{
  "schema": 1,
  "updated": "2026-11-04",
  "note": "Public payload catalogues for Samsung late-load (per-boot) root. Every entry links to its own upstream source. Unbolt does not redistribute third-party binaries; verify hashes and licences at the source before running anything.",
  "entries": [
    {
      "id": "root-my-galaxy-payloads",
      "name": "Root My Galaxy Payloads",
      "maintainer": "BuSung-dev",
      "repo": "https://github.com/BuSung-dev/Root-My-Galaxy-Payloads",
      "app": "https://github.com/BuSung-dev/Root-My-Galaxy",
      "licence": "Apache-2.0",
      "stars": 516,
      "exploit": "CVE-2026-43499 (app-domain), IonStack",
      "method": "per-boot late-load KernelSU, no boot image modified",
      "kernelsu": "late-load ksud + per-build kernelsu.ko (KDP/RKP/DEFEX aware)",
      "coverage": [
        "Galaxy S25 / S25+ / S25 Edge / S25 Ultra (kernel 6.6.98)",
        "Galaxy S24 Ultra SM-S928U1 (6.1.145)",
        "Galaxy S24 Ultra SM-S9280 (6.1.145)",
        "Galaxy S24+ SM-S926B (6.1.157)",
        "Galaxy A56 5G SM-A566E (6.6.102)",
        "Galaxy A36 5G SM-A366W (6.6.46)",
        "Galaxy A53 5G SM-A536E (5.10.237)",
        "Galaxy S23 Ultra SM-S9180 (5.15.189) - test in progress",
        "Galaxy Z Fold4 SM-F9360 (5.10.236)",
        "Galaxy S23+ SM-S916B (5.15.189) - shell-only experimental",
        "Galaxy S23 Ultra SM-S918B (5.15.189) - confirmed via Shizuku mode"
      ],
      "verification": "Per-payload status published by the maintainer (device-tested / in progress / experimental). Not independently verified by Unbolt.",
      "notes": "Also ships a machine-readable support feed (schema v3) with flat models/kernelVersions arrays used for runtime matching."
    },
    {
      "id": "root-my-galaxy-payloads-extended",
      "name": "Root My Galaxy Payloads Extended",
      "maintainer": "igorcv88",
      "repo": "https://github.com/igorcv88/Root-My-Galaxy-Payloads-Extended",
      "app": "https://github.com/igorcv88/Root-My-Galaxy-Extended",
      "licence": "Apache-2.0",
      "stars": 6,
      "exploit": "CVE-2026-43499",
      "method": "exact-match firmware profiles + late-load KernelSU",
      "kernelsu": "KernelSU 3.3.0 with Samsung KDP / RKP / DEFEX handling",
      "coverage": [
        "SM-S938B S938BXXSBCZG3 (6.6.98) - supported",
        "SM-S937B S937BXXU8CZF1 (6.6.98) - verified exact match",
        "SM-S938B S938BXXUCZZI4 (One UI 9 beta, 6.6.127) - hardware validated",
        "SM-S931B S931BXXUCZZI4 (One UI 9 beta, 6.6.127) - exact-match profile",
        "SM-S936B (6.6.98) - advanced support, unvalidated"
      ],
      "verification": "Exact-match profile selection; the maintainer marks each profile's validation level. Not independently verified by Unbolt.",
      "notes": "Documents the DEFEX-compatible bind-execution path needed for the root helper on One UI 9."
    },
    {
      "id": "root-my-galaxy-payloads-standalone",
      "name": "Root My Galaxy Payloads (standalone fork)",
      "maintainer": "Memetic0",
      "repo": "https://github.com/Memetic0/Root-My-Galaxy-Payloads-standalone",
      "licence": "Apache-2.0",
      "stars": 6,
      "exploit": "CVE-2026-43499",
      "method": "same as upstream, adds an extra device profile",
      "coverage": [
        "Galaxy S22+ SM-S906B S906BXXSNGZD7 (kernel 5.10.237)",
        "inherits the upstream payload table"
      ],
      "verification": "Fork of the upstream repo with one added profile. Not independently verified by Unbolt."
    },
    {
      "id": "unbolt-f956b-dzi1",
      "name": "Unbolt GhostLock payload (SM-F956B DZI1)",
      "maintainer": "Unbolt",
      "repo": "https://codeberg.org/getbacktoyahroots",
      "licence": "GPL-3.0 (KernelSU artifacts), Unbolt project (payload)",
      "exploit": "CVE-2026-43499 (GhostLock chain)",
      "method": "shell-domain launch + ksud late-load; per-boot, no partition written",
      "coverage": [
        "Galaxy Z Fold 6 SM-F956B, F956BXXS4DZI1, kernel 6.1.145-android14-11-33418572-abF956BXXS4DZI1"
      ],
      "verification": "Hardware-verified on the single device it was built for. The manager refuses to run on any other model/build/kernel.",
      "notes": "Shipped in Vol.5 as a standalone payload and as the manager's auto re-root."
    },
    {
      "id": "kernelsu-next",
      "name": "KernelSU-Next (upstream)",
      "maintainer": "KernelSU-Next",
      "repo": "https://github.com/KernelSU-Next/KernelSU-Next",
      "licence": "GPL-3.0",
      "method": "root manager; LKM / late-load mode; ksud + kernelsu.ko per KMI",
      "coverage": [
        "KMI android12-5.10 through android17-6.18 (per-KMI artifacts)"
      ],
      "verification": "Upstream source of the ksud/kernelsu.ko used by the payloads above.",
      "notes": "Samsung's KDP/RKP/DEFEX means a generic KMI module can still panic; per-build variants are the norm."
    },
    {
      "id": "cve-2026-43499-reference",
      "name": "CVE-2026-43499 reference exploit source",
      "maintainer": "NebuSec",
      "repo": "https://github.com/NebuSec/CyberMeowfia/tree/main/IonStack/CVE-2026-43499/exploit",
      "licence": "see upstream",
      "method": "original published exploit source (IonStack)",
      "verification": "Reference implementation for auditors; the Samsung payloads above are ports of this.",
      "notes": "Reading the primitive is the honest way to judge any port of it."
    }
  ],
  "rerootMechanisms": [
    {
      "id": "ksu-boot-scripts",
      "name": "KernelSU / KernelSU-Next / SukiSU / APatch boot scripts",
      "dirs": [
        "/data/adb/late-load.d/",
        "/data/adb/service.d/",
        "/data/adb/post-fs-data.d/",
        "/data/adb/post-mount.d/",
        "/data/adb/boot-completed.d/"
      ],
      "device": "any Android (device-agnostic)",
      "rootAtBoot": true,
      "lockedBootloader": false,
      "notes": "Script must be executable and LF-terminated. post-fs-data is blocking and time-capped; service stage is non-blocking and recommended. All boot scripts run in the manager's BusyBox ash with standalone mode.",
      "source": "https://kernelsu.org/guide/module.html"
    },
    {
      "id": "magisk-boot-scripts",
      "name": "Magisk general boot scripts",
      "dirs": [
        "/data/adb/post-fs-data.d",
        "/data/adb/service.d"
      ],
      "device": "any Android with Magisk (boot image patched)",
      "rootAtBoot": true,
      "lockedBootloader": false,
      "notes": "post-fs-data is blocking (40 s cap, scripts 35 s); service.d is late_start and recommended. Use resetprop -n in post-fs-data; setprop deadlocks.",
      "source": "https://topjohnwu.github.io/Magisk/guides.html"
    },
    {
      "id": "module-service-sh",
      "name": "Module script (service.sh / post-fs-data.sh)",
      "dirs": [
        "/data/adb/modules/<id>/service.sh",
        "/data/adb/modules/<id>/post-fs-data.sh"
      ],
      "device": "any Android with Magisk or KernelSU family",
      "rootAtBoot": true,
      "lockedBootloader": false,
      "notes": "Runs only while the module is enabled; not executed in core-only mode. Modules should not install general scripts.",
      "source": "https://kernelsu.org/guide/module.html"
    },
    {
      "id": "termux-boot",
      "name": "Termux:Boot",
      "dirs": [
        "~/.termux/boot/"
      ],
      "device": "any Android, rootless",
      "rootAtBoot": false,
      "lockedBootloader": true,
      "notes": "Boot add-on fires after system boot as the app user. Requires battery-optimisation exemption; boot event lands roughly 60 s after unlock. GPL-3.0.",
      "source": "https://wiki.termux.com/wiki/Termux%3ABoot"
    },
    {
      "id": "tasker-boot",
      "name": "Tasker / MacroDroid on-boot shell action",
      "dirs": [
        "app automation profile"
      ],
      "device": "any Android, rootless",
      "rootAtBoot": false,
      "lockedBootloader": true,
      "notes": "Same trigger model as Termux:Boot but with a GUI; still subject to OEM background-kill policies.",
      "source": "https://dontkillmyapp.com/"
    },
    {
      "id": "manager-service",
      "name": "Root manager foreground service (Unbolt Manager, Root My Galaxy)",
      "dirs": [
        "app service + retry loop"
      ],
      "device": "any Android the app supports",
      "rootAtBoot": false,
      "lockedBootloader": true,
      "notes": "The only option that can apply a firmware guard before running a payload. Unbolt Manager refuses any model/build/kernel other than SM-F956B / F956BXXS4DZI1 / 6.1.145.",
      "source": "https://www.getyahrootback.com/downloads/"
    },
    {
      "id": "pc-adb-watchdog",
      "name": "PC-side adb watchdog",
      "dirs": [
        "host script"
      ],
      "device": "any Android with adb",
      "rootAtBoot": false,
      "lockedBootloader": true,
      "notes": "Host loop waits for the device, pushes the payload and verifies root; useful when on-device background restrictions kill every app trigger.",
      "source": "https://developer.android.com/tools/adb"
    },
    {
      "id": "init-d",
      "name": "init.d",
      "dirs": [
        "/system/etc/init.d/"
      ],
      "device": "legacy / custom kernels only",
      "rootAtBoot": true,
      "lockedBootloader": false,
      "notes": "Requires kernel or ramdisk support; not present on modern Samsung stock firmware.",
      "source": "https://source.android.com/docs/core/architecture/init"
    }
  ]
}