Single JSON-driven toolkit. From an unprivileged (uid 2000) adb shell on a
locked retail Quest 3:
- Dirty-Frag page-cache poison stages an attacker-keyed AES-GCM ESP SA and
injects an init_array ctor into hal_tracking (via libeva) that poisons a
diff-patched vendor .ko (llcc_perfmon) to flip selinux_state.enforcing=0;
- ctl.start insmod_sh finit-loads it -> SELinux Permissive (zero root);
- --postex: a second diff-patched carrier (usbip-vudc) cred-patches a waiting
shell to uid 0 (+ syncs the SELinux status page via
selinux_status_update_setenforce) and runs Singularity Magisk (v30.7 fork,
no zygote restart) -> headless `su` under SELinux Enforcing, ~40s.
Both carriers are DIFF-PATCHED existing modules (no per-kernel compilation);
adding a firmware = `port.py --zip ... --device ...` -> targets/<name>.json.
Proven on builds 52345320027600520 and 52433670032200520.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
