## https://sploitus.com/exploit?id=F0E1B0B7-0829-5F99-B52A-C5F2F16041FC
# xpad2-ionstack-poc
Pure-C, host-assisted re-root proof of concept for the explicitly supported
XPad2 firmware profile. It packages the verified IonStack chain into a
single, independently buildable source tree.
The runtime chain uses native C/ELF components only. It does not require
Python, Java, DEX, `app_process`, or a JVM on the Android target. ADB is used
for deployment and verification.
## Supported profile
This POC intentionally fails closed unless all profile checks match:
```text
device: ls12_mt8797_wifi_64
Android: 13 / SDK 33
fingerprint: alps/vnd_ls12_mt8797_wifi_64/ls12_mt8797_wifi_64:13/TP1A.220624.014/260:user/release-keys
kernel: 4.19.191+ / #1 SMP PREEMPT Mon Jun 29 04:08:29 CST 2026
```
The exploit can panic or reboot the device. Use it only on hardware you own
or are explicitly authorized to test, with a recovery path available.
This repository is narrowly scoped to the firmware profile above. It is not a
general-purpose rooting tool, and offsets or assumptions must not be reused on
other devices without independent validation.
## Build
Requirements:
- macOS or Linux host with `clang`, `make`, and `adb`;
- Android NDK r29 (API 35 is the default build API);
- an arm64/compat32 target matching the profile above.
```sh
make -j4
```
Override discovery when needed:
```sh
make NDK_ROOT=/path/to/android-ndk API=35 -j4
```
All artifacts are emitted under `build/`; the build has no source dependency
outside this repository.
## Run
Start with the non-exploit profile check:
```sh
./build/xpad2-ionstack-reroot -s SERIAL --preflight-only
```
Exercise discovery and the order-3/PFN/content gates without the final
adjust-PI trigger or kernel write:
```sh
./build/xpad2-ionstack-reroot -s SERIAL --validate-only
```
Run the full chain:
```sh
./build/xpad2-ionstack-reroot -s SERIAL
```
Logs are written below `results/YYYY-MM-DD/` by default. Root is ephemeral:
the POC does not modify AVB, boot images, or system partitions and must be
run again after reboot.
## Verified behavior
The final six-worker version completed five independent normal-reboot trials
on the development unit: 5/5 successful, with no panic or unexpected Boot-ID
change. Every trial independently verified `su -c id`, `/proc/kpageflags`
access, and restoration of the temporarily replaced fops. This measures
repeatability on one physical unit; it is not a claim that every device sold
under the same model name is compatible.
## Licensing
Copyright (C) 2026 yoyicue.
The combined project is released under `GPL-3.0-or-later`; see `LICENSE`.
Third-party IonStack-derived files retain their Apache-2.0 provenance and
license; see `NOTICE` and `licenses/Apache-2.0.txt`.
## Security reports
Please do not include device identifiers, private firmware images, crash dumps,
or other sensitive data in a public issue. See `SECURITY.md` for the reporting
guidelines.
## Acknowledgements
Special thanks to TALPAD-BOOM Group.