feat: add USB cable deployer (deploy_usb.py) + cert/firewall fixes

.github/workflows/build-rootshell.yml

@@ -0,0 +1,62 @@
+name: Build rootshell
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Cross-compile rootshell (ARM)
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install ARM cross-compiler
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y binutils-arm-linux-gnueabi
+
+      - name: Build rootshell from assembly
+        working-directory: orbic_fw_c
+        run: |
+          # Assemble — target ARMv7 (Cortex-A8), EABI5
+          arm-linux-gnueabi-as -meabi=5 -o rootshell.o rootshell.S
+          # Link — static, no libc
+          arm-linux-gnueabi-ld -o rootshell rootshell.o
+          # Strip — minimize binary size
+          arm-linux-gnueabi-strip rootshell
+          # Verify
+          file rootshell
+          ls -la rootshell
+
+      - name: Verify ELF properties
+        working-directory: orbic_fw_c
+        run: |
+          echo "=== File type ==="
+          file rootshell
+          echo ""
+          echo "=== ELF headers ==="
+          arm-linux-gnueabi-readelf -h rootshell
+          echo ""
+          echo "=== Size ==="
+          ls -la rootshell
+          echo ""
+          # Ensure it's a static ARM ELF
+          file rootshell | grep -q "ARM" || { echo "ERROR: not an ARM binary"; exit 1; }
+          file rootshell | grep -q "statically linked" || { echo "ERROR: not statically linked"; exit 1; }
+          echo "✓ rootshell is a valid static ARM ELF"
+
+      - name: Upload rootshell artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: rootshell-arm
+          path: orbic_fw_c/rootshell
+
+      - name: Attach rootshell to release
+        if: github.event_name == 'release'
+        uses: softprops/action-gh-release@v2
+        with:
+          files: orbic_fw_c/rootshell

README.md

@@ -79,7 +79,17 @@ A terminal-styled custom firmware for the **Orbic RCL400** hotspot with hacking
 - Orbic RCL400 hotspot
 - **Windows:** ARM cross-compiler (included in `gcc_win/` folder)
 - **macOS:** Custom ARM toolchain (included in `gcc_mac/` folder, built with crosstool-ng targeting kernel 3.2 for compatibility)
-- Python 3 with `requests` and `cryptography` modules
+- Python 3 with `requests` and `cryptography` modules (`pip install -r requirements.txt`)
+- **USB cable deploy (`deploy_usb.py`) — optional:**
+  - `pyusb` Python package (`pip install pyusb`) + native **libusb** backend
+    - macOS: `brew install libusb`
+    - Linux: `sudo apt install libusb-1.0-0`
+  - `adb` (Android Debug Bridge) CLI on your PATH
+    - macOS: `brew install android-platform-tools`
+    - Linux: `sudo apt install adb`
+    - Windows: [platform-tools](https://developer.android.com/tools/releases/platform-tools)
+  - If `pyusb`/`libusb` are missing, `deploy_usb.py` automatically falls back to ADB-only mode.
+
 
 ## Building
 
@@ -135,6 +145,32 @@ This uploads and installs:
 
 The firmware auto-starts on reboot (port 8443).
 
+### Option C: USB Cable Deploy (no WiFi / no password)
+
+Deploy entirely over a USB cable — no WiFi connection and no admin password
+required. Mirrors Rayhunter's `orbic-usb` installer method.
+
+```bash
+# Install dependencies (see Requirements above)
+pip install -r requirements.txt        # includes pyusb
+brew install libusb                    # macOS native backend (Linux: apt install libusb-1.0-0)
+brew install android-platform-tools    # adb CLI
+
+# Generate certs (first time only) and deploy
+cd orbic_fw_c && python3 gen_pki.py && cd ..
+python3 deploy_usb.py
+
+# Verify an existing install without redeploying
+python3 deploy_usb.py --verify-only
+```
+
+`deploy_usb.py` switches the device from RNDIS to ADB mode over USB, pushes the
+firmware/certs, configures the firewall, installs boot persistence, and starts
+`orbic_app`. If `pyusb`/`libusb` are unavailable it falls back to ADB-only mode
+(requires the device to already be in ADB mode). See
+[`docs/deploy_usb_feature.md`](docs/deploy_usb_feature.md) for full details.
+
+
 ## Accessing
 
 Open your browser to: **`https://192.168.1.1:8443/`**

dagshell_boot.sh

@@ -10,9 +10,10 @@ echo "=== BOOT $(date) ===" > $BOOTLOG
 busybox nc -ll -p 24 -e /bin/sh &
 echo "[OK] Shell on port 24" >> $BOOTLOG
 
-# 2. Open HTTPS port (Port 8443)
+# 2. Open HTTP and HTTPS ports (8080 and 8443)
 iptables -I INPUT -p tcp --dport 8443 -j ACCEPT
-echo "[OK] Port 8443 open" >> $BOOTLOG
+iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
+echo "[OK] Ports 8080 and 8443 open" >> $BOOTLOG
 
 # 3. Configure DNS forwarding for dnsmasq
 # CRITICAL: dnsmasq uses --dhcp-option-force=6,192.168.1.1 which makes
@@ -71,8 +72,10 @@ if [ -f "$CONFIG_FILE" ]; then
 fi
 
 # 7. Start DagShell
+# NOTE: </dev/null keeps fd 0 open. Without it, socket() can return fd 0,
+# which triggers the server_fd==0 exit check bug in the binary.
 sleep 5
-/data/orbic_app &
+/data/orbic_app </dev/null &
 echo "" >> $BOOTLOG
 echo "[OK] orbic_app started PID=$!" >> $BOOTLOG
 echo "=== BOOT COMPLETE ===" >> $BOOTLOG