DirtyInit

One-touch, universal root for Samsung devices as u:r:init:s0 using DirtyFrag

SUMMARY

This is the first public DirtyFrag for Android exploit that jumps straight from a user app to root. The root namespace is init - the most powerful non-kernel namespace on Android. It requires no setup or configuration. Best of all, it works for everyone. It's been tested on Galaxy devices from the Note 20 Ultra to the S26 Ultra.

It uses a stable, public API - IpSecManager - to handle the required XFRM socket and crypto. It's the same set of APIs that VPNs and other secure networking apps use. How does this avoid the need for CAP_SYS_ADMIN and a Phase 1 escalation to system_server or network_stack? Because system_server itself runs these APIs in its own namespace and forwards them on to the appropriate native networking daemon. Same principle as using a file explorer to install an app - system_server proxies it to installd. It doesn't use DirtyFrag as a step into GhostLock or kernel-root: init is its target. To achieve this escalation, DirtyFrag overwrites the LogMessage function in /system/lib64/libbase.so, which init uses for its logging functions and calls nearly constantly, with a payload that causes init to fork a child and set up a unix stream socket. Init Unix stream sockets are accessible to every namespace except untrusted_app, so we have to use ADB as a relay. Once the exploit finishes, tap EXTRACT CLI, which dumps the 'dirtyinit' binary to /sdcard. Then use ADB to copy it to /data/local/tmp and execute it to connect to the init socket and run commands from init's namespace.