sunfish-admin
12d2179c20
Ship Magisk like GOLDEN; KernelSU optional recycle only; parallel to sunfish-a16-rom standby.
65 lines
2.1 KiB
Markdown
65 lines
2.1 KiB
Markdown
# Quickstart: 007 KernelSU + Yuh gate (LAB only)
|
|
|
|
**Device**: LAB `11231JEC207477` — never GOLDEN `11071JEC203839`
|
|
|
|
## Goal
|
|
|
|
Prove selective root + verified hide, then **Yuh and Swissquote PASS** in Island. Without both banks
|
|
passing, do not declare `007` done.
|
|
|
|
## Prerequisites
|
|
|
|
- Working `005` userspace stack on LAB (microG + Phonesky + spoofing)
|
|
- `007` boot image with pinned KernelSU-Next
|
|
- Island installed; Aurora available
|
|
- Baseline reading: `docs/002-golden-inventory.md`, `docs/002-lab-iodes-baseline.md`
|
|
|
|
## 1. Flash LAB
|
|
|
|
Use `docs/003-flash-lab.md` with the `007` artifact. Confirm:
|
|
|
|
```bash
|
|
SERIAL=11231JEC207477
|
|
adb -s "$SERIAL" shell getprop ro.lineage.version
|
|
# KernelSU manager present; grant root to one debug app only
|
|
```
|
|
|
|
## 2. Hide surface
|
|
|
|
1. Deny root for `com.yuh` and `com.swissquote.android` (all relevant users).
|
|
2. Enable umount/hide for those UIDs.
|
|
3. **Verify mounts** from a probe — see `contracts/ksu-hide-surface.md`.
|
|
|
|
## 3. SusFS (after step 2 green)
|
|
|
|
Enable SusFS per pin; confirm boot; re-check hide. Soak before claiming.
|
|
|
|
## 4. Attestation experiment
|
|
|
|
Apply TrickyStore-class (or equivalent) + any microG HA toggles under test.
|
|
Capture logcat around Yuh open (`keystore2`, KeyMint, RKP).
|
|
|
|
## 5. Banking (Island)
|
|
|
|
1. Aurora install Yuh/Swissquote → do not open on owner if following AXP order.
|
|
2. Clone into Island; first launch in Island.
|
|
3. Swissquote: must PASS a usable authenticated session.
|
|
4. Yuh: **must PASS** for feature acceptance (`contracts/banking-yuh-gate.md`).
|
|
|
|
## Pass criteria
|
|
|
|
- [ ] KSU selective root works
|
|
- [ ] Banking UIDs: root deny + verified hide
|
|
- [ ] SusFS claimed only if stable
|
|
- [ ] **Yuh PASS** in Island with evidence under `/srv/rom/artifacts/007-…`
|
|
- [ ] Swissquote PASS on the same stack
|
|
- [ ] No Magisk production image
|
|
|
|
## Failure
|
|
|
|
If either bank remains unusable after reasonable SusFS/attestation
|
|
iterations: stop, keep artifacts, mark `007` blocked — consider stock phone for
|
|
banks; do not ship “root without Yuh” as success.
|
|
|
|
Before any rooted flash, complete T039. Before acceptance complete T040.
|