Root My Galaxy 0.3.70

SHA-256: bd40b0b80923eabd52f714cee516d2bb2b4479f2c5b540a54344638026539f79

Changes since v0.3.69.

What's changed

• #56 Restore native KernelSU soft reboot and root-first Shizuku
• #57 Add guarded Advanced root recovery tools

Full changelog

Detailed pull-request notes for all changes included in this release.

#56 — Restore native KernelSU soft reboot and root-first Shizuku

Fix the post-root userspace flow after the ZZI4 hardware validation.

Hardware diagnosis

• The exploit/root path itself completed successfully on ZZI4.
• /data/local/tmp/rmg-postroot-keeper.log showed the post-root keeper aborting on Meta-Overlayfsx ext4 image never became mounted before any userspace restart.
• That gate is circular for soft reboot: the KernelSU userspace lifecycle is what is responsible for recreating metamodule/module mounts.

Soft-reboot changes

• Remove the Meta-Overlayfsx/ViPER pre-restart readiness gates from the keeper.
• Remove direct ctl.restart zygote; the app no longer emulates soft reboot with a zygote-only refresh.
• Delegate the transition to the already-installed /data/adb/ksud soft-reboot, so KernelSU owns reset/stop/post-fs-data/metamodule mounts/start/services/boot-completed in its native init-context flow.
• Keep boot-id single-owner/idempotence guards.
• Do not report success merely because the detached keeper forked. The launcher handshake is published only after ksud soft-reboot returns success, proving KernelSU accepted its daemonized native worker.
• A concurrent same-boot caller observes the real owner's shared acceptance marker and never issues a second soft-reboot command.
• Fail closed on /data/adb/ksud only; do not fall back to a target-named /data/local/tmp binary that might embed a stale/wrong LKM.

KernelSU/ZZI4 safety boundary

• No exploit or payload changes.
• No late-load call from post-root code.
• No .ksud-stage manipulation.
• No replacement/restaging of /data/adb/ksud.
• The existing S938B staged-daemon + PID1 mount-namespace hotfix remains untouched.

Shizuku after soft reboot

• On framework BOOT_COMPLETED, probe Binder first and then prefer already-active KernelSU root before Wi-Fi/mDNS/ADB.
• Prefer the authenticated RMG root-helper bridge; use direct KernelSU su only after a bounded id probe proves uid=0.
• Keep the existing Wi-Fi/ADB path as fallback for cold boots where ephemeral KernelSU is not active.
• Root-only startup no longer calls Wireless ADB cleanup or changes adb_wifi_enabled; TemporaryWirelessAdb.use continues to own cleanup only when the ADB branch is actually entered.
• Auto Root remains boot-id gated and independent; a userspace reboot can restart Shizuku without re-running the exploit.

Documentation

• Refresh the app README for CZG3 + current ZZI4/Android 17 state, Tracefs + physical-alias writer policy, current routePolicy, KernelSU staged-daemon invariants, native soft reboot and root-first Shizuku.
• Refresh docs/POSTROOT_AUTOMATION.md to match the actual implementation.

Validation

• Temporary branch preflight run 34404168930 completed successfully on the final code/test HEAD before the workflow was removed.
• Passed :app:testDebugUnitTest, :app:lintDebug, :app:assembleRelease and post-root source invariants.
• Unit tests enforce: native ksud soft-reboot, no zygote restart, no late-load/restaging, /data/adb/ksud only, post-ksud acceptance handshake, same-boot ownership behavior, and absence of OverlayFSx/ViPER pre-gates.

#57 — Add guarded Advanced root recovery tools

Summary

• add Advanced recovery actions for Restart Zygote, Reload KernelSU modules, KernelSU soft reboot, and Reboot & unroot
• require hold-to-confirm for every recovery action
• replace the automatic post-root KernelSU soft reboot option with the lighter Restart Zygote behavior while preserving the existing stored opt-in
• require global late-load/PID1 mount readiness before post-root restart paths
• make Reboot & unroot synchronously disable Auto Root before scheduling the full reboot
• adapt module reload to RMG's same-boot late-load replay guard and verify readiness again after the lifecycle replay
• add English and pt-BR descriptions/use cases

Validation

The temporary branch CI ran :app:testDebugUnitTest, :app:lintDebug, and :app:assembleRelease successfully against the generated integration before committing those exact changes. The temporary workflow was removed from the final diff.

Runtime validation still required

Before merging, test on the target S938B late-load setup:

1. automatic Restart Zygote after a successful root and confirm Zygisk/LSPosed attach
2. manual Restart Zygote
3. Reload KernelSU modules, especially metamodule mounts and boot-completed marker recovery
4. KernelSU soft reboot
5. Reboot & unroot with Auto Root enabled, confirming the next boot remains unrooted

No exploit timings, tracefs/P0/FOPS path, or kernel payload were changed.

Payload provenance

• Payload commit: 90123a82a0a25c91bc3713fa23f9cc4460ab7d33
• Root helper SHA-256: 788611baf566f0ca9008d28fa7d1b1edb4657efc56e4b5ac24b319ae12519dd4
• Root helper synchronized from feed: true