GhostLock NVIDIA Shield 9.2.4 — autonomous boot re-root

Adds autonomous, on-device ADB re-root for the exact NVIDIA Shield TV Pro 2019 (mdarcy) Shield Experience 9.2.4 build.

After one-time APK installation, a non-exported BOOT_COMPLETED receiver starts a temporary foreground service and invokes the hash-pinned GhostLock payload from an unprivileged app UID. No external host or su binary is needed after installation, and no verified partition is modified.

Validated end to end with the Linux fallback stopped: boot count 134 first exposed stock UID-2000/enforcing adbd; the next fresh ADB transport reported UID/GID 0, capability mask 0000003fffffffff in every capability set, seccomp 0, and SELinux permissive. The service and notification then cleaned themselves up. The fallback unit was subsequently masked.

This is autonomous re-exploitation once per boot, not a static firmware patch. There is a brief UID-2000 window during startup, and a later adbd restart loses root until the next reboot. A lost race can still panic the kernel. Use only on an owned or explicitly authorized device matching the exact fingerprint and kernel.

Required target:

• Fingerprint: NVIDIA/mdarcy/mdarcy:11/RQ1A.210105.003/7825230_4387.0822:user/release-keys
• Kernel: 4.9.141-tegra-gb6e5605a

Release SHA-256:

• APK: 5ced50985a40063f8d3a0d9497b5b850b7e085fac2c35b028956dcfaf99e9495
• Native runner: 56fb508527ffe7da5ab79f857c9d51edbb19b940dcfc88753146927e848a2cf6
• Payload: a3a1e75b627d8dd419e9bafd2a73082a8647510bf6ce4f975e52baf5aa1d0761
• Convenience ZIP: f7791bf485ff0d51d96c7ae7d632064892a6af1a8fd179655f002b1fa19dcd4b

The convenience ZIP preserves the APK path expected by persistence/install.ps1.

GhostLock NVIDIA Shield 9.2.4 (mdarcy)

Validated port for NVIDIA Shield TV Pro 2019 (mdarcy), Shield Experience 9.2.4.

Exact fingerprint: NVIDIA/mdarcy/mdarcy:11/RQ1A.210105.003/7825230_4387.0822:user/release-keys
Kernel: 4.9.141-tegra-gb6e5605a
SHA-256: a3a1e75b627d8dd419e9bafd2a73082a8647510bf6ce4f975e52baf5aa1d0761

The payload roots the live adbd process only. It does not embed or install su, does not change the wallpaper, and does not modify verified partitions. Root is volatile; the repository's optional host watchdog was validated across a normal Shield reboot.

Warning: this is a build-specific kernel exploit. A mismatch or lost race can panic the kernel. Use only on an owned or explicitly authorized device matching the exact fingerprint.