Mystic GSI Updates

Pixel-arrow-16-15861848-AB-20260719-MysticGSI.zip

Android XR 16.0 (64-bit only) Ported from arrow (arrow) Info: Device brand: google Device manufacturer: Google Device model: arrow Device codename: arrow Device board: neo61 Android version: 16 Android SDK: 36 Build fingerprint: google/arrow/arrow:16/BGQ1.260715.001/15861848:userdebug/test-keys Build type: arrow-userdebug Build tags: test-keys Build ID: BGQ1.260715.001 Security patch: 2025-09-05 Raw Image Size: 2.14 GiB Notes: - Permissive SELinux recommended Wait! Where's MysticCloud??? MysticCloud servers got nuked because we're Russians 🥀🥀🥀 We'll see what we can do with it though :<

OnePlus 13 BOOTED

have fun booting this ;)

Aluminium OS (17.0) Ported from Multi-device ARM64 (quartz) Info: Device brand: HP Device manufacturer: HP Device model: Multi-device ARM64 Device codename: quartz Device board: hamoa Android version: 17 Android SDK: 37 Build fingerprint: HP/quartz/quar…

MysticCloud

Aluminium OS (17.0) Ported from Multi-device ARM64 (quartz) Info: Device brand: HP Device manufacturer: HP Device model: Multi-device ARM64 Device codename: quartz Device board: hamoa Android version: 17 Android SDK: 37 Build fingerprint: HP/quartz/quartz:17/CL2B.260330.037/15298538:userdebug/dev-keys Build type: quartz-userdebug Build tags: dev-keys Build ID: CL2B.260330.037 Security patch: 2026-05-05 Raw Image Size: 4.71 GiB Notes: - Permissive SELinux recommended Download: MysticCloud

Hey.. we need to talk.. The May 2026 update has been released today! As we’ve leaked before, this update includes a bootloader update for the Pixel 10 series that increments the anti-rollback counter, preventing from downgrading to a vulnerable version of the bootloader. While we’re out here warning you, there’s a big brick issue that Google refuses to address publicly: b/507968853 As many of you developers know, once a Pixel enters one of these recovery modes: Pixel ROM Recovery (Pixel 6-8 series) Pixel BL1 Recovery (Pixel 9 series) Pixel DBL Recovery (Pixel 10+ series) The Pixel becomes a paperweight. We know that Googlers have an internal tool (go/flash/tools/pixel/rom_recovery) and signed recovery images (signed/signed-recovery.zip) to recover a device from such mode. However, external users don’t have them. Every complaint about that on the Issue Tracker gets a Won’t Fix or a Duplicate of x status. The primary issue (b/402455330) hasn’t gotten an answer from Google since April 2025. The continued silence makes it look like the company doesn’t care about its users. The problem has been raised for years. Yet there’s still no public statement. Everything's changed when a developer (JoshuaDoes) has released a tool called tensor-usbdl that can work with a device stuck in Pixel ROM Recovery mode. The catch? - Currently, the tool only has the leaked recovery signed images for the Pixel 7 / Pixel 7 Pro and the Pixel 8 / 8 Pro. - The Pixel 8 images only work if you have never updated your phone to the May 2025 update. If you did, well you’re locked out for now. The fact that an independent developer made such a tool proves that Google could do something about this but they won’t, meanwhile no one we know of has taken advantage of it to break the device security. What do you think about this? Have you ever bricked a Pixel? Let us know in the comment section! By the way regarding the leaks, we know and we're dropping another bomb soon so stay tuned

Due to Crecker's uncooperative attitude, the original (and not vibe‑coded (;) PoC is now open source. Go give it some love: https://github.com/halal-beef/houston-pub

This is not related to my projects, but I'd like to raise awareness since, in my opinion, this is a bit fucked up and a real shame for the reverse engineering community. As some might know (or not), Umer (halal-beef) primarily, and others spent months reversing an Exynos iROM exploit that was originally discovered by a friend of mine (hello AA) (but was never made public). I knew about the PoC because of the latter and even had coverage about it, so I can definitely speak about the research efforts made by Umer for months. He actually posted about it on his (now gone) Telegram channel, and you could tell he knew what he was doing, nothing was fake (a few bits of it, here). Then this guy somehow got his hands on halal's PoC (someone leaked it to him), ran it through AI, "improved" it without actually knowing how it works, and started teasing it like it was his own achievement. Naturally, he got called out for stealing stuff and not giving proper credit, and all he did was delete the chat where the evidence had been posted. Not satisfied with that, he simply cried in DMs (instead of publicly addressing everyone who confronted him) to halal and even threatened to leak the thing. You can see a more detailed story / proof here: https://t.me/uechats/3 The bug itself (CVE-2024-56426) is public, already used in tools like Chimera and Sigmakey, and now he's threatening to report it to big companies, even though it's already been addressed. Crecker, do better ;)

The Nekogram devs have admitted this!

This isn't a leak, but... BREAKING: Nekogram is secretly sending your phone numbers to the developer The backdoor is hidden in the http://Extra.java file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline…

This isn't a leak, but... BREAKING: Nekogram is secretly sending your phone numbers to the developer The backdoor is hidden in the http://Extra.java file, which differs from the template uploaded to the repository. The obfuscated code sends data as an inline request to the @nekonotificationbot, leaving no trace. More info about the backdoor: https://github.com/Nekogram/Nekogram/issues/336 (locked by Nekogram devs) To validate this, we made a PoC: an LSPosed module that replaces the bot ID and username to ours so all requests are going to it. That way, we confirmed that the phone numbers are being collected. Every. Login. The PoC is available here: https://github.com/RomashkaTea/nekogram-proof-of-logging

Pixel Android CinnamonBun Ported from Sasquatch (sasquatch) Info: Device brand: google Device manufacturer: Google Device model: Sasquatch Device codename: sasquatch Device board: sm8975 Android version: CinnamonBun Android SDK: 37 Build fingerprint: google/sasquatch/sasquatch:CinnamonBun/ZP1B.260401.001/15045786:userdebug/dev-keys Build type: sasquatch-user Build tags: dev-keys Build ID: ZP1B.260401.001 Security patch: 2026-07-05 Raw Image Size: 6.70 GiB Download: MysticCloud

RealmeUI [17.0.0] Ported from ossi (RE6030L1) Info: Device brand: realme Device manufacturer: realme Device model: ossi Device codename: RE6030L1 Device board: canoe Android version: CinnamonBun Android SDK: 36 Build fingerprint: realme/RMX5200/RE6030L1:17/CP21.260206.001/B.393a1a0-16520ba-16521a0:user/release-keys Build type: qssi-user Build tags: release-keys Build ID: CP21.260206.001 Security patch: 2026-03-01 Raw Image Size: 12.27 GiB Download: SourceForge

ColorOS [17.0.0] Ported from OPPO Find X9 Pro 卫星通信版 (OP5E11L1) Info: Device brand: OPPO Device manufacturer: OPPO Device model: OPPO Find X9 Pro 卫星通信版 Device codename: OP5E11L1 Device board: mt6993 Android version: CinnamonBun Android SDK: 36 Build fingerprint: OPPO/PLG120/OP5E11L1:17/CP21.260206.001/B.3236060-f423aa-f423a9:user/release-keys Build type: sys_mssi_64_cn_armv82-user Build tags: release-keys Build ID: CP21.260206.001 Security patch: 2026-03-01 Raw Image Size: 11.99 GiB Download: SourceForge | MysticCloud

ColorOS [17.0.0] Ported from 一加 15 (OP60FFL1) Info: Device brand: OnePlus Device manufacturer: OnePlus Device model: 一加 15 Device codename: OP60FFL1 Device board: canoe Android version: CinnamonBun Android SDK: 36 Build fingerprint: OnePlus/PLK110/OP60FFL1:17/CP21.260206.001/B.2466256-1725a4-1725a1:user/release-keys Build type: qssi-user Build tags: release-keys Build ID: CP21.260206.001 Security patch: 2026-03-01 Raw Image Size: 11.84 GiB Download: SourceForge | MysticCloud