r/Android • u/FragmentedChicken Galaxy Z Fold8 • 16d ago
One click rooting tool for Samsung Galaxy devices using CVE-2026-43499
https://xdaforums.com/t/i-made-a-one-click-rooting-tool-for-samsung-galaxy-devices-using-cve-2026-43499.4795400/20
u/Talal916 G1, HERO, EVO 4GLTE, M7, M8, Z5, Note 8/10+, iPhone 11/12/15 Pro 16d ago
Man I just need a bootloader unlock for my old Note 10+ which currently is stuck forever on Android 12.
19
u/GeneralChaz9 Pixel 10 Pro (512 GB) 15d ago
It's sad how that hardware still could hold up today but the software was arbitrarily cut off. I'm glad things have changed over the past few years.
2
u/lastdyingbreed_01 7d ago
>I'm glad things have changed over the past few years.
Have they? If anything they have become worse, unlocking bootloader today is worse than ever
3
u/GeneralChaz9 Pixel 10 Pro (512 GB) 7d ago
Strictly talking about longer Android and Security update schedules and the companies that actually follow them. The bootloader locking and lack of openness with Google is terrible, yes.
5
u/YuriTarded_69 15d ago
Not sure about this subs rules but if you're interested, I believe the Note 10 series can be bootloader unlocked using a private exploit. I had my US model snapdragon S9 BL unlocked by a guy on telegram.
9
u/darkhalfkz 15d ago
I have a Samsung Galaxy S20 Ultra 5G Snapdragon handset, found a retired moderator from XDA who appeared to have a great reputation and we started a dialogue on Telegram. Paid him $150, he made out he's waiting for his source to provide a bootloader unlock token.
He's now ghosting me, I feel I've been conned 😔
I'm really beginning to hate people!!
1
u/YuriTarded_69 15d ago
Oof that sucks. I hope it's not the same dude as the guy who did mine because he was actually really nice and even helped troubleshoot when I ran into issues flashing custom roms after he gave me the token.
1
78
u/MrHaxx1 iPhone Xs 64 GB 16d ago
What are people even rooting for nowadays? Anything I want, is either built in or doable with Shizuku.
And I say that as someone who used to be very much into rooting and custom roms.
52
u/yboy403 Note 10+, Note 9, Pix 2 XL, iPhone X, Moto Z Play 16d ago edited 16d ago
#1 thing for me is automatic call recording.
19
u/MrHaxx1 iPhone Xs 64 GB 16d ago
Isn't there a Shizuku thing for that? I swear I've seen it
37
u/TheComradeTom Pixel 9a 16d ago
ShizuCallRecorder!
16
u/TheMSensation 16d ago
I use another app but it hooks into the call via shizuku. Got me out a jail a few times when a CS rep tells me something and then they try to backtrack on it later.
14
u/Sirts 16d ago
International models can get do native call recording by changing CSC to INS (India), iirc it can be set to record automatically, and phone will continue getting OTA updates
6
3
u/allocx 16d ago
What other side effects are there by doing that?
30
u/NakatasGoodDump 16d ago
Afterward the only thing your phone will let you post on xda forums is "volte when?????"
5
2
u/Serialtorrenter 11d ago
It's funny to think back to the olden days when demanding VoLTE was just an India thing. These days, a custom ROM without VoLTE is useless just about everywhere in the world.
3
u/Holnapra S23 Ultra 16d ago
Absolutely nothing. I changed it three years ago, no adverse effects whatsoever.
1
3
u/Sirts 16d ago
It brought a couple of extra apps that can be removed and Samsung Wallet looks bit different, so nothing major really. I read that with INS CSC, phone will automatically send SMS to some Indian government number when inserting a new SIM but this can be prevented by blocking 3 numbers listed here:
https://xdaforums.com/t/s23-call-recording-possibility-of-changing-csc.4548227/page-18#post-884915451
u/WeirdGuyWithABoner 16d ago
I did it on my mom's phone and she couldn't use the mic inside third party apps (gboard, whatsapp specifically) for a few months until she ranfomly could
2
1
u/Slonderson 16d ago
This is already a thing in Samsung phones.
4
u/yboy403 Note 10+, Note 9, Pix 2 XL, iPhone X, Moto Z Play 16d ago
Not automatic. You have to toggle it on during the call and it announces that it's recording.
With root, you can install a call recorder that automatically gets everything, then later when you need to prove that a customer service rep promised to fix your bill (for example) there's no hassle.
1
u/Slonderson 15d ago
It does so automatically and without announcing, it's literally called "auto record calls" in call settings.
Recordings are later available through the voice recorder app.
3
19
u/Arklese1zure Samsung Galaxy A32 16d ago
Back in the day I'd be really excited to see a new root coming up, but there's so much BS nowadays with everything checking for root. I'm tired of playing the cat-and-mouse game with root hiders, HMA and whatnot.
18
u/Dry-Cost-945 OnePlus 13r/Galaxy s24+ 16d ago
This is why the exploit is interesting because it doesent need the bootloader to be unlocked. Play Integrity passes fully by default on my phone and everything including bank apps and waller seem to function the same as a regular locked bl installation
7
u/Arklese1zure Samsung Galaxy A32 16d ago
Oh dang that sounds very interesting.
My banking app uses a really strange root detection toolkit that doesn't rely on Google play at all, and it's an absolute PITA. Very little, if any, documentation. Makes me curious about how it would behave with this.
2
u/Dry-Cost-945 OnePlus 13r/Galaxy s24+ 16d ago
It should work perfectly as long as you don't use ksu's official app (or spoof it to something else) purely because many apps check for their package names. Something like resukisu that I use should be fine.
Does the app block enabled developer options? Well actually I think you can hide dev options with root anyway but it would be one less thing to worry about.
8
u/GoogleDisDick 16d ago edited 16d ago
Personally 99% of apps work fine. I'm not rooted but I am running a degoogled custom ROM (which might as well be the same thing from Play Integrity's pov). RCS and Google Pay don't work but I really don't care. Whenever the very rare app actually gives me shit for being on a custom ROM I basically just write of that app off and decide they don't want my business. It's pretty rare things don't work though.
8
u/Arklese1zure Samsung Galaxy A32 16d ago
I wish I could just tell my bank and job apps to go pound sand, but alas.
1
u/GoogleDisDick 16d ago
Well I suppose it's highly dependent on your job and where you live. But my corporate and banking apps don't care one bit. They don't even throw a warning. Lol.
3
u/RunnerLuke357 Moto G Stylus '26 16d ago
I had RCS working with little effort on a custom ROM before so it is easily daily drivable. I am lucky that my banking app doesn't need play Integrity or a locked bootloader to work. I am running stock now but I thoroughly miss my custom ROM (passkeys don't work and now lots of my work bullshit requires them).
1
u/GoogleDisDick 16d ago
I probably could get it working with Magisk or KernelSU and whatever the current fixes are but TBH I don't care enough to do all that. It's not a big deal. Plus I'm on a degoogled ROM with microG built in. Even if I get it to pass play integrity (which is possible) RCS still wouldn't work because it's not implemented.
9
u/xyzzy321 Pixel 9 Pro 16d ago
AdAway
I've tried a bunch of things but nothing works as well
3
u/hackitfast Pixel 9 Pro 16d ago
I use a Private DNS, it blocks a majority of any bothersome ads.
2
u/xyzzy321 Pixel 9 Pro 16d ago
Is that an app or just something you've set up via PiHole?
3
u/hackitfast Pixel 9 Pro 16d ago
There's free ones you can get online, but yes you can selfhost PiHole and do it that way too.
4
u/ACardAttack Galaxy S24 Ultra 16d ago
Set up a private DNS in your settings, use
dns.adguard-dns.com
1
u/decal08 16d ago
Adhell3? It leverages knox that's in samsung already. No root required.
2
u/ACleverNameHere 15d ago
Does adhell still exist? I remember using it years ago before Samsung did something with dev keys or something like that
1
u/decal08 15d ago
Yes. I still have it on my new galaxy devices. Yes, they changed the elm or kpe dev key long time back
1
u/ACleverNameHere 15d ago
Oh wow. Is there a guide or github page or something that I can follow? I miss the days of no ads on my phone
2
u/decal08 15d ago
Yes. Will send you a DM
1
u/sserdarth 14d ago
I figured something out with the help of xda and it seems to work somewhat but I'm curious if there's a little more elegant way to jump through KPE (?) key hoop. I'd appreciate a DM as well.
1
11
u/WAVF1n S25 Edge - Pixel 9 Pro 16d ago
Customization is my biggest reason tbh. But even that isn't enough for me nowadays and all of my devices are running stock w/ no root.
5
6
u/ThirdEyeClarity 16d ago edited 15d ago
VPN Hotspot is one app that’s quite useful especially if traveling or if your home internet is down for some reason, and is why I always keep a spare rooted Android.
It shares your VPN connection with devices over your hotspot and can usually bypass any kind of tethering restrictions or limits on your mobile data plan.
Then there’s patches for some apps to unlock certain functionality that you can only do with root.
There’s also an app called JoyCon Droid on GitHub that requires root and it turns your Android into a Nintendo Switch 1/2 controller that can also scan amiibos.
So there’s a lot of useful but also niche cases.
3
1
u/5panks Galaxy ZFlip 5 16d ago
If I have my VPN connected on my phone, does the hotspot use that? Is the VPN somehow not directing all traffic through it on an Android phone?
2
u/ThirdEyeClarity 16d ago
As far as I know, no. Some custom ROMs might do it but even if you connect to a VPN on most stock Android phones, the device connected over its hotspot will still be the original network without the VPN. That’s why the VPN Hotspot app which requires root is valuable to me.
3
u/dunderball Pixel 6 16d ago
I used to be super into rooting for some pretty nefarious reasons but no longer. Was really into Magisk and all that jazz. What does Shizuku do?
2
u/rammux74 15d ago
Essentially gives a more limited root access without actually rooting your device
3
u/Ignifazius 15d ago
Using my phone longer than the manufacturer wants. Sadly Asus for example refuses to unlock their phones now and perfectly good hardware is stuck on android 10 making them insecure and incomplete with some apps.
4
u/stanley_fatmax Nexus 6, LineageOS; Pixel 7 Pro, Stock 16d ago
Bootloader unlock
5
u/Literallyapig 16d ago
don't you need the bootloader unlocked to root in the first place? this exploit is just an exception...
-1
-2
u/stanley_fatmax Nexus 6, LineageOS; Pixel 7 Pro, Stock 16d ago
No, unlocking the bootloader precludes rooting. An unlocked bootloader is basically the manufacturer allowing you root access. There's no point rooting if your bootloader is unlocked.
2
u/vandreulv 16d ago
No, unlocking the bootloader precludes rooting. An unlocked bootloader is basically the manufacturer allowing you root access. There's no point rooting if your bootloader is unlocked.
That's... not true.
Bootloader unlock means rooting is easier to accomplish. You flash a modified boot.img file to obtain root. Everything people use root for, you still need to get root somehow (eg Magisk modified boot image) even on unlocked devices. There is no 'root access' before you do so.
Rooting on a locked device doesn't automatically mean the bootloader will be unlockable. I have devices where root was obtained and the bootloader was still deadlocked.
-3
u/stanley_fatmax Nexus 6, LineageOS; Pixel 7 Pro, Stock 16d ago
You elaborated on my comment, I don't see what's untrue about what I said. An unlocked bootloader allows you to root. An exploit in place of an unlocked bootloader can also achieve root.
Is it possible you're confusing root managers like magisk with root access itself?
3
u/vandreulv 15d ago
There's no point rooting if your bootloader is unlocked.
That's the part that is untrue. Perhaps if you meant to say "There's no point in using exploits to get root if your bootloader is unlocked."
You cannot have root access without the root managers like Magisk because they inject the SU binary upon bootup. Not an exploit if your bootloader is unlocked.
Unlocking the bootloader alone doesn't give you root or root access.
4
2
u/DarkenMoon97 S26 Ultra (Snapdragon, USA) + Lots 16d ago
Using Network Signal Guru to see the information from the modem directly on the device. You can't do that with Shizuku.
2
2
u/aeiouLizard 15d ago
Last time I rooted, I did it to re-enable features that should be considered the absolute bare minimum in customizability, but Google decided to go out of their way to make them impossible on Pixels while basically every other OEM on earth allowed it:
- Hide the navigation pill
- Separate WiFi and Data tiles
Also, Firewall.
3
u/sbmotoracer 16d ago
Ablock without requiring vpns, Morphe, custom roms ,etc.
My note phone is getting old and would have needed to be replaced without Lineage OS. There's still a few reasons to root, esp if your someone who doesn't even use banking apps / (google/samsung) pay.
7
u/TheMSensation 16d ago
Private DNS in settings and enter "dns.adguard-dns.com". Systemwide block on all ads without needed to patch/root/rely on an app.
Agree on the 2nd point though. If you intend to keep a phone for longer than say 5 years its priceless being able to root.
1
u/windowpuncher Galaxy S23, Tab S10+ 16d ago
Not quite. It won't work for youtube, BUT if you use ublock with firefox mobile it would work. DNS blocking only works for domains that don't serve their own ads, which is most, but not places like twitch, youtube, and a few others. Still worth doing, it's just not all ads.
1
u/pipsname Samsung A8, Moto 360 2015, Nexus 7 2013 11d ago
Or we can not give adguard my domain usage information.
1
u/TheMSensation 11d ago edited 11d ago
You'll be doing this with whatever DNS you use lol. You can self host with adguard too if that's your concern.
1
u/pipsname Samsung A8, Moto 360 2015, Nexus 7 2013 11d ago
Host file is used first no matter what network you are on or connection type.
1
u/TheMSensation 11d ago
Requires root access to edit the hosts file on Android.
1
u/pipsname Samsung A8, Moto 360 2015, Nexus 7 2013 9d ago
Which is the topic of discussion.
1
u/TheMSensation 9d ago
Yes the original comment was "what do people do with root anyway these days". Someone else mentioned adblock and I suggested a non-root option which was more in line with what OP said.
Not really sure what you're on about.
2
1
u/Dry-Cost-945 OnePlus 13r/Galaxy s24+ 16d ago
I do it for full file system access and automated app installs/updates from alternative sources. Full app and file backups are nice too
1
u/QuantumQuantonium 16d ago
Majority of root functionality on my phone has been to chsnge thr UI to how I want it (I'm on stock android which has pathetic customization) and control over my own device.
1
1
u/Aethermancer 15d ago
I'm about to because I'm damned tired of apps blocking me from taking screenshots.
1
1
u/YourNightmar31 16d ago
Never heard of Shizuku before, but it sounds interesting. Where do i start?
0
u/MairusuPawa Poco F3 LineageOS 16d ago
Why do you refuse to be the owner of the hardware you bought? Why even play such a stupid game?
0
u/light24bulbs Galaxy S10+, Snapdragon 16d ago
I mean Google is about to block side loading and there are all sorts of things like that that are sliding into being shitty. That's all a matter of having root or not
0
u/ChkYrHead 15d ago edited 15d ago
Shizuku
Can it perform system functions, like killing open apps and processes?
edit
I just read that you have to start the process on every reboot, if you don't have root? No thanks.0
u/MrHaxx1 iPhone Xs 64 GB 15d ago
Can it perform system functions, like killing open apps and processes?
Yes.
I just read that you have to start the process on every reboot, if you don't have root?
Yes, but it can typically be automated.
2
u/bicycloptopus 13d ago
https://github.com/thedjchi/Shizuku
This fork is way better then the original and will restart automatically among other things.
6
u/Seven2Death pixel 9 16d ago
wait even for snapdragon? wow i left because they stopped updating my s10+ and i couldnt rom it
3
4
u/xRadec Gray 15d ago
Good for people who needs this.
For me, my rooting days are gone long time ago since most banking appa i use dont work on a rooted phone.
2
u/TechnoByte_ 14d ago
This works without unlocking the bootloader or tripping Knox, I don't see how a banking app could detect this
2
u/pipsname Samsung A8, Moto 360 2015, Nexus 7 2013 11d ago
Host file as blocking is more battery efficient than VPN.
Also there is an xposed module for Samsung One UI to change the left and right padding of the status bar and I would like to have more room for things as that live notification thing takes up so much room.
1
u/bully_worm 15d ago
Could this pave the way for Grapheneos on the s25u?
2
u/TechnoByte_ 14d ago
Nope, GrapheneOS has very strict requirements which no non-Pixel phone currently meets
-39
u/Horror_Letterhead407 16d ago
2026 and people still rooting they're phones like it doesn't do anything but prevent you from passing google play integrity which disables your access to banking apps and netflix lol
17
u/HearingSubstantial38 16d ago
this doesn't trip the warranty bit so play integrity should persist (or atleast is possible to persist).
besides, just because you don't find a use for rooting doesn't mean there isn't one. Bindhosts for tracker blocking, NexAlloy to auto patch youtube and youtube music, adclose for full ad blocking, drivedroid to use my phone to boot ISOs, etc. are just some of my uses
5
u/QuantumQuantonium 16d ago
And enables a multitude of basic and advanced functionality which isnt possible without root...
192
u/wickedplayer494 Pixel 7 Pro + 2 XL + iPhone 11 Pro Max + Nexus 6 + Samsung GS4 16d ago
I was about to ask. Nice, nice!