Profiled --adb-root on live Q3 (52433670036000520). Cuts:
- Writer (e2e.dex): the intermittent "writer incomplete" retries were IpSec
objects (encap socket + Binder token) getting GC-collected mid-run under
post-boot memory pressure -> IpSecService tore down the SA -> every send threw
ECONNREFUSED -> whole run aborted + JVM/SA restart (~4-8s each). Fixed by pinning
them in a static (KEEP), plus SO_SNDBUF bump and per-record retry on transient
errno (EAGAIN/ENOBUFS/ECONNREFUSED) so a hiccup never aborts the run. Also paced
sends at 1ms instead of 3ms (the on-device ctor poisons sleeplessly).
- orchestrate.py: poll getenforce after `ctl.start insmod_sh` instead of a fixed
sleep(4) (~3.5s); settle default 8 -> 3 (ctor's init_array runs early); Q3
--adb-root skips the two code-poison reverts (~8s) — transient session, SA already
stopped so the dead-SA ctor is harmless (--postex still reverts, for Magisk).
poison() now surfaces the writer's exception on retry for diagnosis.
Verified on-device: 14.6s, single clean inject pass (no retries), fresh `adb shell`
= uid 0 / u:r:kernel:s0.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Single JSON-driven toolkit. From an unprivileged (uid 2000) adb shell on a
locked retail Quest 3:
- Dirty-Frag page-cache poison stages an attacker-keyed AES-GCM ESP SA and
injects an init_array ctor into hal_tracking (via libeva) that poisons a
diff-patched vendor .ko (llcc_perfmon) to flip selinux_state.enforcing=0;
- ctl.start insmod_sh finit-loads it -> SELinux Permissive (zero root);
- --postex: a second diff-patched carrier (usbip-vudc) cred-patches a waiting
shell to uid 0 (+ syncs the SELinux status page via
selinux_status_update_setenforce) and runs Singularity Magisk (v30.7 fork,
no zygote restart) -> headless `su` under SELinux Enforcing, ~40s.
Both carriers are DIFF-PATCHED existing modules (no per-kernel compilation);
adding a firmware = `port.py --zip ... --device ...` -> targets/<name>.json.
Proven on builds 52345320027600520 and 52433670032200520.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
