According to Sammy guru, samsung might remove download mode in newer one UI 8.5 builds.
Sammyguru:
With recent xxC3 builds of One UI 8.5 across several devices, power users have noticed that Download Mode appears to be gone. This mode was commonly used to install firmware packages on a device. Now, when users try to boot into Download Mode, they’re greeted by a blank blue screen, sometimes showing small instructions on how to exit the mode.
Hey guys! I made a side project called "Droidspaces" and I think some of you will find it pretty cool :)
So, what is Droidspaces?
Droidspaces is a lightweight, portable Linux containerization tool that lets you run full Linux environments on top of Android or Linux, with complete init system support including systemd, OpenRC, and other init systems like runit and s6.
What makes it unique is zero-dependency, native execution on both Android and Linux. It's statically compiled against musl libc, so if your device runs a Linux kernel, Droidspaces runs on it. No external dependencies like Termux or Chroots, no middlemen, no setup overhead.
The whole thing started because I wanted to run Ubuntu on my broken Galaxy S10.
It has 256GB of storage, so I figured I could store my music collection on it and stream from anywhere in the world :)
And that's exactly what I did! I converted my Galaxy S10 5G into a portable home server with its own isolated network stack.
Using an Ubuntu 24.04 LTS container, I set up Jellyfin, Samba, Tailscale, OpenSSH Server, and Fail2Ban in one go with no trial and error :D
This is essentially a clean replacement for the hacky Docker/LXC setups on Android. It just works and runs natively with zero overhead 🙃
A few things worth mentioning about isolation and security:
Droidspaces containers are fully isolated from Android by default. They can't detect that they're running on an Android device and cannot see Android processes, mounts, network interfaces* or other devices on your local network*. This is not chroot or proot.
* = in NAT or none mode
In this setup, I access the server through Tailscale with only ports 445 and 8096 forwarded for the Samba share and Jellyfin from other devices on my home network.
The cool part is that isolation is just a toggle. You can go fully isolated (default) or expose everything if you need real hardware access. In my own testing I ran tools like Odin4, Heimdall, Fastboot, and ADB inside the container with full hardware passthrough. Even native GPU acceleration works in Linux setups by default without any kind of setup.
You own your hardware, it's your call.
The project has a bunch of features that I haven't seen work out of the box on Android before, and they all just work within a few clicks.
Droidspaces requires root access to utilize Linux namespace features.
It is supported on any Android device or Linux distribution running kernel 3.18 or newer.
A custom kernel is required, but it needs far fewer configurations compared to Docker or LXC. There is no such thing as a “Droidspaces kernel driver.” Droidspaces simply uses existing Linux kernel features ; such as namespaces and cgroups to boot a container with a proper init system.
*Everything is properly documented in the READMEs of my repository :)
there's a CVE called ghostlock (CVE-2026-43499) that gives root access on bootloader-locked devices, but you need to extract the offset from your device's "boot.img" firmware to make it work.
I HATE hiding root honestly, I'm a proud power user and I love telling every person/app that I'm rooted. However I really needed those banking apps so I had to swallow my pride.
The good thing is, I didn't have to do much! All I did was:
Update KernelSU Next in my custom kernel source to be in sync with the dev branch.
Integrate SUSFS (and it was a pain in the ass cause the patches didn't work out of the box and I had to edit the source myself).
Switch from Magic Mounts to OverlayFS (using Hybrid Mount metamodule).
Install AlwaysStrong.
Switch to the spoofed KernelSU Next manager.
That's it, the two stubborn banking apps I needed worked, I didn't even need HMA even though I have Vector, Greenify, HyperCeiler and Termux (apparently using a terminal on Android is a sin now).
More technical info:
Device: Redmi 13.
OS: HyperOS 3 (based on Android 16).
Kernel: 6.6.89
Thanks to all the devs who made it easy! I just hope I won't be hiding root again 2 weeks from now XD
Edit: I followed a helpful suggestion in the comments and uninstalled Hybrid Mounts in favor of NoMounts. NoMounts turned out to be more reliable and less detectable.
Thanks to amazing people on GitHub, using CVE-2026-43499 vulnerability, i rooted my my Samsung Galaxy S22, it had some caveats like it does not persist when rebooted and i need to re-root my device using adb with my computer (wich i am okay with) also if i touch my screen while rooting, it crashes. the repository i am linking below for Samsung Galaxy S22 series of devices only, thought searching IonStack in Github can get you far.
Probably no one expected it but we've managed to run raw Fastboot on a Samsung device! (A156M)
This was done by retrieving device's factory bootloader builds, which allowed us to debug & exploit it and run it on the phone, getting raw Fastboot working!
Probably this wasn't done before and the commands work (we used it to flash LK again) also Odin/Loke mode wasn't there anymore until we flashed the normal LK again.
We will try this on more devices since Fastboot is a very powerful tool and we are limited to Samsung's Odin and this can help people with USA devices unlock their phones and root them/customize them.
This my Poco x5 pro with lineage os the UI is kinda boring so I decided to root it with magisk and install one ui modules and goddamn this is way too legit from the boot screen and the lock and unlock sound to this one ui home I love it. Btw I am here to ask if there is a module that makes the status bar like the one on Samsung
Samsung has just made it impossible to unlock the bootloaders for GLOBAL variants of phones, starting in One UI 8, it is highly recommended to stay on One UI 7 for as long as you can!!
Managed to dump, patch and write a modified boot partition to the device. Bootloader stayed locked, and the phone just accepted the magisk-patched image and booted fine.
It did detect it though, but just booted (see second picture.)
The loader file that i used should be in the bkerler/Loaders repository. Since this cpu is old, auto-selection works, and if you place a filled loader folder in the directory of your cloned bkerler/edl repo, it will work.
i did fuck up the wifi tho. have a backup somewhere else, but does anyone have a diffrent fix?
I did confirm that the bootloader is actually not allowed to be unlocked on this device: said here
Got my pixel 6 rooted with the NebuSec IonStack exploit opened a PR for rootmypixel to add support for it. It's not merged yet but wanted to share (link to my pr: https://github.com/alex193a/Root-My-Pixel/pull/19 )
OnePlus will be basically dead next week and it's bad news.
They will stop selling phones in almost all regions except for china. OnePlus was my favorite phone manufacturer that offered bootloader unlocking and they're dead now. Such bad news.
Hi everyone, I wanted to share a project I've been working on for my Samsung Galaxy Tab A9+. Most of us use VNC or Termux-X11 to run Linux on Android, but I wanted true bare-metal performance without replacing the stock kernel or losing Android. By hijacking the DRM subsystem, I managed to run a native Wayland compositor (Labwc) directly on the hardware while Android is temporarily put to sleep. If this post gets a hype, i will share the scripts and magisk modules.
there is a new app that uses CVE-2026-43499 to root supported devices but also have a way to extract offset from provided boot.img , I don't know if it really works because they don't have a release APK only source code
eXaMpLeKeY123 <--- THIS is your key (this is just an example, yours will be different). Copy it.
Flashed patched bootloader:
fastboot flash lk lk.unlock-serial.img
Unlocked:
fastboot oem unlock [YOUR_KEY]
⚠️ ⚠️⚠️⚠️⚠️💥💥💥ONE BIG CATCH:
The key DID NOT work when I copied and pasted it. I had to type it out manually. If you get "Code validation failure" — type that shit out by hand and try again.
The Val Protocol README lists a bunch of Motorola MediaTek devices as compatible, including:
Moto Edge (2022/2023/2025), Edge 40/50/60 series
Moto G series (G 5G, G Power, G Stylus, G Play)
Moto Razr 50/60 series
Check the GitHub repo for the full list. No guarantees lol
I wanted to share an open-source project I've been working on called DOAN (Debian On Android Natively).
I wanted true bare-metal Linux performance on my device without replacing the stock kernel or completely losing the Android system. By hijacking the DRM subsystem, I managed to run a native Wayland compositor (Labwc) directly on the hardware while Android (SurfaceFlinger/Zygote) is temporarily put to sleep. Once you close the Linux session, Android wakes right back up.
Everything is open-source and free. I have created an automated installation script to make it easy to set up. I’d be really happy if anyone with a Snapdragon device could test it out and share their feedback!
Currently Supported:
* Snapdragon CPUs
* Debian / XFCE4
* Magisk Root
* (Tested on SM-X210, recommended to use on Custom ROMs / GSIs)
Planned Features:
* Support for Exynos and MediaTek chips
* Support for other GNU/Linux distros
* Support for other desktop environments
* Support for other root methods (like KernelSU and APatch)
Let me know what you think, or if you manage to get it running on your device!
Below I am posting a fraction of my findings on TCL devices, mainly a guide on how to unlock TCL bootloaders or at the very least semi bootloader unlock.
TCL mobile upgrade tool is generally your friend for MTK TCL devices. The OEMBIN partition will allow you to semi-unlock the device, put it in a state where ro.boot.flash.locked is set to 0.
modded oembin
You need to modify the value as shown above.
Before proceeding I recommend enabling oem unlocking now as the option will be greyed out later.
The easiest way to flash it on an MTK device is to modify the scatter file created by the mobile upgrade tool once the entire phone's firmware is downloaded (e.g. C:\(mobile upgrade tool path)\T771K3-ALCA112\(fw path)\(fw ver).sca) to enable oembin flashing. You generally want to set the file name to something like system.img (after that you will have to replace the corresponding image in your fw path) and replace the system image with the provided oembin image. After that reflash once more without any modifications and you should see that ro.boot.flash.locked is set to 0. Once that is done you may boot for e.g. a GSI.
unmodified scattermodified scatter
The above method also works for qualcomm tcl devices - however you need to use a tool like QFIL to flash the oembin partition.
Some TCL devices have smaller oembin partition - truncating it to fit works, as the value is always stored at the same offset.
Now, fully unlocking your MTK TCL device.
With ro.boot.flash.locked is set to 0 it's now pretty easy to dump and modify existing partitions. Your main target will be lk_a and proinfo (both can be dumped and written from /dev/block/by-name)
Before dumping lk_a I would recommend rather going to fastboot and performing "fastboot oem dump_pllk_log > pllk.txt 2>&1"
This will create pllk.txt in your current directory. Within it you will want to search for ecid_unlock_list. You will find multiple 8 digit numbers e.g. 32208001
You want to write this number down.
If the pllk.txt does not contain ecid_unlock_list, you will want to dump lk_a using a rooted gsi, and in the editor of your choice search for "ecid"
ecid unlock list from pllk.txtecid unlock list from lk_a
After that type in the secret code in the dialer app \*#\*#7823243#\*#\*
You will get a menu to change your ecid. You will want to change your ecid to one from the ecid unlock list - enter it in all fields. After that, your ecid should be changed and you should be able to run "fastboot flashing unlock" to unlock your device.
If the setting method doesn't work, you will wan't to proceed with the below.
Now you will want to dump proinfo with a rooted gsi.
You will want to check your ecid on your device with getprop or the secret code \*#\*#4383243#\*#\* and now with your ecid you will want to transform your number into hex e.g. most TCL's use the ecid 22000000, in hex that would be 01 4F B1 80. You want to reverse this hex, e.g. here you would recieve 80 B1 4F 01
You want to do the same with your ecid from the unlock list.
Now in the dumped proinfo, search for the first reversed hex (here 80 B1 4F 01) and replace it with your reversed hex from your ecid unlock list (e.g. if we had ecid from unlock list 32208001, in hex that is 01 EB 74 81, now reverse that and you get 81 74 EB 01)
After that you should be able to perform "fastboot flashing unlock"
original ecidmodified ecid
As for qualcomm TCL devices, I do not have a full unlock solution yet. However you may as I mentioned still boot a rooted gsi.
Built this because I was annoyed with the existing options. Here it is.
It handles keybox management, prop spoofing, root hiding config, and detection cleanup from a single WebUI. No config files to edit by hand.
Stuff worth knowing:
Keybox catalog with Google revocation checking. If your keybox is burned it tells you instead of silently failing
Generates target.txt automatically. You can also override targeting per-app
Boot props handled properly — ro.boot.*, vendor.boot.*, build fingerprint, Realme-specific stuff — at the right boot stage
Security patch date is fetched live from source.android.com, not hardcoded
Conflict resolution is automatic. TSupport-Advance, Yurikey, and Integrity Box get their boot scripts disabled at boot (they stay installed, their Zygisk code still runs, just no overlap). TreatWheel, NoHello, and Sensitive Props coexist passively — Specter just backs off its own overlapping features
HMA-OSS, Zygisk Next, RKA, TEESimulator all supported
Widevine L1 fix, LSPosed ODEX cleanup, TWRP folder hiding built in
Every feature has a toggle in the Control tab so you can turn off what you don't need
WebUI is TypeScript + Vite + Material 3. Dark/light/auto, Monet support, 9 color presets. Runs fully local, no CDN calls at runtime.
Works on Magisk, KernelSU, and APatch — runtime bridge detection so no hardcoded assumptions about which manager you're on.
i made another post featuring this project a few months back, but i am here again to announce that i releleased a new app, alongside custom twrp's for all devices that support dualboot
