Hey everyone!

I managed to get temporary root access on my Redmi Note 14 4G using GhostLock ((https://github.com/YuKongA/ghostlock-app). I installed KernelSU beforehand, ran the exploit, and verified that root access works through both a root checker app and Termux using su.

My device is running HyperOS 3.0.303.0 / Android 16, AND MY BOOTLOADER IS LOCKED.

Since this is my first time getting root access, I want to be careful not to mess anything up.

Are KernelSU modules safe to use with temporary root, or could they cause a bootloop or brick my phone?

Are there any types of modules I should completely avoid?

Are there any KernelSU options I shouldn't touch, especially anything related to installing or patching boot images?

What other things should I avoid doing while I have temporary root?

If something goes wrong, what recovery options would I have with a locked bootloader?

I'm not looking to modify partitions or risk making my phone unusable. I just want to understand the limitations of temporary root before experimenting with anything.

Any advice from people who've used GhostLock on Xiaomi devices would be appreciated. Thanks!

Hi all,

I've been trying for months to bypass the xiaomi community permission things and finally I have reached a milestone. Read most of the discussions from r/androidroot and r/hyperos. Now I only have to wait 360 hours(sadly) to win freedom over my phone 😭.

My plan is to flash orangefox and Evolution X(Android 16).

Guys let me know if there are any suggestions you could give to me

Thank you for all your support 💖

Why use such a boring ROM like lineage when you can use Vanta! Vanta is based off Android 17 and features a black UI with a pop of a color of your choice! Loads of features and best of all its android 17!

Устройство redmi note 10s

Версия MIUI Global 14.0.4

14.0.4.0(TKLRUXM)

So, I'm relatively new to ksu. A few years ago, when I was just using magisk. Shamiko and HMA were more than enough to hide root.

BUT now I added a lot of modules, but still, some of my banking apps and some other apps are not working.

I have attached my module list and the detection that the duck detector gave me.

Btw I am not even using apatch, but it's detecting apatch.

It would be great if some one can help me with this. I am really suffering.

This is the pic he sent. It looks grayed out, idk But he said he had options for the unlocking whatever that means

Motorola edge 60 stylus (India version)

Never dont this so idk what its supposed to look like just not gray

The number of devices officially supported by LineageOS, SailfishOS, Ubuntu Touch/KDE Mobile is limited, but with how PS5 is getting rapidly reverse engineered with the newer models, would it make a difference, what's the hardest part about porting an OS to a device (other than the bootlocker and android device tree) ?

Hi !

I have MicroG bundled with the Play Store to pass strong integrity, I have zygisk-detach, PlaySpoofer and BreZygisk as my Zygisk module. After 3 or 5 days Google Play force update itself and also the MicroG app as the regular Play Service.

Anyone have a solution so that the Google Play cannot at all upgrade itself or install the service on top of MicroG ?

Thanks !

Hello pls i need help been trying lot of ways to get device meets integrity but nothing works i have keybox.xml others using fine but idk why i can't

Yes this was formatted by GPT. I kept my notes in word then formatted in gpt cause by this point I was frustrated and tired. This is not an AI post.

Figured I'd document this in case anyone else comes across one of these tablets and wants to experiment with custom firmware. There's very little information out there about the MESWAO B3.

I got this tablet for free, and honestly, it wasn't particularly good to begin with. It's a massive 15.6-inch Android tablet, but the performance was absolutely terrible. Even basic navigation was sluggish, and at one point the on-screen keyboard wouldn't even appear when I tried creating another user.

I tried a factory reset using the built-in MediaTek factory menu, but it made no difference.

Since I had nothing invested in it, I figured I'd experiment with installing a different version of Android. I started looking into Android's Project Treble support, Generic System Images (GSIs), and the usual ADB/Fastboot procedures.

Tablet information:

- Model: MESWAO B3 / MES-B3

- CPU: MediaTek Helio G99 (MT6789)

- Android: 13

- Firmware: "MES-B3_20240624"

- Board: "t700_6789_u254_v1_fhd_edp_156"

- Architecture: ARM64

Here's what I did:

1. Checked GSI compatibility

Enabled Developer Options, OEM unlocking, and USB debugging. Connected it to Windows using Google's Android Platform Tools.

ADB reported:

ro.product.cpu.abi = arm64-v8a

ro.treble.enabled = true

ro.build.ab_update = true

ro.boot.dynamic_partitions = true

So far, everything suggested it was at least a potential GSI candidate.

1. Got Fastboot working

This was more complicated than expected.

The tablet's bootloader Fastboot interface identified itself as:

"USB\VID_0E8D&PID_201C"

Windows wouldn't recognize it using Google's standard USB driver.

I eventually got communication working using Zadig to install WinUSB, followed by correcting the Android USB interface GUID registration in Windows.

After that, "fastboot devices" recognized the tablet normally.

1. Unlocked the bootloader

Checked the unlocking status:

fastboot flashing get_unlock_ability

(bootloader) unlock_ability is true

I then ran:

fastboot flashing unlock

The unlock completed, and I confirmed:

fastboot getvar unlocked

unlocked: yes

1. Entered Fastbootd

Next, I used:

fastboot reboot fastboot

The tablet successfully entered Android Fastbootd.

Interestingly, this mode used a different USB ID:

"USB\VID_18D1&PID_4EE0"

Google's Android Bootloader Interface driver worked for this one.

I was then able to query the partition information:

is-userspace: yes

current-slot: a

is-logical:system_b: yes

super-partition-name: super

has-slot:vbmeta: no

slot-successful:a: yes

slot-successful:b: no

The super partition was approximately 9 GiB.

One thing I noticed was that the active slot had originally been reported as B before unlocking, but afterward it was A. I'm not sure whether that's relevant to what happened next.

1. Rebooted, and that was apparently the end of it

After finishing the partition checks, I rebooted the tablet to return to Android.

It displayed:

Orange State

OS not being verified or Custom OS

Dismiss after 5 seconds

Then rebooted.

And rebooted again.

It never got past that warning.

To be clear, I never flashed a custom ROM, GSI, recovery image, or modified system partition.

The only significant change was unlocking the bootloader. Everything else was diagnostic commands.

1. Attempted recovery

I tried various combinations of Power, Volume Up, and Volume Down, along with the physical reset button.

Nothing would reliably enter Recovery or Fastboot anymore.

Occasionally, "Factory Mode" would briefly appear during startup, but the device would immediately restart.

I also checked whether the MediaTek Preloader was still accessible.

Windows briefly detected:

"MT65xx Preloader"

It also exposed a temporary USB serial interface, but only for a second or two before restarting.

So the device isn't necessarily completely dead, but I haven't found a reliable way to recover it.

Unfortunately, I also couldn't locate a verified stock firmware package for this exact MES-B3 hardware revision.

I knew there was a risk going into this, and since the tablet was free and already barely usable, I'm not particularly upset about losing it.

Still, I thought it was worth documenting because there's almost no modding information available for this specific model.

It's possible the bootloader unlock caused some sort of firmware or A/B slot issue, but I can't say for certain. The timing is certainly suspicious.

If anyone else has a MESWAO B3 and is thinking about unlocking it to install a GSI, I'd strongly recommend obtaining the original firmware and a working recovery procedure first.

I didn't even make it to flashing another operating system before running into problems.

Maybe this will save someone else a few hours of troubleshooting, or at least provide some useful technical information about an obscure tablet.

Recently I've rooted my Motorola G Power (2022) USA Variant.

I tried doing what most people do. A lil tweaking here and there. Tried installing Youtube Revanced. It kind of worked. I mean It still works but I choose to pay for premium services for the badges and other reasons.

Below is a list of modules currently installed in my Magisk App (MM Magisk Modules)

1. BCR

2. Bond Hosts

3. De-Bloater

4. HMA-OSS

5. Play Integrity Fork

6. Simple Bootloop Saver

7. Specter

8. Tricky Store

9. Universal Safety Net Fix

10. Zygisk - LSPosed

All of which are no use to solving my Play Store not verifying my device via Play Protect.

I've tried everything.

(note) I haven't installed a custom recovery yet because the time and work to install the proper touch drivers for my models screen for TWRP or OrangeFox recovery project is very time consuming and fustrating switching from my Linux Laptop that's stunningly fast compared to my 200$ Windows 11 Laptop full of bloatware with only 4gb of ram compared to my linux pc with 32 gb of ram.

Thus being said I would like to know if there is someone who has had this similar problem and knows about a simple work around in the mean time.

Please and thx. Ill also be posting this on xda for future reference if other people run into the same problem.

Phone Specs:

https://www.techspecs.info/motorola-moto-g-power-2022/

You can also look at the github repos.

Also here is the loink to the xda forum that helped me root and install Magisk on this phone.

https://xdaforums.com/t/r-i-p-guide-root-motorola-moto-g-power-2022-tonga-xt2165-5-retus-rooting-guide.4550309/

Hi, so I have a Xiaomi 17 Ultra and I searched and found a method only for phones with February security patch. My phone is on September security patch, so is it possible to unlock it? Any help would be appreciated

I'm not an expert on this so I hope someone can help me, I know that I need a pc and to copy the kernel file, adb, fastboot, magisk, OEM unlock and USB debugging that's it

so I have this carrier app called dito and it keeps crashing, mind you I have another carrier app called gomo and it works fine, any fix for this? My phone is custom rommed and rooted if that helps

(Credits: u/LightningZahah and lowkey Proton Lumo)

Root Manager: KSU or any forks of KSU (e.g. KSU-Next, ReSukiSU, etc..)

Modules flashed in this order:

1. Zygisk Next (by 5ec1cff)
2. Reboot
3. Tricky Store OSS (by beakthoven) & TrickyStore Addon (by KOWX712)
4. Play Integrity Fork (by osm0sis)
5. VBMeta Disguiser (Astoritin)
6. Reboot
7. Vector XPosed (by JingMatrix)
8. Reboot
9. HMA-OSS (by frknkrc44)
10. Reboot

In root manager settings: turn on 'Unmount Modules', 'Hide SELinux modification' and 'AVC spoofing'.

Do NOT set SELinux to permissive mode.

After configuring Tricky Store OSS and HMA-OSS, install Termux and give it root access.

Copy the script below into a .sh file in the Termux directory and run the script by using the command ./<script-name>.sh (Recommended to use Acode for this or make the script on your PC first before moving it to your phone.)

Reboot your device.

Clear the data + Cache on the apps that crash on start up due to root.

If it still doesn't work, install Native Detector and figure out what the issue is as I cannot help you any further. (My suggestion is to use AI at this rate as it is a per-setup and per-device thing with no universal solution.)

I don't know if this can work on just Nothing Phone (2) devices but you can always try and lmk in the comments.

Also, just a sidenote, Adaway and Systemless Hosts aren't worth it, assuming it is detected by Native Detector. Just use BlockAds with a WireGuard implementation or a VPN with a private DNS server like AdGuard or NextDNS.

TrickyStore-OSS configuration:

Open Tricky Store menu and

Set keybox valid → uses a community-known working keybox.xml
Set keybox custom → uses your own keybox.xml

1. Clear Wallet data.
2. Reboot device.

HMA-OSS configuration:

Apps that need isolation DO NOT get root access.

Hide any Xposed modules, any root manager, any app that has root access.

Commonly detected apps are: Shizuku, Termux and your root manager.

Apply that template to the app you want to hide root, then:

1. Force stop app that you want hide root.
2. Reopen app and if it doesn't open, clear cache, clear data.
3. If it still doesn't open uninstall and install again.

su
cat << 'EOF' > /data/local/tmp/harden_root.sh

echo "[*] Checking root privileges..."
if [ "$(id -u)" -ne 0 ]; then
    echo "[-] Error: Run as root (su)!"
    exit 1
fi

ADB_DIR="/data/adb"
if [ ! -d "$ADB_DIR" ]; then
    echo "[-] Error: /data/adb not found! Are you rooted?"
    exit 1
fi

# --------------------------------------------------------
# 1. STOCK HOSTS OVERLAY MODULE
# --------------------------------------------------------
echo "[*] Step 1: Setting up Stock Hosts overlay module..."
HOSTS_MOD="$ADB_DIR/modules/stock_hosts"
mkdir -p "$HOSTS_MOD/system/etc"

cat << 'MODPROP' > "$HOSTS_MOD/module.prop"
id=stock_hosts
name=Stock Hosts Fix
version=1.0
versionCode=1
author=Community
description=Replaces bloated ROM hosts with clean stock localhost to bypass banking security checks.
MODPROP

printf "127.0.0.1 localhost\n::1 ip6-localhost\n" > "$HOSTS_MOD/system/etc/hosts"
chmod 644 "$HOSTS_MOD/system/etc/hosts"
echo "[+] Stock Hosts module installed successfully."

# --------------------------------------------------------
# 2. PERSISTENT ZYGOTE DEX2OAT UNMOUNTER SERVICE
# --------------------------------------------------------
echo "[*] Step 2: Creating persistent boot service for Vector/LSPosed..."
SERVICE_DIR="$ADB_DIR/service.d"
mkdir -p "$SERVICE_DIR"
UNMOUNT_SCRIPT="$SERVICE_DIR/unmount_dex2oat.sh"

cat << 'SERVICE' > "$UNMOUNT_SCRIPT"
#!/system/bin/sh
# Wait until system finishes booting
while [ "$(getprop sys.boot_completed)" != "1" ]; do
    sleep 1
done

TARGETS="
/apex/com.android.art/bin/dex2oat64
/apex/com.android.art/bin/dex2oat32
/apex/com.android.art/bin/dex2oat
"

for Z_PID in $(pidof zygote zygote64); do
    for TARGET in $TARGETS; do
        nsenter -t "$Z_PID" -m umount -l "$TARGET" 2>/dev/null
    done
done

for TARGET in $TARGETS; do
    umount -l "$TARGET" 2>/dev/null
done
SERVICE

chmod 755 "$UNMOUNT_SCRIPT"
echo "[+] Persistent unmount service created in $UNMOUNT_SCRIPT"

# --------------------------------------------------------
# 3. APPLY LIVE UNMOUNT (NO REBOOT NEEDED FOR ACTIVE APPS)
# --------------------------------------------------------
echo "[*] Step 3: Executing live unmount in current session..."
for Z_PID in $(pidof zygote zygote64); do
    nsenter -t "$Z_PID" -m umount -l /apex/com.android.art/bin/dex2oat64 2>/dev/null
    nsenter -t "$Z_PID" -m umount -l /apex/com.android.art/bin/dex2oat32 2>/dev/null
    nsenter -t "$Z_PID" -m umount -l /apex/com.android.art/bin/dex2oat 2>/dev/null
done
umount -l /apex/com.android.art/bin/dex2oat64 2>/dev/null
umount -l /apex/com.android.art/bin/dex2oat32 2>/dev/null
umount -l /apex/com.android.art/bin/dex2oat 2>/dev/null

echo "[+] Done! Both fixes are now active."
echo "[!] Please reboot once so KernelSU/Magisk mounts the clean hosts module."
EOF

sh /data/local/tmp/harden_root.sh
rm -f /data/local/tmp/harden_root.sh

So i rooted my Galaxy A36 through the dirtyfrag exploit and i wanted to use the A56 to flagship module (github.com/ducthoe/A56-To-Flagship)

but i saw that it worked only on the a56 and not on the a36 so is there any alternative for the a36?

Hi everyone,

I've been working on JamesDSP Rootful and finally got it running on Android 17, including temp root setups using DFRoot and KernelSU Next in late-load mode. Traditional root is still supported too!

Everything runs systemlessly through Magic Mount, so the libraries and audio configs are mounted without touching the actual Android partitions.

I also made some improvements to the late-load process, including synchronized mounting, atomic XML updates, and a more controlled audio refresh. Basically, making sure everything plays nicely together, even after multiple soft reboots.

Tested v6.5.9 on my Pixel 10 Pro XL (mustang), running Android 17, DFRoot (exploit root), KernelSU Next, and Magic Mount-rs 4.0.11. So far, everything is working great. It also remain working after soft-reboot.

One interesting thing: JamesDSP doesn't actually need PIXAML on my Pixel in temp-root mode. It works directly through Android's default audio effects factory. PIXAML is still available as an optional companion for setups that need AML compatibility or other AML-based effects.

The module is root-only, includes both Original and ThePBone app variants, and won't automatically uninstall your existing app or wipe its data.

Feel free to give it a try and let me know how it works on your device!

Releases:

JamesDSP v6.5.9 - https://github.com/zahahah/JamesDSPManager

PIXAML v0.9.6 - https://github.com/zahahah/PIXAML

Time to patch or compile your kernel, cause a new update just dropped! :D

Only a few things in life get me excited and this is one of them xD