## https://sploitus.com/exploit?id=9938020B-C1D9-56AD-B29F-A38838AE38C9
# GhostLock-X200 v1.0
> β οΈ **Legal and Safety Statement (Please Read Carefully)**
>
> This repository is intended only for **security research and educational purposes**, and **should be used only on devices that are owned by you or for which you have obtained explicit written permission**. Using this tool on othersβ devices without authorization may violate local laws and regulations. Using this tool may cause device restarts, data corruption, system abnormalities, or warranty voidance. Please evaluate the risks yourself. **The author assumes no responsibility for any direct or indirect damage caused by this tool, nor for any misuse.**
> Continuing to use this repository means that you understand and agree to take full responsibility for any risks involved. This **temporary root toolchain** is based on the CVE-2026-43499 (GhostLock) kernel vulnerability: it does not require unlocking the Bootloader, flashing the firmware, or clearing data. It grants temporary root access after execution, which expires upon restart. [Features](#Features) β’ [Supported Devices](#Supported Devices) β’ [Differences from Other Projects](#Differences from Other Projects) β’
[Quick Start](#QuickStart) β’ [How It Works](#HowItWorks) β’ [Directory Structure](#DirectoryStructure) β’ [License](#License and Source)
---
## Features
- No need to unlock the Bootloader, no need to flash the firmware, no data clearing
- Temporary root: expires upon restart, does not write to the system partition
- Provides a one-click script `root.ps1`: automatically detects the device and kernel, installs missing dependencies, generates offsets
- Offsets are extracted from the device in real-time (kallsyms + BTF + disassembly), not relying on hardcoded addresses
- Includes the `permissive_restore` kernel module to fix network/hotspot anomalies under the `KernelSU` enforcement mode (see βDifferences from Other Projectsβ below)
- Source code, build scripts, and precompiled kernel modules are provided with the repository. Licenses are marked per file
## Supported Devices
| Device | System/Kernel | Status |
|---|---|---|
| Vivo X200 (PD2415) | 16.1.12.2.W10 (Tested and Verified) | β
Available |
| Vivo X200 (PD2415) | 16.1.12.12.W10 (Same kernel, built with b57) | β οΈ Not Tested |
| Vivo X200 (PD2415) | Other 16.1.x models, kernel b57af212129c | β οΈ Not Tested, Can Be Tried |
| Vivo X200 (PD2415) | Kernel >= 6.6.140 | β Fixed, Not Available |
| iQOO Neo11, etc. (Same 6.6.89 MTK kernel) | Same kernel | β οΈ Not Tested, Requires Custom Development |
οΌ `< 6.6.140` (CVE-2026-43499 not fixed) and built as `6.6.89-android15-8-gb57af212129c`. Untested models/builds require verification. Full instructions see
[Instructions](docs/USAGE.zh-CN.md). ## Quick Start
```powershell
# Download the release assets and place them in the package:
powershell -ExecutionPolicy Bypass -File root.ps1
```
Detailed steps (one-click script, dependency installation, manual script, parameter table, common issues) see
[Instructions docs/USAGE.zh-CN.md](docs/USAGE.zh-CN.md). ## How It Works
Seven-stage chain: permissive (SELinux) β kptr β KASLR base β Dynamic Offset β ko Relocation β cred Leak + CAPSROOT β Load permissive_restore/kernelsu β Resume after 25 seconds
Permissive. Details about architecture and components see
[docs/ARCHITECTURE.zh-CN.md](docs/ARCHITECTURE.zh-CN.md). ## Directory Structure
```
βββ root.ps1 # One-click script (automated dependency installation/generation of offsets)
βββ docs/ # ARCHITECTURE (architecture), FILE_MAP (file mapping), USAGE (usage instructions)
βββ exploit/ # Device-side exploitation code (glt/w2host; includes IonStack source code and derived sources)
βββ modules/
β βββ permissive_restore/ # Original kernel module from this repository (GPL-2.0-only)
β βββ kernelsu/ # Official KernelSU v3.2.5 kernel module (GPL-2.0-only)
βββ tools/ # Scripts (main chain scripts) + offset_tools (dynamic offset tools)
βββ refs/ # Upstream reference table (fixed versions)
βββ LICENSES/ # SPDX license texts (REUSE)
βββ LICENSE / NOTICE / THIRD_PARTY_NOTICES.md / SOURCE-URLS.md
βββ REUSE.toml
```
The purpose, source (COPYED/DERIVED/LOCAL), and licenses for each file can be found in
[docs/FILE_MAP.zh-CN.md](docs/FILE_MAP.zh-CN.md). ## Licenses and Sources
- Original project code: **Apache-2.0** (see LICENSE/NOTICE);
`modules/permissive_restore/` is **GPL-2.0-only**;
- `exploit/` contains source code for NebuSec/CyberMeowfia IonStack (Apache-2.0,
commit date fixed), as well as adaptation references for boxiaolanya2008/Neo11Plus and YuKongA/ghostlock-app
(Apache-2.0);
- `modules/kernelsu/kernelsu.ko` is the official KernelSU v3.2.5 release asset
`android15-6.6_kernelsu.ko` (GPL-2.0-only), which was adapted by vermagic:
Only the vermagic string in the.modinfo was modified to match the X200 b57 kernel; no other code was changed.
For the adaptation script, see `modules/kernelsu/patch_vermagic.py`. SHA256 values and sources can be found in
THIRD_PARTY_NOTICES.md/SOURCE-URLS.md;
- `prebuilt/ksud` (release asset) contains `libksud.so` from the official APK, which remains unmodified
(GPL-3.0-or-later). Full list available in [NOTICE](NOTICE), [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md),
[SOURCE-URLS.md](SOURCE-URLS.md). ## Acknowledgments
- [NebuSec / CyberMeowfia](https://github.com/NebuSec/CyberMeowfia) β Original research on IonStack (
CVE-2026-43499)
- [tiann/KernelSU](https://github.com/tiann/KernelSU) β KernelSU v3.2.5
- [boxiaolanya2008/CVE-2026-43499-Neo11Plus](https://github.com/boxiaolanya2008/CVE-2026-43499-Neo11Plus),
[YuKongA/ghostlock-app](https://github.com/YuKongA/ghostlock-app),
[p2p3p/GhostLock-for-OnePlus](https://github.com/p2p3p/GhostLock-for-OnePlus)
β Adaptation and architecture references