finding = the OEM-unlock code was never stripped
(one-way QFPROM fuse, not missing code)
tools = Orbit · PolyQon · RootForge — GPL-3.0, by Unbolt Inc.
devices = 274 devices · 16 brands — plug in & identify yours
$ _
an unbolt inc. project
GetYahRootBack
We are here to bring open source back to its former glory days. Rooting Android devices in the open — documented, shared, for the community.
// tracks
The OEM-unlock code was never stripped — the gate is a one-way QFPROM fuse, not missing code. Full verdict written up.
Read →Our FUS firmware downloader — straight from Samsung's servers, per-partition extraction, GPL. Open source.
Read →All-Android tweaks — full One UI theming suite on Samsung. Theme-system mapped, colour-patch core working. GPL, no paywall.
Read →All-in-one rooting toolkit — device profile, every rooting method, smart downloads, unlock wizard. CLI + GUI.
Read →274 devices across 16 brands documented and counting — plug in & identify, or submit yours.
Read →Every method, honestly scored — Magisk, KernelSU, APatch, temp root: the ups, the downs, and which phone each one is for.
Read →// map every device
Got a device? Send us your journey.
We’re mapping rooting + bootloader unlocks across as many Android devices as we can. Send us your model, build, what you tried, what worked — we’ll write it up and credit you. As a community we are stronger.
or email getbackyahroots@gmail.com
// breakthrough log
Android rooting, in the open
Android rooting, in the open
General findings + tools for rooting Samsung/Android devices — not just one phone.
The Fold 6 deep-dive lives in its own tab: /fold6/.
some tools, shipped quietly
-
Orbit — a Samsung FUS firmware downloader, now on Linux (
.deb) and Windows (.exe). Built on the samloader / Bifrost lineage — full speed, per-partition extraction, no login. -
RootForge — a rooting toolkit. PolyQon — a theming tool. Both open source, both
honest works-in-progress, all in
/tools/and/downloads/. - Works on any Samsung/Android device, not just the Fold 6.
The OEM-unlock code was never stripped
The single biggest correction to the common wisdom: Samsung did not remove the
OEM-unlock code from the bootloader. setOEMFlags / IsUnlocked / IsUnlockCritical /
GetUnlockCount / the milestone check are all present in both bit-2 and bit-4 abl.
The block is one hardcoded androidboot.other.locked=1 in SecUpdateCmdLine — a
reporting gate, not a missing feature. The unlock is gated by a one-way QFPROM fuse
(oem_sw_fuse = 0xc1), written in TZ (SCM 0x2000801), behind the AVB milestone.
That's the honest map: the code is there, the fuse is the wall.<br><br>What this is
We root Android devices in the open — no paywalls, no login, no gatekeeping. Every finding is researched on our own hardware and written up so the next person doesn't start from zero. The Fold 6 was our test bed; the tools and the bootloader findings apply across Samsung's Snapdragon line.