xpad3 v0.1.9

升级公共安装平面并修复历史暂存文件阻断后续安装的问题。

• 锁定 xpad-installer 0.2.14
• 锁定 BoomInstaller v13.6.0.r24.2f6e7c2 production
• APK/DEX 改为逐事务唯一暂存文件，并保留机器可读 staging 诊断
• PD3S /338 Root profile、trigger、IonStack 与 KSU 制品保持不变
• 修复混合 tag 仓库中 delta 基线误选，提供 v0.1.8 → v0.1.9 签名 delta

Android ARM64 ELF SHA-256: c87508e9dbc9d6872d2bf4b892ae8aa28c295479303705d5e19feb344e4a8b52

xpad3-cli v0.1.8

修复 XPad3S /338 Root 链在 pselect 尾部校验失败后的 stale waiter 收尾。

• 精确识别唯一 waiter task，恢复并回读验证 pi_blocked_on、slab cache 与 PID/TGID 元数据。
• 只有上述验证全部通过才由 UID 0 发送 SIGUSR2，安全释放停放的 probe；NeedsReboot 仅作为无法验证安全退出时的兜底。
• trigger 升级为可与旧版共存的 com.ionstack.trigger.v2，无需卸载旧 v1；运行中的任一版本仍会阻止同 boot 叠加利用。
• 锁定 IonStack POC c5e6aca；仍只支持 TALIH-PD3S 精确 /338 profile。

普通用户请下载 xpad3-v0.1.8-android-arm64.zip。

xpad3-cli v0.1.7

Installer-plane synchronization release:

• Locks and embeds xpad-installer v0.2.13 and BoomInstaller v13.6.0.r23.ffa4217.
• Boom root mode uses the common libsu UID 0 OEM Provider path; ADB-shell remains on managed 0044 with 31317 repair-only.
• Adds explicit locked IonStack worktree/artifact overrides so release verification does not overwrite an active PoC development checkout.
• Keeps the exact TALIH-PD3S /338 runtime profile and KernelSU/Manager 32547 alignment unchanged.
• Includes a signed 0.1.6 to 0.1.7 delta.

Verification: 65 Rust tests and the complete signed release verifier passed. The ARM64 binary was also run read-only on a TALIH_PD2 and correctly rejected it as a non-XPad3 product/profile without entering the Root path. A PD3S was not connected for this release cycle.

ARM64 ELF SHA-256: 7e1643a6b1aee3baab9f627cfe4ae46c0a0f6b1ed4d7400deaa1461bef3891d8

xpad3-cli v0.1.6

v0.1.6 fixes the v0.1.5 capture-recovery race observed in the PD3S reboot logs. When the app-domain probe parks after the fops write primitive has already hit, the IonStack runner now keeps the capture worker alive until it emits its post-restore result or exits on its own. The normal 90-second capture deadline and termination signals are deferred while that kernel recovery responsibility is in flight.\n\nA true no-hit path gets a short race-avoidance grace period and then returns exit code 75. New hit/result counters and recovery-wait markers make the distinction durable in exported transaction logs.\n\nThe exact TALIH-PD3S /338 profile gate, KernelSU/Manager 32547 alignment, and signed artifact locks remain enforced. A signed v0.1.5 to v0.1.6 delta is included.

xpad3-cli v0.1.5

v0.1.5 fixes the per-boot safety state after the PD3S app-domain probe parks or times out while deliberately leaving its stale waiter alive.

The IonStack runner now stops immediately with exit code 75 instead of waiting for the 90-second capture timeout. xpad3-cli maps both the new exit code and legacy v0.1.4 parked-probe log markers to NeedsReboot, so the final receipt records needs_reboot=true and same-boot cleanup or retry is rejected.

The exact PD3S /338 profile gate, KernelSU 32547 alignment and signed artifact locks remain enforced. A signed v0.1.4 to v0.1.5 delta is included.

xpad3-cli v0.1.4

v0.1.4 adds reboot-resilient Root and KernelSU late-load diagnostics, including durable transaction/stage traces plus pstore, DropBox, AEE/MRDUMP and MTK DebugLogger collection.

KernelSU Manager, driver and ksud are aligned on official version 32547, removing the previous 32525/32551 mismatch. The beginner guide now documents the exact post-reboot evidence collection workflow.

The exact PD3S /338 profile gate and signed artifact locks remain enforced. A signed v0.1.3 to v0.1.4 delta is included.

xpad3-cli v0.1.3

v0.1.3 fixes repeated XPad3S root failures after an interrupted temporary-root session.

The affected runs reached the exact profile, KASLR leak and holder/reclaim gates, but the capture worker exited early with modprobe-su-prepare su=0 / reason=su_prepare errno=13 because a root-owned, daemon-less /data/local/tmp/su could not be replaced by shell. Rebooting does not remove that file.

The XPad3S cred-writeonly route now skips the unrelated legacy modprobe pre-stage and installs/replaces the embedded su only after the credential write succeeds as root. The CLI also records and reports stale-artifact cleanup failures instead of silently swallowing them. XPad2 behavior is unchanged.

The exact PD3S /338 profile gate and all signed artifact locks remain enforced. A signed v0.1.2 → v0.1.3 delta is included.

xpad3-cli v0.1.2

v0.1.2 integrates xpad-installer v0.2.11 to support the XPad3S OEM installer layout.

The previous installer hard-coded the XPad2 provider APK path /system/app/pad2_znxxservice/pad2_znxxservice.apk. XPad3S exposes the same verified package and managed UID at /system/app/pad_znxxservice/pad_znxxservice.apk, so the 0044 identity was healthy but target APK upgrades could not start the Java provider path.

This release resolves com.tal.pad.znxxservice through PackageManager at runtime and uses the returned readable APK path. The managed 0044 identity, APK signature/version/hash checks, guarded 31317 repair boundary and exact PD3S /338 profile gate remain unchanged.

It also retains the v0.1.1 compat32 trigger ABI fix. A signed v0.1.1 → v0.1.2 delta is included.

xpad3-cli v0.1.1

v0.1.1 修复首版在安装 XPad3S IonStack trigger 时错误要求 arm64-v8a 的问题。

PD3S trigger 为了进入可访问 /dev/ashmem 的 compat32 app-domain，设计上只包含 armeabi-v7a 原生库。本版本将 APK 所需运行 ABI 纳入签名 catalog：

• ionstack-trigger 明确要求 armeabi-v7a；
• KernelSU Manager 与 BoomInstaller 继续要求 arm64-v8a；
• 包名、版本、签名证书、大小和 SHA-256 校验保持不变；
• 增加 compat32 接受路径和错误 ABI 拒绝路径的回归测试。

支持范围没有扩大，仍只放行实机验证的 XPad3S PD3S /338 精确 profile。

从 v0.1.0 更新可使用完整二进制，或使用随本 Release 发布并签名的 v0.1.0 → v0.1.1 delta。Windows CMD 如出现中文乱码，可先执行 chcp 65001。

xpad3-cli v0.1.0

首个公开版本，提供面向现代 5.x 内核 XPad3 系列的 profile-gated root、KernelSU late-load 与安装事务。

当前 release 只放行已经实机验证的 XPad3S PD3S /338：

• 指纹：alps/TALIH-PD3S/TALIH-PD3S:13/TP1A.220624.014/338:user/release-keys
• 内核：5.10.198-android12-9-00019-g6efebf1322d6-ab11471183
• ABI：arm64-v8a
• KernelSU：android12-5.10 late-load，Manager v3.2.5-22-gccfee6dc

CLI 在进入写原语前同时核验完整指纹、kernel release、uname -v 与 ABI；未知 build 不会因同型号或相近版本号自动放行。首次加载 KernelSU 后如返回退出码 75，请正常重启，再用 xpad3 status 复核。

发布包含独立 CLI、离线 cache、完整安装包、签名更新清单、catalog 签名、来源锁和 SHA256SUMS。v0.1.0 是首版，因此没有 delta 资产。