Quick POC using NebuSec CVE-2026-43499 to root my bootloader locked US S25 (SM-S931U1). Btw this works on latest fw. This phone is Android 16, June update. I have detailed notes on flashing, exploitation, offset finding etc, blog post later 🖖

Btw, this is mostly me working with my AI friend and I would say my AI friend is the real kernel expert here, I'm just a poor userland guy 🤣 Capabilities are hard-scaling, it's true

@nebusecurity PR this repo!!

I want to shout-out @misakazip who gave me this idea in the first place exploiting his Xiaomi 15t Pro 🫶 Also big thanks to BuSung and fusiondrive who have KR fw exploits I used for reference, I plan to make some pr's later!

@nebusecurity Here is it being demonstrated on my Galaxy A56 too!

@nebusecurity 🤝

@nebusecurity I tried it on my A54 but my exploit could only trigger a crush 

@nebusecurity Amazing work, can't wait for the blog post!

@nebusecurity 👏 looks like pwn2own prep 😉

@nebusecurity nawww, we'll leave that to the people who want to go there 😉, ironically though I bought this device last year for p2o prep but didn't realize the bootloader issue lol

@nebusecurity Would love to test this on my Samsung s24 ultra. Think this could work on SM-S928U?

@nebusecurity it will work anywhere for now

@nebusecurity Wow! Amazing!

@nebusecurity and i steel need my 15pro max jailbreak tool haha

@nebusecurity How to setup Samsung in Emulator like this? @FuzzySec

@nebusecurity Is there anything for the S21u?

@nebusecurity Is this out yet?

@nebusecurity Did you manage to make it work on s26 kernel 6.12 ?

@nebusecurity It should work anywhere but exploitation varies by device

@nebusecurity I know it should work. And i manage to make it work on the s25 kernel(6.6) same as yours. But on the s26 newer kernel (6.12) adds a hardening that blocks both leak methods (the heap-spray leak and the boot_id leak need for the kernel’s physical-load address)