## https://sploitus.com/exploit?id=D588D372-1BF3-5AC2-9829-495D0AE07D2A
# Neo9Root
> **iQOO Neo9 (PD2338C) Unlocked Without Unlocking – Caps-Root Tool** — An arbitrary physical write privilege scheme based on CVE-2025-21479 (Adreno GPU SDS)
[](LICENSE)
[]()
[]()
No need to unlock the bootloader, no need to flash the device, no need for Magisk. By exploiting the GPU vulnerability, you gain **kernel-level arbitrary physical write** capabilities. After patching key kernel functions, a **41-bit caps** root daemon is created, providing root privileges for `rootc` / `su`. **Key features**: euid remains 2000 to bypass vivo’s anti-root detection (`vr.ko`), root privileges are equivalent to uid=0 but with secure process identities. ---
## ✨ Features
- 🔓 **No need to unlock BL** — No interaction with the bootloader, partition, or dm-Verity; full RAM state, clean upon restart.
- 🧬 **True kernel-level root** — `CapEff: 000001ffffffffff` (41-bit full capabilities), no application-layer disguise.
- 🛡️ **Bypasses vivo’s anti-root detection** — euid=2000 remains, `vr.ko` detection fails, zero crash of the device.
- ⚙️ **Persistent daemon** — File queue + Base64 protocol, zero dependency on command execution, complete output passed through.
- 🔌 **Compatible layer** — `su` wrapper, MT manager / Termux can be directly called.
- 📦 **Zero persistence** — All patches are in RAM, clean state restored automatically upon restart.
## 📱 Supported Devices
| Item | Value |
|---|---|
| Device | iQOO Neo9 (PD2338C) |
| System | Android 15 |
| Kernel | `5.15.178-gaacdc35637c4-dirty` (GKIv1) |
| GPU | Adreno 740 (A7xx) |
| Memory Layout | Physical without KASLR (`stext_pa=0xa8010000`), VA overall slide |
> ⚠️ Vulnerability exploitation depends on the specific kernel layout (symbol offsets, `VIVO_VMET_BREAK_KMI` feature, `vr.ko` behavior). **Other devices/kernels require adaptation**. ## 🚀 Quick Start
### Environment Requirements
- Windows + adb (or adb on any platform, script in PowerShell version)
- USB debugging enabled on the phone
### One-Click Deployment (Recommended)
```powershell
# Clone and run (adb needs to be in PATH; use $env:ADB to specify path)
powershell -ExecutionPolicy Bypass -File scripts\run_rootc_loop.ps1
```
The script will automatically: push the three-piece set → restart to obtain the cold window → multiple rounds of the exploit (approx. 50% success rate per round) → the daemon is ready → verification. ### Manual Deployment
```powershell
# 1. Push (only one time, persistent in /data/local/tmp)
adb push exploit\exploit_vivo_neo9 /data/local/tmp/
adb push client\rootc /data/local/tmp/
adb push client\su /data/local/tmp/
adb shell "chmod 755 /data/local/tmp/exploit_vivo_neo9 /data/local/tmp/rootc /data/local/tmp/su"
# 2. Restart to obtain the cold window (after restart, run /data/local/tmp/exploit_daemon.log 2>&1 &")
# 4. Wait for completion (usually 10s–3min)
adb shell "cat /data/local/tmp/rootd_ready.txt"
# Output "ready" indicates success
## 🛠️ Usage
### rootc — Execute arbitrary root commands
```powershell
# Simple command
adb shell "/data/local/tmp/rootc id"
# Complex command (Base64 encoding, avoid quotation issues)
$b64 = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes('ls -la /data/adb; dmesg | tail -5'))
adb shell "/data/local/tmp/rootc B64:$b64"
```
### su — Compatible with MT manager / Termux
```bash
su -c "ls /data/adb" # Arbitrary root command
su -c "chown 0:0 /path/file" # Change file ownership to root:root
su # Interactive mode (stdin line by line)
```
**Termux Configuration**: For first-time use, root permissions required:
```bash
# Allow write permission to the queue directory + install su to Termux PATH
su -c "chmod 1777 /data/local/tmp"
su -c "cp /data/local/tmp/su /data/data/com.termux/files/usr/bin/su && chmod 755 /data/data/com.termux/files/usr/bin/su"
```
**MT Manager**: Set → ROOT → Custom su path → `/data/local/tmp/su`
### Common Verifications
```bash
su -c id # uid=2000 works normally (see FAQ)
su -c "grep CapEff /proc/self/status" # 000001ffffffffff = full capabilities
su -c "ls /data/adb" # 700 root directory, normal shell denied
```
su -c "chown 0:0 /data/local/tmp/x && ls -l /data/local/tmp/x" # Root-exclusive operation
su -c "head -5 /proc/iomem" # Kernel physical memory layout
su -c "ls /data/data/" # Private data of any app
## 🔬 Principle
CVE-2025-21479 (Adreno SDS: CP_SET_DRAW_STATE misclassification)
Privilege escalation via CP_SMMU_TABLE_UPDATE → SMMU’s TTBR0 points to a fake page table
Any physical write (fake TT0: L1/L2/L3 page tables + 6GB anonymous page spraying hits)
patch cap_bprm_creds_from_file at the entry point (mov w0,#0; ret) → Effective caps are retained after execution (normal commands can also use full caps)
patch kptr_restrict = 0 → /proc/kallsyms is fully accessible
patch vhangup stub (MODE=10 privilege escalation) → fsuid/fsgid=0 + 41-bit caps; euid remains 2000
fork to reside a daemon (File Queue Service)
rootc / su → (File Queue + B64) → Daemon → Any root command (full caps)
**Why euid=2000?** Vivoo’s kernel has a built-in anti-root module “vr.ko”: Non-vrp processes with cred->euid==0 trigger a fatal crash (device restarts). MODE=10 privilege escalation deliberately **does not change euid**, only writes fsuid/fsgid + caps—“vr.ko” cannot trigger this, but the kernel’s capable() check passes everything (true root capabilities).
## 📂 Project Structure
neo9_root/
├── README.md # Documentation
├── LICENSE # MIT
├── exploit/ # Vulnerability exploitation
└── exploit_vivo.c # Source code (STUB_MODE=10 + daemon + cap_bprm patch)
└── exploit_vivo_neo9 # Compiled artifacts (aarch64 musl static)
└── stubs/ # Privilege escalation stub assembly
├── client/ # Clients
└── rootc.c / rootc # Root command clients (File Queue + B64)
└── su # Su-compatible wrapper (MT/Termux)
├── scripts/ # Deployment scripts
└── run_rootc_loop.ps1 # Recommended: Multi-trial automatic deployment
└── run_root_final.ps1 # One-click deployment
└── tools/ # Kernel/module reverse-analysis scripts (vr.ko, etc.)
└── docs/ # Debugging records
└── DEBUG_RECORD.md # Complete debugging records (crash root cause chain)
└── EXPLOIT0_FIX.md # Exploit0 repair records
└── archive/ # Reference for failed solutions (setuid schemes, etc.)
## ⚠️ Known Limitations and Notes
- **Invalidation upon restart**: All patches are in RAM; reinstallation is required after restart.
- **Cold window**: Exploit success depends on <3 minutes after reboot; within ~28 candidates before GPU freeze → Use “run_rootc_loop.ps1” for multiple retries.
- **adb disconnection ≠ crash**: GPU may become unresponsive during high loads, causing adb disconnection. Check with “cat /proc/uptime” (uptime continues to increase while screen remains normal = device not crashing).
- **uid=2000 display**: See principle section; design decision. Equivalent to root capabilities.
- **/system restricted by fstab**; /system is read-only (erofs + dm-verity), unable to modify persistently.
- **/data/local/tmp permissions**: In Termux, chmod 1777 required; this means any app can write to queue files (no issue if desired; restore chmod 771 if needed).
## ❓ FAQ
**Q: Is this real root?** A: Yes. Kernel’s capable() check (CapEff enabled, chown 0:0, reading /proc/iomem, reading any app data) passes everything—kernel recognizes you have root capabilities, but uid is 2000.
**Q: Will it brick the device?** A: No. No disk writes, no persistent modifications. Worst-case scenario: GPU freezes, then restart.
**Q: Does it support other models?** A: Requires adaptation (kernel layout, symbol offsets, vr.ko behavior is exclusive to PD2338C; works for vivo iqoo neo9 with Orange 5 system).
## 📜 Disclaimer
This project is **only for security research and personal use**. Any consequences (including device damage, data loss, warranty invalidation) are the user’s responsibility. Please comply with local laws and use for legitimate purposes only.
## 🙏 Thanks
- [zhuowei/cheese](https://github.com/zhuowei/cheese) — Original GPU exploit framework
- [sarabpal-dev/cheese-cake](https://github.com/sarabpal-dev/cheese-cake) — Extended implementations
- Public research by Type010 / CyberMeowfia, etc. — Inspiration for ideas
## 📄 License
[MIT](LICENSE)