Skip to content

Releases

CVE-2026-98260 Root App v1.4.5-app

CVE-2026-98260 Root App v1.4.5-app Latest
Latest

Choose a tag to compare

View all tags
@woshigenm woshigenm released this 06 Nov 07:38
v1.4.5-app
50a5cda

CVE-2026-98260 Root App v1.4.5-app

  • APK: CVE98260Root.apk, 107,508 B — SHA-256 5eef25346d30e4941fd15accbfae2ab2810eca33d7c681d06f647dccd8d3a0ab
  • Package: com.rootcve.cve98260, 1.1.4 (versionCode 7), debug key
  • Source: tag v1.4.5-app
  • Dependencies: deps.lock; verify with scripts/fetch-deps.sh (check only, no download)
  • Notices: THIRD_PARTY_NOTICES.md

Validation (6.12.58, YLP-W00)

  • Clean-boot Shizuku app flow (deploy + run) twice: KSU_CHAIN_OK,
    su -c id → u:r:ksu:s0. Both boots ended PARKED because a plant held a
    zombie (the known OK/PARKED outcome).
  • adb harness: 20/20 cold-boot chain runs, 0 spontaneous reboots.

Changes since v1.4.4-app

  • 6.12.58 profile marked verified; pre-check verdict uses the profile label.
  • alloc_seen=0 victim free-wait shortened from 30 s to 5 s.
  • Capture-integrity checks (duplicate/misaligned timer addresses); armed
    pick index logging.
  • Default-off diagnostics: target-page free/realloc scan, scan extended to
    the reap, free-scan sensitivity test.
  • Keeper logs the worker exit status; held zombies are parked after 60 s.

Known gaps

  • Standalone build/uid0 was not re-run on 6.12.58.
  • The GRANT_ROOT fallback was not triggered on 6.12.58.

Full record: docs/release-notes.md.

Assets 3
Loading

CVE-2026-98260 Root App v1.4.4-app

CVE-2026-98260 Root App v1.4.4-app

Choose a tag to compare

View all tags
@woshigenm woshigenm released this 04 Nov 18:44
v1.4.4-app
aabf0c1

CVE-2026-98260 Root App v1.4.4-app

Release. This build adds the conditional KernelSU userspace probe and is
built from the merged main branch.

  • Target: Honor MagicPad3 Pro 13.3 (YLP-W00), MagicOS 10.0.0 /
    11.0.0.109 (Android 16)
  • Kernel: 6.12.58-android16-6-g3a7ac1674240-abogki541502914-4k
    (app chain verified 2026-11-05) and
    6.12.38-android16-5-gfde7767f6ef6-abogki481467632-4k (verified)
  • Source: aabf0c1 (tag v1.4.4-app, main)
  • Release record:
    docs/release-notes.md
  • Dependency lock:
    deps.lock;
    verify with
    scripts/fetch-deps.sh
    (SHA-256 only, no download)
  • Package: com.rootcve.cve98260, version 1.1.3 (versionCode 6)
  • APK: CVE98260Root.apk (103,412 B)
  • SHA-256: 00d1a30ce7865a8bc892f140e31550196aeece9fc1f354926f1e2026d07df980

Changes since v1.4.3-app

  • After finit_module, confirm kernelsu is Live in /proc/modules, then
    probe the existing userspace with a direct
    execve("/system/bin/su", {"su","-c","id"}) (not through PATH, so the
    KernelSU execve hook can redirect to /data/adb/ksud).
  • When the probe returns u:r:ksu:s0, restore SELinux Enforcing through the
    same su, skip GRANT_ROOT/root_stage, and report KSU_CHAIN_OK.
  • Only a failed probe runs the GRANT_ROOT + root_stage bootstrap. A
    bootstrap or root_stage failure now reports KSU_CHAIN_FAIL with an
    explicit troubleshooting hint instead of silently continuing.
  • New magicroot suprobe diagnostic subcommand.
  • THIRD_PARTY_NOTICES.md, deps.lock, scripts/fetch-deps.sh and this
    release record are now in the tagged tree, closing the v1.4.3-app known
    gap.

Validation status

  • 6.12.58 clean boot (2026-11-05): finit rc=0, kernelsu module live,
    the su probe returned uid=0(root) ... context=u:r:ksu:s0, the log shows
    userspace already usable; skip GRANT_ROOT/root_stage, and the chain ended
    with KSU_CHAIN_OK. One plant2 socket-burst miss held zombies and produced
    PARKED=1; that miss was on the exploit side and the retry completed the
    chain. Evidence:
    ~/Ko/evidence/38-98260-conditional-su-20261105/ (host-side record).
  • 6.12.38: five clean-boot runs with this chain source (functional
    success 5/5, no PARKED 4/5; 16 of 17 plant attempts hit).
  • Not covered: the GRANT_ROOT fallback was not triggered on 6.12.58
    (it was verified on 6.12.38); the standalone build/uid0 stage has not
    been re-run on 6.12.58.
  • The APK was built from main with the Android debug key; signature,
    version metadata, and the native library / run.sh hashes were checked
    against the source tree before upload.

Build inputs

  • shizuku-api.jar SHA-256
    4315fcd853f487321548be5a997749fe43105fa29aaaa6f6e7a8cdc958a38357
  • shizuku-aidl.jar SHA-256
    584945c98f21b0c4e3ccdb74b51528f89852174c30bb2a4786c43a8ca456e496
  • shizuku-shared.jar SHA-256
    8557b8c715d374f8da18e148ca5b971d1c7435e91447e6d4f7664403c7328760
  • shizuku-provider.jar SHA-256
    35aee86b938cb8d06b315c9d73c30f41ec7cfdc10009a5de83733bc5c4db5051
  • NDK r29 (29.0.14206865), SDK build-tools 37.0.0, platform android-37.0.

Install

adb install -r CVE98260Root.apk
  1. Start Shizuku and tap 1. 授权 Shizuku.
  2. Tap 2. 部署资产.
  3. Tap 3. 开始提权.

Operational notes

  • This is a YLP-W00-specific research app. The pre-check refuses a kernel
    that is not one of the bundled profiles.
  • On a clean boot the app runs the full KernelSU bootstrap. If kernelsu is
    already live, it probes the existing userspace and tries one GRANT_ROOT
    bootstrap only if that probe fails.
  • If a live-KSU run reports FAIL=su_unavailable, the probe and the single
    bootstrap both failed. Check /data/adb/ksud, the module's
    allow_shell=1, the shell allowlist, and Shell SU ADB Only (feature
    ID 6; the manager can re-enable it). Turn it off in the manager or run
    /data/adb/ksud feature set shell_su_adb_only 0, then force-stop the
    manager and retry.
  • Root is temporary: the loaded module and root disappear after reboot;
    userspace files under /data/adb may remain.
  • The app does not write partitions. Never kill a parked launcher holding
    zombie children; reboot to clean up.

License and notices

  • Project license:
    MIT
  • Third-party notices:
    THIRD_PARTY_NOTICES.md
  • The Shizuku client libraries (shizuku-api, shizuku-aidl,
    shizuku-shared, shizuku-provider) are Apache-2.0, Copyright
    RikkaApps; their compiled classes are packaged into classes.dex
    unmodified.

Warning

For authorized security research on devices you own. This APK contains
working exploit code; do not use it against devices without permission.

Loading

CVE-2026-98260 Root App v1.4.3-app

CVE-2026-98260 Root App v1.4.3-app

Choose a tag to compare

View all tags
@woshigenm woshigenm released this 30 Oct 13:56
v1.4.3-app
ede7a29

CVE-2026-98260 Root App v1.4.3-app

Release. This is the first non-prerelease build of the dual-profile app. It
is built from the merged main branch and replaces the withdrawn
v1.4.2-app pre-release.

  • Target: Honor MagicPad3 Pro 13.3 (YLP-W00), MagicOS 10.0.0 /
    11.0.0.109 (Android 16)
  • Kernel: 6.12.38-android16-5-gfde7767f6ef6-abogki481467632-4k (verified)
    and 6.12.58-android16-6-g3a7ac1674240-abogki541502914-4k (adapted;
    device-side run still pending)
  • Source: ede7a29 (tag v1.4.3-app, main)
  • Release record: docs/release-notes.md
  • Dependency lock: deps.lock;
    verify with
    scripts/fetch-deps.sh
    (SHA-256 only, no download)
  • Package: com.rootcve.cve98260, version 1.1.3 (versionCode 6)
  • APK: CVE98260Root.apk (99,316 B)
  • SHA-256: e7b6a020169ed38e8077b6542a2b3dd90022be99624f1964eae19f0dd7a5bf22

Changes since v1.4.2-app

  • Plant verification and retry: after each SELinux/CAP plant the app reads
    back /sys/fs/selinux/enforce or the child's CapEff (bit 16) before the
    child is allowed to exec. A silent miss is retried instead of being treated
    as success. With no held zombie the chain exits KSU_CHAIN_FAIL; with a
    held zombie it prints KSU_CHAIN_HELD and parks.
  • Reaped-victim assertion before either verify abort (waitpid(WNOHANG),
    kill and reap if the victim is somehow still alive).
  • False-hit guard: a socket-burst hit only counts when the allocating pid is
    one of the app's own spray threads.
  • Lower free-to-spray latency: spray threads are armed before the exec gate
    and woken with a futex instead of a pipe, with 100 µs polling. Measured p50
    about 162 µs (13-847 µs) versus 53-79 ms before.
  • Dual spray: 4K/8K/16K/32K socket sends plus anonymous mappings; 30 s free
    window; lockers are held until the victim reaches Z or tgkill returns
    ESRCH.
  • The loader cred write now only zeroes uid/gid (R + 8); fsuid/fsgid are
    derived with setfsuid(0)/setfsgid(0), removing the second cred write.
  • App version 1.1.3 / versionCode 6.
  • Merged to main on 2026-10-30 (the previous pre-release stayed on the
    feature branch until 6.12.58 validation; that branch policy is retired).

Validation status

  • 6.12.38: five clean-boot runs with this chain source: functional success
    5/5, no PARKED 4/5. One run parked after a single socket-burst miss (the
    miss was retried and that run still completed the chain). 16 of 17 plant
    attempts hit; hit orders 0/1/2/3 = 5/4/3/4.
  • 6.12.58: build and static profile checks pass; device-side runtime
    validation is still pending. Do not treat 6.12.58 as verified.
  • The APK was built from ede7a29 with the Android debug key; signature and
    version metadata were checked before upload.
  • The full clean-boot LPE+KSU chain was previously verified on 6.12.38; the
    repository keeps that record.

Build inputs

  • shizuku-api.jar SHA-256
    4315fcd853f487321548be5a997749fe43105fa29aaaa6f6e7a8cdc958a38357
  • shizuku-aidl.jar SHA-256
    584945c98f21b0c4e3ccdb74b51528f89852174c30bb2a4786c43a8ca456e496
  • shizuku-shared.jar SHA-256
    8557b8c715d374f8da18e148ca5b971d1c7435e91447e6d4f7664403c7328760
  • shizuku-provider.jar SHA-256
    35aee86b938cb8d06b315c9d73c30f41ec7cfdc10009a5de83733bc5c4db5051
  • NDK r29 (29.0.14206865), SDK build-tools 37.0.0, platform android-37.0.

Install

adb install -r CVE98260Root.apk
  1. Start Shizuku and tap 1. 授权 Shizuku.
  2. Tap 2. 部署资产.
  3. Tap 3. 开始提权.

Operational notes

  • This is a YLP-W00-specific research app. The pre-check refuses a kernel that
    is not one of the bundled profiles.
  • On a clean boot the app runs the full KernelSU bootstrap. If kernelsu is
    already live, it only checks su -c id.
  • If a live-KSU run reports FAIL=su_unavailable, the KernelSU manager may
    have re-enabled Shell SU ADB Only (feature ID 6). Turn it off in the
    KernelSU UI, or run
    /data/adb/ksud feature set shell_su_adb_only 0, then force-stop the manager
    and retry.
  • Root is temporary: the loaded module and root disappear after reboot;
    userspace files under /data/adb may remain.
  • The app does not write partitions. Never kill a parked launcher holding
    zombie children; reboot to clean up.

License and notices

  • Project license: MIT
  • Third-party notices:
    THIRD_PARTY_NOTICES.md
  • The Shizuku client libraries (shizuku-api, shizuku-aidl,
    shizuku-shared, shizuku-provider) are Apache-2.0, Copyright RikkaApps;
    their compiled classes are packaged into classes.dex unmodified.
  • Known gap: the v1.4.3-app tagged tree predates
    THIRD_PARTY_NOTICES.md and the dependency-lock/release-record files, which
    live on main. The links above resolve on main; the next release will
    include them in the tagged tree.

Warning

For authorized security research on devices you own. This APK contains working
exploit code; do not use it against devices without permission.

Loading

CVE-2026-98260 Root App v1.3-app

CVE-2026-98260 Root App v1.3-app

Choose a tag to compare

View all tags
@woshigenm woshigenm released this 26 Oct 17:09
v1.3-app
6de9c88

CVE-2026-98260 Root App v1.3-app

  • Target: Honor MagicPad3 Pro 13.3 (YLP-W00), MagicOS 10.0.0 / Android 16
  • Kernel: 6.12.38-android16-5-gfde7767f6ef6-abogki481467632-4k
  • Source: 6de9c88 (tag v1.3-app)
  • Package: com.rootcve.cve98260, version 1.0.1 (versionCode 2)
  • APK: CVE98260Root.apk (86,948 B)
  • SHA-256: dda28708aaa39e014fa719040bbc32ec69c0ae2083c8fdb24adcbffd457a3932

Features

  • Shizuku-based UI: authorize, deploy assets, start the chain, clean temporary files, export the visible log.
  • Native vuln_precheck gate before the exploit chain; live-KSU runs also execute magicroot --check.
  • Clean-boot KernelSU bootstrap: manager extraction, selinux_state permissive write,
    CAP_SYS_MODULE, loader cred fix, ko_patch (226 symbols + vermagic),
    finit_module(allow_shell=1), GRANT_ROOT, ksud install.
  • Live-KSU branch: su -c id only; no module reload.
  • No run log under /data/local/tmp/cveapp; 导出日志 overwrites /sdcard/MagicRoot.log.

Install

adb install -r CVE98260Root.apk
  1. Start Shizuku and tap 1. 授权 Shizuku.
  2. Tap 2. 部署资产.
  3. Tap 3. 开始提权.

Operational notes

  • This is a YLP-W00-specific research app; the pre-check refuses unlisted kernels.
  • On a clean boot the app runs the full KernelSU bootstrap. If kernelsu is already live,
    it only checks su -c id.
  • If a live-KSU run reports FAIL=su_unavailable, the KernelSU manager may have
    re-enabled Shell SU ADB Only (feature ID 6). Turn it off in the KernelSU UI, or run
    /data/adb/ksud feature set shell_su_adb_only 0, then force-stop the manager and retry.
  • Root is temporary: the loaded module and root disappear after reboot; userspace files
    under /data/adb may remain.
  • The app does not write partitions. Never kill a parked launcher holding zombie children;
    reboot to clean up.

Warning

For authorized security research on devices you own. This APK contains working exploit
code; do not use it against devices without permission.

Loading