| … | … | @@ -118,12 +118,14 @@ The pgh **daemon** (pgh-sidecar / pgv3) talks over a pathname UNIX socket (`svc. |
| 118 | 118 | - Exploit-root: security patch **2018-06** → Dirty COW/QuadRooter patched; and uid-0 ≠ setenforce (denial is domain-based) so it wouldn't clear `link` anyway. |
| 119 | 119 | - postmarketOS: **no A002A port exists** + needs unlock regardless. |
| 120 | 120 | |
| 121 | | **BUT unlock IS achievable via the documented ENG-firmware route — PROVEN-VIABLE, NOT YET EXECUTED:** |
| 122 | | 1. Flash ASUS-signed **ENG firmware** via EDL (`edl.py` on Linux + the **public** generic 8996 firehose). ENG is ASUS-signed → the locked secure bootloader accepts it. **← destructive: WIPES the device.** |
| 123 | | 2. ENG firmware has `fastboot oem unlock` **enabled** → unlock → Magisk root → `setenforce 0` → hardlinks. Root also collapses the other no-root hacks at once (pathname UDS → drop abstract-socket; real boot service → 24/7; true chroot → drop proot). |
| 124 | | - **Artifacts (exist, GATED):** `V570KL_all_WW_eng_T3.0.6.raw.7z` (599M), `V570KL-ENG-Firmware-Emergency-Download-Tool-QFiL.7z` (113M = QFIL+firehose), `ENG-Firmware-V570KL-T3.0.6-Toshiba2.0-128G.bin.7z` (1.4G, matches our **eMMC-128G / Toshiba** variant). On azROM.net / GiveMeROM.com / HalabTech — **registration/paywall-gated** (NOT on ASUS CDN, NOT in Wayback). |
| 125 | | - **Recovery net:** stock RAW **is** live on ASUS CDN — `https://dlcdnet.asus.com/pub/ASUS/ZenFone/V570KL/VZW_V570KL_V378_all_user.zip` (2.24G, HTTP 200); our current = `VZW_V570KL_V3.8.3`. So an EDL brick is recoverable (CDN host moved `dlcdnlpdv`→`dlcdnet`). |
| 126 | | - **STATUS = blocked only on acquiring the gated ENG firmware; flash NOT attempted.** ⚠ adb gotchas: `adb tcpip 5555` dies on reboot (re-issue over USB); after reboot USB needs a udev rule (`SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", MODE="0660", GROUP="plugdev"` + physical replug). |
| 121 | **⛔✅ UNLOCK — CORRECTED 2026-07-29 (deep research). The earlier "PROVEN-VIABLE ENG route" here was WRONG. Full spec = pear-git org issue #11.** |
| 122 | |
| 123 | 1. **`fastboot oem unlock`-after-ENG is UNPROVEN + CONTRADICTED.** The claim traced to ONE 2018 XDA post (`aamszia`); THREE later V570KL owners failed first-hand on the same build (`jal3223`/`t-mobile_mda`/`turbokherson` → `FAILED (remote: oem unlock is not allowed)`). The "corroborations" were on the DIFFERENT **V520KL** (genuinely unlockable). 8 years, ZERO V570KL TWRP/ROM/root. Real verb on this family = `fastboot oem asus-go` w/ ASUS-signed blob; bare `oem unlock` → `invalide signature`. **DO NOT count on `oem unlock`.** |
| 124 | 2. **The REAL path = EDL 9008 firehose write, BELOW the fastboot lock** (how the sibling V520KL was actually solved). Public **ASUS msm8996Pro UFS firehose loaders EXIST + byte-verified**: `bkerler/Loaders` → `asus_wingtech/0005f0e110438996_18000eb7c3a236d5_fhprg_peek.bin` (cert HW_ID 0005F0E1/OEM 1043 ASUS/MODEL 8996, from ASUS's ZS570KL tree), republished byte-identical as `thantoeaungat/firehose` → `prog_ufs_firehose_8996_ddr_as3.elf`. ⚠ AR is **UFS** (the V520KL recipe's `prog_emmc_...` is WRONG). AFT dead (`ftp.asus.com` NXDOMAIN) → EDL is the ONLY write path. **← still WIPES.** |
| 125 | 3. ★ **THE ONE GATING EXPERIMENT (never done on V570KL):** does that firehose pass THIS fused unit's eFuse HW-ID check? Test = EDL port 9008 → `edl printgpt` w/ the ASUS/Ares loader. Sahara accepts + prints UFS GPT → path OPEN. Rejects → DEAD END, proot/bare stack is the ceiling. **DECISION: we WILL run this — DEFERRED (not now).** |
| 126 | - **ENG raw is FREE** (was recorded paywalled): Google Drive id `1cizBJWHG1oDduMcImWAE_jSsbfQ5TJi6` (1.82 GiB, md5 `5ccc9f70…`, genuine WW eng). Only the **113 MB QFIL/emergency pkg** (host firehose + rawprogram/patch XML) is paywalled (azROM ~$0.40 / HalabTech ~$5). Stock recovery LIVE on ASUS CDN (V378 2.24G + V381 2.27G, Jan-2025) → EDL brick recoverable. |
| 127 | - **⛔ Even a successful port does NOT fix idle power:** pmOS msm8996 ships `CONFIG_ARM_PSCI_CPUIDLE` OFF (enabling → lockups) → idle core hits bare `wfi` → SoC idles **~2.3 W / ~70 °C** (open mainline gap). Weigh HARD vs a $40 OnePlus 3T (trivially unlockable, same SoC + same gotcha). Downstream of unlock IS easy though: ASUS GPL kernel survives (`github.com/crpalmer/zs571kl_stock_kernel`, board codename SIVA), exact-combo DTS template = `msm8996pro-xiaomi-natrium.dts`, Tango cleanly ignorable, headless DTS days-to-weeks. See #11 for the full write-up + gotchas. |
| 128 | - ⚠ adb gotchas: `adb tcpip 5555` dies on reboot (re-issue over USB); after reboot USB needs a udev rule (`SUBSYSTEM=="usb", ATTR{idVendor}=="0b05", MODE="0660", GROUP="plugdev"` + physical replug). And `adb devices` empty despite USB present → `adb kill-server` + retry (fixed it this session). |
| 127 | 129 | |
| 128 | 130 | ## ✅ adb-independent 24/7 autostart via Termux:Boot (SHIPPED + reboot-proven 2026-07-14) |
| 129 | 131 | |
| … | … | @@ -298,6 +300,39 @@ pubkey mode); a key absent from the allow-list reads as **deny**, and hyperdht d |
| 298 | 300 | invisible to the client → `PEER_CONNECTION_FAILED` / silent hang. sshd on **:8022** rejects |
| 299 | 301 | `fleeky` (publickey,password). Plain `mosh`/`ssh` fail because there is no sshd on :22. |
| 300 | 302 | |
| 303 | **8. ⛔★ "celltron is down" was a WiFi AUTO-JOIN HIJACK, not a service/DHT fault (FIXED 2026-08-07).** |
| 304 | Recurred daily. Mechanism, read straight off the `dumpsys wifi` WifiStateMachine ring buffer: |
| 305 | a neighbour's **Xfinity hotspot sat at −40 dBm — STRONGER than the home AP's best BSSID |
| 306 | (−49)** — and `xfinitywifi` was saved at **PRIO 95, above `prsm space`'s 86**. On any |
| 307 | momentary drop, auto-join scored it top (`final score:95140` = RSSI 100 + 5GHz bonus 40), |
| 308 | associated, failed the captive portal, got temp-disabled, rescanned, tried it AGAIN, and only |
| 309 | then crawled back — a **1–3 min outage per cycle**, repeating as the temp-disable expired. |
| 310 | - The `CMD_IP_CONFIGURATION_LOST failures: 1/9` → self-deauth (`reason=3`) in the same trace |
| 311 | is **collateral from the churn, not the trigger**. Don't chase DHCP. |
| 312 | - ⚠ **Diagnose from the ring buffer, not logcat** — logcat is so spammy here it had already |
| 313 | rolled past the 6-minutes-ago event. `dumpsys wifi > f` then grep |
| 314 | `SUPPLICANT_STATE_CHANGE_EVENT`, `IP_CONFIGURATION_LOST`, `final score:`, and the |
| 315 | `^[-*] (DSBLE )?ID: n SSID:` saved-network list (`DSBLE` = *temporary* auto-disable after a |
| 316 | failure, NOT "user disabled" — it expires and the hijack returns). |
| 317 | - ⚠ **`ip -4 addr` showing only `lo` does NOT mean the interface is gone.** `wlan0` was UP but |
| 318 | `DORMANT` mid-flap; `ip link` still listed it. Check `ip link` before concluding driver death. |
| 319 | - ✅ **FIX = forget the network.** No adb path on API 24: `cmd wifi` → *"No shell command |
| 320 | implementation"* (Android 10+) and `wpa_supplicant.conf` is root-only, so it MUST go through |
| 321 | the Settings UI. ASUS skin has **no** "Saved networks" in the WiFi overflow, and |
| 322 | `.Settings$SavedAccessPointsSettingsActivity` **crashes** (`IllegalArgumentException: Invalid |
| 323 | fragment` — not whitelisted) while `.SubSettings` is **not exported** to uid 2000. The route |
| 324 | that works: `am start -a android.settings.WIFI_SETTINGS` → overflow (1374,190) → **Advanced** |
| 325 | → **Manage networks** → tap a row → dialog with **Cancel/Forget** → tap Forget. |
| 326 | - Scripted the whole purge with `uiautomator dump` + `input tap` (parse |
| 327 | `text="…" bounds="[x1,y1][x2,y2]"`, always re-dump between taps since the list re-flows). |
| 328 | **95 saved networks → 2** (kept `prsm space`; kept `Prsm`, a separate SSID at PRIO 90). |
| 329 | Script: scratchpad `purge.py`. ~5.5 s/network. |
| 330 | - ⚠ Leftover risk: `Prsm` is PRIO **90 > `prsm space`'s 86**. Harmless only while it is not in |
| 331 | range — if that SSID ever appears nearby it becomes the next hijacker. |
| 332 | - Sanity anchors from this session: `wifi_sleep_policy=2` and `stay_on_while_plugged_in=3` were |
| 333 | already correct, network was `VALIDATED`/`everCaptivePortalDetected{false}`, uptime 9.7 days |
| 334 | (no reboot), battery 64→75% charging at 30 °C. **None of the usual suspects.** |
| 335 | |
| 301 | 336 | ## Quick command reference |
| 302 | 337 | |
| 303 | 338 | ```bash |