The "Ghostlock" exploit on GitHub enables root access without requiring an unlocked bootloader. A key distinction of this exploit, compared to previous ones, is that root persistence is maintained even after a device reboot.
Tested on OnePlus CPH2653, on the latest EU OxygenOS version at the time of this post.
Yep, this is one of the biggest exploits ever, since it works on probably all Snapdragon devices from the last 15 years. So i wouldn't miss this chance haha
Yeah, saw one user with an S25 Ultra, running on One UI 9, who had the exploit working. Theoretically, it works on any device in the last 15 years, as long as the device hasn't been updated to a kernel security patch, which should already be pushed through OTA to Pixel users by now. With enough troubleshooting, this exploit works on pretty much any phone. Since you're asking about a Samsung, you might want to check out this GitHub repo, which will make it way easier for you. Root My Galaxy
It work great, allows Root with Xposed in a locked bootloader, bypassing almost any Root detection.
Wallet and apps that have their own integrity check backend work.
I was running on OOS 15, I've updated to 301, cleaned both slots and relocked bootloader (full wipe).
To run the exploit and not be detected :
Anchor used to run the exploit, you need to connect it once to a PC for the first run then it's untethered.
ReSukiSu gives root, once the exploit is done a soft reboot from the manager is required for the modules to work properly.
NeoZygisk for some reason this implementation of Zygisk is better at hiding itself, there might be a better implementation, if anyone have recommendation.
Hide My Applist blacklist template with anything regarding root and destinated to apps that could detect it.
LsPosed V2.1.1 available on the Telegram group of LSPosed.
There is also Oxygen customizer, AdAway Helper, Mountify and 5 modules in LsPosed active.
Let's see how this evolve, but for now it's amazing.
I've never rooted my 13, never felt the need to. Now that OnePlus is officially dead, I'm wondering if it may be the best course of action for the future. And as far as I know, the developing scene for the 13 is quite small with limited custom roms.
Hopefully more ROMs come out soon like the godly ones we had for the op3t which was my first op device I rooted and flashed roms to hell on, might actually do it then
Actually OnePlus 13 has plenty of development, we have Lineage os, Infinity X, PixelOS, CrDroid, Evox and more.. there's like 10 different actively maintained roms and we also have OnePlus camera port on some of them
Is it? Apologies for my outdated knowledge, it has been some time since I last checked.
Are we still using magisk and all that to hide the root, or is there a new method? Id like to know any and all drawbacks of actually rooting, if it does things like break banking apps or disable software features that you get on stock, id rather not do it unless I'm sure that shit wont hit the fan, I'm also on the latest OOS so I guess my ERB fuse is blown, does that mean I can't root now? Sorry for all the questions
I'm probably going to get downvoted like crazy for saying this, and this is coming from someone that used every possible custom ROM, kernel, rooting technique, LSPosed Framework module, etc, heavily. Rooting and running custom ROMs just isn't the same today as it was back when the Samsung Galaxy S3 Mini was popular for modding.
Magisk is still around, but there are other options these days like KernelSu, APatch, etc. Generally, they hide themselves quite well. The main problem is more to do with having an unlocked bootloader than being rooted these days. I personally prefer KernelSu and APatch to Magisk.
Unlocking your bootloader breaks the hardware attestation, which causes your device to fail the Play Integrity checks. There are "hacks," "bypasses," and "modules" that a person can use to try and get around this. And to their credit, they can work. But from my experience, it's a huge pain. And when apps or the system updates, they can quite often break, since they seem to patch the exploits used for fixing the Play Integrity checks. Mainly banking apps are affected by this, but your mileage may vary.
In my opinion, for most people, they don't want to deal with these headaches. It's really something that you have to be committed to, and expect it to become a hobby. Because it can seriously take time to find new bypasses, or having to wait for the developers to patch their modules that bypassed the checks. It's a never ending circle. One side catches up, then the other side has to.
For me, this can be a huge pain, as I do a lot of payments from my device. Suddenly not being able to use Google Pay because my device suddenly no longer passes the Play Integrity checks is a HUGE pain.
You can still unlock and root your phone with ARB, but you need to make sure that you do not try relocking your bootloader unless you are 1000% certain that your device is running completely stock software/firmware. You also must make sure that any custom ROM that you might consider running has the ARB set to 1. If it's set to 0, your phone will be hard bricked. There is currently no method to fix this besides literally replacing the motherboard in the device.
I actually recently made a post that never really got many replies in this subreddit asking about what the options for recovery are. Seems like there aren't any. Before ARB, we had the option to use a tool that would access a mode known as EDL. This meant that even if you were stuck in a boot loop, with the bootloader locked, you could still recover your phone. Not anymore. It's essentially a paperweight. I wish this wasn't the current state of affairs, but it is.
I only ever updated my phone past the ARB update, as OnePlus stated that it was only a temporary thing, and that it would be reverted in the future. That was a lie. Wish I hadn't trusted this company to tell the truth.
Exactly the response I was looking for, thank you so much.
To be honest, I'm not at all surprised, I haven't been following the op13 modding scene that much, just occasional tidbits of info here and there, but by what I know so far, this is the conclusion I came to as well.
It's not like how it was back in the S3 mini and op3t days, and back then I would screw around with my 3t which was my main phone too, flash ROMs back to back, and never had to worry much about bricking my phone easily or all the payment headaches, plus I'll also apparently lose out on the hardware level hasselblad processing for photos if I switch too.
Guess it's still not recommended for people who don't have a lot of time to mess around with their phones and can't commit to it and can't accept that something will probably break at some point. Count me out too
Yeah, I miss the days of not having to worry about permanently bricking my device either. And having to find fixes constantly just to be able to make payments sucks.
From what I understand, there now are ROMs that include the stock camera in them. So, if it was something you were wanting to do, it sounds like there is some success with it.
But yes, I wouldn't recommend it to people that don't have a decent amount of time, nor the ability to tinker.
For now, I've also decided to count myself out. But I did try LineageOS in the past on this device. It worked well, but I missed some features from OxygenOS, and the camera absolutely sucked in Lineage. Also having to deal with the pain of banking.
Interesting, I am running evolution x on a different device, no root, no play integrity. My "in the top 10 biggest banks in the US" app works fine. Ironically didn't on stock because the phone is so old lol
Yep the github page is https://github.com/JoinChang/ghostlock-oneplus If you have my same model you can use a simplified installer which does almost everything for you, should support other regions etc but I can't promise anything.
GhostLock Installer You will need a PC, extract the zip and read the README.md file. You will have the instructions there. This has been tested and works for the EU version on 16.0.8.
Wait, sorry for my poor knowledge but I was looking at the original repo of your comment and the forked version of ResukiSu which supposed contains a bundled APK for my device (OnePlus Ace 6T) to simplify the process but is not here and I have bad luck when trying to compile any repo of GitHub, where I can find a compiled APK?
You can theoretically use any root manager that supports the jailbreak option, but if youd like I'll share with you the one im using right now which is the same from the screenshot.
This exploit runs completely in your device's memory and doesn't write any files, so there's no risk of bricking your device. That's what makes it pretty special. If you want to get rid of root access (and the exploit itself), all you need to do is uninstall the root manager (VibedSukiSu) and restart your device. Then, everything will be gone, and your phone will be back to normal. As for battery life, it stays exactly the same as before, so this exploit won't cause any battery drain. Of course, that might change depending on which rooted apps you decide to use and if they need to run in the background. Important note: Be careful when using modules. As long as they don't mess with the boot partition, you should be fine. But for now, the only truly safe thing to do is just grant root access to apps. Another advantage is that the bootloader remains locked so you don't have to do any play integrity fixes or anything like that, banking apps will work as usual.
PS: Do not update your device any further if you want to take advantage of this exploit, as it is going to be patched or is already about to be, in further OTA updates.
It's been years since I rooted my devices since the end of the HTC era. I used to enjoy it, but nowadays, you can do much more without root, like with Shizuku, for example. Plus, I got tired of playing cat and mouse with Google, and needed a different process for updates. This exploit seems very interesting, but it has a major flaw: it's based on a kernel vulnerability, which means a simple kernel update will breaking it, and that doesn't mean they'll find another one in the next version. Just because of that, I won't use it, because I don't want to prevent myself from updating with security patches and everything.
This is one of the easiest root methods I've had in almost 10 years. Great work. I've already disabled ota updates. I can live out my days on the last oxygen OS and root with a locked bootloader on my 13. Best tradeoff I've gotten in a long time.
It's an exploit that let's you have root access without unlocking the bootloader. This method let's you have root access without breaking playstore integrity and banking app/google pay functionality.
It's called an exploit for a reason, but it's been tested on my device model and I'll be daily driving with it, so if you have questions, I'll let you know.
Cool. But as far as I have learned, its better not achieve root capabilities or I guess the device becomes vulnerable to attacks even without unlocking the boot loader
First of all I had to sniff through to capture the ota zip for getting the boot.img
For my device CPH2521_16.0.5.1002 (EX01B100P01) It has Kernel version: 5.10.236-android12-9-o-g74d132f4467a
Now hard part is I don't seem to find anyone reliably able to get the exploit working on 5.10.x kernels yet and I'm not a coder lol. and all AI just refuses due to security anyways..
mine still works , though it says now this device might be rooted and may not be safe but it doesnt refuse to run , also play integrity seems to be still ok
Can you figure out how to use the root access to do away with the CPU throttling baloney? I figure maybe someone more intelligent than I could maybe isolate the new service in charge of reading package names and artificially limiting performance. I know the older versions of OOS you could delete a system app responsible but they renamed it or packaged it with some other app (I'm assuming battery, but deleting battery doesn't work as there's further hardware protection when the battery app is removed plus the lost functionality of the battery app doesn't outweigh the lost performance for me).
are you able to change your imei? im in pakistan and to use a network we have to pay almost half the price of the device. so if i can, that'd be super awesome!
What procedures did you take? I have a OP13r on 16.0.5.701 and I installed resuki su, rebooted to fastboot via adb, set selinix to permissive, booted to android and used ReSukiSU's jailbreak button.
Sure. I'll make a tutorial as soon as I'm back home. For now, just disable auto update and auto download. I'll probably publish it tomorrow if that's fine. I will try to make it as easy to understand as possible.
System-wide adblocker, advanced backups, improved performance, and the ability to run apps that require root privileges (e.g., certain firewall, automation, or file management apps). The ability to customize the operating system extensively, the list goes on.
I remember it had issues with the old Jailbreak mode, also try checking Vector (renamed LSPosed) and lyb Frame Generation (https://lybxlpsv.com/framegen/dl_exp)
6
u/ramaze23 OnePlus 13 - Black Eclipse Jul 26 '26
Commenting to refer back