What is new since 0.4

Added (45)

A second root path: Dirty Frag

• add the universal root, ported from DFRoot
• choose the payload tier, and offer a KMI-generic one
• keep the universal root and the payload flow apart
• ask before a universal run starts
• list the DirtyFrag root in the payload sheet
• root at boot with the DirtyFrag chain

The system-uid helper flow

• port the Dirty Frag stage two and drive it from the app
• ship the stage two inside the app, so the flow needs no file picking
• give the helper this project's id, name, daemon and icon
• install only the helper this app ships, and refuse without one
• replace a helper that is not the build this app ships
• install the helper through Shizuku's shell when there is no root
• read and drive the flow through Shizuku when root is absent
• give stage two the app's screen and a way in for the app
• show every reading the flow acts on in its panel
• put the helper's build numbers in the flow's own panel
• lay the flow's actions out as a grid that shows the step
• stack the flow's actions vertically and cap the process log
• hand the controller back through a service, and say what a run did
• restart the userspace from the app when the helper loads KernelSU
• read whether SELinux is enforcing
• port the D2 fix so Odin stays reachable, off by default
• confirm the clean-up, naming what it will remove

Boot automation

• reroot the phone at boot through the stage-two helper
• read out whether the daemon stage file is armed
• enable reboot after root by default

Payloads, the manager and the exploit

• serve the official catalog beside our own by default
• install the payload's manager when a phone has none
• let a run choose the p0 write window's base
• load the permissive module, with the kernel checked first

The screen, the settings and history

• add a first-run guide, an FAQ and screen-off during runs
• answer whether this phone's kernel can still be rooted
• make a run a live update on Android 16
• give a shared answer an optional progress slot
• buzz once when a run fails
• make advanced mode the default
• derive the KernelSU flavour from the payload
• list what the app left in three places, and delete what you pick
• fold the residue folders into closed headings with their own delete
• list and clear the cached p0 offset
• wrap, elide and de-tick the run's log for the screen
• measure how long a run takes to root the phone
• put the root duration beside the verdict in the list
• keep a pairing authorized instead of expiring it after a week
• empty /data/adb and /data/local/tmp on reboot and unroot

Fixed (41)

Root paths and the run screen

• clear every root gate before a reboot and unroot
• stage the universal root's daemon in device-protected storage
• write the run's kind into its history record
• explain the exit code that means a command never ran
• fill the run bar's rows evenly, and tint the restart

The helper flow

• reject a zero-byte packages.xml backup
• read packages.xml's metadata from the original, not the backup
• keep the key removal the last write before the restart
• read the helper's daemon from a copy system_server can open
• stage this device's own daemon for the helper, not the installed one
• keep the daemon stage file armed for the next boot
• exec the daemon with the arguments it actually declares
• stage a daemon that answers with the version this device runs
• carry the removal into the restart that applies it
• finish the system uid flow, from the daemon it stages to the key it removes
• read this boot's uptime from the app's own clock, and ask for the restart a clean-up owes
• clear a clean-up record only when its own half landed
• tell a full disk apart from a build with no helper
• give the inject's packages.xml copies this fork's own names
• stage the daemon at the path the exploit has compiled in
• require a trusted launcher before honoring autorun
• paint the helper's screen in the app's own colours
• make the log scroll and put the boot's files in a card

Boot gates

• make the two root-on-boot gates mutually exclusive
• start the boot services as specialUse, not dataSync

Shizuku, ADB and the shells

• refuse a command whose output was still being read, for the root shell and for Shizuku
• ask the remote for a bounded wait instead of probing it
• give every command and staging a window
• stop reporting an unreadable authorization timeout as permanent

Settings, the interface and the copy

• stop saying a run turns the screen off unasked
• leave the screen on unless a run is asked to put it out
• stop waiting out the boot by default
• make the KernelSU flavour row a readout that takes no tap
• keep the payload picker's actions on screen for a long list
• take the floating bar away for a step that owns the window

Residue

• never delete the files a run reads
• say which paths a folder delete takes, not "everything"

The exploit, the payload and the manager

• hand the payload the p0 offset this boot already won
• stop handing the payload a cached slide offset
• stop an install that cannot answer from holding the run

Changed (18)

One shared answer set

• add one shared set of answers and move the flow onto it
• ask the shell's first four questions with the shared answer set
• finish the shell's dialogs on the shared answer set
• align the install screen's answers with the shared set
• draw every action button with the shared vocabulary
• draw every busy answer with the shared button
• move the reboot, recovery and wireless-adb answers onto the set
• move the clearing, Shizuku and editor dialogs onto the answer set
• move the residue screen's four questions onto the answer set

Where a run starts and what it says

• make the payload picker the only way into a run
• drop the install-manager offer from the confirmation dialog
• say nothing about the manager in the start confirmation
• report only the payload's manager on the home card
• share one settle floor between both boot gates
• say what the app does in plain words

Reverted

• stop deriving the payload's post-boot window from the app
• stage the installed daemon for the helper again
• drop the permissive module's screen, load and file handling