Building on the prior 32->14s pass, further cuts profiled on live Q3:
- Multi-file Writer (e2e.dex): one Writer invocation now poisons N files under a
single JVM + one IpSec SA. The base chain's inject-lib + libandroid poisons are
batched into one call (poison_batch) instead of two -> saves a JVM+SA (~1.5s).
- Parallel cred carrier: --adb-root builds the adbd cred module (host clang, ~1.2s)
in a background thread during the base chain (adbd pid is stable; rebuilds only if
it changed) -> fully overlapped.
- Skip the slow dd|base64 read of libandroid's original bytes when the run won't
revert (adb-root/no-restore).
- Faster polling: trackingservice-restart 1s->0.3s, adbd-root verify 1s->0.3s.
Net on this Q3: ~11s to a root adb shell (uid0 + u:r:kernel:s0), single clean
inject pass, no retries. Multi-file Writer also speeds the QPro/Q2/postex flows.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Profiled --adb-root on live Q3 (52433670036000520). Cuts:
- Writer (e2e.dex): the intermittent "writer incomplete" retries were IpSec
objects (encap socket + Binder token) getting GC-collected mid-run under
post-boot memory pressure -> IpSecService tore down the SA -> every send threw
ECONNREFUSED -> whole run aborted + JVM/SA restart (~4-8s each). Fixed by pinning
them in a static (KEEP), plus SO_SNDBUF bump and per-record retry on transient
errno (EAGAIN/ENOBUFS/ECONNREFUSED) so a hiccup never aborts the run. Also paced
sends at 1ms instead of 3ms (the on-device ctor poisons sleeplessly).
- orchestrate.py: poll getenforce after `ctl.start insmod_sh` instead of a fixed
sleep(4) (~3.5s); settle default 8 -> 3 (ctor's init_array runs early); Q3
--adb-root skips the two code-poison reverts (~8s) — transient session, SA already
stopped so the dead-SA ctor is harmless (--postex still reverts, for Magisk).
poison() now surfaces the writer's exception on retry for diagnosis.
Verified on-device: 14.6s, single clean inject pass (no retries), fresh `adb shell`
= uid 0 / u:r:kernel:s0.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
Single JSON-driven toolkit. From an unprivileged (uid 2000) adb shell on a
locked retail Quest 3:
- Dirty-Frag page-cache poison stages an attacker-keyed AES-GCM ESP SA and
injects an init_array ctor into hal_tracking (via libeva) that poisons a
diff-patched vendor .ko (llcc_perfmon) to flip selinux_state.enforcing=0;
- ctl.start insmod_sh finit-loads it -> SELinux Permissive (zero root);
- --postex: a second diff-patched carrier (usbip-vudc) cred-patches a waiting
shell to uid 0 (+ syncs the SELinux status page via
selinux_status_update_setenforce) and runs Singularity Magisk (v30.7 fork,
no zygote restart) -> headless `su` under SELinux Enforcing, ~40s.
Both carriers are DIFF-PATCHED existing modules (no per-kernel compilation);
adding a firmware = `port.py --zip ... --device ...` -> targets/<name>.json.
Proven on builds 52345320027600520 and 52433670032200520.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
