henryandClaude Opus 4.8 309dc2c18f Speed up chain to adb-root: 32s -> ~14s (and eliminate retry stalls) ...

Profiled --adb-root on live Q3 (52433670036000520). Cuts:
- Writer (e2e.dex): the intermittent "writer incomplete" retries were IpSec
  objects (encap socket + Binder token) getting GC-collected mid-run under
  post-boot memory pressure -> IpSecService tore down the SA -> every send threw
  ECONNREFUSED -> whole run aborted + JVM/SA restart (~4-8s each). Fixed by pinning
  them in a static (KEEP), plus SO_SNDBUF bump and per-record retry on transient
  errno (EAGAIN/ENOBUFS/ECONNREFUSED) so a hiccup never aborts the run. Also paced
  sends at 1ms instead of 3ms (the on-device ctor poisons sleeplessly).
- orchestrate.py: poll getenforce after `ctl.start insmod_sh` instead of a fixed
  sleep(4) (~3.5s); settle default 8 -> 3 (ctor's init_array runs early); Q3
  --adb-root skips the two code-poison reverts (~8s) — transient session, SA already
  stopped so the dead-SA ctor is harmless (--postex still reverts, for Magisk).
  poison() now surfaces the writer's exception on retry for diagnosis.

Verified on-device: 14.6s, single clean inject pass (no retries), fresh `adb shell`
= uid 0 / u:r:kernel:s0.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-09-21 18:06:06 +02:00

..

Stager.java

DirtyFrag-LPE: unprivileged Quest 3 shell -> kernel exec -> Magisk root

2026-09-20 16:23:19 +02:00

Writer.java

Speed up chain to adb-root: 32s -> ~14s (and eliminate retry stalls)

2026-09-21 18:06:06 +02:00