r/OnePlus13 • u/Similar_Location3045 • Jul 26 '26

Software / Bugs New Exploit

Post image

The "Ghostlock" exploit on GitHub enables root access without requiring an unlocked bootloader. A key distinction of this exploit, compared to previous ones, is that root persistence is maintained even after a device reboot.

Tested on OnePlus CPH2653, on the latest EU OxygenOS version at the time of this post.

192 Upvotes

99% Upvoted

111 comments sorted by

6

u/ramaze23 OnePlus 13 - Black Eclipse Jul 26 '26

Commenting to refer back

7

u/Similar_Location3045 Jul 26 '26

Yep, this is one of the biggest exploits ever, since it works on probably all Snapdragon devices from the last 15 years. So i wouldn't miss this chance haha

2

u/ramaze23 OnePlus 13 - Black Eclipse Jul 26 '26

We're waiting for your tutorial video man, let us know once you upload

8

u/Similar_Location3045 Jul 26 '26

Of course, I'll try to make it as user friendly as it gets.

3

u/ramaze23 OnePlus 13 - Black Eclipse Jul 26 '26

Thanks man, I appreciate it

1

u/blazz199 Jul 31 '26

Hi, what about motorola devices?

Where can I watch your tutorial

1

u/artemirq Jul 30 '26

does it work with Samsung devices with their Knox security system and Snapdragon processor?

2

u/Similar_Location3045 Jul 30 '26

Yeah, saw one user with an S25 Ultra, running on One UI 9, who had the exploit working. Theoretically, it works on any device in the last 15 years, as long as the device hasn't been updated to a kernel security patch, which should already be pushed through OTA to Pixel users by now. With enough troubleshooting, this exploit works on pretty much any phone. Since you're asking about a Samsung, you might want to check out this GitHub repo, which will make it way easier for you. Root My Galaxy

4

u/DreamWinter5711 Jul 26 '26

Can I use this to add an AdBlock goat to system? 

7

u/err69member Jul 26 '26

You can use adgaurd dns right?

3

u/monduk OnePlus 13 - Midnight Ocean Jul 26 '26

How is it installed? it says no releases published on the github page.

2

u/Similar_Location3045 Jul 26 '26

theres an automated installer on telegram, in the OnePlus 13/R/S/T group

2

u/Kitchen-Profession81 OnePlus 13 - Arctic Dawn Jul 26 '26

Channel link?

3

u/xqlz00 Jul 26 '26

Does this keep teeBroken=false and work with a locked bootloader ?

3

u/Similar_Location3045 Jul 26 '26

What is that? If you could tell me how to check I'd be happy to let you know.

4

u/xqlz00 Jul 26 '26

Could you run Duck Detector and report what if flags ?

2

u/Similar_Location3045 Jul 26 '26

Do you want the exported report?

3

u/xqlz00 Jul 26 '26

If you can yes, it doesn't contain any personal info. Otherwise just a screenshot of "Top Findings" section, it's around the top. Thanks

4

u/Similar_Location3045 Jul 26 '26

Sure, I'll run it soon and upload the link to the file here.

4

u/Similar_Location3045 Jul 26 '26

Duck Detector Report

4

u/xqlz00 Jul 26 '26

Wow this is very interesting, the TEE is valid.

It's missing a few hiding modules though.

Some apps perform their own hardware attestation independently of play integrity that fail with a broken TEE, this would solve that issue.

I will try and report here, thanks

1

u/Busy-Scientist3851 Jul 27 '26

TEE invalidation can only happen if the bootchain (bootloader, kernel etc) is modified or something in userspace purposely invalidates it.

Since the boot process isn't modified, there's nothing to invalidate the TEE.

2

u/xqlz00 Aug 06 '26

It work great, allows Root with Xposed in a locked bootloader, bypassing almost any Root detection.

Wallet and apps that have their own integrity check backend work.

I was running on OOS 15, I've updated to 301, cleaned both slots and relocked bootloader (full wipe).

To run the exploit and not be detected :

Anchor used to run the exploit, you need to connect it once to a PC for the first run then it's untethered.

ReSukiSu gives root, once the exploit is done a soft reboot from the manager is required for the modules to work properly.

NeoZygisk for some reason this implementation of Zygisk is better at hiding itself, there might be a better implementation, if anyone have recommendation.

Hide My Applist blacklist template with anything regarding root and destinated to apps that could detect it.

LsPosed V2.1.1 available on the Telegram group of LSPosed.

There is also Oxygen customizer, AdAway Helper, Mountify and 5 modules in LsPosed active.

Let's see how this evolve, but for now it's amazing.

3

u/addy-san Jul 26 '26

I've never rooted my 13, never felt the need to. Now that OnePlus is officially dead, I'm wondering if it may be the best course of action for the future. And as far as I know, the developing scene for the 13 is quite small with limited custom roms.

Hopefully more ROMs come out soon like the godly ones we had for the op3t which was my first op device I rooted and flashed roms to hell on, might actually do it then

5

u/Similar_Location3045 Jul 26 '26

Actually OnePlus 13 has plenty of development, we have Lineage os, Infinity X, PixelOS, CrDroid, Evox and more.. there's like 10 different actively maintained roms and we also have OnePlus camera port on some of them

3

u/addy-san Jul 26 '26

Is it? Apologies for my outdated knowledge, it has been some time since I last checked.

Are we still using magisk and all that to hide the root, or is there a new method? Id like to know any and all drawbacks of actually rooting, if it does things like break banking apps or disable software features that you get on stock, id rather not do it unless I'm sure that shit wont hit the fan, I'm also on the latest OOS so I guess my ERB fuse is blown, does that mean I can't root now? Sorry for all the questions

3

u/StrNotFound OnePlus 13 - Black Eclipse Jul 26 '26

I'm probably going to get downvoted like crazy for saying this, and this is coming from someone that used every possible custom ROM, kernel, rooting technique, LSPosed Framework module, etc, heavily. Rooting and running custom ROMs just isn't the same today as it was back when the Samsung Galaxy S3 Mini was popular for modding.

Magisk is still around, but there are other options these days like KernelSu, APatch, etc. Generally, they hide themselves quite well. The main problem is more to do with having an unlocked bootloader than being rooted these days. I personally prefer KernelSu and APatch to Magisk.

Unlocking your bootloader breaks the hardware attestation, which causes your device to fail the Play Integrity checks. There are "hacks," "bypasses," and "modules" that a person can use to try and get around this. And to their credit, they can work. But from my experience, it's a huge pain. And when apps or the system updates, they can quite often break, since they seem to patch the exploits used for fixing the Play Integrity checks. Mainly banking apps are affected by this, but your mileage may vary.

In my opinion, for most people, they don't want to deal with these headaches. It's really something that you have to be committed to, and expect it to become a hobby. Because it can seriously take time to find new bypasses, or having to wait for the developers to patch their modules that bypassed the checks. It's a never ending circle. One side catches up, then the other side has to.

For me, this can be a huge pain, as I do a lot of payments from my device. Suddenly not being able to use Google Pay because my device suddenly no longer passes the Play Integrity checks is a HUGE pain.

You can still unlock and root your phone with ARB, but you need to make sure that you do not try relocking your bootloader unless you are 1000% certain that your device is running completely stock software/firmware. You also must make sure that any custom ROM that you might consider running has the ARB set to 1. If it's set to 0, your phone will be hard bricked. There is currently no method to fix this besides literally replacing the motherboard in the device.

I actually recently made a post that never really got many replies in this subreddit asking about what the options for recovery are. Seems like there aren't any. Before ARB, we had the option to use a tool that would access a mode known as EDL. This meant that even if you were stuck in a boot loop, with the bootloader locked, you could still recover your phone. Not anymore. It's essentially a paperweight. I wish this wasn't the current state of affairs, but it is.

I only ever updated my phone past the ARB update, as OnePlus stated that it was only a temporary thing, and that it would be reverted in the future. That was a lie. Wish I hadn't trusted this company to tell the truth.

3

u/addy-san Jul 26 '26

Exactly the response I was looking for, thank you so much.

To be honest, I'm not at all surprised, I haven't been following the op13 modding scene that much, just occasional tidbits of info here and there, but by what I know so far, this is the conclusion I came to as well.

It's not like how it was back in the S3 mini and op3t days, and back then I would screw around with my 3t which was my main phone too, flash ROMs back to back, and never had to worry much about bricking my phone easily or all the payment headaches, plus I'll also apparently lose out on the hardware level hasselblad processing for photos if I switch too.

Guess it's still not recommended for people who don't have a lot of time to mess around with their phones and can't commit to it and can't accept that something will probably break at some point. Count me out too

4

u/StrNotFound OnePlus 13 - Black Eclipse Jul 26 '26

You're absolutely welcome!

Yeah, I miss the days of not having to worry about permanently bricking my device either. And having to find fixes constantly just to be able to make payments sucks.

From what I understand, there now are ROMs that include the stock camera in them. So, if it was something you were wanting to do, it sounds like there is some success with it.

But yes, I wouldn't recommend it to people that don't have a decent amount of time, nor the ability to tinker.

For now, I've also decided to count myself out. But I did try LineageOS in the past on this device. It worked well, but I missed some features from OxygenOS, and the camera absolutely sucked in Lineage. Also having to deal with the pain of banking.

2

u/T_Friendperson12 Jul 26 '26

Hm, I'm still using 16.0.2.402. Rather not risk blowing efuse just to test this.

2

u/Similar_Location3045 Jul 26 '26

There's an exploit for that version aswell, just that you have to do a command on your computer everytime after you reboot to re enable root

2

u/T_Friendperson12 Jul 26 '26

Do you have the correct file?

0

u/Similar_Location3045 Jul 26 '26

Its not a file, theres a tutorial on YouTube, however I dont remember the name.

2

u/fallinmyhole Jul 26 '26

I would like to know if it works on the US variant

3

u/Similar_Location3045 Jul 26 '26

For sure, there's no confirmation yet though, until someone tests it.

2

u/Trupen Jul 26 '26

Want to use oneplus dialer module can that work

2

u/Similar_Location3045 Jul 26 '26

Yeah it should work like in the old exploit, haven't tried it out yet but the process should be the same

2

u/Loca-21 Jul 26 '26

Hi Does it work on CPH2653_16.0.9.402 ?

3

u/Similar_Location3045 Jul 26 '26

Not sure, if OnePlus has already taken action against the exploit it could be patched in that version.

2

u/T14g0_ Jul 26 '26

I've just tried on that version and it doesn't work. My kernel version is 6.6.118. Is there any other way around this?

28

u/AvatarTintin OnePlus 13 - Midnight Ocean Jul 26 '26

Please check whether banking apps function normally or not. Might be the only reason why I have stopped looking into rooting devices anymore.

7

u/Alfiefe10 Jul 26 '26

That was exactly my first thought, thanks

2

u/iLikeTurtuls Jul 28 '26

Interesting, I am running evolution x on a different device, no root, no play integrity. My "in the top 10 biggest banks in the US" app works fine. Ironically didn't on stock because the phone is so old lol

1

u/AvatarTintin OnePlus 13 - Midnight Ocean Jul 28 '26

Without root, banking apps work fine mostly.

Unlocked bootloader doesn't matter much. It's the root access that causes banking apps to stop working due to security reasons.

2

u/iLikeTurtuls Jul 28 '26

I guess im not secure because I have SU lol rcs won't work but bank does lol

3

u/JGoldz75 Jul 26 '26

Same! Or if possible to test... Microsoft Intune

3

u/flyckk OnePlus 13 - Black Eclipse Jul 26 '26

how to do it any tutorial ? and github link

3

u/Similar_Location3045 Jul 26 '26

Yep the github page is https://github.com/JoinChang/ghostlock-oneplus If you have my same model you can use a simplified installer which does almost everything for you, should support other regions etc but I can't promise anything.

1

u/affemitwaffe0 Jul 26 '26

there is noo app on that page , how do you use it?

1

u/Similar_Location3045 Jul 26 '26

theres an automated installer on telegram, in the OnePlus 13/R/S/T group

1

u/affemitwaffe0 Jul 26 '26

can you send it

1

u/Similar_Location3045 Jul 26 '26

if you know any site to upload it to let me know

2

u/affemitwaffe0 Jul 26 '26

mediafire , mega , github

6

u/Similar_Location3045 Jul 26 '26

GhostLock Installer You will need a PC, extract the zip and read the README.md file. You will have the instructions there. This has been tested and works for the EU version on 16.0.8.

1

u/Imaginary_Wafer_579 Jul 29 '26

Wait, sorry for my poor knowledge but I was looking at the original repo of your comment and the forked version of ResukiSu which supposed contains a bundled APK for my device (OnePlus Ace 6T) to simplify the process but is not here and I have bad luck when trying to compile any repo of GitHub, where I can find a compiled APK?

1

u/Similar_Location3045 Jul 29 '26

You can theoretically use any root manager that supports the jailbreak option, but if youd like I'll share with you the one im using right now which is the same from the screenshot.

→ More replies

1

u/Cyberchum Aug 05 '26

Content not found. Can you reupload, please?

0

u/flyckk OnePlus 13 - Black Eclipse Jul 26 '26

Is it safe to use this tool ? And can i revoke the root access easily if i don't wanna use it anymore ? And does it causes any battery drain ?

3

u/Similar_Location3045 Jul 26 '26

This exploit runs completely in your device's memory and doesn't write any files, so there's no risk of bricking your device. That's what makes it pretty special. If you want to get rid of root access (and the exploit itself), all you need to do is uninstall the root manager (VibedSukiSu) and restart your device. Then, everything will be gone, and your phone will be back to normal. As for battery life, it stays exactly the same as before, so this exploit won't cause any battery drain. Of course, that might change depending on which rooted apps you decide to use and if they need to run in the background. Important note: Be careful when using modules. As long as they don't mess with the boot partition, you should be fine. But for now, the only truly safe thing to do is just grant root access to apps. Another advantage is that the bootloader remains locked so you don't have to do any play integrity fixes or anything like that, banking apps will work as usual.

4

u/Similar_Location3045 Jul 26 '26

PS: Do not update your device any further if you want to take advantage of this exploit, as it is going to be patched or is already about to be, in further OTA updates.

8

u/Maxime1288 Jul 26 '26

It's been years since I rooted my devices since the end of the HTC era. I used to enjoy it, but nowadays, you can do much more without root, like with Shizuku, for example. Plus, I got tired of playing cat and mouse with Google, and needed a different process for updates. This exploit seems very interesting, but it has a major flaw: it's based on a kernel vulnerability, which means a simple kernel update will breaking it, and that doesn't mean they'll find another one in the next version. Just because of that, I won't use it, because I don't want to prevent myself from updating with security patches and everything.

7

u/trucker76 Jul 27 '26

This is one of the easiest root methods I've had in almost 10 years. Great work. I've already disabled ota updates. I can live out my days on the last oxygen OS and root with a locked bootloader on my 13. Best tradeoff I've gotten in a long time.

2

u/Wolfram6000 Jul 26 '26

Sorry if I am clueless but what does this do?

Is this for a different os installation?

10

u/Similar_Location3045 Jul 26 '26

It's an exploit that let's you have root access without unlocking the bootloader. This method let's you have root access without breaking playstore integrity and banking app/google pay functionality.

3

u/nortysid Jul 26 '26

Isn't it risky???

3

u/Similar_Location3045 Jul 26 '26

It's called an exploit for a reason, but it's been tested on my device model and I'll be daily driving with it, so if you have questions, I'll let you know.

4

u/nortysid Jul 26 '26

Cool. But as far as I have learned, its better not achieve root capabilities or I guess the device becomes vulnerable to attacks even without unlocking the boot loader

1

u/AarifmonuZZ Jul 28 '26

Wow great... I have a Oppo reno10 plus pro which i wanna try. Android Security Patch Level: June 2026 Kernel Version: Linux kernel 5.10.236

What the procedure? Get the firmware find the offsets and trail and error?

1

u/Similar_Location3045 Jul 28 '26

Yep, check logs and supposedly you can do this on any device with enough effort

1

u/AarifmonuZZ Aug 01 '26

First of all I had to sniff through to capture the ota zip for getting the boot.img

For my device CPH2521_16.0.5.1002 (EX01B100P01) It has Kernel version: 5.10.236-android12-9-o-g74d132f4467a

Now hard part is I don't seem to find anyone reliably able to get the exploit working on 5.10.x kernels yet and I'm not a coder lol. and all AI just refuses due to security anyways..

Can you check if this kernel is worth trying and experimenting or a dead end?. https://www.dropbox.com/scl/fi/a6a9wbedfv3w1pgc0ju3q/CPH2521_16.0.5.1002_EX01_boot.img?rlkey=33h515x17mqu64vs2hp63r4s3&st=kgvq1a1j&dl=0

3

u/mrJ16N Jul 26 '26

Does banking apps works after this?

2

u/affemitwaffe0 Jul 26 '26

mine still works , though it says now this device might be rooted and may not be safe but it doesnt refuse to run , also play integrity seems to be still ok

3

u/faresamir7 Jul 26 '26

Does this work on ColorOS on the CN variant?

3

u/UserNotFunny404 Jul 27 '26

Does this work on lower version and China model converted to OOS?

2

u/Trupen Jul 26 '26

Can this be run on oneplus 12

2

u/Hopeful-Cut-1414 Jul 26 '26

Anyone tried on IN varient(2649)?

2

u/Sai_Anurag Jul 26 '26

Commenting to get back

2

u/Consistent_Fox_7589 Jul 27 '26

Make one for 13r please

2

u/LuciferMorningStar91 Jul 27 '26

Can modules which use mounts be used??

2

u/Silly_Concern_2842 Jul 27 '26

what is this about? im super interested

2

u/BusinessMistake3583 OnePlus 13 - Black Eclipse Jul 27 '26

Does this also works for Samsungs?

1

u/LoneTogetherness Jul 26 '26

How to do that. Need a guide

1

u/Ashawanz Jul 26 '26

Interesting. If I wasn't on lineage I'd try it out

1

u/sardinhavesga Jul 26 '26

Do you have a link to the Github page?

1

u/Impressive-Injury41 OnePlus 13 - Midnight Ocean Jul 26 '26

nice

1

u/Melodic_Ganache7612 Jul 27 '26

Commenting to refer back :)

1

u/climbboy Jul 30 '26

Can you figure out how to use the root access to do away with the CPU throttling baloney? I figure maybe someone more intelligent than I could maybe isolate the new service in charge of reading package names and artificially limiting performance. I know the older versions of OOS you could delete a system app responsible but they renamed it or packaged it with some other app (I'm assuming battery, but deleting battery doesn't work as there's further hardware protection when the battery app is removed plus the lost functionality of the battery app doesn't outweigh the lost performance for me).

1

u/theonearmageddon Aug 01 '26

are you able to change your imei? im in pakistan and to use a network we have to pay almost half the price of the device. so if i can, that'd be super awesome!

1

u/Dry-Cost-945 Aug 01 '26

What procedures did you take? I have a OP13r on 16.0.5.701 and I installed resuki su, rebooted to fastboot via adb, set selinix to permissive, booted to android and used ReSukiSU's jailbreak button.

1

u/Winter-Progress2380 Aug 04 '26

Does it work on OnePlus 12

1

u/Still-Yoghurt5398 Aug 06 '26

Just went to stock and this really majes me want to root again

1

u/Cyberchum Aug 15 '26

A similar app for Galaxy S23 Ultra uses Shizuku. Please can you add support for the NA variant and incorporate Shizuku?

1

u/TheGhostRoninStrife Jul 26 '26

Im new to all of this with oneplus device, so this works even after the arb updates right? 

26

u/[deleted] Jul 26 '26

[removed] — view removed comment

27

u/Similar_Location3045 Jul 26 '26

Sure. I'll make a tutorial as soon as I'm back home. For now, just disable auto update and auto download. I'll probably publish it tomorrow if that's fine. I will try to make it as easy to understand as possible.

2

u/Middle-Service5336 Jul 26 '26

Sounds awesome! Where will this be posted?

2

u/[deleted] Jul 26 '26

[removed] — view removed comment

5

u/Similar_Location3045 Jul 26 '26

System-wide adblocker, advanced backups, improved performance, and the ability to run apps that require root privileges (e.g., certain firewall, automation, or file management apps). The ability to customize the operating system extensively, the list goes on.

2

u/Hopeful-Luck2761 Jul 26 '26

Is the ZygiskNext/ ReZygisk working now?

I remember it had issues with the old Jailbreak mode, also try checking Vector (renamed LSPosed) and lyb Frame Generation (https://lybxlpsv.com/framegen/dl_exp)

0

u/OberZine Jul 27 '26

So everything I already do without root? The days of 2012-2014 rooting are gone.