Skip to content

Detect 'Log buffer size = Off' and show actionable error - #173

Merged
diabl0w merged 1 commit into
masterfrom
ccr-63634c5f-54f64z
Oct 22, 2026
Merged

diabl0w merged 1 commit into
masterfrom
ccr-63634c5f-54f64z

Conversation

@diabl0w

@diabl0w diabl0w commented Oct 22, 2026

Copy link
Copy Markdown
Owner

When persist.log.tag starts with 'S' (SILENT), Android's ShouldLog() short-circuits all LOG() macros, so sentry::sentry() is never called and the hook never fires, causing a silent 10-second timeout.
When developer options "Log buffer size" is set to "off", it writes "Settings" to persist.log.tag. (which is not intuitive as it seems the intention of that prop is to only be a verbosity filter, and "S" just happens to work)

When persist.log.tag starts with 'S' (SILENT), Android's ShouldLog()
short-circuits all LOG() macros, so sentry::sentry() is never called
and the hook never fires, causing a silent 10-second timeout.

Detect the condition early and surface a clear error message pointing
the user to Developer Options → Log buffer size.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LBe2fnb1R2tfnd9drHHeSw
@diabl0w
diabl0w merged commit aff18a7 into master Oct 22, 2026
8 checks passed
diabl0w added a commit that referenced this pull request Oct 22, 2026
When persist.log.tag starts with 'S' (SILENT), Android's ShouldLog() short-circuits all LOG() macros, so sentry::sentry() is never called and the hook never fires, causing a silent 10-second timeout.
When developer options "Log buffer size" is set to "off", it writes "Settings" to persist.log.tag. (which is not intuitive as it seems the intention of that prop is to only be a verbosity filter, and "S" just happens to work)
yonggamer pushed a commit to yonggamer/DirtyFrag that referenced this pull request Nov 1, 2026
Brings in the eight upstream commits between our 1.16 merge base (d3cd07a) and the
v4.7 tag - six of substance, plus two version bumps that resolve to our own:

- 6179d57 "Bug fixes and simplification" (mitschud#139). patch_fn_ret_zero no longer
  decodes a BTI/PACIASP/PACIBSP preamble and no longer picks retaa/retab per SoC:
  it unconditionally writes three words - BTI C, MOV x0,#0, RET - which is a
  valid landing pad whether or not BTI is enforced, and RET is correct because we
  are replacing the whole prologue, not branching into the middle of one. In
  bootstrap.c the fork() that rewrote /proc/self/attr/current to u:r:init:s0 is
  gone; the LKM now writes that context through
  echo -n 'u:r:init:s0' > /proc/self/attr/exec inside the usermodehelper command,
  so the context switch happens at the exec instead of in a child we then wait on.
- 0fed9a8 "Fix kernel compatibility".
- 452191a "Fix oppo devices": the section diet moves from an llvm-objcopy pass to
  the compiler (-Qn -fno-addrsig), and the root Makefile drops its objcopy pass.
- ae2ed2b guards the new avc_has_perm / avc_has_perm_noaudit patches behind a
  readback of selinux_state, for kernels built with
  CONFIG_SECURITY_SELINUX_DEVELOP=n where writing selinux_state is a no-op (diabl0w#172).
- 779b3be makes ExploitRunner stop with an actionable message when persist.log.tag
  starts with S - Developer Options "Log buffer size = Off" leaves the exploit
  blind to its own logcat output (diabl0w#173).
- 4ec133c adds the GPL-2.0 LICENSE file the upstream maintainer asked for, which
  lands here too: this fork is GPLv2 from this commit on.

Conflict resolutions:
- app/build.gradle.kts: keep DirtyFrag versioning rather than upstream's
  407 / "4.7" - now versionCode 34, versionName 1.17.
- .gitignore: keep our app/keystore.jks, *.log and apk/ and take upstream's
  .DS_Store.

Nothing else conflicted. exp.c carries only fork work and upstream never touched
it; bootstrap.c, lkm/dfroot.c and ExploitRunner.java had no fork-side edits after
the 1.16 merge, so upstream's versions apply cleanly on top of them.

The eight tracked app/src/main/jni/ko/dfroot-<KMI>.ko are deliberately NOT
refreshed in this merge: they are still built from the 1.16 (upstream 4.5) tree.
Rebuilding them needs the ghcr.io/ylarod/ddk-min containers that the LKM Makefile
and the build-lkms CI job drive, and this box has no container runtime. CI rebuilds
all eight from source on every push and downloads them into jni/ko/ before the APK
is assembled, so a CI-built 1.17 APK does contain the avc, oppo and kernel-compat
fixes. Only a locally built 1.17 APK would still ship the 1.16 modules, and the
tracked copies should be refreshed from the build-lkms artifacts before the 1.17
tag, the way d9c8861 did for 1.16.

minSdk stays 32 - upstream did not change it.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants