## https://sploitus.com/exploit?id=D26FB7F9-F651-540E-8A31-179E9A4D43E9
# vivo/iQOO Temporary Root Toolkit
> No unlocking required, no flashing required, temporary root (disabled after reboot).
> Core principle: CVE-2026-43499 (futex PI UAF) kernel exploit + KernelSU temporarily loaded.
## Supported Models (App version)
| Model | Device Code | Loader |
|---|---|---|
| iQOO Z10 Turbo | `z10t` / `iqooz10t` / `V2452A` / `pd2452` | preload_z10t.so (156KB) |
| iQOO Z10 Turbo Pro | `V2453A` / `pd2453` | preload_neo11.so (162KB) |
| iQOO Z10 Turbo+ | `pd2405` / `pd2507` | preload_z10t.so (156KB) |
| iQOO 13 | `V2408A` / `pd2408` | preload_neo11.so |
| iQOO Neo11 | `V2520A` / `pd2520` | preload_neo11.so |
| iQOO Neo10 Pro+ | `V2463A` / `pd2463` | preload_neo11.so |
| vivo X200 | `pd2415` (separate seven-stage link) | glt/w2host framework |
## Directory Structure
| Path | Description |
|---|---|
| `README_.md` | Detailed usage and maintenance documentation |
| `build_final.py` / `bump_version.py` | Build and version upgrade scripts |
| `TemporaryRootToolkitiQOO.sh` | Termux version of the toolkit script |
| `IQOO Temporary Root Toolkit(1)/` | Complete Termux version (including X200 mode, see `x200/`) |
| `IQOO Temporary Root Toolkit Optimized Version/` | Optimized version of the toolkit script |
| `vivo_iqoo Temporary Root Toolkit/` | Windows PC version (USB wired) script |
| `Z10TurboPro_TemporaryRootTool/` | Specialized PC version for Z10 Turbo Pro |
| `releases/` | Version archive description |
> The repository only hosts **source code and scripts**; APKs, zip files, loaders, etc. are not included in the repository.
## Privilege Escalation Process (High success rate method)
1. Reboot the phone (Key: **pristine boot_id**)
2. Push the privilege loader (Automatically identifies the appropriate loader for the model)
3. Execute the privilege escalation: If a injection output is detected → Automatically turn off the screen → Wait 5 seconds before turning the screen on (May need to repeat this process once)
4. After completion → The phone **soft-restarts**, indicating success**
5. Reconnect → Verify root access (`uid=0` indicates success) → Load KernelSU
## Limitations and Risks
- **Temporary root**: Must be rerun after each cold boot (about 1-2 minutes); the root status becomes invalid after each reboot
- Kernels >= 6.6.140 have fixed CVEs; not available (scripts automatically reject attempts)
- If the attempt fails, the phone must be restarted before attempting again. Multiple failed attempts will result in failure
- No risk of bricking the device (worst-case scenario: kernel panic, then recovery upon restart)
## Building
```bash
# Signature keys and passwords are provided via environment variables (Not disclosed with the repository)
export IQOO_KEYSTORE=/path/to/your.keystore
export IQOO_KS_PASS=your-keystore-password
python build_final.py out.apk
```
## Disclaimer
This tool is for educational and research purposes only. Please use it on your own device. Users must bear all risks and legal responsibilities.
## Third-party Components
See `IQOO Temporary Root Toolkit(1)/THIRD_PARTY.md` (GhostLock-X200 link: Apache-2.0 / GPL-2.0-only; KernelSU: GPL-2.0-only).