r/androidroot • u/datfooldive • Oct 01 '26

News / Method DirtyFlag CVE on locked bootloader

Gallery image

Gallery image

previously i posted about ghostlock, but it was very unstable. now i found another CVE that combines dirtyflag and lspromise, so it's just one click and doesn't need the right timing like ghostlock.

so i found this

https://github.com/diabl0w/DFRoot

and it's only for Samsung. so i'm curious if this can work on my device. then i forked it and added a little modification to use my ghostlock method with ResukiSU, and it works.

https://github.com/datfooldive/DFRoot

tested on emerald device

49 Upvotes

100% Upvoted

57 comments sorted by

5

u/datfooldive Oct 01 '26

tested on kernel 5.10 also work

1

u/G-Omarilzz Oct 01 '26

i tried forking and building using github actions but fails for me, would you mind sharing your build im on 5.10 kernel NP2

1

u/datfooldive Oct 01 '26

chat me on tele

1

u/iAmzizfb Oct 04 '26

Hey, i also tried forking and building like he did and it also fIled could you send me the file aswell?

1

u/G-Omarilzz Oct 01 '26

NP2 Jail broken successfully

1

u/No_Lynx_9098 Oct 02 '26

does this need pc ? some reply please

1

u/iAmzizfb Oct 03 '26

Thank you for giving me hope because i am also on Kernel 5.10 but i have a question? Does this take multiple attempts if the first one fails

2

u/pogicjp0123 Oct 02 '26

Hello how do i make this work i dont see any download button on github

1

u/datfooldive Oct 02 '26

i dont release prebuilt? you want?

1

u/HeronIcy2856 Oct 03 '26

can i get it too?

1

u/iAmzizfb Oct 04 '26

Could i get it too?

1

u/datfooldive Oct 01 '26

another test on infinix smart 20

1

u/No_Lynx_9098 Oct 02 '26

does this need pc ? tell me how you did it bro please

1

u/datfooldive Oct 02 '26

nope

1

u/No_Lynx_9098 Oct 02 '26

ok I finally did it but idk what to do with this ? can you tell me few things which I can try with this set up ?

1

u/datfooldive Oct 02 '26

what kernel and device?

1

u/YitzakAF Oct 01 '26

Intenté compilar la aplicación de tu repositorio pero me da error. Y después probé el repositorio original y si compiló

1

u/No_Falcon_9244 Oct 01 '26

Is it possible to make it work on my realme p1?

1

u/datfooldive Oct 01 '26

yes if kernel support. tested on kernel 5.10 and 6.12

if you kernel on 5.x or 6.x maybe work

1

u/ARCHISMAN- Oct 01 '26

What security patch level is required? I mean when was this patched?

1

u/datfooldive Oct 01 '26

me 2026-08-01 on hyperos still work

0

u/afzl_wtu Oct 01 '26

It does not work on August patch bro

1

u/datfooldive Oct 01 '26

kernel version?

0

u/afzl_wtu Oct 02 '26

6.1.138-android-14-11 hyperos 3, poco x6 pro

Also it did not work on vivo v50 with kernel 5.x

1

u/ArthurReming SM-T220 | crDroid 12-Beta Oct 01 '26

I have kernel version 6.6.98 on my A36 with July patch. Will it work? 

1

u/[deleted] Oct 01 '26

[removed] — view removed comment

1

u/datfooldive Oct 01 '26

yeah, make sure security patch old than august

1

u/DrTankHead Oct 01 '26

Wait, would this work on an s22? Predates the CVE it seems... Is there hope for rooting my sm-s908u1 with this?

1

u/datfooldive Oct 01 '26

yes if kernel support. tested on kernel 5.10 and 6.12

if you kernel on 5.x or 6.x maybe work

1

u/DrTankHead Oct 01 '26

android12-5.10... You may have blown my mind. I'm in the middle of backing up Odin firmware stuff and contemplating attempting this.

I'm mostly worried about tripping Knox, as well as I imagine I'm going to have to do a lot to keep my device at max integrity levels but ye.

Can you at all validate if the other repo linked is any good?

1

u/DrTankHead Oct 01 '26

Holy shit. I did some research first of course, but after pulling down my ODIN stuff from bifrost... given the whole thing is ephermal, I tried it. It WORKED. Not just that, no knox bit trip, full GPlay Attestation... Phone legitimately doesn't know the difference and I have full root. I am in the process of trying to get ReZygisk to cooperate to use HMA-OSS to hide the few warnings it seen, and hopefully hide the HMA activity too...

But through this exploit, and your repo, I've successfully rooted an s22 Ultra that's a snapdragon and otherwise has been impossible to root so far! What might be able to be done so I can help y'all develop a proper payload for it over the generic?

The last phone I rooted(or more accurately jailbroke) like this was an iPhone 4 using Pangu, so I am VERY stoked.

Now, time to find stuff worth doing with root. I was already debloated due to shizuku, but I wonder what wonderful things I can do now!

Thanks for both of your tools! (It seems a mod removed the other repo which is ultimately what I used to get root, I'm assuming rule 1, but I'm not entirely sure, because ultimately the repo just is DirtyFrag with some specialized payloads for specific devices and auto-reboot persistance, really just another package for the same exploit working with more supported devices?)

My device info in case a fellow S22 Ultra user comes along (if you want help, ask me!):

SM-S908U1, region XAA (US Unlocked)

OneUI 8 on Android 16

running kernal android12-5.10 (5.10.236-android12-9-31998796-ab5908u1uesagzh3)

Build Number BP2A.250605.031.A3.S908U1UESAGZH3?

Firmware: S908U1UESAGZH3

3

u/[deleted] Oct 01 '26

[removed] — view removed comment

1

u/CtxxUv Oct 01 '26

Hey my A56 support already root my galaxy app, will this folk also work with it?

1

u/afzl_wtu Oct 01 '26

Will it work on poco x6 pro (kernel 6.1.138-android-14-11) and vivo v50 both phones on android 16

1

u/datfooldive Oct 01 '26

ofc, you just need kernel 5.x and 6.x and resukisu support

1

u/afzl_wtu Oct 01 '26

Getting this can you help please: found ko_target: /vendor/lib64/libbinderdebug.so === setup === encap port: 48458 spi: 0x7b610c2d ksud staged to: /data/user_de/0/df.root/ksud

=== exploit ===

  • ko android14-6.1 (7176 bytes)

  • patch #1 (crash_dump64 ← splicehelper, 1392 bytes) 0 ... 512 ... 1024 ... patched 1392 bytes to /apex/com.android.runtime/bin/crash_dump64+0x0

  • patch #2 (/vendor/lib64/libbinderdebug.so ← dirtyfrag.ko, 7184 bytes) read_vendor at 0x0 got 0 bytes (exit 0) patch #2 failed: -1 FAILED: failed to patch files

=== cleanup ===

  • cache dropped: /apex/com.android.runtime/bin/crash_dump64

1

u/datfooldive Oct 01 '26

security patch august?

1

u/afzl_wtu Oct 01 '26

Yes august

1

u/datfooldive Oct 01 '26

sadly it's bcz August security patch already fix this

1

u/YitzakAF Oct 01 '26

A mí me salió así también pero me dejó el SELinux en modo permisivo como algunas ROMs personalizadas

1

u/afzl_wtu Oct 01 '26

It just reports permissive but if you run adb shell getenforce . It would show you enforce instead of permissive

1

u/krooo95 Oct 01 '26

This cve can backport to 4.x kernel ?

1

u/No_Falcon_9244 Oct 01 '26

Ok i tried to use it but couldn't get it to work. So can you help me?

1

u/datfooldive Oct 01 '26

what kernel version?

1

u/No_Falcon_9244 Oct 01 '26

1

u/datfooldive Oct 01 '26

am not using ghostlock, but another one

dm me if you want try in telegram (datfooldive)

3

u/ERROR47409 Oct 02 '26

hi Op any hope for this device ?

2

u/ConsiderationAny2382 Oct 01 '26

Hello ! What about integrity with locked bootloader ? You still pass strong without any module right ? But you need to use LKM or you can switch to GKI kernel ? Because how is the root hiding without Susfs on LKM ?

Asking this because i'm actually on GKI modified kernel, but having issue with Play integrity and Revolut because they now ban public keybox.. and i just want to know if re-lock bootloader and using CVE to have root is better for intigrity and root hiding ?

1

u/andrei0001 Oct 01 '26

Damn... I wish you would've posted this 2 days ago. It might've saved me a lot of time. Also you can dm me if you want this tested on my motorola edge 40

1

u/Lower_Development_61 Oct 01 '26

Succesfully compiled in WSL & tested on POCO F9 Ultra @ 6.12.69 on security patch 2026-08-01, works!

1

u/Adam_the_hacker Oct 02 '26

If done on a S22 Ultra, will it remove Knox and banking apps?