## https://sploitus.com/exploit?id=ADDCE3E9-CDF7-538F-8B21-407C332F1434
# GhostLock X200 (App)
A one-click root app for **vivo X200** devices, targeting the **GhostLock (CVE-2026-43499)** kernel vulnerability. This app does not require flashing the device, unlocking it, or wiping data. After execution, a **temporary root access** is granted; it becomes invalid after rebooting, and the app needs to be reopened to perform another root process. This is the mobile version of the [ghostlock-x200-root](https://github.com/xiaohj233/ghostlock-x200-root) (PC version toolchain); they share the same privilege escalation chain. It can be used with **Shizuku** (supporting wireless debugging) authorization; **no computer ADB is required**.
> **Legal and Safety Statement (Please Read Carefully)**
> This repository is **only intended for security research and educational purposes**, and **should only be used on devices that you own or have explicit permission to use**. Using this tool on others’ devices without authorization may violate local laws. Using this tool may cause abnormal device reboots, data corruption, system abnormalities, or warranty voids. Please evaluate the risks yourself. **The author assumes no responsibility for any direct or indirect damage caused by this tool, nor for any misuse.**
> Continuing to read or use this repository means you understand and accept full responsibility for all risks involved.
## How to Use
1. Install and launch **Shizuku** (Android 16 requires GitHub version 13.6.0+).
2. Open this app and follow the instructions to grant Shell permissions.
3. Click “Start Rooting” and wait for all steps to complete (about 1-2 minutes).
4. Verify: Execute `su -c id` in the terminal; the output should be `uid=0(root)`.
5. The root access becomes invalid after rebooting. Repeat steps 1-3.
**Note:** Wait about 4 minutes after booting up before running the app again. The root process may trigger a kernel restart (which can be automatically recovered without bricking the device).
## Building
You need to have [ghostlock-x200-root](https://github.com/xiaohj233/ghostlock-x200-root) (v1.3.5) available to provide the privilege escalation assets, along with NDK r21e, Android SDK build-tools 36/android-35, and JDK 11.
```bash
bash runner/build_runner.sh # Compile the runner
bash tools/make_payload.sh # Assemble the privilege escalation assets
bash tools/build_app.sh /root/androidsdk # Generate the APK
```
The frontend artifacts are distributed with the repository. You need to rebuild them after modifying the `ui-preview/` frontend code (see `tools/regen_www.py`). Details about the underlying mechanics, device compatibility, etc., can be found in the PC version repository documentation: [Architecture](https://github.com/xiaohj233/ghostlock-x200-root/tree/v1.3.5/docs/ARCHITECTURE.zh-CN.md), [Usage Instructions](https://github.com/xiaohj233/ghostlock-x200-root/tree/v1.3.5/docs/USAGE.zh-CN.md); details about this repository can be found in `docs/DESIGN.md`.
## Directory Structure
```
app/ Android App (Java framework + integrated with Shizuku)
runner/ Privilege escalation orchestrator (C language)
exploit/ Source code for the privilege escalation program
ui-preview/ Windows UI frontend
tools/ Build scripts
```
## License and Source
This project uses Apache-2.0 license ([LICENSE](LICENSE); copyright holder **xiaohj233)**. The privilege escalation assets and source code come from [ghostlock-x200-root](https://github.com/xiaohj233/ghostlock-x200-root) (including third-party code like IonStack/KernelSU; see [NOTICE](NOTICE) for the full source).
## Acknowledgments
- [NebuSec / CyberMeowfia](https://github.com/NebuSec/CyberMeowfia) — IonStack (CVE-2026-43499)
- [tiann/KernelSU](https://github.com/tiann/KernelSU) — KernelSU
- [RikkaApps/Shizuku](https://github.com/RikkaApps/Shizuku) — Shell execution
- [Furry-Xiyi/WinUIonWeb](https://github.com/Furry-Xiyi/WinUIonWeb) — Windows UI frontend components