git404hub

what is duchamp-root fr?

colorful-glassblock/duchamp-root — explained in plain English

Analysis updated 2026-05-18

27CAudience · developerComplexity · 4/5LicenseSetup · hard

tl;dr

A one click rooting tool for the Xiaomi K70e phone that exploits a kernel bug to install KernelSU, shared for educational research purposes.

vibe map

mindmap
  root((duchamp-root))
    What it does
      One click root
      Kernel exploit
      KernelSU install
    Tech stack
      C
      Android NDK
      KernelSU daemon
    Use cases
      Root Xiaomi K70e
      Study kernel exploits
      Security research
    Audience
      Security researchers
      Advanced Android users
    Risks
      Bootloader warranty
      Possible bricking
      Educational use only

Code map

Detail Auto

An interactive map of this repo's files and how they connect — its source is parsed live in your browser. Click Visualize to build it.

filefunction / class

what do people make with this?

VIBE 1

Root a Xiaomi K70e device for research or study of Android kernel exploitation.

VIBE 2

Study a documented kernel exploit chain including KASLR leaks and file-operations hijacking.

VIBE 3

Get a persistent KernelSU root manager installed via a kernel vulnerability instead of an unlocked bootloader flash.

what's the stack?

CAndroid NDKKernelSU

how it stacks up fr

colorful-glassblock/duchamp-rootkassane/openssl-ziglibretro/genesis-plus-gx-wide
Stars272727
LanguageCCC
Last pushed2026-04-202026-07-02
MaintenanceMaintainedActive
Setup difficultyhardmoderateeasy
Complexity4/53/52/5
Audiencedeveloperdevelopergeneral

Figures from each repo's GitHub metadata at analysis time.

how do i run it?

Difficulty · hard time til it works · 1h+

Requires a specific Xiaomi K70e device, ADB access, and comfort with the risk of bricking the phone.

You can use and modify the code, but any derivative work you distribute must also be released as open source under the same GPLv3 terms.

in plain english

duchamp-root is a one click rooting tool for a specific phone, the Xiaomi K70e, known by its codename duchamp. It works by exploiting a kernel vulnerability the README labels CVE-2026-43499, nicknamed IonStack, and once it gains control it installs KernelSU, a root management system, as a background daemon on the device. The README explains the exploit chain in technical detail. It starts by leaking the kernel's memory layout through a timing side channel, then hijacks a table of file operation function pointers using a race condition, then forges a pipe buffer structure to get the ability to read and write arbitrary physical memory. From there it patches the process credentials of a root child process to give it full permissions, disables security mechanisms like seccomp and SELinux enforcement, and finally extracts and launches the embedded KernelSU daemon so the root access persists. To use it, you need a Xiaomi K70e device, a working ADB connection, and either an unlocked bootloader or acceptance that the tool's injection method does not strictly require one. The basic flow is downloading a file called preload.so from the project's releases, pushing it to the device over ADB, and running it against a target app using LD_PRELOAD, a Linux mechanism for injecting code into a running process. The project can also be compiled from source using the Android NDK's aarch64 compiler and a Makefile. The current release only fully supports the duchamp device, though the source includes reference configuration files for several other device codenames that the author says are unverified. The README is explicit and repeated in its disclaimer that this tool is for educational and research purposes only, and warns that unlocking a bootloader can void a warranty and that rooting a device can cause it to stop booting or lose data, with no responsibility accepted for damage. The code is released under the GPLv3 license, a copyleft license that requires derivative works to remain open source under the same terms. The README is written in a casual, meme heavy style with both Chinese and English sections describing the same technical content.

prompts (copy fr)

prompt 1
Explain the exploit chain used by duchamp-root step by step in plain terms.
prompt 2
Walk me through pushing and running preload.so on a Xiaomi K70e over ADB.
prompt 3
Help me compile duchamp-root from source using the Android NDK.
prompt 4
What are the risks of using a rooting tool like this on my phone?

Frequently asked questions

what is duchamp-root fr?

A one click rooting tool for the Xiaomi K70e phone that exploits a kernel bug to install KernelSU, shared for educational research purposes.

What language is duchamp-root written in?

Mainly C. The stack also includes C, Android NDK, KernelSU.

What license does duchamp-root use?

You can use and modify the code, but any derivative work you distribute must also be released as open source under the same GPLv3 terms.

How hard is duchamp-root to set up?

Setup difficulty is rated hard, with roughly 1h+ to a first successful run.

Who is duchamp-root for?

Mainly developer.

peek the repo → explain another one

This repo across BitVibe Labs

double-check against the repo, no cap.