YuKongA/ghostlock-app

YuKongA/ghostlock-app has 2,847 GitHub stars and 669 forks. GitHot measured +32 stars in 24 hours and +336 in 7 days. Last checked 2026-11-09 18:54 UTC. Last push 2026-11-02.

Cómo se miden estas cifras

GhostLock One-Tap Execution App (CVE-2026-43499)

2,847 estrellas 669 forks +32 in 24h

Crecimiento de estrellas medido

in 24h: +32
in 7 days: +336
in 15 days: Actualización retrasada
in 1 month: Actualización retrasada

Cambios netos en períodos que se solapan, no totales diarios. Los datos no disponibles se dejan en blanco. Las estrellas indican interés, no calidad.

README.md

Original

GhostLock-App

中文

GhostLock uses CVE-2026-43499 to gain temporary root on supported Android kernels and load KernelSU.

Use the app

Install a root manager APK from KernelSU, BakaSU/ReSukiSU, or KowSU.
Install the GhostLock APK and open it.
Check that your kernel is supported, then tap Run.

Support requires an exact uname -r match. Check the supported devices for your kernel build.

If Shizuku is enabled, start it with ADB before running GhostLock. Tap GhostLock's status card to grant access.

Any root manager that ships libksud.so provides ksud for module loading. The built-in list (KernelSU, ReSukiSU, BakaSU, KowSU) is auto-detected, and other managers can be picked in Settings → Root manager. Without ksud, W1/W2 still grant uid 0 but no module is loaded.

Add a kernel profile

You can import a profile without rebuilding the app:

Parse OTA link accepts a full OTA ZIP URL.
Parse local image accepts boot.img and an optional xbl_config.img.
Import offsets.conf (v2) accepts a HOCON profile. Import offsets.json (v1) converts an older JSON report in the app.

Extractor output is an unverified candidate. The app checks missing or invalid fields before execution. Generating a profile does not prove device support. See the porting guide for validation and built-in registration.

See the MediaTek guide for image-based address recovery and the rooted-device fallback.

Command-line tools

Run the native binary with an exported profile

Requires the Android NDK, make, Gradle, and ADB. An adb shell run skips the app's seccomp bypass stage.

make -C src ghostlock
./gradlew exportKernelProfiles
adb push build/native/ghostlock /data/local/tmp/ghostlock
adb push "build/kernel-profiles/<release>.bin" /data/local/tmp/profile.bin
adb shell chmod 755 /data/local/tmp/ghostlock
adb shell /data/local/tmp/ghostlock --load-prebuilt-profile /data/local/tmp/profile.bin

Build and run the offset extractor

Requires Rust. The extractor accepts a boot image, a full OTA ZIP, or an HTTP(S) URL.

(cd tools/extract_rs && cargo build --release)
build/extract/release/ghostlock-extract boot.img --xbl-config xbl_config.img --format conf --out profile.conf
build/extract/release/ghostlock-extract OTA.zip --format conf --out profile.conf

Import profile.conf in the app. Omit --xbl-config if you do not have that image. The extractor rejects a patched remove_waiter() with exit code 6.

Reference

Profile schema and execution defaults
Native core
Add a component, engineering rules, and writing rules

Credits and license

Licensed under Apache License 2.0. Based on:

YuKongA/ghostlock-app

Crecimiento de estrellas medido

README.md

GhostLock-App

Use the app

Add a kernel profile

Command-line tools

Reference

Credits and license

Explorar proyectos relacionados

codecrafters-io/build-your-own-x

public-apis/public-apis

morluto/rea

openclaw/openclaw