ghostlock-app
GhostLock uses CVE-2026-43499 to gain temporary root on supported Android kernels and load KernelSU.
Use the app
- Install a root manager APK from KernelSU, BakaSU/ReSukiSU, or KowSU.
- Install the GhostLock APK and open it.
- Check that your kernel is supported, then tap Run.
Support requires an exact uname -r match. Check the supported devices for your kernel build.
If Shizuku is enabled, start it with ADB before running GhostLock. Tap GhostLock's status card to grant access.
Add a kernel profile
You can import a profile without rebuilding the app:
- Parse OTA link accepts a full OTA ZIP URL.
- Parse local image accepts
boot.imgand an optionalxbl_config.img. - Import offsets.conf (v2) accepts a HOCON profile. Import offsets.json (v1) converts an older JSON report in the app.
Extractor output is an unverified candidate. The app checks missing or invalid fields before execution. Generating a profile does not prove device support. See the porting guide for validation and built-in registration.
See the MediaTek guide for image-based address recovery and the rooted-device fallback.
Command-line tools
Run the native binary with an exported profile
Requires the Android NDK, make, Gradle, and ADB. An adb shell run skips the app's seccomp bypass stage.
make -C src ghostlock
./gradlew.bat exportKernelProfiles
adb push build/native/ghostlock /data/local/tmp/ghostlock
adb push build/kernel-profiles/<release>.bin /data/local/tmp/profile.bin
adb shell chmod 755 /data/local/tmp/ghostlock
adb shell /data/local/tmp/ghostlock --load-prebuilt-profile /data/local/tmp/profile.bin
Build and run the offset extractor
Requires Rust. The extractor accepts a boot image, a full OTA ZIP, or an HTTP(S) URL.
Push-Location tools/extract_rs
cargo build --release
Pop-Location
build/extract/release/ghostlock-extract.exe boot.img --xbl-config xbl_config.img --format conf --out profile.conf
build/extract/release/ghostlock-extract.exe OTA.zip --format conf --out profile.conf
Import profile.conf in the app. Omit --xbl-config if you do not have that image. The extractor rejects a patched remove_waiter() with exit code 6.
Reference
- Profile schema and execution defaults
- Native core
- Add a component, engineering rules, and writing rules
Credits and license
Licensed under Apache License 2.0. Based on:
