Hi all, I would like to inquire if it is possible to be able to root the Quest and introduce mods, launchers, optimizations and customization especially that it runs snapdragon 835 ? 
Mods, Customization - Snapdragon 835
- Thread starter Shady282
- Start date
Hi!
I found the security patch level of Quest is a bit old.
2017-10-05
Maybe we can use existing vulnerabilty to get root.
I found the security patch level of Quest is a bit old.
2017-10-05
Maybe we can use existing vulnerabilty to get root.
I tried waterdrop (CVE-2019-2025), but no luck.
info:
http://blogs.360.cn/post/Binder_Kernel_Vul_EN.html
https://www.exploit-db.com/exploits/46503
$ /data/local/tmp/poc
/data/local/tmp/poc: binder_become_context_manager: Device or resource busy
We need kernel hacker. Can anyone help?
---------- Post added at 08:26 ---------- Previous post was at 08:19 ----------
In addition, I found Quest have Qualcomm's EDL mode. By pressing vul-up,down and power will boot in EDL mode.
And Quest supports fastboot on USB Update Mode. but "fastboot oem unlock" needs unlock code.
info:
http://blogs.360.cn/post/Binder_Kernel_Vul_EN.html
https://www.exploit-db.com/exploits/46503
$ /data/local/tmp/poc
/data/local/tmp/poc: binder_become_context_manager: Device or resource busy
We need kernel hacker. Can anyone help?
---------- Post added at 08:26 ---------- Previous post was at 08:19 ----------
In addition, I found Quest have Qualcomm's EDL mode. By pressing vul-up,down and power will boot in EDL mode.
And Quest supports fastboot on USB Update Mode. but "fastboot oem unlock" needs unlock code.
I tried the dirtycow methods but I think that was patched out before this build, no success.
I also tried just running the usual commands to bring up USB Tethering, but that seems to need root as well. All I want is better ALVR streaming
I also tried just running the usual commands to bring up USB Tethering, but that seems to need root as well. All I want is better ALVR streaming
fyi Oculus is unwilling to provide bootloader unlock codes citing section 4.1 of their Terms of Service, as being in conflict with the request.
I found this to be interesting.
I've began a support request to get the boot loader unlock codes and explicitly began requesting the GPL code (parts of Android and their Linux kernel source). This should give me a few options.
They may or may not decline giving me the boot loader codes. Not the end of the world.
They are legally obligated to give me certain source code for what's running on this device. Such as the linux kernel with the modifications they've made. If they don't provide this source in it's entirety, then there's some legal implications involved there. The first response from their support was pretty ignorant. They linked me to some download section of their website that only had developer SDKs, not the sources I was requiring of them.
Anyway, once I have the kernel source, if no bootloader codes are provided, I can begin scouring it for ways to elevate to root at least.
I've began a support request to get the boot loader unlock codes and explicitly began requesting the GPL code (parts of Android and their Linux kernel source). This should give me a few options.
They may or may not decline giving me the boot loader codes. Not the end of the world.
They are legally obligated to give me certain source code for what's running on this device. Such as the linux kernel with the modifications they've made. If they don't provide this source in it's entirety, then there's some legal implications involved there. The first response from their support was pretty ignorant. They linked me to some download section of their website that only had developer SDKs, not the sources I was requiring of them.
Anyway, once I have the kernel source, if no bootloader codes are provided, I can begin scouring it for ways to elevate to root at least.
I believe the kernel for the oculus go is here:
https://github.com/facebookincubator/oculus-go-kernel
I can't see any published quest kernel, perhaps it's the same?
It's quite possible for the kernel to be the same. I'm going to await confirmation directly from Oculus. If it goes well, I get to unlock my bootloader on top of having the correct source. If it goes poorly, who knows. I might get to see what the legal side of the GNU GPL looks like.
I really want to audit the support for this device and software I own.
Not the same. The posted kernel for Go is Linux 3 while Quest is using Linux 4.4.21. They've built on Android, which means they're starting with a stock Linux kernel, I don't think getting their sources is going to clue us into anything that can't be known already; they'll just upload that same vanilla Linux 4 kernel source. The drivers they will use for practically everything are almost certainly closed-source. They don't have to provide their kernel configuration either.
Best of luck on getting the bootloader, though, that's the holy grail at the moment
Best of luck on getting the bootloader, though, that's the holy grail at the moment
Well, the dudes that I'm talking with finally provided kernel source:
https://github.com/facebookincubator/oculus-linux-kernel
It's the Quest Branch of the Oculus Linux Kernel. So we have something to search through for vulnerabilities.
I'm still talking with them about flashing the hardware. I'm not convinced that it's locked, because they seemed a bit confused what I was talking about. Having not touched phone boot loaders in years, I'm still doing my research into the bootloading stuff, since I'm only guessing that it involves a signature check at the moment.
https://github.com/facebookincubator/oculus-linux-kernel
It's the Quest Branch of the Oculus Linux Kernel. So we have something to search through for vulnerabilities.
I'm still talking with them about flashing the hardware. I'm not convinced that it's locked, because they seemed a bit confused what I was talking about. Having not touched phone boot loaders in years, I'm still doing my research into the bootloading stuff, since I'm only guessing that it involves a signature check at the moment.
Waiting for mine to be delivered, where does it store the downloaded game files?
The game files, if you mean the apk-files are generally stored on the internal sdcard and are available as movable USB storage. I don't think you even need to set it in developer mode to access the apk files. Anyway, if you set the device in the supplied developer mode it works fine. So there is no problem to load your own applications or backup downloaded games. SideQuest is a great application that simplifies this for semi-advanced users.
You can also use adb quite extensively and for example use scrcpy to dump the full screen output to a computer. Over all the Quest allows you to do most things you need.
But... The "problem" is that the Quest Android OS is locked and some things, mainly Ethernet over USB, have been disabled. You can stream video to the Quest via Wifi and play Oculus or SteamVR games that run on your computer fairly decent as it is now (using AVLR), but if Ethernet over USB was activated it could more or less replace a Oculus Rift or other wired unit completely. Oculus would likely not be happy with this since it would threaten their business/ market strategies, their segmentation of devices and the Oculus Store. But, that is why rooting the device would be interesting.
I've been finding holes to install the USB ethernet driver, but with no luck. Hope somebody will root the device so i can use either USB Tethering or a USB Ethernet device. Will even pay the person that can crack the device haha.
If I enter this CMD:
adb shell am start -a android.intent.action.VIEW -d com.oculus.tv -e uri com.android.settings/.DevelopmentSettings com.oculus.vrshell/.MainActivity
I can't even enable RNDIS manually, but that is logic since they just only added the WLAN drivers to the device.
If I enter this CMD:
adb shell am start -a android.intent.action.VIEW -d com.oculus.tv -e uri com.android.settings/.DevelopmentSettings com.oculus.vrshell/.MainActivity
I can't even enable RNDIS manually, but that is logic since they just only added the WLAN drivers to the device.
I just want to check that you've definitely tried plugging in a USB-C ethernet adapter? If you haven't I'm going to order one, plug in to the Quest and do lsusb.
I tried the dirtycow methods but I think that was patched out before this build, no success.
I also tried just running the usual commands to bring up USB Tethering, but that seems to need root as well. All I want is better ALVR streaming
guys if you use 5ghz wifi you get speeds way faster than you need anyway - I dont know why you so need to enable ethernet?
the quest has a better screen res than the rift as well. Games come up mint using ALVR
I use moonlight to stream normal non-vr games as well - also works flawlessly
however - one thing that doesnt work too well - if i am using ALVR to stream a VR game that uses a gamepad and not the controlers, i pair my XBOX gamepad via bluetooth and ALVR crashes every time.
When i use moonlight and the bluetooth gamepad it does not crash.
This means i can only play VR games which require a gamepad if i am in proximity to the PC itself and not anywhere in the house which is what i would like.
Has anyone found a solution to this "ALVR crashes with Bluetooth Gamepad connected" issue yet?
the quest has a better screen res than the rift as well. Games come up mint using ALVR
I use moonlight to stream normal non-vr games as well - also works flawlessly
however - one thing that doesnt work too well - if i am using ALVR to stream a VR game that uses a gamepad and not the controlers, i pair my XBOX gamepad via bluetooth and ALVR crashes every time.
When i use moonlight and the bluetooth gamepad it does not crash.
This means i can only play VR games which require a gamepad if i am in proximity to the PC itself and not anywhere in the house which is what i would like.
Has anyone found a solution to this "ALVR crashes with Bluetooth Gamepad connected" issue yet?
Quest Root - 90Hz possibility
With the quest link coming up and the fact that the Quest's OLED displays apparently can support up to 90Hz (Though they won't change it due to needing to verify it with the FCC), I'm hoping that that could be a reason for people to start trying to go for root! Especially with PCVR, a Rooted Quest running at 90Hz would possibly be better than the Oculus Rift S!
With the quest link coming up and the fact that the Quest's OLED displays apparently can support up to 90Hz (Though they won't change it due to needing to verify it with the FCC), I'm hoping that that could be a reason for people to start trying to go for root! Especially with PCVR, a Rooted Quest running at 90Hz would possibly be better than the Oculus Rift S!
one click root???
has anyone tried (one click root) to get root access
https://www.xda-developers.com/best-one-click-root-2018/
maybe the root master works or something else because android 7 was annouced in August 22, 2016 and rootmaster got last update 2017.
sry bad english.
has anyone tried (one click root) to get root access
https://www.xda-developers.com/best-one-click-root-2018/
maybe the root master works or something else because android 7 was annouced in August 22, 2016 and rootmaster got last update 2017.
sry bad english.
Our Apps
Get our official app!
The best way to access XDA on your phone
Nav Gestures
Add swipe gestures to any Android
One Handed Mode
Eases uses one hand with your phone