Meta Quest 3/3s XR headsets finally rooted after 2 years
Technology
20
Beiträge
9
Kommentatoren
0
Aufrufe
-
Meta XR headsets are very cheap for the performance they give. Unfortunately they require a Meta account and one can assume as much data as legally possibly is sent back to the advertising company.
For years now, since the Quest 1, those Android devices have not been rooted except for some specific version number of the Quest 2.
This recent work https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1 makes the latest headset with a rather recent update (but NOT the very last ones, so be cautious!) rootable.
GitHub - FreeXR/eureka_panther-adreno-gpu-exploit-1: Our first exploit: a memory corruption vulnerability in the Adreno GPU driver for Eureka/Panther (3/3s) devices, enabling arbitrary kernel memory read/write and privilege escalation.
Our first exploit: a memory corruption vulnerability in the Adreno GPU driver for Eureka/Panther (3/3s) devices, enabling arbitrary kernel memory read/write and privilege escalation. - FreeXR/eureka_panther-adreno-gpu-exploit-1
GitHub (github.com)
Waiting on a software freedom-respecting headset.
-
Well I would ask you to reconsider reconsidering. It's a very neat technical fear, arguably even an important one... but you would be giving money to Meta. So unless you really have to, because you work in the domain, maybe try to recycle a 2nd hand headset for a cheaper price and tinker with it as much as you want? Maybe even contribute to the rooting process by finding ways to remove the Meta account requirement altogether?
TL:DR: nobody needs a XR headset but if you do and you want to get a Meta one, get it 2nd hand.
I'm kind of curious. Is the Quest 3 actually profitable, or is it a loss leader? If it's the latter, I'd be even more inclined to take their product and have them lose money in the process.
-
I'm kind of curious. Is the Quest 3 actually profitable, or is it a loss leader? If it's the latter, I'd be even more inclined to take their product and have them lose money in the process.
High probability of it being a loss leader with its specs. So if you were to buy and root it they'll definitely lose money.
However, the bootloader unlock process is still quite dangerous so you might end up with an expensive paper weight.
-
High probability of it being a loss leader with its specs. So if you were to buy and root it they'll definitely lose money.
However, the bootloader unlock process is still quite dangerous so you might end up with an expensive paper weight.
Yeah, i saw that note later. I can wait.
-
Yesssssss!
Using root on META Quest 3/3S is very dangerous SINGLE CHANGE IN THE BOOTLOADER PARTITION WILL RESULT IN A HARD BRICK AND MAKE YOUR DEVICE UNUSABLE!!! requiring one to unsolder the UFS chip and reprogramming it with external (and expensive) hardware. Reflashing the device via EDL is impossible due to Meta refusing to provide the users the cryptographical keys needed to authentificate secure boot on QFPROM implemetation.
Ehhhhh.... Maybe I'll wait a bit...
Actually, those steps are the ones necessary to recover from a hard brick (re: the device is unusable because you did something you shouldn't have as root).
The actual process to root the device is simply running a few
adbcommands (so a prereq is having Developer Mode enabled).Once you have ran the exploit, your root escalation is temporary until the device is rebooted or you take additional steps to persists your root privileges (thus, potentially leading you towards a hard brick).
source: The docs
-
Meta XR headsets are very cheap for the performance they give. Unfortunately they require a Meta account and one can assume as much data as legally possibly is sent back to the advertising company.
For years now, since the Quest 1, those Android devices have not been rooted except for some specific version number of the Quest 2.
This recent work https://github.com/FreeXR/eureka_panther-adreno-gpu-exploit-1 makes the latest headset with a rather recent update (but NOT the very last ones, so be cautious!) rootable.
GitHub - FreeXR/eureka_panther-adreno-gpu-exploit-1: Our first exploit: a memory corruption vulnerability in the Adreno GPU driver for Eureka/Panther (3/3s) devices, enabling arbitrary kernel memory read/write and privilege escalation.
Our first exploit: a memory corruption vulnerability in the Adreno GPU driver for Eureka/Panther (3/3s) devices, enabling arbitrary kernel memory read/write and privilege escalation. - FreeXR/eureka_panther-adreno-gpu-exploit-1
GitHub (github.com)
... makes the latest headset with a rather recent update (but NOT the very last ones, so be cautious!) rootable.
Any ideas which version(s) are susceptible? I couldn't find it mentioned.
-
... makes the latest headset with a rather recent update (but NOT the very last ones, so be cautious!) rootable.
Any ideas which version(s) are susceptible? I couldn't find it mentioned.
- Quest 3: v79 5115411.12900.520 (August 7, 2025) and below, to about version v71.
- Quest 3S: v79 117688.9900.610 (August 6, 2025) and below, to about version v71.
according to https://github.com/zhuowei/cheese/tree/main?tab=readme-ov-file#supported-versions
-
Waiting on a software freedom-respecting headset.
Recommendations
- Valve Index but it's not standalone. It's "just" a headset so what you do with it is up to you, no need to register anything with Valve, nor have Steam (even though SteamVR is convenient) and works on Linux. With Proton even the latest indie VR games work. IMHO also Half-life: Alyx is in itself worth it.
- Lynx-XR1 that can already be rooted https://lynx.miraheze.org/wiki/Rooting_Process (which I did few months ago) but arguably their customization of Android isn't as convenient as what Meta did. For tinkerers though and if you can actually get one, it's great. Also no account required.
There are others, e.g. https://simulavr.com/ which is standalone and Linux proper (not Android), but I haven't tried so I can't vouch for them.
-
I'm kind of curious. Is the Quest 3 actually profitable, or is it a loss leader? If it's the latter, I'd be even more inclined to take their product and have them lose money in the process.
Good point, based on how much Meta spends on their XR department I wouldn't be shocked if the hardware itself is also losing money and used as a kind of innovation-washing marketing strategy. That said I'd still recommend buying 2nd hand so that it's cheaper and doesn't register on their book as a sale. Also no purchase information shared with Meta.
-
Yesssssss!
Using root on META Quest 3/3S is very dangerous SINGLE CHANGE IN THE BOOTLOADER PARTITION WILL RESULT IN A HARD BRICK AND MAKE YOUR DEVICE UNUSABLE!!! requiring one to unsolder the UFS chip and reprogramming it with external (and expensive) hardware. Reflashing the device via EDL is impossible due to Meta refusing to provide the users the cryptographical keys needed to authentificate secure boot on QFPROM implemetation.
Ehhhhh.... Maybe I'll wait a bit...
It is indeed a risk AND you must pin your current OS version, so no new update including no new feature (not sure which one one would need for now though) but more importantly no security updates.
That being said... if you do not actively try to mess it up, i.e. doing precisely what has been warned against NOT doing, it should be safe.
In doubt, if you can't afford another headset, have no actual need for rooting and have never done that before, definitely safer to wait.
-
Actually, those steps are the ones necessary to recover from a hard brick (re: the device is unusable because you did something you shouldn't have as root).
The actual process to root the device is simply running a few
adbcommands (so a prereq is having Developer Mode enabled).Once you have ran the exploit, your root escalation is temporary until the device is rebooted or you take additional steps to persists your root privileges (thus, potentially leading you towards a hard brick).
source: The docs
Actually, those steps are the ones necessary to recover from a hard brick (re: the device is unusable because you did something you shouldn't have as root).
I get that; the whole reason I want to root it is to FAFO tho. So I'll wait until the worst I could do is need to factory reset it. lol
