Root My Galaxy 0.3.51

SHA-256: 8c93178832c76185372e273d6e3f58d637b735074c61df344bc4e138d1677178

Changes since v0.3.50.

What's changed

• #41 Unify standalone and Shizuku payload launch

Full changelog

Detailed pull-request notes for all changes included in this release.

#41 — Unify standalone and Shizuku payload launch

Problem

Manual Shizuku launched /system/bin/sh -c true with the exploit in LD_PRELOAD, while standalone and Auto Root launched the native helper with --run-payload. That bypassed the helper's detached payload child, setsid, persistent log setup, log relay, and explicit dlopen lifecycle only for Shizuku.

A P1 review also identified a lifecycle regression in the first unification patch: --run-payload forks the actual payload, clears its parent-death signal and calls setsid(), so killing only the Shizuku remote helper on stall/timeout/coroutine cancellation could leave the payload running.

Solution

• Build one helper --run-payload command for both transports.
• Use the staged helper, payload and log paths under Shizuku.
• Keep the experimental environment identical and remove transport-specific loader variables.
• Wrap only the returned Shizuku Process with explicit cancellation ownership.
• Normal Shizuku execution remains direct helper --run-payload; there is no /proc polling or extra shell in the race hot path.
• On Process.destroy(), launch an out-of-band Shizuku cleanup keyed by the unique RMG_RUN_ID inherited by the helper/payload descendants.
• The cleanup records cve43499-run session leaders (set only after the payload child succeeds at setsid()), sends TERM then KILL to those process groups and to all matching PIDs, then destroys the original remote helper.
• Cleanup is idempotent with AtomicBoolean and bounded to two seconds.
• Add unit coverage for both loader command shapes, absence of LD_PRELOAD, and the run-scoped cancellation command.

Safety and compatibility

This does not change the CZG3 60 ms FOPS delay, 120 s boot gate, P0 parameters, offsets, retries, observer lifecycle, mutation handling, cache-gate behavior, or fail-closed decisions. Shizuku still owns the remote execution context; only final loader choreography and cancellation ownership are normalized.

Validation

Original PR commit:

• focused ExploitRunControlTest — passed
• testDebugUnitTest, lintDebug, assembleRelease — passed; 88 tests, 0 failures/errors/skips
• git diff --check — passed
• payload make host-test — passed; payload repo unchanged

Lifecycle follow-up:

• changed Kotlin cancellation/wrapper code compiled locally with kotlinc
• cancellation shell syntax checked locally
• cancellation behavior exercised against a fake helper that forks a child, calls setsid(), names it cve43499-run, and inherits RMG_RUN_ID; both helper and detached child were terminated
• no GitHub Actions workflow was added or modified