Investigation is closed. Working fork: https://github.com/soumarcelino/Root-My-Galaxy-SM-S918B
PLEASE READ BuSung-dev/Root-My-Galaxy-Payloads#160
This repository documents ongoing research into an ARM64 kernel from the Samsung Galaxy S23 Ultra and the work required to adapt GhostLock techniques to a specific firmware build. It is not a finished exploit or a one-click tool. At this stage, the repository contains target-specific offsets and research notes.
The project follows a simple rule: every value should trace back to evidence that can be checked. A symbol address, structure layout, or crash diagnosis is not treated as fact merely because it looks plausible in a decompiler.
| Property | Value |
|---|---|
| Device | Samsung Galaxy S23 Ultra, dm3q / SM-S918B |
| Build | S918BXXSAFZF5 |
| Android version | 16 |
| Fingerprint | samsung/dm3qxxx/dm3q:16/BP4A.251205.006/S918BXXSAFZF5:user/release-keys |
| Architecture | ARM64 |
| Kernel text base | 0xffffffc008000000 |
| Physical base | 0x80000000 |
| Physical kernel load address | 0x80080000 |
The active constants are stored in src/offsets/target.h.
.
├── src/offsets/
│ ├── target.h # active Samsung target
│ ├── 5.10.h # reference OPPO target, kernel 5.10
│ └── 5.15.h # Xiaomi reference target, kernel 5.15
├── notes/ # intended for reports and a hypothesis log
└── guided.md # ARM64 and kernel reverse-engineering plan
The 5.10.h and 5.15.h files do not describe the active Samsung build. In particular, 5.15.h contains values explicitly marked as placeholders and must not be treated as a verified target profile.
The active profile uses _text at 0xffffffc008000000 and currently defines the following entries:
| Symbol | Address | Offset from _text |
|---|---|---|
commit_creds |
0xffffffc008120104 |
0x00120104 |
ashmem_ioctl |
0xffffffc00914c6dc |
0x0114c6dc |
ashmem_fops |
0xffffffc00a00d5b8 |
0x0200d5b8 |
kmalloc_caches |
0xffffffc00a064578 |
0x02064578 |
Additional addresses and layouts are listed in target.h, but they do not all carry the same level of confidence. Some come directly from symbols, while others describe structure fields or exploit-specific memory layouts. Before using any of them on a device, verify the value independently against your own matching kernel artifacts, disassembly, or observable runtime state.
This project is intended for education and authorized research on devices you own or have explicit permission to test. Kernel experiments can cause data loss, boot loops, or require a reflash. Use a dedicated test device, keep backups, and never carry offsets across firmware builds without revalidating them!
Original code and documentation in this repository are licensed under the Apache License 2.0.
Extracted kernel artifacts, generated representations of kernel data, firmware-derived files, and other third-party material remain subject to their respective copyright and license terms. The Apache License does not relicense those materials or grant rights that their original licensors have not provided.