live

an unbolt inc. project

GetYahRootBack

Open-source Android rooting tools, Samsung firmware utilities, and bootloader research. No paywalled loaders, no accounts, and no Discord-only download links.

Open the Device WikiPlug In & IdentifyRead the Log
root@android: ~/research
$ cat status.log
finding  = the OEM-unlock code was never stripped
            (one-way QFPROM fuse, not missing code)
tools    = Orbit · PolyQon · RootForge — GPL-3.0, by Unbolt Inc.
devices  = 274 device pages · 5 lab-verified
$ _
Everything here is early. Unbolt Home, PolyQon, Hub, RootForge, Orbit and this site are all in active development — and these are complex programs, so there is still a lot that needs polishing. Expect rough edges. If something breaks, tell us and we'll fix it.
Everything is on Codeberg now — all six repos, full history, tags and matching source archives are live at codeberg.org/getbacktoyahroots. Browse the source → Unbolt Home 0.13.1 is out — One UI page dots, 4-column drawer, 3×3 folders, PolyQon theme sync. Download the beta →

start here

New to rooting? Three steps, no jargon.

01Find your deviceWiki page, build number, unlock status.02Pick a methodWhat actually works on your firmware.03Get the toolsFree, GPL-3.0, no account needed.

the device wiki

Every Android device. Its info. The methods that work on it.

We're building an open database of Android bootloader unlock rules and root methods. 5 devices are fully lab-verified so far, and 269 device pages are seeded stubs waiting for community test reports.

freshness: 5 lab-verified · 269 stubs — every page shows its last-verified date.

Browse the WikiPlug In & Identify+ Document Your DeviceRooting Methods

tracks

OEM Unlockproven

The OEM-unlock code was never stripped — the gate is a one-way QFPROM fuse, not missing code. Full verdict written up.

Read →
Orbit Downloaderpublic

Our FUS firmware downloader — straight from Samsung's servers, per-partition extraction, GPL. Open source.

Read →
PolyQon Themingv0.2.19 · beta

All-Android tweaks — full One UI theming suite on Samsung. Theme-system mapped, colour-patch core working. GPL, free and open.

Read →
RootForge Toolkitpublic

Desktop ADB toolkit (Linux & Windows) that reads your connected phone's build props, checks kernel/GKI compatibility, and points you to the right Magisk, KernelSU-Next, or APatch workflow.

Read →
Device Mapgrowing

274 device pages across 16 brands — 5 lab-verified, 269 stubs waiting for test reports. Plug in and identify yours.

Read →
Rooting Methodsexplained

Every method, honestly scored — Magisk, KernelSU, APatch, temp root: the ups, the downs, and which phone each one is for.

Read →

map every device

Got a device? Send us your journey.

We’re mapping rooting + bootloader unlocks across as many Android devices as we can. Send us your model, build, what you tried, what worked — we’ll write it up and credit you. As a community we are stronger.

+ Document Your Device Plug In & Identify

or email getbackyahroots@gmail.com

breakthrough log

context

Android rooting, in the open

Android rooting, in the open

General findings + tools for rooting Samsung/Android devices — not just one phone. The Fold 6 deep-dive lives in its own tab: /fold6/.

2026-10-29just in

PolyQon 0.2.19, Hub 0.6.2, RootForge 2.4.5 — the terminal update

  • PolyQon 0.2.19: themes now survive a reboot — the guard module re-fabricates the saved overlays at boot, because Android wipes shell overlays on every boot. Plus the dark terminal UI, a working boot-animation file picker and the recovery guard.
  • Unbolt Hub 0.6.0: same terminal palette (solid panels, mono values, blue accent), real root detection (su -c id, not a su file), one search icon, toolbar below the status bar and wrapping status chips. Fixes the search crash.
  • RootForge 2.4.4: Odin flashing now verifies the .tar.md5 trailer and extracts members before flashing; the GhostLock payload is correctly attributed as Apache-2.0 with its licence and modification notice.
  • Unbolt Home 0.13 is out: One UI page dots (equal-size, no active pill), 4-column drawer and 3×3 folders in the preset, a Restore One UI preset action and the always-on page indicator. Release-signed APK on the downloads page — beta, keep your old launcher as a fallback.
2026-10-28

OEM unlocking is back on a bit-4 Fold 6 — no flash, no firmware edit

  • On our own SM-F956B (F956BXXS4DZI1, bit 4, locked) the OEM unlocking row in Developer options is normally hidden by a single boot flag: androidboot.other.locked=1, appended by the bit-4 abl on every boot. The unlock code was never stripped — the UI was hidden.
  • With temporary root, resetprop -n ro.boot.other.locked 0 brings the row back. Under KnoxGuard Checking the switch is enabled; tapping it and confirming Samsung's “Allow OEM unlocking?” dialog flips the persistent-data-block flag from 0 to 1 — verified on the device.
  • Not unlocked yet. That flag is the unlock request. The real unlock is Download Mode + long-press Volume Up, which wipes userdata — and whether the TZ accepts the fuse write on a bit-4 build is still the untested step. Full recipe, evidence and caveats under Research → OEM unlock gate anatomy.
  • Update, same day — Download Mode still refuses. With the toggle on and the request persisted, Download Mode shows only “press up to continue”; the “hold up to unlock bootloader” line never appears. Dumping the partitions proved why: persistent and devinfo are byte-identical to the pre-toggle captures, and the toggle is only a framework setting (settings global oem_unlock_allowed=1) — the oem_lock HAL is absent, so nothing hands it to the bootloader. Current suspect is KnoxGuard Checking: Download Mode checks PRENORMAL/COMPLETED via tz_kg, and our state is unsettled. Status: request set, bootloader still locked, gate narrowed. Live unlock status →
2026-10-28just in

Unbolt Home 0.13.1 is out

  • Unbolt Home 0.13.1 is out — a release-signed beta with the One UI preset, a 4-column drawer, 3×3 folders, One UI page dots and PolyQon theme sync.
  • Next up: proper dock spread, nested folders, widget overlap depth, backup v2 and a first-run preset chooser. No ads, no telemetry, no account.
  • Everything GPL-3.0. Progress will be posted here and on the tools page.
2026-10-26

some tools, shipped quietly

  • Orbit — a Samsung FUS firmware downloader, now on Linux (.deb) and Windows (.exe). Built on the samloader / Bifrost lineage — full speed, per-partition extraction, no login.
  • RootForge — a rooting toolkit. PolyQon — a theming tool. Both open source, both honest works-in-progress, all in /tools/ and /downloads/.
  • Works on any Samsung/Android device, not just the Fold 6.

The OEM-unlock code was never stripped

The single biggest correction to the common wisdom: Samsung did not remove the OEM-unlock code from the bootloader. setOEMFlags / IsUnlocked / IsUnlockCritical / GetUnlockCount / the milestone check are all present in both bit-2 and bit-4 abl. The block is one hardcoded androidboot.other.locked=1 in SecUpdateCmdLine — a reporting gate, not a missing feature. The unlock is gated by a one-way QFPROM fuse (oem_sw_fuse = 0xc1), written in TZ (SCM 0x2000801), behind the AVB milestone.

That's the honest map: the code is there, the fuse is the wall.<br><br>What this is

We root Android devices in the open — free, documented, and shared. Every finding is researched on our own hardware and written up so the next person doesn't start from zero. The Fold 6 was our test bed; the tools and the bootloader findings apply across Samsung's Snapdragon line.