Back Sploitus Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware
RAM-only temp root for OPPO Find X5 Pro PFEM00 (kernel `5.10.198-android12-9`, ColorOS, locked bootloader) via CVE-2025-21479 (Adreno KGSL) → [KernelSU]( v3.3.0 LKM late-load. 中文：[README_zh.md](README_zh.md)
Chain: KGSL physical R/W → disarm OEM guard, SELinux permissive, `kptr_restrict=0` → `capset` patch grants full caps → `ksud late-load` (official KernelSU LKM `android12-5.10`) → KernelSU manager `me.weishu.kernelsu`. Everything is gone after reboot; nothing is flashed.
**Own device, security research only. The exploit writes kernel memory: a bad run reboots the device.**
Get the bundle from [Releases](../../releases) (`exploit_guard`, `su0`, `ksud`, `oneclick_root.sh`), put it in one folder, run with adb on the PC:
bash oneclick_root.sh # run chain + verification
bash oneclick_root.sh shell # then drop into a uid=0 shell
bash build.sh # Android NDK r28c (or set ANDROID_NDK_HOME), aarch64, API 31
Every push builds on GitHub Actions and uploads a bundle artifact; `v*` tags publish to Releases.
src/cheese.c exploit (single TU: KGSL primitive, guard patch, SELinux/kptr, capset patch)
src/adrenaline.h KGSL ioctl interface (Project Zero Adrenaline)
src/kallsyms_lookup.c kallsyms helpers
scripts/oneclick_root.sh PC-side one-click chain
GPL-3.0 — see [LICENSE](LICENSE).
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
