QuestStack is a Meta Quest 1 root and bootloader unlocking project.
Using the GhostLock privilege escalation chain and the CVE-2021-1931 ABL/fastboot vulnerability, QuestStack provides a way to gain root access on the latest Quest 1 firmware, temporarily boot using a vulnerable ABL, and unlock the device bootloader.
The project combines Quest firmware research, root access, A/B slot manipulation, ABL modification, fastboot exploitation, backups, and verification into one automated workflow aimed at giving developers and enthusiasts full control over Quest 1 hardware.
Status: Released
90 HZ Possible. Check the Discord below
QuestStack is currently available as a desktop application for Windows, Linux, and macOS.
The current version includes a full graphical interface, automatic device detection, verified backups, SHA-256 integrity checks, automatic slot handling, and recovery logic.
- ✅ Quest 1
- ✅ Firmware:
49845030443200410(Latest)
- ❌ Quest 2
- ❌ Quest Pro
- ❌ Any other headset
QuestStack checks the connected device before allowing the full process to start.
The firmware build, Quest product information, fingerprint, and A/B slot state are checked automatically to reduce the chance of running the process on the wrong device.
If you prefer to do this with the website instead of the app, use:
https://quest1-unlock.skystate.ch/
Credits: Darknight
The website version is a separate implementation and does not necessarily provide the same workflow, backup system, or recovery features as the desktop version.
Your Quest 1 must be running:
49845030443200410
You can check your currently installed firmware version using:
adb shell getprop ro.build.version.incrementalIf your device is not on the required firmware version, reboot into USB Update Mode and sideload the required firmware package:
https://files.cocaine.trade/firmware/meta/Quest/q1_49845030443200410.zip
After installing the firmware, boot the headset normally and make sure ADB / USB debugging is enabled.
- Boot the Quest 1 normally.
- Connect it to your computer using USB.
- Allow USB debugging if prompted.
- Launch QuestStack.
- Wait for the headset to be detected.
- Make sure QuestStack reports the device as supported.
- Select Full Process.
- Press Start.
- Read the warning before continuing.
- Keep the headset connected until QuestStack finishes.
The full process will factory reset the headset.
QuestStack handles the rest of the process automatically.
During the full process, QuestStack will:
- Detect the connected headset.
- Verify that it is a supported Quest 1.
- Verify the required firmware and device fingerprint.
- Detect the currently active A/B slot.
- Download and verify the required files.
- Gain temporary root access using GhostLock / ionstack.
- Create a verified backup of the inactive slot.
- Push the required vulnerable firmware files to the headset.
- Flash the vulnerable boot firmware to the inactive slot.
- Read the flashed partitions back and verify them.
- Switch to the vulnerable slot.
- Reboot directly into fastboot.
- Perform the CVE-2021-1931 bootloader unlock.
- Verify that the bootloader is actually unlocked.
- Restore the original slot.
- Factory reset the headset.
- Reboot back into Android.
If something fails before the vulnerable slot is activated, QuestStack stops without switching to it.
If something fails after the vulnerable slot has been activated, QuestStack attempts to restore the original slot automatically.
Before modifying the inactive slot, QuestStack creates a persistent backup of the affected partitions on your computer.
Backups include information such as:
- Device serial
- Device model
- Firmware fingerprint
- Slot information
- Partition sizes
- SHA-256 hashes
QuestStack compares the SHA-256 hash of each copied partition against the original block device before marking the backup as valid.
Incomplete backups are not treated as valid backups.
Existing verified backups can be viewed from the Backups tab inside QuestStack.
QuestStack verifies important files throughout the entire process.
SHA-256 verification is currently used for:
- Firmware archive
- Firmware images
- ionstack root exploit
- Bundled ADB and fastboot tools
- Files pushed to the headset
- Partition backups
- Flashed partitions
If a required file does not match its expected hash, QuestStack will stop instead of continuing.
QuestStack performs the downgrade on the inactive slot.
The currently booted Android slot is left untouched during the downgrade process.
Before switching slots, QuestStack verifies that the vulnerable firmware was actually written correctly.
After the bootloader has been unlocked, QuestStack switches back to the original slot before wiping and rebooting the headset.
This means the vulnerable slot is only used temporarily for the unlock process.
QuestStack also includes an Unlock Only mode.
This mode is intended for a headset that is already running the vulnerable ABL and is already in fastboot.
Unlock Only mode does not:
- Gain root
- Flash firmware
- Modify the active slot
- Create the normal downgrade backup
- Factory reset the headset
- Automatically reboot the headset
Use this mode only if you already know the headset is running the correct vulnerable ABL.
QuestStack contains automatic recovery logic for failures that happen after the vulnerable slot has been activated.
If possible, the program will switch the headset back to the original slot automatically.
If automatic slot recovery fails, do not continue booting the vulnerable slot blindly.
Keep the headset connected, preserve the backup created by QuestStack, and check the logs before doing anything else.
For help, use the Discord server linked below.
If you're looking for help consider joining this server:
You can also find discussion about Quest 1 modifications, 90 Hz, recovery, and other experiments there.
Quest 2 Devices running V59 or lower have a similar chance of having this work as intended to unlock the bootloader but the chance of bricking outweighs the benefit of unlocking the bootloader, This remains a future goal and will not be ignored
Built using research and tools from the Android security and VR development communities specifically (FreeXR), including previous Quest bootloader unlocking work from darknight:
https://github.com/darknight1050/quest-bootloader-unlocker
Additional credit goes to the researchers and developers behind GhostLock, ionstack, and the other work that made modern Quest 1 root and bootloader unlocking possible.
QuestStack is licensed under the GNU General Public License v3.0.
See LICENSE for details.
This project is provided for educational and research purposes.
Modifying bootloader state, flashing boot firmware, or changing system software can permanently affect your device.
QuestStack includes backups, verification, and recovery checks to reduce risk, but there is still a possibility of data loss or an unbootable device.
Use at your own risk.