henryandClaude Opus 4.8 2324ce262e Q2 old-build (50837850062000150, 4.19.157): kernel offset auto-derivation + split flow ...

Adds support for the oldest Quest 2 dump, whose 4.19.157 kernel and tightly
packed userspace break three assumptions of the merged (QPro-style) flow.

Kernel side (auto-derived by port.py, offline-verified):
- selinux_state is absent from kallsyms (no data syms, no BTF). Xref it via
  avc_has_perm_noaudit callers (majority-voted adrp/add x0) ->
  0xffffff800976f8f8 (dsel 0x109672c). Fallback only fires when the symbol is
  missing, so 4.19.325/5.10 ports are unchanged. Adds OBJDUMP to toolconf.
- task_struct->cred = 0x7e0 (not 0x7e8 as on 4.19.325); derive from
  commit_creds. --cred-off auto + always cross-check. enforcing_off=1 and
  cred->security=0x78 verified unchanged.

Userspace side (split flow): no tracking-mapped, shell-readable lib has a
>=3500B exec gap on this build, so the full merged cred stub overflows
(libgralloc.qti=552B, libcdsprpc=3328B). fuguquest now auto-selects a split
path (or "split_flow": true):
- Phase A: enforcing-only carrier via the tracking ctor
  (build_credmod_ex(enforcing_only): 104B patch -> 1904B stub, fits libcdsprpc)
  -> Permissive. Reuses the ABS64-anchor path so it works on rdbg's 18-CALL26
  init (build_carrier cannot).
- Phase B: full cred carrier, module renamed -> rdbgcp (rename_module) so it
  coexists with the loaded Phase-A rdbg, loaded shell-direct via a poisoned cfg
  under DAC -> root. Both patched inits return early (no device registration).

The tracking daemon is trackingfidelityservice (not trackingservice). Newer Q2
targets still take the unchanged merged path (their stub fits). Offline
validator added: rust/examples/fitcheck.rs. Remaining on-device checks are in
the target's port_notes.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-09-29 22:32:39 +02:00

..

fitcheck.rs

Q2 old-build (50837850062000150, 4.19.157): kernel offset auto-derivation + split flow

2026-09-29 22:32:39 +02:00