Support for vivo S15 Pro (PD2207) - no code cave in libc++.so

[liyabl]

Hi @diabl0w,

First of all, thank you for your awesome work on DFRoot.

I'm trying to root my device using DFRoot v4.5, but it fails during the patching stage.

Device details:

• Model: vivo S15 Pro (PD2207)
• Android: 14
• Kernel: 5.10.233-android12-9-g0267c354d6b4-dirty

Log output:
=== exploit (patching files) ===
patch: crash_dump64 <- splicehelper (1408 bytes)
patched 1408 bytes to /apex/com.android.runtime/bin/crash_dump64+0x0
Using KMI: android12-5.10
patch: /vendor/lib64/libbinderdebug.so <- dfroot.ko (13104 bytes)
patched 13104 bytes to /vendor/lib64/libbinderdebug.so+0x0
Finding symbol offsets for /system/lib64/libc++.so:
shellcode (464) exceeds tail-page slack (112 bytes)
no code cave large enough (need 464, largest found 14) - DEVICE NOT SUPPORTED
failed to find offsets for /system/lib64/libc++.so
patch: ERROR - failed to patch files

I've done some analysis:

• The exploit chain successfully patches crash_dump64 and libbinderdebug.so.
• The final step fails because it needs to inject 464 bytes of shellcode into /system/lib64/libc++.so, but vivo's firmware heavily optimizes this library and leaves almost no alignment padding (only 14 bytes available).

Is there any plan to:

1. Support a custom injection target (e.g., /vendor/lib64/libvivo.vaf.utils.so)?
2. Add a fallback mechanism to scan for code caves in other libraries?
3. Or should I wait for a future update?

Thanks a lot!

[diabl0w]

this is being tracked in #99

I am certainly keeping the issue open because the issue is clear and generally has a clear solution. however the solution requires a somewhat substantial rewrite of the codebase. I have no immediate plans to tackle this and would prefer for someone to make a pull request for it.

[diabl0w]

this should actually be easier than i anticipated... working on it

[liyabl]

@diabl0w Replying to your comment above: I've got this working on the #145 device. The key is not forcing libc++.so; switch the shellcode host.

Device / firmware:
vivo S15 Pro (PD2207 / V2207A)
PD2207_A_14.2.11.5.W10.V000L1 / Android 14
kernel: 5.10.233-android12-9-g0267c354d6b4-dirty
SELinux remains Enforcing; seccfg untouched

Working patch sequence:
crash_dump64 <- splicehelper (1408 B)
/vendor/lib64/libbinderdebug.so <- dfroot.ko (13776 B)
Found: hook=0x18c30 shellcode=0x40a10 len=1040
/system/lib64/libbase.so <- shellcode (1040 B @ 0x40a10)
/system/lib64/libbase.so <- trampoline (16 B @ 0x18c30)

After triggering, logcat shows:
libbase: loading custom module
hook: worker child alive (init domain)
hook: ko file opened (vendor_file read ok)

Verification:
adb shell su -c id -> uid=0(root) ... context=u:r:ksu:s0
/dev/dfm0 … /dev/dfm6 all present; KernelSU modules load fine
finit_module failed: other errno / EEXIST is expected here (already loaded)

One more gotcha: the embedded ko must match this kernel's vermagic and __versions CRC (e.g. module_layout=0xbc01ead0), otherwise it fails with ENOEXEC.

Suggestion: when libc++.so has no large enough cave, add a fallback/candidate injection target (e.g. libbase.so, or a user-configurable target) instead of immediately returning DEVICE NOT SUPPORTED. I can post the full logcat/build diff to #99, or prepare a PR if that helps.