diabl0w/DFRoot

What DFRoot does

DFRoot targets Android devices and exploits CVE-2026-43284 (DirtyFrag), a kernel page cache write primitive, to load its own kernel module and obtain root. It does not need an unlocked bootloader and is designed to work with any KernelSU-compatible SU manager rather than a specific vendor tool.

The mechanism works by abusing AES-CBC ESP packet decryption into the page cache of spliced files. With a crafted IV, the tool overwrites 16-byte-aligned blocks of libc++.so without write permission or copy-on-write. Shellcode patched into a hooked std::ostream function then runs when init reaps an orphan process, loads dfroot.ko through insmod, sets SELinux permissive, and starts the su daemon from the installed SU manager. The README lays out the full chain in six steps: IPsec transform setup, splicehelper execution through crash_dump64, writing the kernel module into a vendor_file, the libc++ hook, dfroot.ko init, and bootstrap (Exploit chain).

Quick start

1. Download and install the latest DFRoot release.
2. Install a compatible SU manager: Samsung devices use diabl0w's KernelSU; other devices can use KernelSU, KernelSU-Next, or KowSU.
3. Run DFRoot and check the log. A patching failure means the device is not vulnerable; a success message should produce root through the installed SU manager.

On the build side, the repository uses make and expects an Android build environment with a kernel module toolchain. The README does not list prerequisites such as NDK version, kernel headers, or target kernel versions, so building from source requires filling that gap yourself before you can run it.

Constraints

The tool only works on devices whose kernel still contains the vulnerable behavior. Newer kernels that include the official mitigation, or ones with an accidental mitigation (typically on kernel 6.1), will report patching failure. If success is reported but root is missing, the README points to disabling Auto Soft Reboot or to an existing discussion thread. Module failures are recovered by disabling KSU modules in the settings; bootlooping after enabling Start at Boot usually requires safe mode to disable those options. The README also warns that the author is not responsible for device damage.

The exploit modifies kernel state, writes to vendor_file paths, sets SELinux permissive, and bypasses DEFEX where applicable. These are invasive changes that can affect system stability and security posture. The project is licensed under GPL-2.0 and credits the original PoC and related code from LSPosed's lspromise, polygraphene's DFReroot, and combeng6th's DirtyInit.

HotRepo's take

DFRoot has 826 stars and 418 forks, but no daily ranking or time-series growth data is attached, so its standing on HotRepo's boards cannot be compared over time. The repository's content is unusually concrete for a security tool: it documents the full exploit chain and names its dependencies, which makes the implementation reviewable. The main uncertainty is distribution rather than explanation — users install a prebuilt release, and the README does not describe how that artifact maps to the source tree or who signs it.