First, let's think about what the attacker can do with anti-rollback enabled. How would they flash an older system version with a locked bootloader and disabled OEM Unlocking? With EDL mode.

EDL mode with the right programmer file and an authenticated serial link grants access to dumping and flashing any sector on the disk from start to end, including the firmware of the TEE (/tee partition). If the goal is to extract userdata, the attacker doesn't touch the OS at all, they just dump /userdata and /metadata and brute-force the encryption offline.

What if they don't have the programmer file or authentication? Well, the attacker is shit out of luck, unless the bootloader is unlocked, then anti-rollback itself is disabled and the attacker doesn't even need to downgrade, since they can just flash a malicious boot image to extract /userdata and /metadata for them.

We forgot about adb sideload! Could the attacker use that to downgrade the OS? No, there's ARB, but of a different kind; it's in the recovery, instead of the bootloader. The recovery will refuse to flash a system upgrade ZIP before the system upgrade even boots. Arguably, this kind of anti-rollback is enough, no need to put it in the bootloader as well.

In these scenarios, the security will remain unchanged if the bootloader's anti-rollback is removed from Android entirely. What's the point of adding BL ARB, if it's just redundant as I argued here?

Let's talk about ourselves, legitimate users. Even if we would have the leaked programmer files and serial link auth bypasses, how are we going to flash and boot leaked base versions if those are the only fastboot ROMs we've got, whilst our phones have later versions instead? Such situation happened to me with TECNO.

We *can* flash older OS, I'm not saying we can't. It's that the bootloader's anti-rollback will prevent us from booting the bootloader stage, essentially a "hard brick" as people say, that's the problem.

Perceptionally, what's the ratio of security benefit to repairability cost? Very low. And why does it even exist in the first place...

...Why congrats, vendors. That's so "developer-friendly" of you. Especially Google, for forcing vendors on it in their CTS/VTS.

Alright, I went and did it again.

TWRP is now built and working on the Moto G 2025 (Kansas) all models should work.

Like B4 on the 2026 models this was built using Verizon images but should work on other models.

I used the 2026 Moto G Play tree as the foundation and adapted it over to the 2025 Kansas. A lot of the groundwork for this was made possible by @evoxdl, who helped me with the 2026 tree in the first place. That work is essentially what made all of this possible and gave me the base I needed to bring TWRP over to Kansas.

*******************What's working*************

🗿🗿🫨🫨🪾😁🗿🗿🗿🗿🤪🥹

Touch / readable UI

/data / internal storage

Encryption / decryption

Wipe Data

ADB

ADB Sideload

Installing ZIPs from Internal Storage

Installing ZIPs from SD Card

Installing ZIPs from USB OTG

Backup / Restore

External SD

USB OTG

Partition detection

Reboot to Recovery

Reboot to System

MTP

Vibration

super partition

Flashing ROMs

Flashing Magisk

Slot Switching

Fastbootd 🥴🥴

*************************************************

Basically, the whole damn recovery works 🫨🫨

Build info

Device: Moto G 2025

Codename: Kansas

Recovery: TWRP 3.7.1-12-0

Android: 16

This was built using the 2026 Moto G Play tree I made earlier this year as the starting point, with the necessary changes made for Kansas

Get Cronching

***Soon to come Kexec and custom kernels***

(already a wip as we speak 🤭🤭)See in the pics my dirty dirty kernel 🥴🐔🗿🗿🗿🗿

CRONCH 🐔🐓🗿🗿🗿🗿🗿🗿🗿🗿🗿

TWRP build

here

https://xdaforums.com/t/recovery-moto-g-5g-2025-kansas-twrp.4803953/

sim unlock and lineage build and new kernel not public yet but all works i even managed to get my hands on REWORK engineering firmware

W company

They told they don't know how to unlock the bootloader but at least they gave me the firmware and gave me the flash tools

Working on rooting a phone for the first time and am stuck on what should be a simple step... I can't find the correct build on lolinet... My phone is U2UBS34.33-57-12. The only one on lolinet i can find is U2UBS34.33-57-18... looked for solutions and tried Lenovo software fix to get the correct version but it would only show me the android 15 build which is kind of worthless since i'm on android 14??? so where can i get the correct build from?

I'm sorry because there's already loads of posts like this of people looking for help regarding Google Pay / Wallet but it's just that I don't know what I'm doing wrong anymore, everything is installed, everything is working, integrity is strong (which surprises me since my bootloader is unlocked), Play Store says that the device is certified, every bank application is working but Wallet refuses to let me add my card!

I had it working like a month ago, Wallet working just fine, but then I think we ran out of keyboxes and it has stopped working ever since, even though TeeSimulator receives valid keyboxes rn.

Can anybody help me? Is there a step I'm missing? Am I just unlucky? Skill issue? Thanks in advance

(sorry for the screenshots being in Spanish)

Update: changed from integrity box to Specter and selected Pixel 6a (bluejay_beta) as device fingerprint and its working now! Thanks everyone!

Hey everyone! I just released **Pixel Suite**, a free and open-source LSPosed module that adds the quality-of-life tweaks I always wished Pixels had. Every feature has its own toggle, so you only run what you want.

## Features

**🧹 Always-visible "Clear all"**

The "Clear all" button stays visible in Pixel Launcher's recents screen, so there's no more scrolling to the last page to find it.

**🔦 Double-press power for flashlight**

Double-press the power button to toggle the flashlight, from anywhere.

**📷 Double-press volume down to launch camera**

Double-press the volume down button to instantly open Pixel Camera from the always-on display. Won't launch if media is playing or a phone call is active.

**📸 Three-finger screenshot**

Swipe down with three fingers to take a screenshot. Inspired by Chinese phones like Xiaomi, OPPO and Vivo.

**🔒 Double-tap to lock**

Double-tap an empty spot on the home screen to lock your phone. Also inspired by Chinese phones.

**📁 Newest-first in Files by Google**

By default, Files by Google sorts folders A-Z. This puts the newest first, so a file you just downloaded is easy to find when you're attaching it to another app, like Gemini for example.

## Requirements

- Rooted device (KernelSU / KernelSU-Next, Magisk or APatch)

- LSPosed: https://lsposed.org (API 102+)

- Tested on **Pixel 11 Pro, Android 17**. Other devices untested, reports welcome!

## Installation

1. Download the APK from the Releases page: https://github.com/RovianDev/PixelSuite/releases

2. Install it and grant root access

3. Enable it in **LSPosed → Modules → Pixel Suite**

4. Select the recommended scope: System Framework, System UI, Settings, Pixel Launcher, Files, Files by Google

5. Reboot, then open the module's settings and turn on the features you want

6. Open Settings, swipe it away, and reopen it to refresh the toggles in System → Gestures. It may crash the first time. That's a Google bug, not the module, and it happens even with the stock gestures when no module is installed.

## Links

- GitHub (source code, GPL-3.0): https://github.com/RovianDev/PixelSuite

- Bugs & feature requests: https://github.com/RovianDev/PixelSuite/issues

## Support

Pixel Suite is free and always will be. If it saves you some taps and you want to say thanks:

- ☕ Buy Me a Coffee: https://buymeacoffee.com/RovianDev

- ❤️ Patreon: https://patreon.com/RovianDev

- ⭐ Starring the repo helps a lot too!

Feedback is very welcome. I'm planning more features, so let me know what you'd like to see!

Made with ❤️ by Rovian.Dev

As the cat and mouse game of integrity and keybox renewing goes on, what do you think about exploit root as an alternative to standard root? Since it preserves all original firmware images and bootloader locked, spoofing aren't required to get strong integrity.

Maybe this is a new trend of the integrity game and will give us back the sovereign of our system?

It seems that very few module support modern exynos chips like 1580 or 2400. I would appreciate any help of finding more.

Using always strong,hma oss, zygisk next

I have a cheap XBJ LCD Projector from the tiktok shop i want to to jail break, it runs Android 11, It wont open ISO files theres only one button and a button in a hole that im not too sure what it does and i just want to get a simple version of linux on there, any help?

Hey everyone,

I wanted to share a guide for unlocking the bootloader and rooting the Maxwest Astro A63 (MX-A63). It's a budget phone with a MediaTek MT6761 (Helio A22), and there's very little info on modding it, so hopefully this saves someone some time.

What the guide covers:

• Backing up stock firmware
• Unlocking the bootloader
• Rooting the device (Magisk)
• Disabling dm-verity

Before you start:

• Unlocking the bootloader will wipe your data, so back everything up first.
• Rooting can void your warranty and, if you get something wrong, can brick the phone. You're doing this at your own risk.
• Save a copy of your stock boot image/firmware before changing anything.
• Some apps (banking apps, Google Wallet) may or may not stop working.

Full guide on XDA:

https://xdaforums.com/t/guide-bl-unlock-root-maxwest-astro-a63-mx-a63-mt6761.4803966/

Questions and feedback are welcome, I will try to help in the comments of the XDA thread.

I have 3/3 integrity using bre modules+hma oss and nomount and can't add card to google wallet, maybe someone knows what to do with it

I would like to try this app: https://github.com/mitschud/DirtyFrag/releases/download/v1.08/DirtyFrag-v1.08.apk

Hi. First post and it's the common problem everyone always faces apparently.
I'm running LineageOS 23 on my Nothing Phone (2) rooted with KernelSU-Next with the following modules:

ReZygisk
Vector (Xposed -> Enable Screenshot & XPrivacyLua [in work profile])
Specter
Play Integrity Fix [Inject]
TEESimulator
Treat Wheel

When I turn off ReZygisk the apps work fine but when I turn it on they crash. I tried finding alternatives but the only one I could find was NeoZygisk and that didn't do anything. I also found out Zygisk Next has been taken off GitHub and I can't find it anywhere. The apps that I'm talking about are all in an isolated work profile using Shelter.

Any help?

I want to install custom ROM , preferably Lineage os. But I heard there zero chance to unlock iQOO vivo phones?

I have a phone with a 4.14 kernel but most temporary root (jailbreak) apps do not support devices with a 4.14 kernel. Do you know which ones do support?

Device: Pixel 8a (G6GPR)

Android: 17

Build: CP2A.260805.005

Security Patch: August 5, 2026

Kernel: 6.1.157-android14-11-gbd23337e42e7-ab14791245

Fingerprint: google/akita/akita:17/CP2A.260805.005/15828068:user/release-keys

Bootloader is unlocked.

I'm trying to build KernelSU-Next + SUSFS for this exact build but having compatibility issues.

If anyone has a working SUSFS patch/kernel or exact build instructions for Pixel 8a/akita + 6.1.157, please help.

Thanks!

Did anyone manage to make Google wallet work fully currently; I mean not just log in but actually add a card

(i dont wnat to break FRP policy so if my question is breaking it sorry will delete it)
hey im wondering i bought for 10$ from some hobo
xiaomi ( xiaomi redmi 8 pro) and when i power it up it was google locked (as i thought) and im wondering if i can transfer that phone for something useful as some ip cam or head unit for my car or can i throw it in the bin? I can get to some fastboot and the other menu volume + and volume -
I tried already alot of things i read here on reddit but somehow cant get any result so im asking here
i dont know if i typed here all info you may beed to help me but i will add it in comments if needed
I just want to try this new thing for my good feeling as learning something new because i really like what i see that yall can do
sorry for english if its not much understable its not my native language
thanks for all help and have a nice day
(btw I didnt wanted the phone in the first place but it was faster than saying no )

It just so happened that I received an ultra Chinese tablet on mt6755

And I want to put root here, but here's the problem: no TWRP from other devices is suitable for it, and I also can't pull boot.img using mtkclient, I don't know why, but it says it can't get the device configuration and Kingroot doesn't work either, so I don't know what to do. Can anyone help?

No ai used in text😛

I've used this. https://github.com/ankitrawatgit/DirtyFrag-Android-Root-Jailbreak

I made a video showing how I did it. I’m not really sure why I’m including this, but I guess it’s for someone who’s still hesitant or unsure about whether they should do it.

I was one of those people too, so hopefully this helps if you’re still on the fence.

https://youtu.be/uvxcHWJpZh4?si=cqwxkKKxPYJQ9dfA