Mystic GSI is now open-source!

YES, you read that right. After 3 years of building GSIs privately, we’ve finally decided to make our tool available for everyone. 

A bit of history first. On July 29, 2023, we released our very first GSI, ported from the Pixel 5a (barbet).
The idea behind the project was simple: stop depending on someone else and build our own GSIs from whatever firmware we wanted. 

Three years, ~1000+ GSIs and 17K of you later, and, the tool that can build a MysticGSI is finally public, so you can make your own without having to ask us ;)

Android 10 - 17 for many ROMs (HyperOS/MIUI, ColorOS/RealmeUI/OxygenOS, etc.)
Works on macOS & Linux. 

The repository is here 👈

Contributions, fixes and new patches are very welcome! 
As always, how well a GSI works depends on your device and luck ;)

Huge thanks to phhusson, erfanoabdi and Nippon (also Nippon, I’m really sorry for whatever I’ve said a while ago about your situation ;<), whose work made all of this possible! 

It feels very surreal to finally see this publicly available ;) 

Happy building! 🔥

We discovered a privileged process arbitrary code execution vulnerability in Android 17. This vulnerability was patched in Android 17 QPR1 but was not included in any security bulletin. Combined with the dirty frag vulnerability (CVE-2026-43284), we achieved full root privilege escalation on Android 17.0.

The DirtyFrag vulnerability was disclosed 3 months ago but is still exploitabe, because Google has delayed the release frequency of vulnerability patches, changing from monthly to quarterly security bulletins. In the AI ​​era, this behavior is completely incomprehensible. A large number of devices in the Android ecosystem are vulnerable to attacks due to the vulnerability details leaked in the Pixel system; even Pixel devices not participating in the beta program are not immune.

Therefore, we used two "already patched" vulnerabilities to demonstrate full rooting on Google Pixel 10 with the latest patches as a warning, urging Google to change its practices and release vulnerability patches promptly.

Xiaomi Dialer & Contacts port (HyperOS 3) for AOSP
Ported by Islam AlorabI
Telegram: @IslamAlorabI
Channel: @Shadow6by8

Source: Xiaomi 15 Global, HyperOS 3.0.303.0 (Android 16)

• Install: KernelSU / Magisk module (requires a mount metamodule on KernelSU 3+)
• It should work on Android 15/16; otherwise, it is unknown and requires your testing. Set the "Phone" app as default to ensure it works properly.

Note: This is a test build intended for testing and is not yet stable for daily use. Test everything and report bugs with logs