UniRoot V5.0.0

What's new in V5

• New exploit (fast) — the unprivileged DirtyFrag engine (CVE-2026-43284): no profile, no Shizuku, no setup. Press Root now and the phone roots itself — at every boot too (Start on boot).
• In-app ksud updater — one button (New exploit section) downloads the latest official ksud and patches it on device with the bundled Samsung KDP+DEFEX .kos:
  • KernelSU Next → the result becomes an auto-selected profile (named version-code, e.g. 3.4.0-33294)
  • KernelSU classic → same, staged automatically over the bundled one
  • Already updated? → "you are already updated"
  • Profiles are deletable from Advanced settings
• ksud profile bands for both flavors (same style as the old exploit profiles)
• Boot auto-root — a foreground service waits for the first unlock and re-runs the chain (up to 6 attempts, WakeLock held)
• Progress UI — animated progress bar with live engine stages (Phone rooted ✓), bottom popup for the updater, fully English UI
• Root state banner — live su -c id probe: no more false "rooted" after a reboot
• Old exploit (slow) — the classic profile pipeline is untouched (CVE-2026-43499, Shizuku, Root My Galaxy, per-device profiles, instant root, run logs)

Credits

This project stands on the shoulders of:

• diabl0w — DFRoot, the DirtyFrag engine
• snothin — GhostSam, the Samsung kos + ksud patching approach
• polygraphene — DFRoot fork lineage, DEFEX bypass work
• tiann — KernelSU
• rifsxd & the KernelSU-Next team — KernelSU-Next
• YuKongA — GhostLock, the UI base

Thank you all 🙏

---

I am not responsible for bricked phones.

UniRoot v4.1 — Stability Update

UniRoot v4.1

One-click root for Samsung Galaxy devices — CVE-2026-43499 / dirty-pipe payloads with a KernelSU late-load.

Made by kuuky

⚠️ I am not responsible for bricked phones.

🆕 What's new since v3.5

KernelSU / KernelSU Next switch (home page)

Two buttons right on the home screen, above the profile selector. The flavor you pick decides everything: which profiles are listed, which ksud is staged, and which manager is relaunched when root succeeds. Each flavor has its own profile set:

• KernelSU — S25 ZZHL / ZZI4, S93XX, S26 Ultra ZZHK, Oppo, RMG profiles
• KernelSU Next — S93XX Next, S25 ZZHL Next, S25 ZZI4 Next (KSUD NEXT S938X), S26 Ultra ZZHK Next (KSUD NEXT S948X)

Auto-root on boot — reworked

• Live progress notification (Android 16 ProgressStyle — renders in the Samsung Now Bar / Live notifications on One UI 8+) tracking the real root stages: settle → exploit running → KASLR found → kernel access → late-loading KernelSU → rooted.
• Guided toasts: "Root starts in 1 minute — check notification" at boot, "Don't touch the phone until it's done" when the exploit runs, and the final "Success — phone is rooted" / "Run failed — reboot".
• Always-on-top "DON'T TOUCH THE PHONE" banner while the exploit runs.
• Stop button right on the notification — cancels the automatic launch without force-stopping the app.
• Runs once per fresh boot (boot-count guarded) and waits for Shizuku on profiles that need it.

Reliability

• Auto-relaunch on every profile: a failed run no longer ends the session — the payload is relaunched automatically (up to 3 runs, 60 s apart; the dirty-oracle state clears itself in about a minute). Stops immediately with Reboot required when the pipe budget is exhausted.
• Shizuku engine rebuilt on the official IShizukuService AIDL — commands now actually execute, with server-side timeouts and a sanity id check per run.
• S26 Ultra pipeline hardened: real host-pid tracking, kill-before-retry, dirty-oracle early stop.
• Manager relaunch fixed: after a successful root the matching manager (KernelSU or KernelSU Next, per the selected flavor) is force-stopped and relaunched through the Shizuku shell — reliable even with the app in background.

Classic S26 profile — proven binaries

The classic S26 Ultra profile keeps the original validated ksud from the September 9 root session (md5 65701a64…, the ksud-working build), unchanged.

📥 Install

1. Download UniRoot-v4.1.apk below and install it (allow unknown sources).
2. Pick the flavor (KernelSU or KernelSU Next) — the profile auto-detects.
3. S26 Ultra: start Shizuku (enable its "Start on boot" for auto-root) and grant it to Uni-Root.
4. Tap Root now — or just reboot with Auto-root on boot enabled.

Root is per boot (LKM late-load). If a run fails: reboot, then run once.

🧰 Credits

• UI based on GhostLock (YuKongA)
• Device feed & payloads: Root My Galaxy (BuSung-dev)
• KernelSU (tiann) · KernelSU Next
• wr3cckl3ss — KSUD NEXT builds
• @Vikramaditya015 — auto-root on reboot

UniRoot v3.5

UniRoot v3.5

One-click root for Samsung Galaxy devices — CVE-2026-43499 / dirty-pipe payloads with a KernelSU late-load.

Made by kuuky.

⚠️ I am not responsible for bricked phones.

🆕 What's new in v3.5

Crash-proof run logs (Root My Galaxy style)

The log box now exists from the start of the run (status Running) and every log line is persisted live. A crash, a freeze or an unexpected reboot mid-run no longer loses anything: on next launch the interrupted box is recovered as "Failed (interrupted)" with the full log. Every run lands in the Run history with date, final status (Completed / Failed / Crash / Reboot required) and is shareable as .txt.

Auto-root on boot (opt-in, off by default)

New switch in Advanced settings. When enabled, after every reboot the app automatically re-runs the last used profile through a foreground service:

• waits ~45 s for the boot to settle (SELinux, vendor init, slab state),
• waits up to 5 min for Shizuku to come back on profiles that need it (S26 Ultra — enable Shizuku's "Start on boot" with wireless debugging),
• runs once per boot (boot-count guarded — no double runs eating the pipe budget),
• posts a notification with the result; the full log lands in Run history as usual.

This is the natural companion to the LKM late-load root: root is per boot, so the app just re-applies it for you.

New S25 ksud (Samsung DEFEX/KDP build)

The bundled ksud of all three S25 profiles (S93XX, ZZHL, ZZI4) is replaced by the new DEFEX-patched build (md5 121f9acb…). Existing installs pick it up automatically: on startup the app compares embedded assets with the staged files and silently refreshes binaries that differ — profiles and settings are preserved, no "Reset profiles" needed.

Patched ksud test toggle (Advanced settings)

Off by default. When on, the pipeline stages your own patched ksud (e.g. a Samsung DEFEX/KDP rebuild for the S26 Ultra) instead of the profile one. The run log prints the md5 of both the installed file and the staged /data/local/tmp/ksud so you can verify exactly what ran. See KSU_PATCH.md in the repo for the rebuild details.

Smarter S26 pipeline

• One run per boot, enforced: after 8 failed internal attempts the run stops with an explicit Reboot required instead of burning the pipe budget in a contaminated boot state.
• Real host tracking: liveness is now checked through the payload's actual host pid (written at launch) — the old heuristic killed healthy runs ("Process terminated early" false positives are gone).
• Kill-before-retry: any relaunch first kills the leftover host so its pipes are released and the kernel pipe budget recovers.

Shizuku engine rebuilt

Commands run through the official IShizukuService.newProcess AIDL with a full Process adapter and server-side timeouts — no more silent failures, and a sanity id check is logged at every Shizuku run.

📥 Install

1. Download UniRoot-v3.5.apk below and install it (allow unknown sources).
2. S26 Ultra: start Shizuku (for auto-root, enable its "Start on boot") and grant it to Uni-Root.
3. Open the app — profile auto-detects — Root now.

Root is per boot (LKM late-load): re-run after a reboot, or just leave Auto-root on boot on. If a run fails without crashing: reboot, then run once.

🧰 Credits

• UI based on GhostLock (YuKongA)
• Device feed & payloads: Root My Galaxy
• KernelSU: tiann/kernelSU