Repository navigation
Fix/6.5 issues - #142
Merged
Merged
Fix/6.5 issues#142
Conversation
On a POCO F1 under TCG the guest reaches sshd after about two and a half minutes, the app logs in, and then the 150s boot window expires while the first command channel is still opening. The VM was killed a second before it answered: the log shows "guest is answering again" right after "VM boot failed". The safe-profile retry hit the same wall and the engine was declared broken on a device where it works. The boot window now follows the guest. SshBootWatch extends it when the guest's network comes up, when sshd answers, when the app logs in, and when the console reaches its login prompt, up to a 7 minute cap. Without progress it still ends at 150s. GuestPort replaces the full SSH handshake used to poll the port with a single short connection, so a dead probe costs 2s instead of 20s. It tells apart a port nothing listens on, a forwarded port the guest never answers behind, a guest that drops the connection because sshd is not up yet, another service, and a real sshd banner. Once a banner is seen the raw probe stops, so OpenSSH 10's per-source penalties do not build up against the app. The failure text names the stage that stalled instead of guessing from the console. 2222 is no longer assumed free. GuestPort.claim moves to the next free loopback port when another app holds it and says what holds it. QEMU processes left behind by an earlier run are stopped first, since they kept both the disk image and the port. Port forwards are reapplied when the SSH session is rebuilt, which VNC and the UML port mirror used to lose silently, and a forward that fails is retried instead of being recorded as live. The ping is bounded by its own timeout rather than a blocking read, and the exec stream is taken before connect so a channel that dies early reports why. A passt kill by the host's seccomp filter is now reported as such, with the syscall named, instead of surfacing as a bare "networking did not start". Refs #135.
Brute-forcing a handshake failed with ERROR: Opening dictionary "/sdcard/Stryker/wordlists/x.txt" failed (No such file or directory) even though the file was there and the app's own probe had just found it at that very path. chroot_exec runs its argument as env -i ... $1 with $1 unquoted, so the shell splits the string into words but never removes the quotes. aircrack-ng was handed a name that still carried the double quotes. A path with a space was split in half for the same reason. Root mode now feeds the command to the chroot shell the way AdvancedProcess and customChrootCommand already do, so the shell parses the quoting. GuestFiles resolves a shared file for whichever engine is running. It checks every place the share can appear in one command and reports what it found: readable, zero bytes, unreadable, a folder, or absent. It proves readability by opening the file instead of trusting [ -f ]. The capture file goes through the same resolver; it used to be mapped with String.replace and stayed a host path whenever the prefix did not match, which is what broke UML, where the share is /host. When nothing is reachable the message says why: the guest reads the folder but the file is not in it, the folder is there but empty so the share never got mounted, or there is no folder at all. UML and QEMU get different advice. A failed run no longer reports "Password not found". CrackOutcome reads aircrack-ng's output for a dictionary that will not open, a start without -w, a capture with no handshake, no network in the file, a missing binary, and a non-zero exit, and the row shows that instead. An exhausted wordlist is still a plain miss. The BSSID is passed with -b and stdin is closed, so a capture holding more than one network no longer waits forever on aircrack-ng's prompt. stderr reaches the app now: JSch was discarding it in rootless mode and root mode only read it after stdout had closed, which could block on a full pipe. "Please specify a dictionary (option -w)" counts as proof that aircrack-ng read the capture. The handshake check runs without a wordlist on purpose, and that line was being read as a failure to open the file, so a good capture was saved unverified.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.