👻 Root your Android WITHOUT unlocking the bootloader — gone on reboot

Tutorials & Methods
, ,
1

:ghost: Root your Android WITHOUT unlocking the bootloader — gone on reboot

ghost root: the bootloader stays LOCKED, root works for one boot session, a restart washes everything away — your warranty never notices

root your android like a ghost
root your android like a ghost1200×900 273 KB

no unlock · no flash · no traces · reboot = back to stock

a public kernel bug (CVE-2026-43499) gives admin power for one boot session, with KernelSU riding along — this is the open-source project that packs it into one run (542​:star:, GPLv3)

  [LOCKED PHONE] ──▶ [KERNEL BUG] ──▶ [ROOT · TODAY]
   bootloader         one public       KernelSU loads
   stays locked       CVE, run once    gone on reboot

▁ ▂ ▃ what the ghost can do ▃ ▂ ▁

:puzzle_piece: KernelSU modules — real root powers while the session lasts, no bootloader touched

:bank: banks see a stock phone — locked bootloader, reboot-clean… but that’s “usually”, not a promise: test your bank first

:shield: warranty stays intact — no unlock flag, no eFuse trip, nothing flashed, ever

▁ ▂ ▃ does your phone have a ghost? ▃ ▂ ▁

phone ghost status
:1st_place_medal: POCO X7 Pro / Redmi Turbo 4 :white_check_mark: the verified target (repo)
:mobile_phone: Xiaomi 17 / Pro / Ultra :white_check_mark: full Android 16 port (popsicle)
:flexed_biceps: Redmi K70E :white_check_mark: one-click flow (duchamp-root)
:robot: Samsung · Pixel (GKI 6.12) :hammer: in progress (S26)
:selfie: Pixel 6 → 11 :hammer: community profiles (Root My Pixel)

same model name is NOT enough — every port needs your exact firmware build, matched by hash

▁ ▂ ▃ the honest fine print ▃ ▂ ▁

:repeat_button: reboot = clean — the ghost leaves, stock returns, unroot = reboot + delete payload + revoke ADB

:door: the bug cuts both ways — until your kernel is patched, that same door exists for bad apps: use a spare phone, not your main one

:balance_scale: banks: usually, not guaranteed — hardware checks on Android 13+ can still notice a modified session (Play Integrity)

:fire_extinguisher: images come from official OEM packages only — Google’s OTA sideload needs no unlock; wrong-firmware experiments are how bricks happen

Root like a ghost: in, do the thing, reboot — and the phone never knew.