YuKongA/ghostlock-app
YuKongA/ghostlock-app has 2,728 GitHub stars and 648 forks. GitHot measured +48 stars in 24 hours. Last checked 2026-11-06 21:34 UTC. Last push 2026-11-02.
GhostLock One-Tap Execution App (CVE-2026-43499)
측정된 스타 증가
- in 24h
- +48
- in 7 days
- 업데이트 지연
- in 15 days
- 업데이트 지연
- in 1 month
- 업데이트 지연
서로 겹치는 기간의 순증가량이며 일별 합계가 아닙니다. 측정값이 없으면 비워 둡니다. 스타는 관심도를 나타내며 품질을 보장하지 않습니다.
README.md
OriginalGhostLock-App
GhostLock uses CVE-2026-43499 to gain temporary root on supported Android kernels and load KernelSU.
Use the app
- Install a root manager APK from KernelSU, BakaSU/ReSukiSU, or KowSU.
- Install the GhostLock APK and open it.
- Check that your kernel is supported, then tap Run.
Support requires an exact uname -r match. Check the supported devices for your kernel build.
If Shizuku is enabled, start it with ADB before running GhostLock. Tap GhostLock's status card to grant access.
Any root manager that ships libksud.so provides ksud for module loading. The built-in list (KernelSU, ReSukiSU, BakaSU, KowSU) is auto-detected, and other managers can be picked in Settings → Root manager. Without ksud, W1/W2 still grant uid 0 but no module is loaded.
Add a kernel profile
You can import a profile without rebuilding the app:
- Parse OTA link accepts a full OTA ZIP URL.
- Parse local image accepts
boot.imgand an optionalxbl_config.img. - Import offsets.conf (v2) accepts a HOCON profile. Import offsets.json (v1) converts an older JSON report in the app.
Extractor output is an unverified candidate. The app checks missing or invalid fields before execution. Generating a profile does not prove device support. See the porting guide for validation and built-in registration.
See the MediaTek guide for image-based address recovery and the rooted-device fallback.
Command-line tools
Run the native binary with an exported profile
Requires the Android NDK, make, Gradle, and ADB. An adb shell run skips the app's seccomp bypass stage.
make -C src ghostlock
./gradlew exportKernelProfiles
adb push build/native/ghostlock /data/local/tmp/ghostlock
adb push "build/kernel-profiles/<release>.bin" /data/local/tmp/profile.bin
adb shell chmod 755 /data/local/tmp/ghostlock
adb shell /data/local/tmp/ghostlock --load-prebuilt-profile /data/local/tmp/profile.bin
Build and run the offset extractor
Requires Rust. The extractor accepts a boot image, a full OTA ZIP, or an HTTP(S) URL.
(cd tools/extract_rs && cargo build --release)
build/extract/release/ghostlock-extract boot.img --xbl-config xbl_config.img --format conf --out profile.conf
build/extract/release/ghostlock-extract OTA.zip --format conf --out profile.conf
Import profile.conf in the app. Omit --xbl-config if you do not have that image. The extractor rejects a patched remove_waiter() with exit code 6.
Reference
- Profile schema and execution defaults
- Native core
- Add a component, engineering rules, and writing rules
Credits and license
Licensed under Apache License 2.0. Based on: