initroot

initroot: Motorola Bootloader Kernel Cmdline Injection Secure Boot & Device Locking Bypass CVE-2016-10277 By Roee Hay / Aleph Research, HCL Technologies First stage exploit: Tethered jailbreak This exploit gains an ephemeral unrestricted root access on the device. For example, on cedric some...

shim

shim, a first-stage UEFI bootloader shim is a trivial EFI application that, when run, attempts to open and execute another application. It will initially attempt to do this via the standard EFI LoadImage and StartImage calls. If these fail because Secure Boot is enabled and the binary is not sign...

ABL_ROP

Updating ABL serial with ROP: When ran this notebook will load ABL and attempt to update the device's serial number via ROP chain to call memmove. Derived from eShard's https://github.com/eshard/pixel6-boot/blob/main/runablpublic.ipynb whilst following along with...

CRACK12

CRACK12 rooting an ATOZEE P12 on Android 14 using CVE-2022-38694 — because fastboot oem unlock said no, so we found another way. what even is this so there's this tablet. the ATOZEE P12. you've never heard of it. nobody has. it costs like $80 and the manufacturer's name sounds like someone fell...

ch55x_firmware_extractor

CH55x firmware extractor The CH55x firmware extractor is used to read out firmware from CH55x integrated circuits. There is no in-built support in the devices for directly reading out the firmware through the bootloader. However, there is a functionality to verify the firmware contents 8 bytes at...

BareMetal-RAM-Dumper

BareMetal RAM Dumper A simple x86 bare-metal tool designed to boot from a disk/USB and dump the system's RAM directly to the booting medium. It relies on BIOS interrupts to boot and perform disk operations, and enters unreal mode to access memory above the 1MB barrier. Background: Cold Boot Attac...

PixelDump_CVE-2016-8462

PixelDump - CVE-2016-8462 PixelDump CVE-2016-8462 was one of Pixel bootloader vulnerabilities found/worked out by beaups and Jon 'jcase' Sawyer. Disclaimer This is a dirty POC that was never intended to be released, I just copied another project, spent a few minutes adding a few lines, and sent i...

RootMyVivo

RootMyVivo Root for vivo and iQOO phones with a locked bootloader. No unlocking, no flashing — install the APK, press the button, wait. Built on GhostLock CVE-2026-43499, a use-after-free in futex PI plus KernelSU installed on top of the temporary root. Русский · 中文 How it goes 1. Install the APK...

ghostlock-k419-adapter

GhostLock — OnePlus Locked Bootloader Jailbreak Kernel exploit for OnePlus/OPPO/realme devices with locked bootloader. Achieves root + KernelSU installation without unlocking bootloader or modifying boot image. Runtime auto-detection of kernel version with multi-device offset table. Vulnerability...

ROOT-ZTE-X1001

ZTE Blade X1001 — Root with Magisk Android 15, Unisoc UMS9230 ⚠️ WARNING: Rooting a device can void the warranty, brick the device if done incorrectly, and erase all data. Proceed at your own risk. This repository is for educational purposes only. Table of Contents Device information Prerequisites...

vankyo-s30-bootloader-unlock

Vankyo S30 Bootloader Unlock Unlock the bootloader on a Vankyo MatrixPad S30 Unisoc SC9863A using the CVE-2022-38694 FDL1 method. The S30's BootROM accepts unsigned FDL1 in download mode without requiring the ROP bypass, which simplifies the unlock significantly. Quick Start ./unlock.sh --prebuil...

ubl-itel-s23

Unlock Bootloader — Itel S23 S665L / Unisoc T606 Guide to unlock the bootloader on the Itel S23 S665L using the CVE-2022-38694 exploit on the Unisoc T606 UMS9230 chipset. Device Info Property| Value ---|--- Brand| Itel Model| S665L S23 Android| 12 SDK 31 Build|...

Starlink-FI

Starlink User Terminal Modchip This repository accompanies the talk titled "Glitched on Earth by Humans: A Black-Box Security Evaluation of the SpaceX Starlink User Terminal". A slide deck is available here, a recording of the talk should be available soon. The talk covers how we managed to execu...

ipxe

iPXE network bootloader iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as: boot from a web server via HTTP or HTTPS, boot from an iSCSI, FCoE, or AoE SAN, control the boot process with a script, create interactiv...

GhostLock-for-OnePlus

GhostLock — OnePlus Kernel exploit targeting locked-bootloader OnePlus devices. Uses CVE-2026-43499 to obtain root access without unlocking the bootloader or modifying boot.img. Authorized security research and educational purposes only. Table of Contents Vulnerability Overview Supported Devices...

So You Want To Build A Nethunter Kernel

So You Want To Build A Nethunter Kernel Introduction The biggest hurdle for most people who want to set up a Nethunter device is the kernel requirement. Unless your device already has a prebuilt and maintained kernel, then you will be told to build one yourself. There is a lot of documentation on...

echidna

Echidna A bootloader unlocker for devices that are exploitable with katana. Supported devices Currently, all Snapdragon 845 devices are unlockable except Samsung Demo...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable kernel bug yields a short-lived read/write primitive. That primitive is spent late-loading a KernelSU module into the running...

QuestStack

QuestStack QuestStack is a Meta Quest root and bootloader unlocking project. Using the GhostLock privilege escalation chain and the CVE-2021-1931 ABL/fastboot vulnerability, QuestStack provides a way to gain root access on the latest Quest 1 firmware, temporarily boot using a vulnerable ABL, and...

CVE-2022-38694_unlock_bootloader

CVE-2022-38694 An attacker with physical access to the device can overwrite a function pointer somewhere in the BootROM data section or a return address stored on the stack and execute their own code with BootROM privileges. For detailed information, read the article by NCC Group. Quick links: To...