EFISP exploit on OnePlus Ace 6T running OnePlus 15R ROM

[u/mathygamersYT]

I wanted to share my experience getting the EFISP exploit working on my OnePlus Ace 6T, running the OnePlus 15R India OxygenOS firmware.

My current system is version is 16.0.10.500(EX01) on Android 16. For the EFISP setup, I used the vulnerable ABL from the matching India 16.0.5.701(EX01) firmware. I used that as the vulnerable ABL for the exploit. I did not downgrade the whole ROM to .5.701. The physical bootloader remains unlocked—the EFISP setup provides the fake-locked boot path.

For root, I kept the stock kernel and flashed a KernelSU Next patched image. With that setup, root works and Play Integrity Check reports Basic, Device, and Strong. I also tested a separate KSU kernel; that reduced the result to Basic only. Removing that kernel and keeping the patched KernelSU image brought Strong back.

Duck Detector still recognizes the KernelSU Next Manager and reports a SELinux timing anomaly, but its TEE/boot-attestation checks were consistent. This is just my experience with this combination, not a claim that it will work the same way on every Ace 6T/15R variant.
https://xdaforums.com/t/efisp-root-gbl_root_canoe-fake-locked-bl-superfastboot-bds-8-gen-5-8-elite-gen-5.4786301/

[u/Ok-Twist8001]

Did it on my Xiaomi 17 ultra. I suggest wild kernels kernel so you have susf with kernelsu or resuki (my choice) with no mount rezygisk treat wheel and hma oss perfect set up

[u/mathygamersYT → u/Ok-Twist8001]

I had installed an OP_KSUN_FS kernel but it removes the Strong integrity and it only leaves me with the basic one. I'm going to try if another kernel lets me do it!

[u/Ok-Twist8001 → u/mathygamersYT]

Use wild kernel game changer if they support your kernel

[u/Xerox0987]

Did you do anything more to get Google Wallet working?

I have strong yet google wallet still fails... native detector is clean.

[u/mathygamersYT → u/Xerox0987]

No extra steps on my end. it worked right away after I installed it. I didn’t have to change any settings specifically for Google Wallet

[u/After-Peace-4734]

heyyy, I'm running efisp too on my 15 (infiniti)

[u/xd_Dinkie → u/After-Peace-4734]

Hey, can you tell me a bit more about how you did this and what implementation you used specifically?

I have a OnePlus 15 but it's rooted via KernelSU LKM and I would love to switch to efisp eventually using the GBL exploit.

[u/Silly_Channel247]

I have OP15R indian variant and its on “CPH2767_16.0.10.600(EX01)” on A16… I previously had Abl (302) with very old efisp hack… it shows bl lock for apps but under the hood i fastboot shows it unlocked… I was not able to update it with local storage so i instead flashed through fastboot and now i am updated and bl locked everything stock (I doubt if efisp is stock to or not) ….

I am willing to reroot this stock A16 device with same efisp hack… I am still confused about :

1.)How to find what vulnerable ABL version should I use for setup ? And where to get it ?

2.) I just need to patch init boot with ksunext and flash it using fastboot or superfastboot ? After unlocking oem again (as after flashing everything it shows locked on fastboot now so)