Root My Galaxy Payloads

This repository contains the device-specific native side of Root My Galaxy:

• exact firmware profiles and offsets;
• the app-domain CVE-2026-43499 exploit source and compiled payload;
• the app bootstrap helper source;
• the verified KernelSU late-load build artifacts;
• the support feed consumed by the application.

It intentionally does not contain Android application source code.

Supported payloads

The S916B FZG1 profile is shell-only today. Its exact tracefs route works from adb shell, but direct app-domain execution is not supported. Root My Galaxy would need to delegate the native runner through an authorized shell bridge such as Shizuku. See artifacts/dm2q-S916BXXSAFZG1/README.md.

The S918B FZF5 profile is hardware-verified through the app's Shizuku mode (exploit, KernelSU late-load, granted su under enforcing). Its physical-P0 fallback also engages in unprivileged app-domain execution, but rooting without Shizuku is not yet hardware-confirmed. See docs/SM-S918B-S918BXXSAFZF5.md.

Schema version 3 keeps each exploit and KernelSU artifact once. Its flat models and kernelVersions arrays define runtime compatibility. See support/README.md for the matching rules.

The port is based on the exploit source published at https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499/exploit.

Feed delivery

Root My Galaxy resolves the payload repository's current commit first and fetches support/targets-v3.json and every artifact from that immutable commit. Per-artifact SHA-256 fields and manifest signatures are not part of schema version 3. targets-v2.json is retained for released 0.2.3 clients.

Build

make TARGET=pa3q-S938NKSUACZF1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e3q-S928USQS6DZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e2s-S926BXXUEDZDR ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e1s-S921BXXSFDZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a15-A155NKSS6BYH1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-A566EXXSCCZG6 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a36xq-A366WVLS3AYG1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a53x-A536EXXSNGZG3 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=dm3q-S9180ZHS8FZF5 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=dm2q-S916BXXSAFZG1 ANDROID_NDK_HOME=/path/to/android-ndk

Outputs:

build/<profile>/cve-2026-43499
build/<profile>/cve-2026-43499-app.so
build/<profile>/cve-2026-43499-root

The release app payload is built with:

make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk release

The complete firmware-to-profile procedure is recorded in docs/PORTING.md. Samsung-specific KernelSU changes and versioned artifacts are documented in kernelsu/README.md. The exact S921B DZF2 analysis is recorded separately in docs/SM-S921B-S921BXXSFDZF2.md, and the S928U/S928U1 DZF2 analysis is in docs/SM-S928U1-S928U1UES6DZF2.md. S921B is an Exynos 2400 target and is not a Qualcomm/Snapdragon reference for E3Q. The 5.10 A15 analysis is in docs/SM-A155N-A155NKSS6BYH1.md. The SM-A566E CCZG6 analysis and validation record is in docs/SM-A566E-A566EXXSCCZG6.md. The SM-S926B DZDR analysis and device-validation record is in docs/SM-S926B-S926BXXUEDZDR.md. The SM-A366W AYG1 device validation is in docs/SM-A366W-A366WVLS3AYG1.md. The experimental SM-S916B FZG1 shell port and its exact hardware evidence are in docs/SM-S916B-S916BXXSAFZG1.md. The SM-A536E GZG3 device validation is in docs/SM-A536E-A536EXXSNGZG3.md.

Use only on devices you own or are explicitly authorized to test.