Root wasn’t the end.
From system compromise, we pulled the wallet keystore, recovered the private key, derived the public key, and verified it against the on-chain wallet on BaseScan.
Full PoC ↓
BootROM → root → lock-screen PIN.
We enter BROM mode, load a patched preloader, gain root, extract the lock credential, recover the 6-digit PIN offline, and use it to unlock the phone.
Full PoC ↓