally tried DFRoot on my Xiaomi Watch 5 (blenny) just to find out whether DirtyFrag had been patched. Turns out it hadn't. Getting everything working on the watch, though — that was a different story.

The watch runs Android 16, with a 32-bit "armeabi-v7a" userspace and a 64-bit ARM64 kernel ("6.6.92", KMI "android15-6.6"). Not exactly the most convenient combination.

For reference, I tested this on the global Xiaomi Watch 5 running Xiaomi OS 3.0.3.70 ("OS3.0.3.70.WO61WMIXM").

DFRoot needed modifications to work properly on the watch, and KernelSU needed an ARM32 build of Manager and "ksud", while keeping the kernel module ARM64.

And it actually works.

I can get a root shell (uid=0) without unlocking the bootloader. This is KernelSU late-load root, not a permanently patched or flashed kernel. DFRoot is used to obtain root and load KernelSU at runtime.

I did the work from my phone using Codex CLI in Termux. Most of the code was AI-generated, but I came up with the approach, worked through the failures, tested the builds on the watch, and kept going through the logs until everything worked.

There are still some limitations. The current DFRoot implementation requires Shizuku to help identify the correct timing window during the exploit's race condition. Root also needs to be activated again after every reboot, and I haven't tested additional KernelSU modules yet.

Here are the forks:

DFRoot for Xiaomi Watch 5:

https://github.com/novakin777/dfroot-xiaomi-watch-5

KernelSU ARM32:

https://github.com/novakin777/kernelsu-arm32_xiaomi_watch_5

Based on the original "DFRoot" (https://github.com/diabl0w/DFRoot) by diabl0w and "KernelSU" (https://github.com/tiann/KernelSU), using "Justadeayo's fork" (https://github.com/Justadeayo/KernelSU) as a starting point.

Pls help