sunfish-admin/AXP-Resurection
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AXP Magisk resurrection track: Speckit 009 port AXP/LOS22 to LOS23.

Browse Source 
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
This commit is contained in:
sunfish-admin committed 2026-09-16 21:56:22 +00:00
commit 12d2179c20
150 files changed
+26263
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/007-lab-results-20260916.md
+220
View File
@@ -0,0 +1,220 @@
# 007 LAB results — 2026-09-16
LAB only: serial `11231JEC207477`. GOLDEN not used.
Build base: `23.2-20260915-UNOFFICIAL-sunfish`.
Kernel under test: ReSukiSU **35153** + SusFS **v1.5.5**, DEBUG boot
`#8 … Wed Sep 16 12:09:18 UTC 2026`
(`boot-resukisu-susfs-DEBUG-20260916T115115Z.img`).
Related: [source audit](007-susfs-source-audit.md),
[attempts brief](007-susfs-attempts-chatgpt-brief.md),
[runbook](007-kernelsu-runbook.md).
## Executive summary
| Area | Result |
|------|--------|
| SusFS + ReSukiSU **boot** (matched vendor) | **PASS** |
| Manager 35153 + `susfs_init` | **PASS** |
| Play downloads (system Phonesky alone) | **FAIL** → fixed with exact-alarm APK hotfix |
| TEESimulator-RS + ReZygisk + PIF inject | Installed and running |
| Yuh / Swissquote usable session | **FAIL** (Talsec root detect / exit **-69**) |
| SusFS as banking hide by itself | **Not sufficient** (expected; US2/attestation still open) |
**Bottom line:** The SusFS bring-up *pipeline* works end-to-end (build →
matched `boot`+`vendor` → modules load → Manager sees SusFS). Banking PASS is
still blocked by root/environment detection; SusFS did not clear that gate.
---
## 1. Boot / SusFS bring-up
### What failed earlier (corrected causality)
1. **Boot-only SusFS flashes** left LAB on an old `/vendor/lib/modules` set.
With `CONFIG_MODVERSIONS=y`, `drv2624` (and peers) disagreed on CRCs
(**31/56** incl. `module_layout`). That matches the T004038Z-class hang in
`VibratorManagerService` when the module never loads — **not** proof of the
later early-panic series.
2. First matched-module attempt used a **hand-repacked** `vendor.img` with
wrong SELinux labels (`vendor_file` instead of
`vendor_kernel_modules`). `init-insmod-sh` got `avc: denied { module_load }`
→ empty `lsmod` → same vibrator / bootanim stall. **ADB was alive.**
Reproduce ABI check:
```bash
python3 scripts/check-module-abi.py <Module.symvers> <module.ko>
```
### What worked
| Step | Detail |
|------|--------|
| DEBUG boot | `panic=0`, VT/fbcon; artifact `.local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img` |
| Vendor | Repacked modules from same build; flash via **fastbootd** (`vendor_a` sparse); vbmeta `--disable-verity --disable-verification` |
| SELinux fix | Relabel `.ko` → `u:object_r:vendor_kernel_modules:s0` (`incrementalfs` → `vendor_incremental_module`) |
| Post-boot | `sys.boot_completed=1`, `drv2624` + ~40 modules loaded |
| SusFS | `dmesg`: `susfs_init … version: v1.5.5` |
| Manager | Spoofed `weogax.atbfxb.skiggr` **35153**; UI: driver 35153, SusFS v1.5.5, hook **Manual**, SELinux Enforcing |
`su` from adb: `uid=0` `u:r:ksu:s0`. No `/sys/fs/susfs` (normal for 1.5.5;
ioctl/supercall path).
### Architecture note (open)
MANUAL_HOOK + `CONFIG_KSU_SUSFS` remains a **local hybrid** vs upstream ReSukiSU
hook `choice`. This DEBUG build **boots** with that hybrid + matched vendor.
ChatGPT’s “hook ABI collision” theory is **not** required to explain the
vibrator hang; it remains a hypothesis for earlier logo→reboot trials that
were not re-run with matched vendor. Prefer a controlled **SusFS-inline,
no MANUAL**, min-features experiment later — do not treat hybrid as final
architecture.
Prepared but not on this boot: execve post-hook UAF patch
`vendor/sunfish/patches/007-kernelsu/0001-exec-avoid-post-hook-filename-uaf.patch`
(real bug; also present on root-only path → not SusFS-only panic proof).
---
## 2. Play Store “pending”
**Cause:** `DownloadService` crash loop:
```text
SecurityException: FGS type systemExempted requires
FOREGROUND_SERVICE_SYSTEM_EXEMPTED + (SCHEDULE_EXACT_ALARM | USE_EXACT_ALARM | VPN)
```
System `/system/priv-app/Phonesky` lacked `USE_EXACT_ALARM` in the **APK
manifest** (privapp XML alone is insufficient). Documented hotfix:
| Item | Path |
|------|------|
| Host | `/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk` |
| Laptop | `.local-artifacts/004-microg/Phonesky_exact-alarm.apk` |
```bash
adb install -r .local-artifacts/004-microg/Phonesky_exact-alarm.apk
```
Not in the bacon image yet (deferred with other API warnings). Next bacon must
ship the exact-alarm Phonesky prebuilt.
---
## 3. Modules reinstall
Installed with `su -M` (global mount ns; plain `su` often cannot see
`/data/adb` under SusFS) via `/data/adb/ksud module install …`:
| Module | id | Version |
|--------|-----|---------|
| ReZygisk | `rezygisk` | v1.0.0 (515) |
| TEESimulator-RS | `tricky_store` | v6.0.1-307 |
| Play Integrity Fix [INJECT] | `playintegrityfix` | v4.7-1-inject-s |
Zips staged under `.local-artifacts/007-kernelsu/modules/`. Versions matched
upstream `update.json` at install time. Reboot required after install; user
confirmed activated.
**TEESimulator targets:** default `target.txt` had Play/GMS + test apps only.
`com.yuh` and `com.swissquote.android` must be listed (GUI may not expose this;
edit `/data/adb/tricky_store/target.txt` or module action). Adding them was
necessary for TEEsim to bind those UIDs; it did **not** by itself clear Talsec.
Observed TEEsim noise: `StrongBox op limit reached (hw=4 sw=0 max=4)`,
`Skip patching short certificate chain of length null`.
**PIF note:** `pif.prop` spoofed **Pixel 6** (`oriole`) on sunfish — device
mismatch risk for banks; revisit fingerprint before next bank trial.
---
## 4. Banking (Yuh / Swissquote)
### Observed behaviour
- Both load **Talsec** `libts.so`.
- Swissquote (and Yuh after retries): `VM exiting with result code **-69**`
then process death — intentional anti-root exit, **not** an uncaught Java
crash. Same signature as 2026-09-15 captures (with/without TEEsim).
- Probes in logcat: `getenforce`, `/proc`, serial props, `qemu.*`, `ps` /
`pid_max`, cache symlink, etc.
- Operator report: after many attempts Yuh **locked the app** citing **root**.
### Profile / policy gaps (spec US2 still open)
- Contract: banks **never** receive root; umount/hide must be **verified**.
- `.allowlist` contained both bank packages (binary profile); confirm in
Manager UI: **Deny / Forbidden** + **Umount modules** for
`com.yuh` and `com.swissquote.android` (all userIds tested).
- SusFS initialised ≠ verified path hide for banking UIDs.
- Island / work profile not re-validated in this session.
### Verdict on SusFS vs banks
SusFS **does not** replace: deny-root profiles, verified umount, coherent
attestation (TEEsim keybox/StrongBox), and PIF props matching the device.
Pipeline works; **both-bank PASS remains FAIL**.
---
## 5. Operational recipes (LAB)
### Flash matched DEBUG (fastbootd)
```bash
adb reboot fastboot # userspace fastbootd
fastboot flash vendor_a .local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img
fastboot --disable-verity --disable-verification flash vbmeta_a .local-artifacts/007-kernelsu/vbmeta.img
fastboot flash boot_a .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot flash boot_b .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot reboot
```
Rollback vendor (host): `/srv/rom/artifacts/007-kernelsu/vendor-pre-debug-20260915.img`.
### Module install (after SusFS boot)
```bash
adb push <zip> /data/local/tmp/ksu-mods/
adb shell 'su -M -c "/data/adb/ksud module install /data/local/tmp/ksu-mods/<zip>"'
adb reboot
```
### TEESimulator bank targets
```bash
adb shell 'su -M -c "grep -E \"yuh|swissquote\" /data/adb/tricky_store/target.txt ||
printf \"%s\\n\" com.yuh com.swissquote.android >> /data/adb/tricky_store/target.txt"'
```
---
## 6. Artifacts index
| Artifact | Location |
|----------|----------|
| DEBUG boot | `.local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img` |
| Vendor sparse (correct SELinux) | `.local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img` (+ host `…/vendor-repack/`) |
| Experiment dir | `a16-build:/srv/rom/artifacts/007-kernelsu/debug-20260916T115115Z/` |
| Module zips | `.local-artifacts/007-kernelsu/modules/` |
| Phonesky exact-alarm | `.local-artifacts/004-microg/Phonesky_exact-alarm.apk` |
| ABI checker | `scripts/check-module-abi.py` |
| RCA CRCs | `.local-artifacts/007-kernelsu/rca-20260916/` |
| Manager pin | `.local-artifacts/007-kernelsu/SPOOFED_MANAGER_PIN.txt` (35153) |
---
## 7. Open follow-ups (non-ordering commitment)
1. Bacon: ship exact-alarm Phonesky + always package `boot` with matching
vendor modules (and correct `vendor_kernel_modules` labels).
2. Confirm Manager Deny + Umount for both banks; prove with `su` from bank UID
and mount evidence (US2).
3. TEEsim StrongBox limit / keybox quality; PIF fingerprint → sunfish-coherent.
4. Optional control: SusFS-inline without MANUAL, min features, matched vendor.
5. Apply execve UAF patch on next kernel rebuild.
6. Do **not** claim banking PASS until Yuh + Swissquote usable sessions on the
same stack (runbook hard-gate).