YuKongA / ghostlock-app

# GhostLock-App
中文
GhostLock uses CVE-2026-43499 to gain temporary root on supported Android kernels and load KernelSU.
## Use the app
1. Install a root manager APK from KernelSU, BakaSU/ReSukiSU, or KowSU.
2. Install the GhostLock APK and open it.
3. Check that your kernel is supported, then tap **Run**.
Support requires an exact `uname -r` match. Check the supported devices for your kernel build.
If Shizuku is enabled, start it with ADB before running GhostLock. Tap GhostLock's status card to grant access.
Any root manager that ships `libksud.so` provides `ksud` for module loading. The built-in list (KernelSU, ReSukiSU, BakaSU, KowSU) is auto-detected, and other managers can be picked in **Settings → Root manager**. Without `ksud`, W1/W2 still grant uid 0 but no module is loaded.
## Add a kernel profile
You can import a profile without rebuilding the app:
- **Parse OTA link** accepts a full OTA ZIP URL.
- **Parse local image** accepts `boot.img` and an optional `xbl_config.img`.
- **Import offsets.conf (v2)** accepts a HOCON profile. **Import offsets.json (v1)** converts an older JSON report in the app.
Extractor output is an unverified candidate. The app checks missing or invalid fields before execution. Generating a profile does not prove device support. See the porting guide for validation and built-in registration.
See the MediaTek guide for image-based address recovery and the rooted-device fallback.
## Command-line tools
 Run the native binary with an exported profile 
Requires the Android NDK, `make`, Gradle, and ADB. An adb shell run skips the app's seccomp bypass stage.
 [code] 
 Build and run the offset extractor 
Requires Rust. The extractor accepts a boot image, a full OTA ZIP, or an HTTP(S) URL.
 [code] 
Import `profile.conf` in the app. Omit `--xbl-config` if you do not have that image. The extractor rejects a patched `remove_waiter()` with exit code `6`.
## Reference
- Profile schema and execution defaults
- Native core
- Add a component, engineering rules, and writing rules
## Credits and license
Licensed under Apache License 2.0. Based on:
- NebuSec/CyberMeowfia
- JoinChang/ghostlock-oneplus
- x-spy/CVE-2026-43499-popsicle