AXP-Resurection/docs/007-lab-results-20260916.md

007 LAB results — 2026-09-16

LAB only: serial 11231JEC207477. GOLDEN not used.
Build base: 23.2-20260915-UNOFFICIAL-sunfish.
Kernel under test: ReSukiSU 35153 + SusFS v1.5.5, DEBUG boot #8 … Wed Sep 16 12:09:18 UTC 2026 (boot-resukisu-susfs-DEBUG-20260916T115115Z.img).

Related: source audit, attempts brief, runbook.

Executive summary

Area	Result
SusFS + ReSukiSU boot (matched vendor)	PASS
Manager 35153 + susfs_init	PASS
Play downloads (system Phonesky alone)	FAIL → fixed with exact-alarm APK hotfix
TEESimulator-RS + ReZygisk + PIF inject	Installed and running
Yuh / Swissquote usable session	FAIL (Talsec root detect / exit -69)
SusFS as banking hide by itself	Not sufficient (expected; US2/attestation still open)

Bottom line: The SusFS bring-up pipeline works end-to-end (build → matched boot+vendor → modules load → Manager sees SusFS). Banking PASS is still blocked by root/environment detection; SusFS did not clear that gate.

---

1. Boot / SusFS bring-up

What failed earlier (corrected causality)

1. Boot-only SusFS flashes left LAB on an old /vendor/lib/modules set. With CONFIG_MODVERSIONS=y, drv2624 (and peers) disagreed on CRCs (31/56 incl. module_layout). That matches the T004038Z-class hang in VibratorManagerService when the module never loads — not proof of the later early-panic series.
2. First matched-module attempt used a hand-repacked vendor.img with wrong SELinux labels (vendor_file instead of vendor_kernel_modules). init-insmod-sh got avc: denied { module_load } → empty lsmod → same vibrator / bootanim stall. ADB was alive.

Reproduce ABI check:

python3 scripts/check-module-abi.py <Module.symvers> <module.ko>

What worked

Step	Detail
DEBUG boot	panic=0, VT/fbcon; artifact .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
Vendor	Repacked modules from same build; flash via fastbootd (vendor_a sparse); vbmeta --disable-verity --disable-verification
SELinux fix	Relabel .ko → u:object_r:vendor_kernel_modules:s0 (incrementalfs → vendor_incremental_module)
Post-boot	sys.boot_completed=1, drv2624 + ~40 modules loaded
SusFS	dmesg: susfs_init … version: v1.5.5
Manager	Spoofed weogax.atbfxb.skiggr 35153; UI: driver 35153, SusFS v1.5.5, hook Manual, SELinux Enforcing

su from adb: uid=0 u:r:ksu:s0. No /sys/fs/susfs (normal for 1.5.5; ioctl/supercall path).

Architecture note (open)

MANUAL_HOOK + CONFIG_KSU_SUSFS remains a local hybrid vs upstream ReSukiSU hook choice. This DEBUG build boots with that hybrid + matched vendor. ChatGPT’s “hook ABI collision” theory is not required to explain the vibrator hang; it remains a hypothesis for earlier logo→reboot trials that were not re-run with matched vendor. Prefer a controlled SusFS-inline, no MANUAL, min-features experiment later — do not treat hybrid as final architecture.

Prepared but not on this boot: execve post-hook UAF patch vendor/sunfish/patches/007-kernelsu/0001-exec-avoid-post-hook-filename-uaf.patch (real bug; also present on root-only path → not SusFS-only panic proof).

---

2. Play Store “pending”

Cause: DownloadService crash loop:

SecurityException: FGS type systemExempted requires
FOREGROUND_SERVICE_SYSTEM_EXEMPTED + (SCHEDULE_EXACT_ALARM | USE_EXACT_ALARM | VPN)

System /system/priv-app/Phonesky lacked USE_EXACT_ALARM in the APK manifest (privapp XML alone is insufficient). Documented hotfix:

Item	Path
Host	/srv/rom/artifacts/005-spoofing/Phonesky_exact-alarm.apk
Laptop	.local-artifacts/004-microg/Phonesky_exact-alarm.apk

adb install -r .local-artifacts/004-microg/Phonesky_exact-alarm.apk

Not in the bacon image yet (deferred with other API warnings). Next bacon must ship the exact-alarm Phonesky prebuilt.

---

3. Modules reinstall

Installed with su -M (global mount ns; plain su often cannot see /data/adb under SusFS) via /data/adb/ksud module install …:

Module	id	Version
ReZygisk	rezygisk	v1.0.0 (515)
TEESimulator-RS	tricky_store	v6.0.1-307
Play Integrity Fix [INJECT]	playintegrityfix	v4.7-1-inject-s

Zips staged under .local-artifacts/007-kernelsu/modules/. Versions matched upstream update.json at install time. Reboot required after install; user confirmed activated.

TEESimulator targets: default target.txt had Play/GMS + test apps only. com.yuh and com.swissquote.android must be listed (GUI may not expose this; edit /data/adb/tricky_store/target.txt or module action). Adding them was necessary for TEEsim to bind those UIDs; it did not by itself clear Talsec.

Observed TEEsim noise: StrongBox op limit reached (hw=4 sw=0 max=4), Skip patching short certificate chain of length null.

PIF note: pif.prop spoofed Pixel 6 (oriole) on sunfish — device mismatch risk for banks; revisit fingerprint before next bank trial.

---

4. Banking (Yuh / Swissquote)

Observed behaviour

• Both load Talsec libts.so.
• Swissquote (and Yuh after retries): VM exiting with result code **-69** then process death — intentional anti-root exit, not an uncaught Java crash. Same signature as 2026-09-15 captures (with/without TEEsim).
• Probes in logcat: getenforce, /proc, serial props, qemu.*, ps / pid_max, cache symlink, etc.
• Operator report: after many attempts Yuh locked the app citing root.

Profile / policy gaps (spec US2 still open)

• Contract: banks never receive root; umount/hide must be verified.
• .allowlist contained both bank packages (binary profile); confirm in Manager UI: Deny / Forbidden + Umount modules for com.yuh and com.swissquote.android (all userIds tested).
• SusFS initialised ≠ verified path hide for banking UIDs.
• Island / work profile not re-validated in this session.

Verdict on SusFS vs banks

SusFS does not replace: deny-root profiles, verified umount, coherent attestation (TEEsim keybox/StrongBox), and PIF props matching the device. Pipeline works; both-bank PASS remains FAIL.

---

5. Operational recipes (LAB)

Flash matched DEBUG (fastbootd)

adb reboot fastboot   # userspace fastbootd
fastboot flash vendor_a .local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img
fastboot --disable-verity --disable-verification flash vbmeta_a .local-artifacts/007-kernelsu/vbmeta.img
fastboot flash boot_a .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot flash boot_b .local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
fastboot reboot

Rollback vendor (host): /srv/rom/artifacts/007-kernelsu/vendor-pre-debug-20260915.img.

Module install (after SusFS boot)

adb push <zip> /data/local/tmp/ksu-mods/
adb shell 'su -M -c "/data/adb/ksud module install /data/local/tmp/ksu-mods/<zip>"'
adb reboot

TEESimulator bank targets

adb shell 'su -M -c "grep -E \"yuh|swissquote\" /data/adb/tricky_store/target.txt ||
  printf \"%s\\n\" com.yuh com.swissquote.android >> /data/adb/tricky_store/target.txt"'

---

6. Artifacts index

Artifact	Location
DEBUG boot	.local-artifacts/007-kernelsu/boot-resukisu-susfs-DEBUG-20260916T115115Z.img
Vendor sparse (correct SELinux)	.local-artifacts/007-kernelsu/vendor-DEBUG-modules.sparse.img (+ host …/vendor-repack/)
Experiment dir	a16-build:/srv/rom/artifacts/007-kernelsu/debug-20260916T115115Z/
Module zips	.local-artifacts/007-kernelsu/modules/
Phonesky exact-alarm	.local-artifacts/004-microg/Phonesky_exact-alarm.apk
ABI checker	scripts/check-module-abi.py
RCA CRCs	.local-artifacts/007-kernelsu/rca-20260916/
Manager pin	.local-artifacts/007-kernelsu/SPOOFED_MANAGER_PIN.txt (35153)

---

7. Open follow-ups (non-ordering commitment)

1. Bacon: ship exact-alarm Phonesky + always package boot with matching vendor modules (and correct vendor_kernel_modules labels).
2. Confirm Manager Deny + Umount for both banks; prove with su from bank UID and mount evidence (US2).
3. TEEsim StrongBox limit / keybox quality; PIF fingerprint → sunfish-coherent.
4. Optional control: SusFS-inline without MANUAL, min features, matched vendor.
5. Apply execve UAF patch on next kernel rebuild.
6. Do not claim banking PASS until Yuh + Swissquote usable sessions on the same stack (runbook hard-gate).