Root with Locked Bootloader
Keep STRONG Integrity
Automated PowerShell tool for Snapdragon 8 Elite devices. Flash a patched GBL via the EFISP partition — bootloader stays locked, STRONG Play Integrity passes natively. No spoofing. No keybox.
Windows PC
Windows 10 or 11. PowerShell 5.1+ (already included). No Mac/Linux support yet.
✓ Auto-checked by scriptADB & Fastboot (Android Platform Tools)
Free tools from Google. If not installed, the script downloads them automatically from Google's servers (~10 MB). You don't need to do anything.
✓ Auto-downloaded if missingUSB Debugging enabled on your phone
Settings → About Phone → tap Build Number 7 times → Developer Options → USB Debugging ON. The script walks you through this step-by-step.
✓ Script guides you through itEFI File — AUTO IN v1.4
The script downloads the full EFI toolkit automatically from superturtlee's GitHub, selects the best EFI for your device model, and places it in the right folder. No action needed.
✓ Fully automated — zero user actioninit_boot_patched.img — AUTO IN v1.4
The script pulls init_boot.img directly from your phone via ADB, downloads magiskboot, and patches it on your PC automatically. No firmware download, no manual extraction. If on-PC patching fails, it installs Magisk app and guides you through one tap.
Compatible firmware (before March 2026)
Settings → About → Android Security Patch Level must be before 2026-03-01. The script checks this automatically and stops if your firmware is patched.
✓ Auto-checked by scriptHow the exploit works — technical explanation
Qualcomm's Generic Bootloader (GBL) on affected Snapdragon 8 Elite firmware loads the EFI binary from the efisp partition without verifying its signature. By flashing a patched EFI (generic_superfastboot.efi from superturtlee's research) to that partition, we get a superfastboot environment that lets us flash a root-patched init_boot.img. The Android bootloader itself never changes — it stays locked. Because Google's Play Integrity checks the bootloader lock state (not init_boot), MEETS_STRONG_INTEGRITY passes natively. Qualcomm closed this hole in March 2026 firmware — only works below that patch level.
Credits & Attribution
superturtlee discovered and documented the GBL/EFISP exploit and released the EFI binaries that make this possible. The XeraX team built the PowerShell automation wrapper — device detection, firmware verification, file validation, and the step-by-step guided flash — on top of that original research.
What's New in v1.4
Fully automated — zero manual file prepLive Tool Simulation
What you see when you run itSupported Devices
Step-by-Step Guide
Works for all confirmed devicesCheck Your Firmware Patch Level
This exploit works only on firmware with a security patch before March 2026. Go to Settings → About Phone → Android Security Patch Level.
✓ Safe: anything dated 2025-xx-xx, 2026-01-01, or 2026-02-01
✗ Patched: 2026-03-01 or later — stop here, the exploit is closed
Enable ADB & OEM Unlock
Tap Build Number 7 times (Settings → About) to unlock Developer Options. Then enable USB Debugging and OEM Unlocking inside Developer Options. Connect phone to PC via USB and authorize the ADB prompt on-device.
Download All Three Required Files
Place all three in the same folder on your Windows PC:
Patch init_boot.img with Magisk or KernelSU
Extract init_boot.img from your device's stock firmware ZIP. Copy it to your phone. Open Magisk or KernelSU → Install → Select and patch a file → pick init_boot.img. Copy the output file (named magisk_patched_*.img) back to your PC and rename it init_boot_patched.img.
Run XeraX Root Tool
Right-click XeraX-Root.ps1 → Run with PowerShell. The tool will auto-detect your device, check the firmware patch level, verify all three files are present, and walk you through the flash. You can also run it from a terminal:
If Windows blocks execution policy, select "Yes" at the UAC prompt or run PowerShell as Administrator.
The Tool Does the Rest Automatically
Once you confirm, the script reboots your device to fastboot, sends the patched EFI to the EFISP partition to activate the Qualcomm GBL bypass, then flashes your patched init_boot. It reboots back to Android automatically. The whole process takes about 3 minutes.
Verify Root + Play Integrity
After reboot, open Magisk or KernelSU to confirm root status. Install Play Integrity API Checker from the Play Store. All three checks should pass — including MEETS_STRONG_INTEGRITY — with no PIF module or keybox required.
Block OTA Updates — Critical
Any OTA will close the EFISP exploit and remove root permanently. Run this via Termux or ADB shell to disable auto-updates:
Also install the OTA Survival Script from Magisk modules for persistent protection across reboots.
After Rooting — STRONG Integrity Passes Natively
Because your bootloader stays locked, Google's Play Integrity sees a clean device. STRONG passes with zero modules. If any app still fails (rare), use our Play Integrity Fix page for additional hardening — usually just a GMS denylist update is enough.