Root access on a locked Android bootloader, for one boot at a time.
Devices · Live tables · Tools · Modules · Quick start · Troubleshooting · Contributing
Verified against upstream projects and CVE records in November 2026. Hardware-confirmed targets only.
- What is temporary root?
- Supported devices
- Tools and managers
- Modules
- Quick start
- Troubleshooting and FAQ
- Contributing and disclaimer
- Sources
Tip
New here? Read What is temporary root? first, find your exact model in Supported devices, then follow Quick start. If your build is not listed, do not try the closest one.
Temporary root gives an app or an ADB shell UID 0 on the current boot without unlocking the bootloader or flashing a boot image. A loader exploits a kernel bug, starts a root daemon, and late-loads a KernelSU kernel module. A KernelSU-compatible manager can then grant su. A full reboot unloads the module and ends the session.
The loader that works depends on the device, its firmware build, and its kernel. Match all three.
Click to show how the loaders work
The loaders use one of these kernel bugs:
- DirtyFrag (CVE-2026-43284): a page-cache write reached through ESP-in-UDP decryption. It is deterministic: a run either works or stops with an error. The loader needs a kernel module built for the device's KMI.
- GhostLock (CVE-2026-43499): a futex priority-inheritance use-after-free turned into a controlled kernel write. It is a race, so retries and kernel panics are normal, and a working payload is tied to the exact kernel layout.
- Adreno GPU route (CVE-2025-21479): a GPU command-packet defect that lets the GPU overwrite its own page tables for physical read/write. RootMyVivo ships it for older 5.10/5.15 Snapdragon 8-class vivo and iQOO devices whose GPU firmware predates Qualcomm's June 2025 fix.
A few ports use other device-specific routes, such as a vendor service on MIUI or Honor, or a fastboot-issued permissive command line. Their table row says so.
CVE records give these patch floors. DirtyFrag and GhostLock affect older branches than the ones listed.
| Kernel branch | DirtyFrag fixed in | GhostLock fixed in |
|---|---|---|
| 5.10 | 5.10.255 | 5.10.261 |
| 5.15 | 5.15.205 | 5.15.212 |
| 6.1 | 6.1.171 | 6.1.175 |
| 6.6 | 6.6.138 | 6.6.140 |
| 6.12 | 6.12.87 | 6.12.86 |
| 6.18 | 6.18.28 | 6.18.27 |
| 7.0 | 7.0.5 | 7.0.4 |
Vendors backport fixes out of order and sometimes change a kernel without changing the version string, so treat these numbers as a hint. The loader's own vulnerability check decides.
It enables:
sufor apps you approve, through a KernelSU-compatible manager.- A root shell while the bootloader stays locked and the boot image stays stock.
- Modules that mount files or hook apps at runtime, for the current boot.
- A session that leaves the verified-boot chain, the stock kernel, and the recovery partitions untouched.
It does not:
- Survive a full reboot.
- Unlock the bootloader or allow unsigned images, custom ROMs, kernels, or recoveries.
- Run modules that need to start before Android, replace boot scripts, or write a partition.
- Guarantee Play Integrity, banking apps, or recovery from a bad module.
- Cover every device. A profile is built for a specific model and kernel layout.
A soft reboot restarts Android's interface and system services, not the kernel, so root and module mounts stay. A full reboot loads the stock kernel again and clears root. Files under /data/adb can remain, but nothing loads them. Do not delete that directory to "unroot": it also holds ADB keys and data other tools rely on.
Related but different: Shizuku runs a service as the shell user through ADB and is not root, though several loaders use it as a transport. adb root works only on builds that allow it. Virtual-root apps (dual-space and parallel-space tools) sandbox selected apps and never grant UID 0. Magisk, KernelSU, and APatch boot-image installs are permanent and need an unlocked bootloader. KernelSU's late-load mode is a component of temporary root, not a root method by itself.
Warning
Temporary root is full root for the session, delivered by privilege-escalation code running in the kernel. A wrong profile or a lost race can panic the device, an incompatible module can bootloop it, and a partition write can make it unbootable. Verify the exact model, firmware build, and uname -r against the upstream project before running a loader, and back up data you cannot lose. Only use hardware you own or have explicit permission to modify.
Only targets with a documented hardware run are listed, with the exact build and kernel the loader matches. A generated profile or an upstream candidate is not a confirmed target.
| Status | Meaning |
|---|---|
| Tested | A completed run on that exact target, including the full temporary-root chain where the loader provides one. |
| Experimental | A partial, shell-only, or explicitly experimental hardware run. |
Match the full kernel release your phone reports. Two phones on the same Android release can differ in kernel build, page size, and vendor hardening, so a partial match is not enough.
Root My Galaxy is the main loader and ships per-build payloads matched on model plus kernel. GhostLock-Galaxy, the A17 and A16 ports, GhostSam, and RootMyS24 cover builds outside its list.
Click to show 21 confirmed Samsung targets
| Device | Model | Build or kernel | Loader | Status |
|---|---|---|---|---|
| Galaxy S25, S25+, S25 Ultra, S25 Edge | SM-S9310/B/N/Q/U/U1/W/Z, SM-S936B/N/U/U1/W, SM-S937B/N/U/U1/W, SM-S9380/B/N/Q/U/U1/W/Z, SC-51F, SCG31, SC-52F, SCG32 | 6.6.98 |
Root My Galaxy | Tested |
| Galaxy S25+ China | SM-S9360 | S9360ZCSCCZG1, 6.6.98 |
Root My Galaxy | Tested |
| Galaxy S25 Edge China | SM-S9370 | S9370ZCS9CZG1, 6.6.98 |
Root My Galaxy | Tested |
| Galaxy S24 Ultra (US) | SM-S928U1 | S928USQS6DZF2, 6.1.145 |
Root My Galaxy | Tested |
| Galaxy S24 Ultra International | SM-S928B | S928BXXS6DZF2, 6.1.145 |
Root My Galaxy | Tested |
| Galaxy S24 Ultra China | SM-S9280 | S9280ZCS6DZF2, 6.1.145 |
Root My Galaxy | Tested |
| Galaxy S24+ | SM-S926B | S926BXXUEDZDR, 6.1.157 |
Root My Galaxy | Tested |
| Galaxy S23 Ultra | SM-S918B | S918BXXSAFZF5, 5.15.189 |
Root My Galaxy (Shizuku mode) | Tested |
| Galaxy S23+ | SM-S916B | S916BXXSAFZG1, 5.15.189 |
Root My Galaxy (shell-only profile) | Experimental |
| Galaxy A56 5G | SM-A566E | A566EXXSCCZG6, 6.6.102 |
Root My Galaxy | Tested |
| Galaxy A36 5G | SM-A366W | A366WVLS3AYG1, 6.6.46 |
Root My Galaxy | Tested |
| Galaxy A53 5G | SM-A536E | A536EXXSNGZG3, 5.10.237 |
Root My Galaxy | Tested |
| Galaxy Tab S9 (Wi-Fi) | SM-X710 | X710XXS6EZF1, 5.15.189 |
Root My Galaxy | Tested |
| Galaxy A17 | SM-A175F | A175FXXS3BZA5 (6.12.23), A175FXXS6CZG1 (6.12.38) |
ghostlock-a17 | Tested |
| Galaxy A16 5G | SM-A166W | A166WVLS8DZG1, 5.15.189-android13-3-33503169 |
SM-A166W port | Tested |
| Galaxy Z Fold4 | SM-F9360 | F9360ZCSAIZF1, 5.10.236 |
Root My Galaxy Payloads (command line) | Tested |
| Galaxy Z Flip6 (Korea) | SM-F741N | F741NKSS4DZE1, 6.1.145 |
RootMyS24 | Tested |
| Galaxy S24 (China) | SM-S9210 | S9210ZCS6DZI1, 6.1.145 |
RootMyS24 | Tested |
| Galaxy S24+ (Taiwan) | SM-S9260 | S9260ZHS6DZG1, 6.1.145 |
RootMyS24 | Tested |
| Galaxy S24 Ultra (Europe, One UI 9) | SM-S928B | S928BXXU6EZIF, 6.1.162 |
RootMyS24 | Tested |
| Galaxy S26, S26+, S26 Ultra | SM-S942x, SM-S947x, SM-S948x | 6.12 (S9420ZCS4AZG1 plus other tested builds) |
GhostSam / ghostlock-s26 | Tested |
Live table: Root My Galaxy payloads · targets-v3.json · ghostlock-a17 target · SM-A166W build · ghostlock-s26 firmware
Click to show compatibility notes
- Galaxy S23 Ultra (
SM-S918B) is confirmed through the app's Shizuku mode only. Galaxy S23+ (SM-S916B) has an ADB-shell profile and no app payload, so treat it as experimental. - Some payloads cover more models than the test device: the S24 Ultra payload also matches
SM-S928W, and the A56 payload matchesSM-A5660,SM-A566B,SM-A566S,SM-A566U1, andSM-A566W. - The shared S25 payload covers the Snapdragon variants. S25+ and S25 Edge China builds use separate payloads.
- The Z Fold4 (
SM-F9360) chain is confirmed from the command line; its app payload is not. - RootMyS24 covers more S24, Z Flip6, and China Z Fold6 builds, including firmware marked as untested. Root My Galaxy's target feed also lists some builds with no documented hardware run (Z Fold7, S24, S24 FE, S23, and S9180), so treat those as candidates.
All rows use Root My Pixel, which requires Shizuku. Builds are matched exactly; an OTA changes the target.
Click to show 15 confirmed Pixel targets
| Model | Supported build | KMI | Status |
|---|---|---|---|
| Pixel 11, 11 Pro, 11 Pro XL | CD1A.260618.001.C2 |
android16-6.12 |
Tested |
| Pixel 11 Pro Fold | CD1A.260618.001.C3 |
android16-6.12 |
Tested |
| Pixel 10, 10 Pro, 10 Pro Fold | CP2A.260705.006 |
android15-6.6 |
Tested |
| Pixel 10 Pro XL | CP2A.260705.006, CP2A.260805.005 |
android15-6.6 |
Tested |
| Pixel 10a | CP2A.260705.006, CP2A.260805.005 |
android14-6.1 |
Tested |
| Pixel 9, 9a | CP2A.260705.006; Pixel 9 also AD1A.240905.004 |
android14-6.1 |
Tested |
| Pixel 9 Pro, 9 Pro XL, 9 Pro Fold | CP2A.260705.006 |
android15-6.1 |
Tested |
| Pixel 8, 8 Pro | CP2A.260705.006 |
android14-6.1 |
Tested |
| Pixel 8a | CP2A.260805.005 |
android14-6.1 |
Tested |
| Pixel 7, 7 Pro | CP2A.260705.006; Pixel 7 also BP2A.250705.008 |
android14-6.1 |
Tested |
| Pixel 7a | CP2A.260705.006 |
android14-6.1 |
Tested |
| Pixel 6, 6 Pro | CP2A.260705.006 |
android14-6.1 |
Tested |
| Pixel 6a | CP2A.260705.006, CP1A.260405.005 |
android14-6.1 |
Tested |
| Pixel Fold | CP2A.260605.012, CP2A.260705.006 |
android14-6.1 |
Tested |
| Pixel Tablet | BP1A.250405.007, CP2A.260705.006 |
android14-6.1 |
Tested |
Root My Pixel reports the exploit is unreliable: many users needed more than 20 attempts, and a failed attempt can reboot the phone. GhostLock App also has Pixel 7, 9a, 9 Pro, and 9 Pro Fold profiles, but those are candidates, not confirmed targets.
ghostlock-oneplus is the main loader for OnePlus and OPPO builds. The OnePlus Pad 3 uses a dedicated Root My Device build, and the Realme GT 7T has its own port.
Click to show 9 confirmed OnePlus, OPPO, and Realme targets
| Device | Model | Build or kernel | Loader | Status |
|---|---|---|---|---|
| OnePlus Ace 6T | PLR110 | 6.12.38-android16-5-g8c67d4274c0a-ab14275539-4k (ColorOS 16.0.2.403), 6.12.38-android16-5-g844001fb8721-ab14552068-4k (16.0.8.301) |
ghostlock-oneplus | Tested |
| OnePlus 15 | CPH2745, CPH2747, CPH2749 | 6.12.23-android16-5-gb2a876903b49-ab14541642-4k (16.0.9.400) |
ghostlock-oneplus | Tested |
| OnePlus 15 | PLK110 | 6.12.58 (android16-6, Android 17 Beta 3) |
ghostlock-oneplus | Tested |
| OnePlus 13 | IN2060 | 6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k (16.0.2.403) |
ghostlock-oneplus | Tested |
| OnePlus 13 | IN2060 | 6.6.89-android15-8-g97a9aaefab9a-ab14519050-4k, 6.6.30-android15-8-g013ec21bba94-abogki383916444-4k, 6.6.118-android15-8-g93e223c276e7-abogki500782043-4k |
Anchor | Tested |
| OPPO K15 Pro+ | PMG110 | PMG110_16.0.9.400(CN01), 6.6.118-android15-8-g93e223c276e7-abogki500782043-4k |
Root My Device (Witaqua) | Experimental |
| OPPO Pad 4 Pro | n/a | 6.6.89-android15-8-g096cdb6ecefc-ab14358676-4k |
ghostlock-oneplus | Tested |
| OnePlus Pad 3 | OPD2415 | OPD2415_16.0.9.400(EX01), 6.6.118-android15-8-g2e6b9c3812c5-ab15114928-4k |
Root My Device (tqmane) | Tested |
| Realme GT 7T | RMX5085 | 6.6.118-android15-8 |
ghostlock-rmx5085 | Tested |
Live table: ghostlock-oneplus verified devices · not-feasible layouts · Root My Device OnePlus Pad 3
Click to show compatibility notes
- The PLK110 OnePlus 15 entry is the Android 17 Beta 3 kernel. A stable build with a different kernel is not covered.
- OnePlus 13
IN2060and OPPO Pad 4 Pro use a different root path (UMH). - ghostlock-oneplus also has offsets for devices it has not tested, and a list of devices its layout cannot support. Check both before you try a build.
RootMyVivo matches the full kernel release from its payload catalog. Its GhostLock port accepts 6.6 kernels up to 6.6.139 and 6.1 kernels up to 6.1.144; later releases carry the fix. The catalog also has a separate Adreno route (CVE-2025-21479) for older 5.10/5.15 devices.
Click to show 6 confirmed vivo and iQOO targets
| Device | Model | Kernel | Loader | Status |
|---|---|---|---|---|
| iQOO Neo 11 | PD2520, PD2520A–E, V2520A | 6.6.89-android15-8-g1f71897ac249 |
RootMyVivo | Tested |
| iQOO Z10 Turbo Pro | PD2453, PD2453A, V2453A | 6.6.89-android15-8-g1f71897ac249 |
RootMyVivo | Tested |
| iQOO Z9 5G / vivo T3 5G | I2302 / V2334 | 5.15.178-android13-8-g0ebe6a5da65d |
iQOO Z9 / vivo T3 port | Tested |
| vivo X200 | PD2415, V2415A | 6.6.89-android15-8-gb57af212129c (Port 16.1.12.2.W10) |
GhostLock-X200 / RootMyVivo | Tested |
| iQOO Neo8 | PD2301, V2301A | 5.10.198-gki-gfb2f5774872c |
cve-2025-21479_iqooneo8 / RootMyVivo | Tested |
| vivo T3 Ultra | V2426 | 5.15.197-android13-8-00040-g1d68e338760e-ab15563954 |
MT6989-ghostlock | Tested |
Live table: RootMyVivo payload catalog · iQOO Z9 / vivo T3 port · vivo X200 device notes · vivo T3 Ultra target
Click to show compatibility notes
- The catalog also lists iQOO 13 India, iQOO Neo10 Pro, and an X200 family entry. Some entries reuse another model's payload (iQOO 13 China, Neo10 Pro+, X200 Ultra); those are mappings, not confirmed runs.
- A
6.6.127build on an iQOO Neo 11 has the fix, so the 6.6.89 payload does not cover it.
These devices use several independent loaders, including ghostlock-oneplus, Root My Device, zenfone9-ghostlock, and Honor ports based on GhostLock App.
Click to show 7 confirmed Xiaomi, ASUS, Nothing, and Honor targets
| Device | Model or codename | Build or kernel | Loader | Status |
|---|---|---|---|---|
| Xiaomi 17 | pudding | OS3.0.315.0.WPCCNXM (6.12.23), 6.12.69 |
ghostlock-oneplus | Tested |
| Xiaomi 17T Pro | warhol | OS3.0.304.0.WPSJPXM, 6.12.38-android16-5-g1d46253471dd-ab15048002-4k |
Root My Device (Witaqua) | Tested |
| Xiaomi 14T Japan | XIG07 | OS3.0.7.0.WNEJPKD, 6.1.138-android14-11-g44bda9e8f6e9-ab13792638 |
Root My Device (Witaqua) | Tested |
| ASUS Zenfone 9 | ASUS_AI2202 | 5.10.205-android12-9-00029-g3f12df86bfdb-ab11799032 |
zenfone9-ghostlock | Tested |
| Nothing Phone (3a) | A059 / Asteroids | B4.1-260618-1048, 6.1.157-android14-11-g82d681c9b06b-ab14634535 |
Root My Device (tqmane) | Tested |
| HONOR 400 (global) | DNY-NX9 | DNY-N39 10.0.0.213(C636E4R3P2), 5.15.180-android13-8-00018-g9b2308ac0ad6-ab14563692 |
MnemosyneLab/ghostlock-honor | Tested |
| HONOR 80 Pro Flat | ANB-AN00 / HNANB | MagicOS 9.0.0.230 (ANB-AN00 9.0.0.230(CHNC00E230R2P5)), 5.10.236-android12-9-gd671cf8c2b02 |
ANB Root | Tested |
Live list: Root My Device targets · Nothing Phone (3a) · zenfone9-ghostlock · ghostlock-honor scope · ANB Root compatibility
Click to show compatibility notes
- The Nothing Phone (3a) build
B4.1-260810-1153is supported upstream, but the verified run was onB4.1-260618-1048. BuildC5.0-260915-2123is allowlisted but its root flow is not verified. - GhostLock App has profiles for many Xiaomi, POCO, Redmi, Meizu, Sony, Motorola, Honor, and other devices. Those are candidates, not confirmed runs. Its MediaTek guide covers MT devices that miss the default target.
- The POCO M6 Pro 4G and Meizu 21 ports have no upstream support table, so they are not listed as confirmed targets.
GhostLock-5.10 covers the Fire devices, while the Shield TV and Quest 3 have dedicated ports.
Click to show 4 confirmed Amazon, NVIDIA, and Meta targets
| Device | Codename | Build or kernel | Loader | Status |
|---|---|---|---|---|
| Amazon Fire Max 11 | sunstone | Fire OS 8.3.3.8 RS8338.3339N, 5.10 |
GhostLock-5.10 | Tested |
| Fire TV Stick 4K Max (2023) | karat | Fire OS 8.1.8.2 RS8182.3811N, 5.10 |
GhostLock-5.10 | Tested |
| NVIDIA Shield TV Pro 2019 | mdarcy | Shield Experience 9.2.4, 4.9.141-tegra-gb6e5605a |
GhostLock NVIDIA Shield | Tested |
| Meta Quest 3 | eureka | 5.10.240-g55be3759aea4, incremental 52345320035400520 |
Root My Device (Witaqua) | Tested |
Live table: GhostLock-5.10 supported builds · NVIDIA Shield validated target · Root My Device targets
Click to show compatibility notes
- GhostLock-5.10 also supports older Fire OS builds; its table lists each build and kernel.
- The Shield port gives root to the live ADB daemon instead of installing a manager. Root survives ADB disconnects but not an ADB restart, and the included app re-runs the exploit at boot.
- Meta fixed GhostLock in Quest 3 incremental
52345320040100520and Quest 3S incremental3697600032300610. Later builds are not vulnerable. IonStackQuest3's own target is incremental52168470043600520.
These tables are maintained upstream and change more often than this README. Check your exact model, build, and uname -r. If they differ from this page, the upstream table wins.
| Project | Devices | Live support data |
|---|---|---|
| Root My Galaxy | Samsung Galaxy | Payload list · JSON |
| GhostSam | Galaxy S22, S26, Z Fold8 | Device list |
| GhostLock-Galaxy | Galaxy Z Fold6 | Kernel list |
| ghostlock-a17 | Galaxy A17 | Target list |
| Root My Pixel | Pixel 6–11 | Build list |
| ghostlock-oneplus | OnePlus, OPPO, Xiaomi | Verified list · Infeasible layouts |
| Root My Device (tqmane) | Nothing Phone (3a), OnePlus Pad 3 | Nothing list · Pad 3 list |
| Root My Device (Witaqua) | Xiaomi, OPPO, and Meta Quest | Target list · Notes |
| RootMyVivo | vivo and iQOO | Target list |
| RootMyS24 | Galaxy S24, Z Flip6, Z Fold6 China builds | Verified and pending firmware lists |
| GhostLock-5.10 | Fire Max 11, Fire TV Stick 4K Max | Build list |
| GhostLock App | Multi-brand uname -r profiles |
Profile list |
A temporary root setup needs a loader, a KernelSU-compatible manager, and whatever transport the loader uses. Some apps bundle all three.
| Tool | Method | Coverage | Latest | Notes |
|---|---|---|---|---|
| DirtyFrag | DirtyFrag | Samsung and other KMIs the app ships modules for |  |
On-device. Hardened DFRoot fork. Module toggle, autorun with a failed-run interlock, automatic soft reboot, partition protection, download-mode indicator, and a recovery writer for Samsung download mode |
| DFRoot | DirtyFrag | Broad; manager-agnostic |  |
On-device. Minimal upstream chain |
| GhostSam | Both | Galaxy S22, S26, Z Fold8 series |  |
ADB. Per-series build tables. The DirtyFrag path needs no race |
| GhostLock App | GhostLock | Exact uname -r profiles across many brands |
 |
On-device or Shizuku. A profile is a candidate, not a tested device. Supports profile import and command-line tools |
| Root My Galaxy | GhostLock | Selected Galaxy builds |  |
On-device; Shizuku for some profiles. Payloads live in the payload repository |
| Root My Pixel | GhostLock | Pixel 6 through Pixel 11 |  |
Shizuku. GhostLock race; retries are common |
| RootMyVivo | GhostLock + Adreno | vivo and iQOO, 5.10–6.12 |  |
Shizuku first run, then ADB over TCP. Payload catalog fetched at runtime; each entry says how it was verified |
| Root My Device (Witaqua) | GhostLock | Xiaomi 17T Pro, Xiaomi 14T Japan, Meta Quest 3 |  |
On-device. Checks the full target before running |
| Root My Device (tqmane) | GhostLock | Nothing Phone (3a), OnePlus Pad 3 |  |
Shizuku. Separate app builds per device |
| RootMyS24 | GhostLock | Galaxy S24 China/HK/TW, Z Fold6 China |  |
Shizuku or wireless debugging. Uses the official KernelSU manager |
| GhostLock-Galaxy | GhostLock | Galaxy Z Fold6 SM-F9560 builds |  |
ADB or Shizuku. Covers three registered kernels |
| ghostlock-oneplus | GhostLock | OnePlus, Xiaomi, and OPPO builds | |
ADB. Also lists layouts it cannot support |
| GhostLock-for-OnePlus | GhostLock | Ace 6T, OnePlus 15 PLK110 |  |
ADB. Verified kernels only |
| ghostlock-a17 | GhostLock | Galaxy A17 SM-A175F | |
ADB. Ends in a per-boot root shell, not a manager |
| GhostLock-5.10 | GhostLock | Fire Max 11, Fire TV Stick 4K Max 2023 | |
ADB. Root shell plus a local bind shell; disables OTA after success |
| GhostLock NVIDIA Shield | GhostLock | Shield TV Pro 2019 |  |
ADB. Gives root to the ADB daemon, with no su manager |
| cve-2025-21479_iqooneo8 | Adreno GPU | iQOO Neo8 SM8475 on 5.10.198 |
|
ADB. Needs pre-June-2025 GPU firmware |
| GhostLock-X200 | GhostLock | vivo X200 PD2415 on the b57 kernel |  |
PC toolkit (PowerShell) or the companion app. Only the X200 b57 combination is verified |
| MT6989-ghostlock | GhostLock | vivo T3 Ultra V2426 (MT6989) |  |
Shizuku or plain adb shell. One attempt per boot; downloads the exploit and manager from its release |
| GhostLock HONOR | GhostLock | HONOR 400 DNY-NX9 on 5.15.180-...g9b2308ac0ad6 |
 |
On-device or Shizuku. GhostLock App fork; standalone and Shizuku recovery paths; overseas model only |
| ANB Root | GhostLock | HONOR 80 Pro Flat ANB-AN00 on 5.10.236-android12-9-gd671cf8c2b02 |
 |
Shizuku over wireless debugging. Single verified MagicOS combo; checks model and exact kernel |
| Redmi K70 Pro temp root | MIUI service | Redmi K70 Pro (manet), HyperOS 3 / Android 16 |  |
PC tool plus ADB or fastboot. Boots a permissive command line through fastboot, then late-loads KernelSU through a MIUI service. Not a GhostLock or DirtyFrag route |
| ghostlock-s26 | GhostLock | Galaxy S26 series |  |
ADB. Merged into GhostSam |
| IonStackQuest3 | GhostLock | Quest 3 on the listed incrementals |  |
ADB. Meta fixed newer builds |
| DirtyInit | DirtyFrag | Samsung devices with the primitive |  |
ADB relay. Init-context toolkit; not a KernelSU route |
Click to show which kernel modules each loader ships
GhostSam ships one DirtyFrag module per KMI and marks its set as follows. DirtyFrag also builds modules per KMI; its release assets list the included set. The KMI is not the full target: two phones on the same KMI can still differ in kernel build, page size, and vendor hardening.
| KMI | Module status | Notes |
|---|---|---|
android12-5.10 |
Tested | |
android13-5.10 |
Untested | |
android13-5.15 |
Tested | |
android14-5.15 |
Untested | |
android14-6.1 |
Partial | Kernels up to 6.1.71; later 6.1 builds are not supported by this module. |
android15-6.6 |
Tested | |
android16-6.12 |
Tested | |
android17-6.18 |
Untested |
Other device-specific ports:
- ghostlock-emerald for POCO M6 Pro 4G.
- zenfone9-ghostlock for ASUS Zenfone 9.
- ghostlock-rmx5085 for Realme GT 7T.
- Meizu 21 GhostLock for Meizu 21.
- iQOO Z9 / vivo T3 port for iQOO Z9 5G and vivo T3 5G.
- ghostlock-xringo1 for XRING O1 on
6.6.77and6.6.118. - SM-A166W port for Galaxy A16 5G.
A multi-device repack can bundle legitimate payloads and still add code. Do not treat one as a trusted upstream, and do not grant root to a loader you cannot identify.
| Manager | What it is | Use it for |
|---|---|---|
| KernelSU | Upstream kernel-based root manager | GKI devices; late-load support |
| KernelSU-Next | KernelSU fork | Devices a loader names it for |
| KowSU | KernelSU fork | Alternative manager for loaders that support it |
| BakaSU | KernelSU fork, formerly ReSukiSU | Pixel profiles and other targets that name it |
| diabl0w KernelSU | Samsung-patched KernelSU | Samsung DirtyFrag and several Galaxy ports |
Use the manager the loader names. On Samsung, use diabl0w's build. A manager alone does not provide temporary root.
Click to show why the manager choice matters
The manager must provide libksud.so, the library a loader uses to stage ksud on the device. A manager without that library cannot produce root. Use a current build from the project itself.
Do not use a manager's install, flash, or patch-boot-image actions on a locked phone. Those actions write protected partitions and are a documented hardbrick path.
| Tool | What it does | Why it matters |
|---|---|---|
| Shizuku | ADB-privileged API bridge, runs as the shell user | Several loaders stage payloads through it. It is not root. |
| Anchor | One-tap launcher for the ghostlock-oneplus chain | Sets up local ADB with its own key. Requires a one-time adb tcpip 5555 setup |
| Android Platform Tools | adb, fastboot |
Build checks, logs, sideloading, uninstall recovery |
| Termux | Terminal emulator | uname -r, su, and on-device checks |
| Obtainium | APK updates from GitHub releases | Keeps loaders on the project's release channel |
- Download from the project's own release page. Avoid reuploads, Telegram mirrors, paid builds, and remote-root services.
- Check the release tag and date, and compare published hashes or signing certificates when the project provides them.
- Build from source when you can. A clean VirusTotal result is not proof that an exploit APK is safe.
Click to show porting notes
Every loader is built around device-specific offsets. A generated profile is a candidate, not a supported device. Start with the GhostLock App porting guide, the Root My Galaxy payload notes, or the ghostlock-oneplus README.
Late-loaded KernelSU is not a normal boot-time install. Modules that mount files or hook apps at runtime can work. Modules that must run before Android starts, replace a boot script, or write a partition cannot, and some fail by bootlooping the device.
Click to show how late-load limits modules
Late-loaded KernelSU has no init.rc injection, no module preinit, no post-fs-data event, and no ksud kprobe hooks. Safe-mode detection and boot-log capture are disabled. late-load.d, post-mount.d, service.d, and boot-completed.d scripts still run.
Samsung's DEFEX path rules and KDP add another way for a module that works on a Pixel to fail on a Galaxy.
| Status | Meaning |
|---|---|
| Working | Reported working on temporary root by the upstream module list or a community test. |
| Caveat | Works with a known bug, instability, or setup requirement. |
| Broken | Reported not working; several entries reboot the phone. |
| Avoid | Known hardbrick or serious failure on a locked device. |
| Reported | A community report that has not been reproduced widely. |
| Outdated | Superseded or unmaintained. |
The upstream list is the maintained source; the tables below summarize it. Most reports come from one device: a Galaxy S25 SM-S931B on One UI 8.5 with Root My Galaxy. Treat them as starting points, not device-independent results.
| Module | What it does | Status | Notes |
|---|---|---|---|
| LSPosed | Xposed framework | Working | Needs a Zygisk provider. GPS can misbehave. Scope changes need a soft reboot. |
| ZygiskNext | Zygisk implementation for KernelSU | Working | The provider paired with LSPosed here. Use a current release; some older builds are reported buggy. |
| Vector | LSPosed fork | Working | Works on the latest CI and canary builds. |
| NeoZygisk | Zygisk implementation | Working | Works on the latest CI build. |
| AdClose | Blocks ads and app limits through Xposed | Working | |
| AdGuard Certificate | HTTPS filtering certificate as a module | Working | |
| AFWall+ | iptables firewall app | Working | Root app. A bad rule can cut off ADB. |
| bindhosts | Systemless hosts | Working | |
| Discover Ads Filter | Removes ads from Google Discover | Working | |
| amznkiller | Removes Amazon app ads | Working | |
| Facebook App Ads Remover | Removes Facebook app ads | Working | |
| NexAlloy | App modification toolkit | Working | |
| HMA | Hides apps from selected apps | Working | Works on the latest CI and canary builds. Needs a soft restart to start its service. |
| Re:X | Xposed module for X | Working | |
| ReVancedXposed_Spotify | Spotify patches | Working | |
| WaDeepDark | WhatsApp theming | Working | |
| YouTube ReVanced | YouTube patches | Working | Check reports before updating. |
| IAmNotADeveloper | Hides developer-options state | Working | |
| Migrate-OSS | Backup and migration | Working | |
| pairipfix | Bypasses PairIP signature checks | Working | |
| Update Locker | Stops selected apps from updating | Working | |
| Zygisk Detach | Detaches apps from the Play Store | Working | Needs a working Zygisk provider. |
| CorePatch | Disables signature verification | Caveat | Confirmed buggy; soft-bootloop reports. Keep the module-disable switch reachable. |
| DuckUSB | Hides USB debugging from scoped apps | Working | |
| MT Manager | File manager and APK editor | Working | Do not edit system files on a locked phone. |
| OneUI Settings Hook | Adds and changes One UI settings | Working | Samsung only. |
| OneUIX | One UI customization | Working | |
| App Manager | Package manager and debloat tool | Working | |
| net-switch | Network mode switching | Working | |
| Scene | Performance and battery profiles | Working | Avoid kernel or voltage changes. |
| Frosty | Battery and Google services optimization | Caveat | Buggy; possible wake-lock issues. |
| ViPERFX_RE | ViPER4Android audio processing | Caveat | Follow its install order; it expects KernelSU. |
| Module | What happens | Status |
|---|---|---|
| Enable Screenshot (Disable FLAG_SECURE) | Reboots the device on the test build. | Broken |
| PrivacySpace | Does not work. | Broken |
| ReZygisk | Reboots the device. | Broken |
| Treat-Wheel-Zygisk | Reboots the device. | Broken |
Use ZygiskNext as the provider with LSPosed. ReZygisk and Treat-Wheel-Zygisk still reboot the phone in these reports, so do not swap providers "for stability" without current evidence.
| Tool or module | Why | Status |
|---|---|---|
| Magisk | Direct Install writes protected images. On a locked Samsung this has caused a permanent hardbrick and the D2 screen. | Avoid |
| KonaBess-Next | GPU voltage and clock changes; reported permanent hardbrick on the test device. | Avoid |
| KonaBess | Older GPU modification tool. | Outdated |
The Magisk entry does not mean Magisk is malware. Its install model assumes an unlocked bootloader; Direct Install on a locked phone is the mistake.
| Module | What it does | Status | Notes |
|---|---|---|---|
| Tailscale module | Runs Tailscale as a root service | Reported | Worked for at least one user. |
| Crond4Android | Cron daemon with a UI | Reported | |
| Sui | Alternative superuser interface | Reported | Do not run it alongside KernelSU without reading both projects. |
| pm-install-from-anywhere | Lets pm install APKs from any path |
Reported | |
| CaptureSposed | Disables Android 14 screenshot detection | Reported | Conflicts with the Enable Screenshot failure report. |
| HyperLock | HyperOS SystemUI theming (HyperDuo fork) | Reported | Tested by its author on a Redmi Note 13 Pro 4G. |
- Confirm
su -c idworks and the manager opens. - Install one module, then soft reboot.
- Check the feature it changes. Add the next module only after that passes.
Do not install LSPosed, a Zygisk provider, three Xposed modules, and a kernel tweaker in one pass. If the phone bootloops, you will not know which one caused it, and the manager may be unreachable.
If a loader offers autorun, leave it off until the module set is known good: autorun plus a bootlooping module re-runs the failure on every boot. Grant root per app and revoke it when the session ends.
Indexes for finding modules: the LSPosed module repository and MMRL. Neither tests for late-load compatibility.
-
Record the exact target. Model, firmware build, Android version, security patch, and the full kernel release. Save the output where you can read it after a reboot.
adb shell getprop ro.product.model adb shell getprop ro.product.device adb shell getprop ro.build.display.id adb shell getprop ro.build.version.release adb shell uname -r
Without a computer, Settings > About phone gives the model and build;
uname -rin Termux gives the kernel. -
Match the exact build upstream. Use Supported devices for a confirmed starting point, then open the loader's own live table. If the project does not list your exact model, build, and kernel, stop. Do not try the closest one.
-
Back up and plan recovery. Copy data you cannot lose, and know how to reach safe mode, download mode, or a service center for that model before you run anything.
-
Install the manager the loader names. Open it once so its services are registered. Do not use its install, flash, or patch-boot-image actions. On Samsung with DirtyFrag, use diabl0w's KernelSU build.
-
Run the loader. Install it from the upstream release page, grant the permissions or transport it asks for, confirm it detected the expected model and kernel, then start the run and keep it in the foreground. Do not start a second run while the first is still working.
-
Verify, then test modules one at a time.
adb shell su -c id
Expected output starts with
uid=0(root). The SELinux context can differ. Ifsuis missing, the exploit may have completed while the late-load failed; see Troubleshooting. Install one module, soft reboot, and test. A soft reboot keeps root; a full reboot clears it. Use the manager's soft-reboot action rather thanadb reboot.
Nothing in this workflow flashes, patches, or installs a boot image. If a guide asks you to, it is a permanent-root procedure.
Click to show GhostLock panics or reboots instead of finishing
A GhostLock panic is a failed attempt at a race, not by itself a brick. Wait for the phone to reboot, then retry if the build is supported. Stop if it panics at the same stage every time, if it bootloops with modules disabled, or if it becomes unusually hot.
A DirtyFrag panic more often points to a wrong KMI, a profile mismatch, or vendor hardening rather than timing.
Click to show Samsung shows "reboot device - d2" or will not enter download mode
There are two causes. The download-mode gate on One UI 8.5 and later refuses download mode while a lock-screen credential is set; Android still boots. Remove the screen lock, power off, hold Volume Up and Volume Down together, then connect USB. Some users report that enabling Maintenance Mode first has the same effect.
A modified protected image is different: the bootloader rejects it and Android does not boot. Key combinations will not help. If the phone does not enumerate over USB, contact Samsung or a repair service. If download mode opens, flash signed stock firmware for the exact model and region with Odin. Do not mix firmware from another model, and do not use a "D2 bypass" APK.
Click to show ADB does not list the device or says unauthorized
Check the cable, port, and USB debugging setting, then run adb devices again. For unauthorized, unlock the phone and accept the RSA prompt. For no devices, try another cable and port and check lsusb. Wireless debugging must be paired before it appears.
Click to show The loader reports "not vulnerable" or "patching failed"
The kernel is patched, the vendor backported a fix, or the build has an accidental mitigation. There is no app-side fix, and downgrading firmware on a locked phone can wipe data or brick it. Check the upstream issue tracker and stop.
Click to show Does temporary root survive a full reboot?
No. A full reboot loads the stock kernel, unloads the module, and removes the su daemon and module mounts. Files under /data/adb can remain but are inactive. If the build is still supported, run the loader again.
Click to show Does a soft reboot keep root?
Usually. A soft reboot restarts Android's userspace and system_server, not the Linux kernel, so the late-loaded module stays and module mounts reactivate. That is why module installs often ask for one. adb reboot is a full reboot.
Click to show Does the method unlock the bootloader or wipe data?
No. It does not unlock the bootloader, and there is no unlock-induced wipe. A failed run, a module bootloop, or a recovery attempt can still cost data, so back up first.
Click to show How do I know whether my device is supported?
Record the model code, build display ID, and full uname -r, find the device in Supported devices, then confirm the target in the loader's live table. If the exact build is missing from both, stop.
Click to show Why does the exact kernel build matter?
Offsets come from a specific kernel build. Compiler settings and vendor hardening change the layout, a 4K-page profile does not cover a 16 KB page build, and a vendor can backport the fix without changing the version string. An OTA can move the build or close the bug, so recheck before updating.
Click to show Do I need a computer or Shizuku?
Not always. DirtyFrag, Root My Galaxy, GhostLock App, RootMyVivo, and Root My Device can run on the phone itself. Root My Pixel needs Shizuku, which can be started over wireless debugging without a PC. Some profiles need a one-time ADB setup, and command-line ports are easier from a computer. Shizuku is an ADB bridge, not root.
Click to show Which root manager should I install?
The one the loader documents. Samsung DirtyFrag requires diabl0w's KernelSU build; Root My Pixel expects the BakaSU manager named in its README. A manager alone does not give temporary root.
Click to show Which modules can work?
Modules that mount files or hook apps at runtime can work. Modules that need to start at early boot, replace boot scripts, load a kernel driver, or write a partition generally cannot. See Modules, install one at a time, and keep the loader's module-disable switch reachable.
Click to show Root is missing after a run that looked successful
The exploit likely completed and the late-load failed. Check that you installed the manager the loader names, that it was selected in the loader, and that the kernel matches. Disable auto reboot if it is on, then run again and read the log. If the log shows a patched kernel or a profile mismatch, stop.
Click to show What do I do after a module bootloop?
A full reboot clears root and the kernel module. Open the loader, set modules to disabled, run it again, and remove the module. DirtyFrag's module switch works without root.
If Android does not start, try safe mode (hold Volume Down during boot; Android may also offer it after repeated crashes). Safe mode may not disable a late-loaded kernel module, so the loader switch remains the reliable path. On a user build, adb uninstall <loader-package> removes the loader without root. If the phone does not enumerate over USB and neither recovery nor download mode opens, stop and seek service support.
Click to show Will banking apps or Play Integrity work?
Maybe, but nothing here guarantees it. A locked bootloader helps some checks, while root, manager packages, module files, and SELinux state are all detectable. Strong integrity verdicts usually fail. Test the app before you depend on it.
Click to show How do I report a new device or module result?
Open an issue or pull request with the exact model, build, full uname -r, Android version, loader and manager versions, module version, result, and the relevant log tail. The format is in Contributing. One reproducible result is worth more than a list of guesses.
A report is useful only if someone else can reproduce it. "Works on my S24" is not a data point; the model, build, kernel, tool versions, and result are.
Device: <market name>
Model: <ro.product.model>
Region / CSC: <region or CSC>
Build: <ro.build.display.id>
Android: <ro.build.version.release>
Kernel: <full uname -r>
Page size: <4k or 16k>
Loader: <project and version>
Manager: <manager and version>
Method: <DirtyFrag or GhostLock>
Stage reached: <last successful stage>
Modules: <name and version>
Result: <Tested, Experimental, or failure>
Notes: <what failed, retries, panics, or side effects>
For a failure, include the last 50 lines of the loader log, with personal paths and account names removed. Keep the error text and the stage where it stopped.
Use the labels defined in Supported devices: Tested and Experimental. Do not upgrade a label because a device is popular, or downgrade a failure because it worked once for someone else. A disputed entry keeps the lower status until someone reproduces the result.
- Device reports for builds missing from Supported devices, with a full target string.
- Module reports for versions not in Modules.
- Corrections to tool names, links, or statuses.
- Fixes to instructions that no longer match a current release.
- A link to an upstream change when a row becomes stale.
- Requests to root a specific phone.
- Links to reuploads, Telegram channels, or paid services.
- Instructions that unlock a bootloader or flash a boot image.
- Exploit code or offsets for devices without a public project.
- Claims without a build string or a log.
Small fixes can go straight to a pull request; device and module reports need the evidence above. Open issues at github.com/fynks/awesome-temporary-root/issues.
Content is MIT licensed; contributions are accepted under the same terms. Linked tools carry their own licenses and documentation.
This is a community-maintained index. It does not develop, audit, or guarantee the linked projects, and it is not affiliated with Google, Samsung, KernelSU, NebuSec, or any loader maintainer. Use these tools only on devices you own or have explicit permission to modify.
- CVE records: CVE-2026-43284 (NVD), CVE-2026-43499 (NVD). KernelSU: module guide, bootloop rescue.
- Device and profile sources: Root My Galaxy payloads, GhostLock App supported devices, RootMyVivo catalog, Root My Device payloads, Root My Device project.
- Loader documentation: ghostlock-oneplus, GhostSam, GhostLock-Galaxy, GhostLock-5.10, GhostLock NVIDIA Shield, ghostlock-a17, ghostlock-s26, GhostLock-X200, MT6989-ghostlock, GhostLock HONOR, ANB Root, cve-2025-21479_iqooneo8, redmik70pro.
- Module status: Temporal Root Modules List, XDA testing thread, now closed.
- Background: awesome-android-root, NebuSec IonStack.