Root My Pixel

Root My Pixel is an Android application designed to automate root access on Google Pixel devices leveraging the NebuSec IonStack exploit (CVE-2026-43499) and integrating ReSukiSU / KernelSU.

---

How the Application Works

Root My Pixel lets you temporarily gain root access with ReSukiSU in just one tap.

Installation Workflow

1. Device Detection & Profiling

   • At startup, the app uses native JNI (NativeProbe), /proc/version queries, and system properties to detect the device codename, kernel version, CPU ABI, memory page size, and build display ID.
   • Via ResolveTargetUseCase, it matches the device details against supported target profiles defined in assets/profiles.json.

2. Shizuku Integration

   • The app uses Shizuku (UID 2000) to acquire ADB shell privileges without needing initial root access, which is required to stage and execute payload binaries in /data/local/tmp.
   • A managed ExploitService is bound via Binder IPC to stream exploit execution logs to the UI in real time.

3. Exploit Payload Extraction & Execution

   • Precompiled binary payloads (.so) corresponding to each supported build and the native helper tool (libcve43499root.so) are extracted from APK assets to /data/local/tmp.
   • The IonStack exploit (CVE-2026-43499) is executed to establish a local root daemon socket (temp_su.sock), acquiring full root privileges.

4. KernelSU / ReSukiSU Integration

   • Staging of the ksud binary matching the device's Kernel Module Interface (KMI, e.g., android15-6.6).
   • The app triggers the KernelSU late-load mechanism (ksud late-load --kmi <kmi>).
   • Verifies KernelSU through its UAPI, with ksud debug info and /proc/modules as compatibility fallbacks.
   • Registers the installed ReSukiSU Manager only after validating its production APK signature.

5. User Interface & Management Tools

   • Real-time live log progress monitoring.
   • Handy actions for Soft Reboot (restarting system_server) and Log Exporting for debugging purposes.

---

Supported Devices & Build Profiles

---

Prerequisites

1. A supported Google Pixel device listed in the table above.
2. Shizuku installed and running via ADB (adb shell sh /sdcard/Android/data/rikka.shizuku/starter.sh or Wireless Debugging).
3. ReSukiSU Manager installed on the device to manage root permissions granted to apps.

---

Building from Source

To compile the entire project (native helper, exploit payloads for all targets, and the final debug APK):

Build Requirements

• Android NDK r25+ (ANDROID_NDK_HOME set or present in Android SDK)
• macOS (arm64/x86_64) or Linux (x86_64) host
• Java 17+ and Gradle Wrapper

Build Command

./build-all.sh

The compiled APK will be generated at: app/build/outputs/apk/debug/app-debug.apk

To install it on a connected device via ADB:

adb install -r app/build/outputs/apk/debug/app-debug.apk

⚠️ Keep in mind that the exploit does not have a 100% success rate. Many users have had to try more than 20 times. Many report higher success by opening the app immediately after a reboot, while others find better results 10–40 minutes after rebooting.

🚨 If you root your phone, you might run into trouble making payments with Google Wallet and using RCS messages. Once you unroot, you'll have to wait a couple of days before everything works properly again.

---

Credits

• Exploit: NebuSec IonStack
• App architecture: Inspired and adapted from Root My Galaxy
• ReSukiSU (https://github.com/ReSukiSU/ReSukiSU)