New bootloader lets you take the “Meta” out of the original Meta Quest

新型引导加载程序让你可以彻底摆脱 Meta 对初代 Meta Quest 的控制

Remember the original Quest headset that Meta (then Oculus) trumpeted back in 2019? Meta seems to hope you don’t, since the company officially stopped supporting the wireless VR headset in 2023 to focus on the more popular Quests 2 and 3. 还记得 Meta（当时叫 Oculus）在 2019 年大肆宣传的初代 Quest 头显吗？Meta 似乎希望你已经忘了它，因为该公司已于 2023 年正式停止了对这款无线 VR 头显的支持，转而专注于更受欢迎的 Quest 2 和 Quest 3。

However, tinkerers haven’t abandoned the hardware and recently released a new root-access exploit and bootloader that gives “developers and enthusiasts full control over Quest 1 hardware.” 然而，极客们并没有放弃这款硬件，他们最近发布了一个新的 Root 权限漏洞和引导加载程序（bootloader），让“开发者和爱好者能够完全掌控 Quest 1 硬件”。

The QuestStack project integrates previously known vulnerabilities in the Quest’s Android fastboot process into a privilege escalation chain that leads easily to full root access on the device. The bootloading process is now streamlined enough that it can be completed without any downloads through a web interface after connecting the headset to a PC. QuestStack 项目将 Quest 安卓 fastboot 进程中已知的漏洞整合进了一个权限提升链，从而可以轻松获取设备的完整 Root 权限。现在的引导加载过程已经足够简化，只需将头显连接到电脑，通过网页界面即可完成，无需下载任何额外软件。

With this exploit, the original Quest hardware can now be officially divorced from any reliance on Meta’s servers or services to be useful. That means enterprising Quest owners should be able to sideload apps without needing to register for a Meta Developer account and activating Developer Mode through Meta’s mobile app. 有了这个漏洞，初代 Quest 硬件现在可以正式脱离对 Meta 服务器或服务的依赖，从而继续发挥作用。这意味着有能力的 Quest 用户无需注册 Meta 开发者账号，也无需通过 Meta 移动应用激活开发者模式，即可侧载（sideload）应用程序。

It also means users should be able to go through the initial setup and login steps for a fresh Quest headset even if and when Meta decides to shut down the servers that currently support this process. 这也意味着，即使未来 Meta 决定关闭目前支持初始设置和登录流程的服务器，用户依然能够完成全新 Quest 头显的初始化设置和登录步骤。

Tinkerers are also in the early stages of figuring out how root access can unlock previously unavailable features on the Quest hardware. That includes activating the 90 Hz refresh rate that John Carmack admitted in 2019 was being held back to 72 Hz in the OS for performance reasons. There are also projects in the works to get other VR controllers working with the original Quest. 极客们目前也处于探索阶段，研究如何利用 Root 权限解锁 Quest 硬件上此前不可用的功能。这包括激活 90Hz 刷新率——John Carmack 在 2019 年曾承认，出于性能考虑，该功能在系统中被限制在了 72Hz。此外，还有一些项目正在尝试让其他 VR 控制器适配初代 Quest。

In 2021, Meta’s then-CTO John Carmack released an official “full root access” update for the Oculus Go, the Quest’s wireless predecessor. At the time, Carmack said he hoped that update would allow tinkerers to “repurpose the [Go] hardware for more things today” and ensure that “a randomly discovered shrink wrapped [Go] headset twenty years from now [would] be able to update to the final software version, long after over-the-air update servers have been shut down.” 2021 年，时任 Meta 首席技术官的 John Carmack 为 Quest 的前身——无线头显 Oculus Go 发布了一个官方的“完整 Root 权限”更新。当时，Carmack 表示他希望该更新能让极客们“在今天将 [Go] 硬件重新用于更多用途”，并确保“二十年后偶然发现的一台未拆封 [Go] 头显，在 OTA 更新服务器关闭很久之后，依然能够更新到最终的软件版本。”

QuestStack author starseed12345 speculates on GitHub that a similar exploit could probably enable root access on Quest 2 headsets running older firmware versions but that currently “the chance of bricking outweighs the benefit of unlocking the bootloader.” QuestStack 的作者 starseed12345 在 GitHub 上推测，类似的漏洞或许也能让运行旧版固件的 Quest 2 头显获得 Root 权限，但目前“变砖的风险远大于解锁引导加载程序所带来的收益”。