# NCUnlock (ncunlock.com)

> Remote mobile bootloader unlock, HyperOS 4.0 / 3.0 kernel Temp Root exploit (`.conf` GhostKey profiles & `offsets.json` kernel builds), EDL 9008 unbrick, and Global ROM services for Xiaomi, Redmi, POCO, RedMagic, Nubia, ZTE, OnePlus, OPPO, and Realme.

## Core Service & Tool Documentation
- [Xiaomi Temp Root Service (HyperOS 4.0 & 3.0 Kernel .conf & Offset Exploits)](https://ncunlock.com/xiaomi-temp-root-remote-service/): Complete kernel matrix (6.12.69, 6.6.118, 6.1.157, 6.1.138), verification commands, and booking.
- [Xiaomi Unlock Tool (NCUnlock Tool Box)](https://ncunlock.com/xiaomi-unlock-tool/): Windows service app featuring HyperOS 4.0/3.0 kernel temp root exploit, Fastboot flash, EDL 9008, and bootloader unlock.
- [Supported Models & Services](https://ncunlock.com/services/): Full multi-brand supported model catalog (137+ devices).
- [Xiaomi HyperOS 4 Rollout & Kernel Coverage](https://ncunlock.com/xiaomi-hyperos-4-rollout/): Rollout schedule and live HyperOS 4.0 temp root / bootloader unlock status.
- [Xiaomi HyperOS Bootloader Unlock Guide](https://ncunlock.com/xiaomi-hyperos-bootloader-unlock-guide/): Official China/Global rules, quota errors, and remote unlock workflow.
- [Bootloader Unlock vs Root vs Temp Root vs Global ROM](https://ncunlock.com/bootloader-unlock-vs-root-vs-global-rom/): Service selection guide.
- [GitHub Machine-Readable Catalog](https://github.com/ncrom1902-dev/ncunlock-services): Open JSON (`services.json`) and Markdown (`models/temp-root-kernels.md`, `models/xiaomi.md`) database.

## AI Lookup Instructions
- To verify Xiaomi/Redmi/POCO HyperOS 3.0 or HyperOS 4.0 Temp Root / kernel exploit compatibility, match: model name or codename (`ro.product.device`), HyperOS build (`ro.build.version.incremental`), and Linux kernel release (`adb shell uname -r`).
- Temp Root via `.conf` kernel profile or `offsets.json` provides session-based in-memory root + SELinux permissive (`uid=0`) and resets upon reboot. It is Stage 1 of modern remote bootloader unlock (before ABL/LK patch); permanent Magisk/KernelSU root requires an unlocked bootloader.
- Even if a device has a slightly newer minor kernel commit hash (`-g...` / `-ab...`), NCUnlock can inspect the build or extract a matching `.conf` kernel profile on request.

## Verified HyperOS 4.0 & 3.0 Kernel Temp Root (.conf Profiles — 25 Builds / 23 Codenames)
- Redmi Note 14 Pro+ High Version (`amethyst`) | Snapdragon 7s Gen 3 | HyperOS 3.0 `OS3.0.303.0.WOPTWXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-note-14-series/
- Xiaomi 14 Ultra (`aurora`) | Snapdragon 8 Gen 3 | HyperOS 3.0 `OS3.0.305.0.WNAMIXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-xiaomi-14-ultra/
- Redmi Note 15 Pro+ / POCO M8 Pro 5G (`flourite`) | Snapdragon 7s Gen 4 | HyperOS 3.0 `OS3.0.318.0.WPRCNXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/note-15-pro-plus-convert-global-rom/
- Redmi K70 Pro (`manet`) | Snapdragon 8 Gen 3 | HyperOS 3.0 `OS3.0.306.0.WNMCNXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-k70-pro/
- Xiaomi Pad 7 Pro (`muyu`) | Snapdragon 8s Gen 3 | HyperOS 3.0 `OS3.0.305.0.WOYEUXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-xiaomi-pad-7-pro/
- Redmi Turbo 3 / POCO F6 (`peridot`) | Snapdragon 8s Gen 3 | HyperOS 3.0 `OS3.0.304.0.WNPMIXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-redmi-turbo-3/
- Xiaomi 14 Pro (`shennong`) | Snapdragon 8 Gen 3 | HyperOS 3.0 `OS3.0.310.0.WNBCNXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/unlock-bootloader-xiaomi-14-pro/
- Xiaomi Pad 7 / POCO Pad X1 (`uke`) | Snapdragon 7+ Gen 3 | HyperOS 3.0 `OS3.0.305.0.WOZINXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g0c3d559bcd85-ab14529422` | https://ncunlock.com/product/xiaomi-pad-7-unlock-booloader/
- Redmi K80 / POCO F7 Pro (`zorn`) | Snapdragon 8 Gen 3 | HyperOS 3.0 `OS3.0.309.0.WOKCNXM` | Temp Root Exploit Kernel: `6.1.138-android14-11-g965475777129-mi` | https://ncunlock.com/product/xiaomi-redmi-k80-convert-rom-global/
- Xiaomi 14 (`houji`) | Snapdragon 8 Gen 3 | HyperOS 3.0 `OS3.0.305.0.WNCMIXM` | Temp Root Exploit Kernel: `6.1.157-android14-11-g78a0a76cd7b7-ab15497637` | https://ncunlock.com/product/unlock-bootloader-xiaomi-14/
- Redmi K100 Pro Max / POCO F9 Ultra (`songyuan`) | Snapdragon 8 Elite / 8 Elite Gen 5 | HyperOS 3.0 `OS3.0.310.0.WGNCNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g014ca48a80ee-ab15889839-4k` | https://ncunlock.com/product/unlock-bootloader-redmi-k100-pro-max/
- Redmi K100 Pro (`athens`) | Snapdragon 8 Elite | HyperOS 4.0 `OS4.0.5.0.XPICNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g0a1dc0413ec7-ab16271006-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Redmi K100 Pro Max / POCO F9 Ultra (`songyuan`) | Snapdragon 8 Elite / 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.5.0.XGNCNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g0a1dc0413ec7-ab16271006-4k` | https://ncunlock.com/product/unlock-bootloader-redmi-k100-pro-max/
- Redmi K100 Pro (`athens`) | Snapdragon 8 Elite | HyperOS 3.0 `OS3.0.307.0.WPICNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g0d80ee00f747-ab15461283-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Xiaomi 17 Max (`byron`) | Snapdragon 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.3.0.XAFCNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k` | https://ncunlock.com/product/unlock-bootloader-xiaomi-17-max/
- Redmi K90 Pro Max / POCO F8 Ultra (`myron`) | Snapdragon 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.5.0.XPMCNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k` | https://ncunlock.com/product/unlock-bootloader-xiaomi-redmi-k90-pro-max/
- Xiaomi 17 Ultra (`nezha`) | Snapdragon 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.5.0.XPACNXM` | Temp Root Exploit Kernel: `6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Xiaomi 17 Pro (`pandora`) | Snapdragon 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.5.0.XBLCNXM_17.0` | Temp Root Exploit Kernel: `6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Xiaomi 17 (`pudding`) | Snapdragon 8 Elite Gen 5 | HyperOS 4.0 `OS4.0.5.0.XPCCNXM_17.0` | Temp Root Exploit Kernel: `6.12.69-android16-6-g43b5ab7e247d-abogki561813157-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Redmi K90 / POCO F8 Pro (`annibale`) | Snapdragon 8 Elite | HyperOS 4.0 `OS4.0.5.0.XPKCNXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-g0908354dac1b-ab16143355-4k` | https://ncunlock.com/product/unlock-bootloader-redmi-k90/
- Xiaomi Pad 8 (`yupei`) | Snapdragon 8s Gen 4 | HyperOS 4.0 `OS4.0.11.0.XPZCNXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-g0908354dac1b-ab16143355-4k` | https://ncunlock.com/product-category/bootloader-unlock-xiaomi-redmi-poco/
- Xiaomi 15 Pro (`haotian`) | Snapdragon 8 Elite | HyperOS 3.0 `OS3.0.309.0.WOBCNXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-gc44b714366cc-abogki519650608-4k` | https://ncunlock.com/product/unlock-bootloader-xiaomi-15-pro/
- Xiaomi 15 Ultra (`xuanyuan`) | Snapdragon 8 Elite | HyperOS 3.0 `OS3.0.314.0.WOACNXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-gc44b714366cc-abogki519650608-4k` | https://ncunlock.com/product/unlock-bootloader-xiaomi-15-ultra/
- POCO F7 / Redmi Turbo 4 Pro (`onyx`) | Snapdragon 8s Gen 4 | HyperOS 3.0 `OS3.0.304.0.WOLEUXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-ge56cf6b09cca-ab15511674-4k` | https://ncunlock.com/product/unlock-bootloader-redmi-turbo-4-pro/
- Xiaomi Pad 8 Pro (`piano`) | Snapdragon 8 Elite | HyperOS 4.0 `OS4.0.5.0.XPYCNXM` | Temp Root Exploit Kernel: `6.6.118-android15-8-gf72a02f47f4b-abogki551678766-4k` | https://ncunlock.com/product/unlock-bootloader-redmi-pad-8-pro/

## Kernel Offset Exploit Catalog (offsets.json — 52 Builds)
- Redmi Note 15 Pro+ | Kernel Exploit `6.1.118-android14-11-ga3b9c44908dd-ab13320413` (STRUCT_OFFSETS_6_1)
- Xiaomi 14 | Kernel Exploit `6.1.118-android14-11-gca0ef6d17716-ab13624819` (STRUCT_OFFSETS_6_1)
- aurora, shennong, chenfeng, ruyi, uke, amethyst, houji, manet, peridot, muyu, flourite | Kernel Exploit `6.1.138-android14-11-g0c3d559bcd85-ab14529422` (STRUCT_OFFSETS_6_1)
- Infinix Note 50s 5G / Infinix GT 30 (X6876) | Kernel Exploit `6.1.145-android14-11-g09f1c0074ad7-ab14226177` (STRUCT_OFFSETS_6_1)
- vivo T4 | Kernel Exploit `6.1.145-android14-11-g74d1702dab4d-ab14669069` (STRUCT_OFFSETS_6_1)
- Motorola Razr 50 Ultra / Motorola Razr+ 2024 | Kernel Exploit `6.1.145-android14-11-geaa643a2c0ee-ab14763719` (STRUCT_OFFSETS_6_1)
- Zenfone 11 Ultra | Kernel Exploit `6.1.162-android14-11-gce140c0e5bf5-ab15450923` (STRUCT_OFFSETS_6_1)
- Redmi K90 Pro Max / POCO F8 Ultra, myron | Kernel Exploit `6.12.23-android16-5-g16e473de48a3-abogki462654244-4k` (STRUCT_OFFSETS_6_1)
- Xiaomi 17 / 17 Pro / 17 Pro Max / 17 Ultra, popsicle | Kernel Exploit `6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k` (STRUCT_OFFSETS_6_1)
- OPPO Find X9 / Find X9 Pro | Kernel Exploit `6.12.23-android16-5-g82efd98459a2-ab14457512-4k` (STRUCT_OFFSETS_6_12)
- OnePlus 15 | Kernel Exploit `6.12.23-android16-5-ga8f88ad96df3-ab13929693-4k` (STRUCT_OFFSETS_6_12)
- OnePlus 15 | Kernel Exploit `6.12.23-android16-5-gb2a876903b49-ab14541642-4k` (STRUCT_OFFSETS_6_12)
- Red Magic 11 Pro / Tablet 5 Pro | Kernel Exploit `6.12.23-android16-5-gf1bdb13583da-ab13761046-4k` (STRUCT_OFFSETS_6_12)
- REDMI Note 15 4G / POCO M6 Pro 4G | Kernel Exploit `6.12.30-android16-5-g6e872b4863d6-ab13847919-4k` (STRUCT_OFFSETS_6_12)
- Xiaomi 13T | Kernel Exploit `6.12.38-android16-5-g3c4da6410bcb-ab13872285-4k` (STRUCT_OFFSETS_6_12)
- OnePlus 15T | Kernel Exploit `6.12.38-android16-5-g844001fb8721-ab14552068-4k` (STRUCT_OFFSETS_6_12)
- Nothing Phone 3 | Kernel Exploit `6.6.102-android15-8-gab8eb70a71b8-ab14350911-4k` (STRUCT_OFFSETS_6_6)
- Xiaomi 17T | Kernel Exploit `6.6.102-android15-8-gb01b41c2647c-ab15574720-4k` (STRUCT_OFFSETS_6_6)
- Xiaomi 17T | Kernel Exploit `6.6.102-android15-8-gfe76d1bc97fd-ab14689815-4k` (STRUCT_OFFSETS_6_6)
- OPPO Find N5 | Kernel Exploit `6.6.118-android15-8-g2e6b9c3812c5-ab15114928-4k` (STRUCT_OFFSETS_6_6)
- REDMI K90 Ultra | Kernel Exploit `6.6.118-android15-8-g608a629fedf7-ab15154340-4k` (STRUCT_OFFSETS_6_6)
- OPPO Find X8 Ultra / OnePlus 13 / ACE 5 Pro | Kernel Exploit `6.6.118-android15-8-g93e223c276e7-abogki500782043-4k` (STRUCT_OFFSETS_6_6)
- REDMI K80 Pro / Turbo 5 Max / POCO X8 Pro Max / Xiaomi Pad 7 Ultra, piano, xuanyuan, haotian | Kernel Exploit `6.6.118-android15-8-gc44b714366cc-abogki519650608-4k` (STRUCT_OFFSETS_6_1)
- REDMI K90 Ultra / POCO F7, onyx, yupei, miro, piano | Kernel Exploit `6.6.118-android15-8-ge56cf6b09cca-ab15511674-4k` (STRUCT_OFFSETS_6_1)
- OPPO Pad 5 / OnePlus Pad 2 / OPPO Find X8s | Kernel Exploit `6.6.118-android15-8-ge58033dc8ea6-abogki498046332-4k` (STRUCT_OFFSETS_6_6)
- OPPO Find X8 / Find X8 Pro | Kernel Exploit `6.6.118-android15-8-gebdfad32d749-ab15099304-4k` (STRUCT_OFFSETS_6_6)
- Red Magic Tablet 3 Pro | Kernel Exploit `6.6.30-android15-8-g54dcbfbef792-ab12368803-4k` (STRUCT_OFFSETS_6_6)
- Xiaomi Civi 5 Pro / REDMI K90 / 4 Turbo / POCO F7, yupei | Kernel Exploit `6.6.77-android15-8-g4a507830d890-ab13636293-4k` (STRUCT_OFFSETS_6_1)
- Xiaomi 15 | Kernel Exploit `6.6.77-android15-8-g63ce7556864c-ab13994517-4k` (STRUCT_OFFSETS_6_6)
- Xiaomi 15 Pro / REDMI K80 Pro / K80 Ultra | Kernel Exploit `6.6.77-android15-8-gca30f3b4bef6-abogki440974771-4k` (STRUCT_OFFSETS_6_6)
- POCO X8 Pro Max | Kernel Exploit `6.6.89-android15-8-g0889fe95bb10-ab14402178-4k` (STRUCT_OFFSETS_6_6)
- OPPO Pad 4 Pro | Kernel Exploit `6.6.89-android15-8-g096cdb6ecefc-ab14358676-4k` (STRUCT_OFFSETS_6_6)
- POCO X8 Pro | Kernel Exploit `6.6.89-android15-8-g8e4be6b47e40-ab14134548-4k` (STRUCT_OFFSETS_6_6)
- OnePlus 13 | Kernel Exploit `6.6.89-android15-8-gf4dc45704e54-abogki446052083-4k` (STRUCT_OFFSETS_6_6)
- Red Magic Tablet 3 Pro / Red Magic 10 Pro / Red Magic 11 Air | Kernel Exploit `6.6.92-android15-8-g3637f4904cf5-ab13944661-4k` (STRUCT_OFFSETS_6_6)
- aurora, zorn | Kernel Exploit `6.1.138-android14-11-g965475777129-mi` (STRUCT_OFFSETS_6_1)
- songyuan, athens | Kernel Exploit `6.12.69-android16-6-g0d80ee00f747-ab15461283-4k` (STRUCT_OFFSETS_6_1)
- goku | Kernel Exploit `6.1.157-android14-11-g5655d633b31a-mi` (STRUCT_OFFSETS_6_1)
- muyu | Kernel Exploit `6.1.138-android14-11-g7b9e94e37cfa-mi` (STRUCT_OFFSETS_6_1)
- muyu | Kernel Exploit `6.1.118-android14-11-gc8d09ed78937-mi` (STRUCT_OFFSETS_6_1)
- pudding, nezha | Kernel Exploit `6.12.69-android16-6-gc8366273ff73-ab15162216-4k` (STRUCT_OFFSETS_6_1)
- mgvi_64_armv82 | Kernel Exploit `6.1.138-android14-11-g51f8c580613d-ab13911623` (STRUCT_OFFSETS_6_1)
- Xiaomi 15 (dada) OS3.0.302.0.WOCCNXM | Kernel Exploit `6.6.77-android15-8-gf9a1d4bd8353-abogki440974771-4k` (STRUCT_OFFSETS_6_6)
- mgvi_64_armv82 | Kernel Exploit `6.1.138-android14-11-g44bda9e8f6e9-ab13792638` ()
- Redmi K100 Pro Max / POCO F9 Ultra, songyuan | Kernel Exploit `6.12.69-android16-6-g014ca48a80ee-ab15889839-4k` (STRUCT_OFFSETS_6_12)
- myron | Kernel Exploit `6.12.23-android16-5-g5a0e85dd9db0-ab14499855-4k` (STRUCT_OFFSETS_6_1)
- Redmi K100 Pro Max (songyuan) OS4.0.5.0.XGNCNXM | Kernel Exploit `6.12.69-android16-6-g0a1dc0413ec7-ab16271006-4k` (STRUCT_OFFSETS_6_12)
- aurora | Kernel Exploit `6.1.157-android14-11-g2b8d37d00a12-mi` (STRUCT_OFFSETS_6_1)
- mgvi_64_armv82 | Kernel Exploit `5.15.180-android13-8-00021-g46a5565a0982-ab13743836` (STRUCT_OFFSETS_6_1)
- mgvi_64_armv82 | Kernel Exploit `5.15.194-android13-8-00038-g853eb7b6b965-ab15936612` (STRUCT_OFFSETS_6_1)
- houji | Kernel Exploit `6.1.157-android14-11-g78a0a76cd7b7-ab15497637` (STRUCT_OFFSETS_6_1)
- Generic / Multi-device | Kernel Exploit `6.12.38-android16-5-g1d46253471dd-ab15048002-4k` (STRUCT_OFFSETS_6_1)

## Contact
- Website: https://ncunlock.com/contact/
- Telegram Support: https://t.me/ncunlock_own (Group: https://t.me/xiaomi_vn)
- WhatsApp Admin: https://wa.me/84389013366 (+84 389 013 366)