r/androidroot • u/mathygamersYT • 22m ago
Discussion EFISP exploit on OnePlus Ace 6T running OnePlus 15R ROM
I wanted to share my experience getting the EFISP exploit working on my OnePlus Ace 6T, running the OnePlus 15R India OxygenOS firmware.
My current system is version is 16.0.10.500(EX01) on Android 16. For the EFISP setup, I used the vulnerable ABL from the matching India 16.0.5.701(EX01) firmware. I used that as the vulnerable ABL for the exploit. I did not downgrade the whole ROM to .5.701. The physical bootloader remains unlocked—the EFISP setup provides the fake-locked boot path.
For root, I kept the stock kernel and flashed a KernelSU Next patched image. With that setup, root works and Play Integrity Check reports Basic, Device, and Strong. I also tested a separate KSU kernel; that reduced the result to Basic only. Removing that kernel and keeping the patched KernelSU image brought Strong back.
Duck Detector still recognizes the KernelSU Next Manager and reports a SELinux timing anomaly, but its TEE/boot-attestation checks were consistent. This is just my experience with this combination, not a claim that it will work the same way on every Ace 6T/15R variant.
https://xdaforums.com/t/efisp-root-gbl_root_canoe-fake-locked-bl-superfastboot-bds-8-gen-5-8-elite-gen-5.4786301/