GhostLock uses CVE-2026-43499 to gain temporary root on supported Android kernels and load KernelSU.
- Install a root manager APK from KernelSU, BakaSU/ReSukiSU, or KowSU.
- Install the GhostLock APK and open it.
- Check that your kernel is supported, then tap Run.
Support requires an exact uname -r match. Check the supported devices for your kernel build.
If Shizuku is enabled, start it with ADB before running GhostLock. Tap GhostLock's status card to grant access.
Any root manager that ships libksud.so provides ksud for module loading. The built-in list (KernelSU, ReSukiSU, BakaSU, KowSU) is auto-detected, and other managers can be picked in Settings → Root manager. Without ksud, W1/W2 still grant uid 0 but no module is loaded.
You can import a profile without rebuilding the app:
- Parse OTA link accepts a full OTA ZIP URL.
- Parse local image accepts
boot.imgand an optionalxbl_config.img. - Import offsets.conf (v2) accepts a HOCON profile. Import offsets.json (v1) converts an older JSON report in the app.
Extractor output is an unverified candidate. The app checks missing or invalid fields before execution. Generating a profile does not prove device support. See the porting guide for validation and built-in registration.
See the MediaTek guide for image-based address recovery and the rooted-device fallback.
Run the native binary with an exported profile
Requires the Android NDK, make, Gradle, and ADB. An adb shell run skips the app's seccomp bypass stage.
make -C src ghostlock
./gradlew exportKernelProfiles
adb push build/native/ghostlock /data/local/tmp/ghostlock
adb push "build/kernel-profiles/<release>.bin" /data/local/tmp/profile.bin
adb shell chmod 755 /data/local/tmp/ghostlock
adb shell /data/local/tmp/ghostlock --load-prebuilt-profile /data/local/tmp/profile.binBuild and run the offset extractor
Requires Rust. The extractor accepts a boot image, a full OTA ZIP, or an HTTP(S) URL.
(cd tools/extract_rs && cargo build --release)
build/extract/release/ghostlock-extract boot.img --xbl-config xbl_config.img --format conf --out profile.conf
build/extract/release/ghostlock-extract OTA.zip --format conf --out profile.confImport profile.conf in the app. Omit --xbl-config if you do not have that image. The extractor rejects a patched remove_waiter() with exit code 6.
- Profile schema and execution defaults
- Native core
- Add a component, engineering rules, and writing rules
Licensed under Apache License 2.0. Based on: