Skip to content

Fix the 6.5 terminal crash and a batch of reported guest issues - #131

Merged
zalexdev merged 1 commit into
mainfrom
fix/6.5-issues
Oct 6, 2026
Merged

zalexdev merged 1 commit into
mainfrom
fix/6.5-issues

Conversation

@zalexdev

@zalexdev zalexdev commented Oct 6, 2026

Copy link
Copy Markdown
Owner

The terminal crashed on every device in 6.5. 93bb868 added -Wl,-z,max-page-size=16384 together with -Wl,-z,common-page-size=16384 to the terminal module. With NDK r25's lld the second flag rounds PT_GNU_RELRO up to a 16K boundary, so RELRO ends at 0xc000 while the last PT_LOAD ends at 0xa000. Bionic then mprotects a range whose tail is unmapped and dlopen fails with ENOMEM, reported as "can't enable GNU RELRO protection ... Out of memory". Dropping common-page-size lands RELRO exactly on the page end of the last PT_LOAD and keeps the 16K segment alignment that SDK 36 needs. JNI no longer aborts the process when the library will not load: the session prints the reason into the terminal instead of throwing out of View.onLayout.

Closes #122, #126, #130.

Monitor mode could not be turned back off. disableMonitorModeRootless targeted the base interface even after airmon-ng had renamed it to *mon, and verified with "if (stillMon) stillMon = ..." instead of an or, so it reported success while the radio stayed in monitor. Both paths now resolve the interface that is actually in monitor, retry with iw set type managed, and report honestly.

The guest core was redeployed on every check because GuestCore.VERSION was "6" while the payload carried "5", so the version compare never matched and the agent was restarted in a loop. The restart also left stryker-ptyd alive, since pkill -f stryker-agentd does not match it, and the new ptyd then died on EADDRINUSE with stderr going to /dev/null. ptyd now retries the bind, records why it failed, and the agent reports a missing python3 or an unreadable ptyd instead of skipping it silently. The host reads that status and falls back to netstat when ss is absent.

Closes #120.

RTL8187 needs longer than the 10s allowed for a wlan interface to appear, which surfaced as "driver missing" on an adapter that scans fine. Raised to 45s in both engines and 30s in the scan screen.

Closes #125.

Pixie Dust reported "missing: PKE, PKR, AuthKey, E-Hash1, E-Hash2" when the AP had simply stopped the exchange before M3. It now says where the exchange stopped and surfaces the msg/config_error/reason that WPS-FAIL carries and that was being discarded. get_hex no longer returns [REMOVED] as if it were hex, nor trips over a short line.

Closes #128.

UML dies with MADV_REMOVE err=-95 when its memory file lands on /data, because only tmpfs implements MADV_REMOVE. The engine now prefers a writable tmpfs and, when there is none, explains that instead of printing the raw errno. The QEMU boot deadline stays at 200s but extends while the guest is still producing output, up to 600s, so a slow device is not killed mid-boot.

Closes #123.

The guest core payload now ships as an AES-256-GCM container that the app opens in process before staging. The unpack commands are unchanged: GuestCorePackage writes the same plain tar to the same staged path that busybox tar and the guest-side tar xf already read.

The terminal crashed on every device in 6.5. 93bb868 added
-Wl,-z,max-page-size=16384 together with -Wl,-z,common-page-size=16384
to the terminal module. With NDK r25's lld the second flag rounds
PT_GNU_RELRO up to a 16K boundary, so RELRO ends at 0xc000 while the
last PT_LOAD ends at 0xa000. Bionic then mprotects a range whose tail
is unmapped and dlopen fails with ENOMEM, reported as "can't enable
GNU RELRO protection ... Out of memory". Dropping common-page-size
lands RELRO exactly on the page end of the last PT_LOAD and keeps the
16K segment alignment that SDK 36 needs. JNI no longer aborts the
process when the library will not load: the session prints the reason
into the terminal instead of throwing out of View.onLayout.

Closes #122, #126, #130.

Monitor mode could not be turned back off. disableMonitorModeRootless
targeted the base interface even after airmon-ng had renamed it to
*mon, and verified with "if (stillMon) stillMon = ..." instead of an
or, so it reported success while the radio stayed in monitor. Both
paths now resolve the interface that is actually in monitor, retry
with iw set type managed, and report honestly.

The guest core was redeployed on every check because GuestCore.VERSION
was "6" while the payload carried "5", so the version compare never
matched and the agent was restarted in a loop. The restart also left
stryker-ptyd alive, since pkill -f stryker-agentd does not match it,
and the new ptyd then died on EADDRINUSE with stderr going to
/dev/null. ptyd now retries the bind, records why it failed, and the
agent reports a missing python3 or an unreadable ptyd instead of
skipping it silently. The host reads that status and falls back to
netstat when ss is absent.

Closes #120.

RTL8187 needs longer than the 10s allowed for a wlan interface to
appear, which surfaced as "driver missing" on an adapter that scans
fine. Raised to 45s in both engines and 30s in the scan screen.

Closes #125.

Pixie Dust reported "missing: PKE, PKR, AuthKey, E-Hash1, E-Hash2"
when the AP had simply stopped the exchange before M3. It now says
where the exchange stopped and surfaces the msg/config_error/reason
that WPS-FAIL carries and that was being discarded. get_hex no longer
returns [REMOVED] as if it were hex, nor trips over a short line.

Closes #128.

UML dies with MADV_REMOVE err=-95 when its memory file lands on /data,
because only tmpfs implements MADV_REMOVE. The engine now prefers a
writable tmpfs and, when there is none, explains that instead of
printing the raw errno. The QEMU boot deadline stays at 200s but
extends while the guest is still producing output, up to 600s, so a
slow device is not killed mid-boot.

Closes #123.

The guest core payload now ships as an AES-256-GCM container that the
app opens in process before staging. The unpack commands are
unchanged: GuestCorePackage writes the same plain tar to the same
staged path that busybox tar and the guest-side tar xf already read.
@zalexdev
zalexdev merged commit dee5f9d into main Oct 6, 2026
2 checks passed
@crty8

crty8 commented Oct 12, 2026

Copy link
Copy Markdown

when should we expect a release for this fixes?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants