Use

1. Capture the running device state

Boot rooted Android and connect ADB:

tools/capture.sh out/captured

This reads the runtime device tree, iomem, command line and kernel config. It does not modify the device.

Use the runtime tree from /proc/device-tree. The original /sys/firmware/fdt blob is not safe for this handoff.

tools/prep.sh out/captured /path/to/target/Image \
  out/initramfs.gz out/payload

tools/run.sh out/payload

The script freshly pushes and verifies the module, Image, initramfs and DTB. All device files are placed under /data/local/tmp.

Find the new Ethernet interface with ip link. Then:

nmcli device connect <interface>
telnet 10.42.0.2

If DHCP is unavailable:

sudo ip addr add 10.42.0.1/24 dev <interface>
telnet 10.42.0.2

Run one command without telnet:

python3 tools/qkx_sh.py 'uname -a'

python3 tools/qkx_sh.py 'echo r > /proc/qkx_bootdone'

After Android returns:

tools/read-log.sh

This loads marker_read.ko and prints the target's retained RAM log.

To capture Android kernel messages over the existing USB gadget before kexec:

tools/load-usb-log.sh 60

usb_log.ko hooks the active gadget's EP0 callback and intentionally cannot be unloaded safely. Reboot Android to remove it.