diabl0w / DFRoot

# DFRoot [DirtyFrag (CVE-2026-43284)]
DFRoot is an Android rooting tool that exploits CVE-2026-43284 (DirtyFrag) — a kernel page cache write primitive — to load a custom kernel module without requiring an unlocked bootloader. It is intentionally designed to be SU Manager agnostic and works with any KernelSU-compatible SU manager.
> [!IMPORTANT]
> Before hitting that fork button, consider making a pull request instead :)
## FAQ
**Q: Log says patching failed and that my device isn't vulnerable**
A: Sorry, there is no fix. Either:
 - Your device's kernel is too new
 - Your device manufacturer backported the official mitigation
 - Accidental mitigation (typically seen on kernel 6.1)
**Q: Log says "SUCCESS" or "ksud exited with error", but I don't have root**
A: First, try disabling "Auto Soft Reboot" in DFRoot settings if you have it enabled, otherwise https://github.com/diabl0w/DFRoot/discussions/69
**Q: I installed a module and now I can't launch root without crashing**
A: Toggle "Disable KSU Modules" in DFRoot settings
**Q: I installed a module and have "Start at Boot" enabled and now I am bootlooping**
A: Typically Android will detect bootloops and boot you into Safe Mode, otherwise you can usually hold the Volume Down button during boot to enter safe mode. From there, disable "Start on Boot" and enable "Disable KSU Modules" in DFRoot settings or just uninstall DFRoot until you stabilize.
## Usage
> [!WARNING]
> I am not responsible for any damage to your device.
1. Install DFRoot
2. Install a SU Manager from below:
 - Samsung:
 - diabl0w's KernelSU
 - Other:
 - KernelSU
 - KernelSU-Next
 - KowSU
> If you have a custom KernelSU fork for a specific manufacturer, please make a pull request to add it here.
## Features
- Start on Boot
- Automatic soft reboot (if `late-load --soft-reboot` supported by your SU Manager)
- RO Partition Protection
- Disable all KernelSU modules, to recover from a broken one
- Shizuku not needed — regain root without WiFi!
## How it works
The Android kernel decrypts AES-CBC ESP packets directly into the page cache of files open for `splice()`. By crafting `IV = AES_ECB_DEC(key, current_content) ⊕ desired_content`, any 16-byte-aligned block in a mapped shared library can be overwritten without write permission and without copy-on-write.
The exploit uses this primitive to patch shellcode into `libc++.so` in the kernel's page cache. The next privileged call to the hooked function runs the shellcode, which loads our custom kernel module via `insmod`.
### Exploit chain
1. **IpSec transform** — App allocates a `UdpEncapsulationSocket` + SPI and builds an AES-CBC/HMAC-SHA256 ESP transform via `IpSecManager`.
2. **splicehelper → crash_dump64** — The splicehelper binary is spliced into `crash_dump64` via the CBC primitive. `crash_dump64` runs in the `crash_dump` SELinux domain (via exec label transition), which can open `vendor_file` labeled files (untrusted_app context cannot read these files so we need this bridge). The splicehel