# 007 LAB results — 2026-09-16

LAB only: serial `11231JEC207477`. GOLDEN not used.  
Build base: `23.2-20260915-UNOFFICIAL-sunfish`.  
Kernel under test: ReSukiSU **35153** + SusFS **v1.5.5**, DEBUG boot
`#8 … Wed Sep 16 12:09:18 UTC 2026`
(`boot-resukisu-susfs-DEBUG-20260916T115115Z.img`).

Related: [source audit](007-susfs-source-audit.md),
[attempts brief](007-susfs-attempts-chatgpt-brief.md),
[runbook](007-kernelsu-runbook.md).

## Executive summary

| Area | Result |
|------|--------|
| SusFS + ReSukiSU **boot** (matched vendor) | **PASS** |
| Manager 35153 + `susfs_init` | **PASS** |
| Play downloads (system Phonesky alone) | **FAIL** → fixed with exact-alarm APK hotfix |
| TEESimulator-RS + ReZygisk + PIF inject | Installed and running |
| Yuh / Swissquote usable session | **FAIL** (Talsec root detect / exit **-69**) |
| SusFS as banking hide by itself | **Not sufficient** (expected; US2/attestation still open) |

**Bottom line:** The SusFS bring-up *pipeline* works end-to-end (build →
matched `boot`+`vendor` → modules load → Manager sees SusFS). Banking PASS is
still blocked by root/environment detection; SusFS did not clear that gate.

---

## 1. Boot / SusFS bring-up

### What failed earlier (corrected causality)

1. **Boot-only SusFS flashes** left LAB on an old `/vendor/lib/modules` set.
   With `CONFIG_MODVERSIONS=y`, `drv2624` (and peers) disagreed on CRCs
   (**31/56** incl. `module_layout`). That matches the T004038Z-class hang in
   `VibratorManagerService` when the module never loads — **not** proof of the
   later early-panic series.
2. First matched-module attempt used a **hand-repacked** `vendor.img` with
   wrong SELinux labels (`vendor_file` instead of
   `vendor_kernel_modules`). `init-insmod-sh` got `avc: denied { module_load }`
   → empty `lsmod` → same vibrator / bootanim stall. **ADB was alive.**

Reproduce ABI check:

```bash
python3 scripts/check-module-abi.py <Module.symvers> <module.ko>
```

### What worked

| Step | Detail |
|------|--------|
| DEBUG boot | `panic=0`, VT/fbcon; artifact `.local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img` |
| Vendor | Repacked modules from same build; flash via **fastbootd** (`vendor_a` sparse); vbmeta `--disable-verity --disable-verification` |
| SELinux fix | Relabel `.ko` → `u:object_r:vendor_kernel_modules:s0` (`incrementalfs` → `vendor_incremental_module`) |
| Post-boot | `sys.boot_completed=1`, `drv2624` + ~40 modules loaded |
| SusFS | `dmesg`: `susfs_init … version: v1.5.5` |
| Manager | Spoofed `weogax.atbfxb.skiggr` **35153**; UI: driver 35153, SusFS v1.5.5, hook **Manual**, SELinux Enforcing |

`su` from adb: `uid=0` `u:r:ksu:s0`. No `/sys/fs/susfs` (normal for 1.5.5;
ioctl/supercall path).

### Architecture note (open)

MANUAL_HOOK + `CONFIG_KSU_SUSFS` remains a **local hybrid** vs upstream ReSukiSU
hook `choice`. This DEBUG build **boots** with that hybrid + matched vendor.
ChatGPT’s “hook ABI collision” theory is **not** required to explain the
vibrator hang; it remains a hypothesis for earlier logo→reboot trials that
were not re-run with matched vendor. Prefer a controlled **SusFS-inline,
no MANUAL**, min-features experiment later — do not treat hybrid as final
architecture.

Prepared but not on this boot: execve post-hook UAF patch
`vendor/sunfish/patches/007-kernelsu/0001-exec-avoid-post-hook-filename-uaf.patch`
(real bug; also present on root-only path → not SusFS-only panic proof).

---

## 2. Play Store “pending”

**Cause:** `DownloadService` crash loop:

```text
SecurityException: FGS type systemExempted requires
FOREGROUND_SERVICE_SYSTEM_EXEMPTED + (SCHEDULE_EXACT_ALARM | USE_EXACT_ALARM | VPN)
```

System `/system/priv-app/Phonesky` lacked `USE_EXACT_ALARM` in the **APK
manifest** (privapp XML alone is insufficient). Documented hotfix:

| Item | Path |
|------|------|
| Host | `/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk` |
| Laptop | `.local-artifacts/004-microg/Phonesky_exact-alarm.apk` |

```bash
adb install -r .local-artifacts/004-microg/Phonesky_exact-alarm.apk
```

Not in the bacon image yet (deferred with other API warnings). Next bacon must
ship the exact-alarm Phonesky prebuilt.

---

## 3. Modules reinstall

Installed with `su -M` (global mount ns; plain `su` often cannot see
`/data/adb` under SusFS) via `/data/adb/ksud module install …`:

| Module | id | Version |
|--------|-----|---------|
| ReZygisk | `rezygisk` | v1.0.0 (515) |
| TEESimulator-RS | `tricky_store` | v6.0.1-307 |
| Play Integrity Fix [INJECT] | `playintegrityfix` | v4.7-1-inject-s |

Zips staged under `.local-artifacts/007-kernelsu/modules/`. Versions matched
upstream `update.json` at install time. Reboot required after install; user
confirmed activated.

**TEESimulator targets:** default `target.txt` had Play/GMS + test apps only.
`com.yuh` and `com.swissquote.android` must be listed (GUI may not expose this;
edit `/data/adb/tricky_store/target.txt` or module action). Adding them was
necessary for TEEsim to bind those UIDs; it did **not** by itself clear Talsec.

Observed TEEsim noise: `StrongBox op limit reached (hw=4 sw=0 max=4)`,
`Skip patching short certificate chain of length null`.

**PIF note:** `pif.prop` spoofed **Pixel 6** (`oriole`) on sunfish — device
mismatch risk for banks; revisit fingerprint before next bank trial.

---

## 4. Banking (Yuh / Swissquote)

### Observed behaviour

- Both load **Talsec** `libts.so`.
- Swissquote (and Yuh after retries): `VM exiting with result code **-69**`
  then process death — intentional anti-root exit, **not** an uncaught Java
  crash. Same signature as 2026-09-15 captures (with/without TEEsim).
- Probes in logcat: `getenforce`, `/proc`, serial props, `qemu.*`, `ps` /
  `pid_max`, cache symlink, etc.
- Operator report: after many attempts Yuh **locked the app** citing **root**.

### Profile / policy gaps (spec US2 still open)

- Contract: banks **never** receive root; umount/hide must be **verified**.
- `.allowlist` contained both bank packages (binary profile); confirm in
  Manager UI: **Deny / Forbidden** + **Umount modules** for
  `com.yuh` and `com.swissquote.android` (all userIds tested).
- SusFS initialised ≠ verified path hide for banking UIDs.
- Island / work profile not re-validated in this session.

### Verdict on SusFS vs banks

SusFS **does not** replace: deny-root profiles, verified umount, coherent
attestation (TEEsim keybox/StrongBox), and PIF props matching the device.
Pipeline works; **both-bank PASS remains FAIL**.

---

## 5. Operational recipes (LAB)

### Flash matched DEBUG (fastbootd)

```bash
adb reboot fastboot   # userspace fastbootd
fastboot flash vendor_a .local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img
fastboot --disable-verity --disable-verification flash vbmeta_a .local-artifacts/007-kernelsu/vbmeta.img
fastboot flash boot_a .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot flash boot_b .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot reboot
```

Rollback vendor (host): `/srv/rom/artifacts/007-kernelsu/vendor-pre-debug-20260915.img`.

### Module install (after SusFS boot)

```bash
adb push <zip> /data/local/tmp/ksu-mods/
adb shell 'su -M -c "/data/adb/ksud module install /data/local/tmp/ksu-mods/<zip>"'
adb reboot
```

### TEESimulator bank targets

```bash
adb shell 'su -M -c "grep -E \"yuh|swissquote\" /data/adb/tricky_store/target.txt ||
  printf \"%s\\n\" com.yuh com.swissquote.android >> /data/adb/tricky_store/target.txt"'
```

---

## 6. Artifacts index

| Artifact | Location |
|----------|----------|
| DEBUG boot | `.local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img` |
| Vendor sparse (correct SELinux) | `.local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img` (+ host `…/vendor-repack/`) |
| Experiment dir | `a16-build:/srv/rom/artifacts/007-kernelsu/debug-20260916T115115Z/` |
| Module zips | `.local-artifacts/007-kernelsu/modules/` |
| Phonesky exact-alarm | `.local-artifacts/004-microg/Phonesky_exact-alarm.apk` |
| ABI checker | `scripts/check-module-abi.py` |
| RCA CRCs | `.local-artifacts/007-kernelsu/rca-20260916/` |
| Manager pin | `.local-artifacts/007-kernelsu/SPOOFED_MANAGER_PIN.txt` (35153) |

---

## 7. Open follow-ups (non-ordering commitment)

1. Bacon: ship exact-alarm Phonesky + always package `boot` with matching
   vendor modules (and correct `vendor_kernel_modules` labels).
2. Confirm Manager Deny + Umount for both banks; prove with `su` from bank UID
   and mount evidence (US2).
3. TEEsim StrongBox limit / keybox quality; PIF fingerprint → sunfish-coherent.
4. Optional control: SusFS-inline without MANUAL, min features, matched vendor.
5. Apply execve UAF patch on next kernel rebuild.
6. Do **not** claim banking PASS until Yuh + Swissquote usable sessions on the
   same stack (runbook hard-gate).