GetYahRootBack

Android rooting, in the open

General findings + tools for rooting Samsung/Android devices across models. The Fold 6 deep-dive lives in its own tab: /fold6/.

The next phase starts with a phone you can play with. Hub 0.7.0 adds an offline Playground built from hardware you already own.

• Tilt Maze: accelerometer maze with three hand-checked layouts, local best time and wall-bump haptics.
• Field: a live magnetometer gauge with baseline calibration, field history and optional sound.
• Pulse: camera/torch PPG with an on-device waveform and signal quality. Camera access is requested only when you start it; it is an experimental wellness toy, not a medical device.
• Buzz: a four-track, eight-step haptic sequencer with tempo control, presets and a visual playhead.
• Gravity: throw glowing orbs around a tiny gravity well. Tilt to change the pull, rotate to stir, and switch between Earth, Moon, Zero, Orbit and Reverse.
• Everywhere else: Playground search entries, small-screen and Android 16 polish, and no new network or tracking permissions.

Download Hub 0.7.0 · See the Playground · verify the SHA-256

• PolyQon 0.2.24: universal palette JSON export for non-Samsung phones; Samsung extras remain additive. The 0.2.19 boot re-apply guard still keeps themes alive across restarts.
• Unbolt Hub 0.7.0: Vol. 3 Pocket Lab — Tilt Maze, Field, Pulse, Buzz and Gravity, plus Android 16 and small-screen polish.
• RootForge 2.4.9: GUI safety check and doctor preflight — battery, storage, SELinux, root, bootloader and backup checks before anything is flashed — plus card hover glow and a complete Windows GUI bundle.
• Unbolt Home 0.14.4: branding cleanup — About, legacy launcher, nightly and store icons use the Unbolt mark, and the settings task is “Unbolt Home settings” with the navy gear icon. The 0.14.2 build added Spaces (grid, dock, page dots, search bar, labels, icon pack and wallpaper), app-pair shortcuts, JSON settings profiles and per-display drawer/dock columns.
• Orbit 2.1.5: a restored window geometry is clamped fully on-screen — including title-bar and taskbar room — plus the auth_param.dat credit and queue/packaging fixes.

• PolyQon 0.2.19: themes now survive a reboot — the guard module re-fabricates the saved overlays at boot, because Android wipes shell overlays on every boot. Plus the dark terminal UI, a working boot-animation file picker and the recovery guard.
• Unbolt Hub 0.6.0: same terminal palette (solid panels, mono values, blue accent), real root detection (su -c id, not a su file), one search icon, toolbar below the status bar and wrapping status chips. Fixes the search crash.
• RootForge 2.4.5: Odin flashing now verifies the .tar.md5 trailer and extracts members before flashing; the GhostLock payload is correctly attributed as Apache-2.0 with its licence and modification notice.
• Unbolt Home 0.13.1 is out: One UI page dots (equal-size, no active pill), 4-column drawer and 3×3 folders in the preset, a Restore One UI preset action and the always-on page indicator. Release-signed APK on the downloads page — beta, keep your old launcher as a fallback.

• On our own SM-F956B (F956BXXS4DZI1, bit 4, locked) the OEM unlocking row in Developer options is normally hidden by a single boot flag: androidboot.other.locked=1, appended by the bit-4 abl on every boot. The unlock code was never stripped — the UI was hidden.
• With temporary root, resetprop -n ro.boot.other.locked 0 brings the row back. Under KnoxGuard Checking the switch is enabled; tapping it and confirming Samsung's “Allow OEM unlocking?” dialog flips the persistent-data-block flag from 0 to 1 — verified on the device.
• Not unlocked yet. That flag is the unlock request. The real unlock is Download Mode + long-press Volume Up, which wipes userdata — and whether the TZ accepts the fuse write on a bit-4 build is still the untested step. Full recipe, evidence and caveats under Research → OEM unlock gate anatomy.
• Update, same day — Download Mode still refuses. With the toggle on and the request persisted, Download Mode shows only “press up to continue”; the “hold up to unlock bootloader” line never appears. Dumping the partitions proved why: persistent and devinfo are byte-identical to the pre-toggle captures, and the toggle is only a framework setting (settings global oem_unlock_allowed=1) — the oem_lock HAL is absent, so nothing hands it to the bootloader. Current suspect is KnoxGuard Checking: Download Mode checks PRENORMAL/COMPLETED via tz_kg, and our state is unsettled. Status: request set, bootloader still locked, gate narrowed. Live unlock status →

• Unbolt Home 0.13.1.1 is out — a release-signed beta with the One UI preset, a 4-column drawer, 3×3 folders, One UI page dots and PolyQon theme sync.
• Next up: proper dock spread, nested folders, widget overlap depth, backup v2 and a first-run preset chooser. No ads, no telemetry, no account.
• Everything GPL-3.0. Progress will be posted here and on the tools page.

• Orbit — a Samsung FUS firmware downloader, now on Linux (.deb) and Windows (.exe). Built on the samloader / Bifrost lineage — full speed, per-partition extraction, no login.
• RootForge — a rooting toolkit. PolyQon — a theming tool. Both open source, both honest works-in-progress, all in /tools/ and /downloads/.
• Works across Samsung/Android devices, not only the Fold 6.