Temp-root persistence patterns (race-based kernelsploits)

How to make a per-boot kernel exploit (e.g. CVE-2026-43499 / GhostLock class) into a usable root environment, plus the gotchas.

The handoff daemon pattern

Exploit → UMH (usermode-helper) root daemon → local socket with peer-UID auth → client execs root shells. The persistence trick is a compile-time flag:

c // su daemon serve loop if (stop_after_late_load || (is_one_shot_shell && !SU_PERSIST_ONE_SHOT)) daemon_request_shutdown(daemon_pid, status); ````` - Default builds kill the daemon when the one-shot handoff shell exits. -#define SU_PERSIST_ONE_SHOT 1keeps it alive → **root on tap until reboot**:helper <cmd>` from any shell with the allowed peer UID.

Timing wisdom (empirical)

• Fresh boot + unlocked screen → hit on attempt 1-2, nearly every time — but only with the right environment: phone COLD (thermal drift shifts the race window with CPU clock state — a hot charging phone misses for hours), ~60-90s post-boot settle, and the screen genuinely unlocked (automated keyguard dismissal is not equivalent).
• One attempt per boot. Retrying in-boot corrupts futex/allocator state → panics (matches the Kitploit S26 warning). Even an aborted mid-run attempt corrupts the boot.
• Don't quiesce the system. Airplane mode and loadavg-gating made the race MISS consistently — normal scheduler/modem activity is part of the timing window. (Opposite of the quiesce advice in some ports — measure yours.)
• Check for a built-in timing rotation before pinning env knobs. The GhostLock-Galaxy payload family rotates FOPS_DELAY_USEC-equivalent values (40-90 ms) with a persistent on-device index when the env var is ABSENT — a self-predicting search. Setting the env var disables the rotation and pins one value. Prefer the rotation; reset the state file between sessions if needed.
• Busy boots (SIM provisioning, Play churn) degrade hit rate → reboot and retry.

Kernel-context shell quirks

• u:r:kernel:s0 shells can't look up binder services (service: does not exist) and can't set persist.* properties.
• Fix: runcon u:r:shell:s0 sh -c 'service call …' — uid stays 0, servicemanager works. runcon only works while SELinux is permissive (the exploit's permissive write must have landed).
• Some helper clients have broken argv modes — pipe commands into the no-arg helper (root shell reads stdin) as the reliable path.

Automation shape

reboot → settle ~30 s → wake/stayon → one shot → check uid=0 → miss ⇒ reboot — a small loop script makes the device effectively "root on boot" as long as the PC is plugged in. On-device single-shot scripts exist too; anything that survives reboots needs an unlocked bootloader (by definition, not available here).