yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] cellzealot:
I took a look at the file and it's very possible something similar could be devised for the D3, but we need the SBF file so that the preinstall partition can be pulled from it to use.

The Atrix devs have all of those files and tools available to them already, which is why they were able to create this kind of exploit.

If we had SBFs and an engineering device available to us this would have all been done very quickly on the D3 too. Unfortunately, so far we don't have either.
[Motorola Droid 3] taylorhome11:
Can any type of temproot be achived at all?
[Motorola Droid 3] elkay:
No, I meant what I said. I meant that I asked those things but didn't have a response yet.

This is very, very close.
[Motorola Droid 3] sparkyman216:
This is what I got after gingersnap.

Congratulations! You have root access!

Superuser.apk - com.noshufou.android.su - version 2.3.6 is installed!

Standard su binary location: /system/bin/su: No such file or directory

Standard su binary location: /system/xbin/su: No such file or directory

Alternate su binary location: /sbin/su: Permission denied

Root user id: Root not properly returning its user id

Root group id: Root not properly returning its group id
[Motorola Droid 3] tcrews:
su is root, that's the Super User account.

SuperUser.apk is just an app to let you control what apps can access "su".

You can have root without SuperUser.apk

You can't have root without "su"
[Motorola Droid 3] sparkyman216:
Yea I know just showing what it sajd
[Motorola Droid 3] Mills00013:
Trying to break root on the Xperia for the last few months, I came across this exploit: http://www.cvedetails.com/cve/CVE-2011-1495/

I havn't had time to program anything for it yet, but I know that the file in reference in the AOSP hasnt been touched in over a year. I think that this exploit might gain some ground if someone has time to work up a quick executable.
[Motorola Droid 3] Adam.h.ogle:
I highly doubt that module is compiled into our kernel: It is a driver for LSI-based RAID cards--I have one in my server. Even if it was compiled as a module, we need root to insert it into the kernel...

I've been looking through some of the GNU exploits on cvedetails.com and they seem more plausible, but I need to setup an ARMv7 compile environment to I can get things rolling.

EDIT: The camera is crazy buggy, maybe that is our ticket to root:

<3>[25853.740905] Invalid Device Structure
<3>[25853.747619] get_user_pages() failed
<3>[25853.928344] regulator_check_voltage: operation not allowed for vcam
<3>[25854.375213] messageq_get failed! status = 0xffffffec
[Motorola Droid 3] taylorhome11:
Stupid question but is there a way to skip device check in rsd lite? Where u can flash any sbf to any device?
[Motorola Droid 3] Jewremy:
Have you tried sbf_flash in linux?
[Motorola Droid 3] taylorhome11:
Nope but found it right before you posted. Have to load up ubuntu on my computer as I don't think it will work through a vm
[Motorola Droid 3] Mills00013:
It probably would work in a vm, you just probably wouldnt want to trust such a low level transfer to an emulated port. Just get an ubuntu live cd or go get unetbootin and make a live usb drive with a couple clicks. Easiest way out there.
[Motorola Droid 3] militant:
This was posted over on Droidforums, hopefully this is legit and can be of some help:
[Motorola Droid 3] 3diord:
How about taking out the flash chip, and mounting it on a computer? I've looked around but can't find a board that would really work. This is the closest I've seen..
[Motorola Droid 3] eww245:
You serious? Best of luck to you. Can't see this helping the rest of us though.
[Motorola Droid 3] Seirÿu:
Think we could pass it around through-out the Droid community if it works!? ;)

Cheerin' for you guys! :)

Picking my D3 from Fedex after work! :)
[Motorola Droid 3] elkay:
I haven't hard-modded since I chipped my original Playstation. As much as I want root, I really don't think I'd bother in this case.
[Motorola Droid 3] 3diord:
Well I'd practice on a spare chip. An 8GB version is only $20. If I could only find a board that goes to almost any standard (CF, sata, ide, sd), I'd give it a shot.
[Motorola Droid 3] Mills00013:
Are you suggesting desoldering, flashing, modifying, and then resoldering to the phone?
[Motorola Droid 3] buckmarble:
I don't know if this is useful, but browsing with root explorer, I can actively navigate /pds/camera that has read and write permissions. It doesn't tell me I have to have root to see the folders.
[Motorola Droid 3] 3diord:
Who said flashing? It'd be as simple as mounting the partition, and tossing in a suid su
[Motorola Droid 3] Mills00013:
Ha, you say it as if the flashing is the the difficult part of the steps i mentioned....

it would still certainly consist of desoldering a chip though and then copying it over. Still a pretty hardcore mod.
[Motorola Droid 3] eww245:
I see that too without the root version. Trying to make a folder or file says successful but it's not created. Guess with it mounted with barrier=1 doesn't help.
[Motorola Droid 3] 3diord:
It's a BGA though, so just a bit of heat gun action should work. I found a board that should allow me to access the chip from my computer, but stuff has to be shipped from across the world. If root doesn't exist in about a month, I might have to carefully give it a go.
[Motorola Droid 3] volcanomike:
Can't push to /pda/camera

EDIT: It's not writable
[Motorola Droid 3] eww245:
vold a service that runs allowing for automatic mounting of external media, in our case sdcard-ext, can be executed but does nothing. From my experience with xdandroid (my only android experience) running vold will unmount the sdcard then it can be manually mounted with mount -t -o…

I assume the manual mount and umount of the sdcard in the settings is part of the framework and probably run as system maybe? ? Part of what we need is to get rid of that damned noexec from any mount point.

Just babbling......
[Motorola Droid 3] Adam.h.ogle:
The mounting of all system volumes is done at start-up and is hard-coded into an executable (Google "android fstab"). The mounting of any removable drives is handled by VOLD, which can be ran as a user. Unfortunately, to mount or unmount, I believe you have to have r/w permissions on the block device. We don't, only root does.
[Motorola Droid 3] dpwhitty11:
Whats the most promising thing that's been found the past few days? I understand what y'all are talking about until it gets to the *nix commands and all that.
[Motorola Droid 3] elkay:
Honestly, and I *really* don't mean to offend, if you don't understand the commands that are being issued, then it will be hard to explain what the attempted exploits even are. Common hack methods include buffer overflows, or getting one of our executable files to have root permissions via another file or folder's permissions. Any deeper than that is getting back into talking about the commands.
[Motorola Droid 3] dpwhitty11:
No offense taken. Its not that I don't know what the commands actually do, I just don't know what typed into adb/terminal does until I look up what something stands for, such as ls. I don't spend much time on *nix systems.
[Motorola Droid 3] elkay:
We're basically shooting for the latter right now.. trying to get one of our executables onto the device and to have root+execute permissions via inherited permissions from a folder or process. Finding buffer overflow exploits is 100 fold more tedious and very unlikely in Android itself. That we'd almost certainly have to rely on a ****up by Moto.
[Motorola Droid 3] Mills00013:
Fortunately Moto is known for its ****-ups. So it's only a matter of time...
[Motorola Droid 3] dpwhitty11:
Gotcha.

Did anything ever happen with the camera? Last I checked (a few pages and hours back) it looked promising.
[Motorola Droid 3] elkay:
Funny you should mention that, because I was just about to post in reply to above that the camera is one solid piece of **** and is soooo horribly written that I'm sure there's an exploit of some sort in there.
[Motorola Droid 3] dpwhitty11:
Hahahahah yesssssss this is great news.
[Motorola Droid 3] Adam.h.ogle:
Without the source, it is a crapshoot. The thing holding me back right now is a fear of fubar-ing my phone--we don't really have a way to recover anything yet.

Some more potential exploit points:

Look into where NOSUID is implemented in the FS stack. If it is in ext3, then we may be able to pass a malformed partition using /preinstall and get around the NOSUID issue. This would be a nice bug in Linux, but the general philosophy is "if you can touch it, you own it". Embedded hardware is a little tricky, though.

"Overflash" /preinstall with a huge image. If fastboot is smart, this will do nothing. If it is dumb, it may flow over into another partition. The only problem with this approach is that it is a 99.99% chance of a brick.

Two-phased attack: See if we can elevate to system (uid=1000), then from there, find another exploit to gain root. System can edit quite a few more files.

Has anyone done a factory reset using the boot loader? If not, could someone who has NOT flashed the /preinstall image try it? I want to see if that stupid golf and FPS game come back. Please please please report back if you do this. Note: if you have flashed /preinstall, do this at your own risk...it may brick the phone.
[Motorola Droid 3] blustosa:
Hum, it was interesting seeing the Photon rooted through the dock, I wonder if this would be something feasible for the Droid 3 as well.
[Motorola Droid 3] elkay:
I wish this discussion happened a week earlier when I was bringing back my faulty D3 because I would have gladly tried it on that when I returned it.
[Motorola Droid 3] evulhotdog:
I wish people would stop *****ing about buying the phone and not liking it because its not rooted. Its your fault and nobody elses problem. Go make another thread, its not relevant.
[Motorola Droid 3] Skurvy_Pirate:
I think he was saying he would have tried it on his phone because it was already broken and he was taking it back to get a replacement anyways. It didn't sound like he was *****ing about not liking the phone..
[Motorola Droid 3] 98ramair:
Not to be a jerk but I think the op meant he had a phone to spare and would sacrifice it for the good of the community... Could be wrong but either way your response is a little dickish
[Motorola Droid 3] elkay:
Wow, you kinda read that wrong or took that the wrong direction or something..

Re: the last 2 posts, yeah I was exchanging my D3 with a bad Wifi for a new one. I meant that I could have factory reset it without caring since I was getting a new unit anyway.
[Motorola Droid 3] GoogleAndroid:
He didn't complain about the phone...he said he was willing to sacrifice a defective phone of his. Way to be a ****.
[Motorola Droid 3] pplude:
Can someone post the steps of a factory reset from the bootloader. I haven't flashed and I'm willing to help!
[Motorola Droid 3] Adam.h.ogle:
This is out. Mount populates a bitfield in a fs struct with the mount options (which would normally come from the fstab), and exec does a check against that struct by ANDing it with a constant for NOSUID to see if it has been set. If the constant exists, no setuid magic happens...

I did find several amusing/scary comments in the kernel tree. Really makes you wonder what we base a decent chunk of life on:

Thankfully the code that followed was directly related to debugging...I think...
[Motorola Droid 3] elkay:
You can just do it from Settings > Privacy. No need to go into the bootloader.
[Motorola Droid 3] Adam.h.ogle:
Disclaimer (I hate this part, but cya):

I am not responsible if this renders your device unuseable. I do not believe this will cause any harm to your device, but in the event that it does, you have chosen to follow these instruction of your own free will and I cannot be held liable for any damages.

Instructions:

Go here: http://xdaforums.com/showthread.php?t=1183106. Reboot into recovery, press vol up and vol down (at the same time) to see the menu, use vol down to select the factory reset option, click the power button to select. Pray.

EDIT: or do what ELKAY said. I don't believe there is a difference.
[Motorola Droid 3] elkay:
HAHAHA. As a developer myself, I always love stumbling on a disgruntled programmer's comments.
[Motorola Droid 3] elkay:
Won't my method accomplish the same thing you're looking for?
[Motorola Droid 3] Adam.h.ogle:
AFAIK, yes. Edited post to reflect that.
[Motorola Droid 3] pplude:
before I do, here's my DMESG output. There's something interesting...POINTERS!

This means buffer overflows and possibly crashing this goddamn zygote script, and possibly more. here's the output, and no, I havn't read it either:

http://www.mediafire.com/?pn51p1yn2s5y73q
[Motorola Droid 3] cellzealot:
A Factory Reset formats the user data and cache partitions but does not reload the system partition, so it will not get rid of anything that is in /system/app. The preinstall only happens once during initial boot up after flashing an SBF file or flashing via fastboot.
[Motorola Droid 3] RigWig:
I could be totally off, but if it is possible to get an su apk into the preinstal; dir, and we know that there is a script by moto that installs everything in that dir, couldn't we copy su in there, then run a factory reset which would make that script install su for us?

Edit: Just read the post above, so this wouldn't work then because we have no way to do a true reset on the phone
[Motorola Droid 3] Skurvy_Pirate:
Both Lets Golf 2 and Nova come back after a factory reset.
[Motorola Droid 3] pplude:
So...who's within the 2 week window and wants to flash and then recover the D3? Because I just missed it by 3 days now.
[Motorola Droid 3] 3diord:
The /preinstall flash from atrix? Has anyone tried modifying permissions in the image file before flashing to get suid root?
[Motorola Droid 3] elkay:
I suggested this a few pages back but don't believe anybody tried it.
[Motorola Droid 3] elkay:
I was outside the window by 3 days when I did my exchange but they still gave me a new unit thankfully.
[Motorola Droid 3] pplude:
Yeah, but the guys at wireless zone are dicks
[Motorola Droid 3] elkay:
Oh I wasn't telling you to do it anyway. I was saying that I got damn lucky.
[Motorola Droid 3] btonetbone:
Noob question, but could this be a lead in accessing permisson denied files? There is a program referenced in this thread which allows us to delete the locked bookmarks in the web browser.

http://xdaforums.com/showthread.php?t=1198660
[Motorola Droid 3] elkay:
I think the "locked" bookmarks aren't actually in a read-only place or with permissions preventing them from being deleted. I think it's just a flag in the bookmark index or something like that saying "don't let the stock browser delete these".
[Motorola Droid 3] taylorhome11:
If you want to send me the modified file i will flash it. ive had mine for 2 days....

BTW, if anybody was curious, I was going to attempt to flash a recovery only from a SBF from another device. If you screw up recovery, it wil still boot and work. You just won't be able to access recovery. Done this multiple times before. I just can't get sbf_flash to work. It says put phone in bootloader mode. I have tried every option under the menu when you push both volume keys and power....dunno
[Motorola Droid 3] 3diord:
I had my D3 check for updates from my computer, this is kind of interesting.

POST /blur-services-1.0/ws/upgrade/2/check_for_upgrade/0000081971A5/4503599763255717?k=android&l=100000081971a5&f=pb&p=42&h=EUEeWizjb1eKCyMEOMGcznhfrvr&of=0&ssl=0 HTTP/1.1\r\n

-edit- realized this misses quite a bit of stuff, heres a pastebin of the entire http request

http://pastebin.com/Q6CihWky
[Motorola Droid 3] superkeest:
Just reading p3droids tweets, looks like he just bought a droid 3, 10 hours ago.....
[Motorola Droid 3] Adam.h.ogle:
This is excellent news! If we can determine who the script is running as, we may be able to push su with the correct permissions.
[Motorola Droid 3] Adam.h.ogle:
We tried that. The partition is mounted with "nosuid" which ignores it.
[Motorola Droid 3] 3diord:
What about snooping around Motorola's update servers?
[Motorola Droid 3] elkay:
Oh right right.. so much been going on in here, my bad.
[Motorola Droid 3] Jewremy:
Bp sbf flash should be the sbf flashing mode aka the one you want, AP fastboot is the fastboot flashing mode. Sbf_flash may need to be updated.
[Motorola Droid 3] eww245:
There appears to be a secure "MD5" in there, for a second I thought it could be the signature keys, or at least the type needed for signing an update.zip, but I don' believe so.
[Motorola Droid 3] eww245:
This is after initially un-installing I assume? If so this does look promising.
[Motorola Droid 3] taylorhome11:
reading up on sbf_flash does this show any promise? BTW, I think sbf_flash does have a device check still because it will work with the phone intended but not with d3....

http://blog.opticaldelusion.org/2011/02/sbfflash-updates.html
[Motorola Droid 3] Adam.h.ogle:
KrazyKrivda believes the /system/bin/loadpreinstalls.sh script gets executed after every reboot, not just after a factory reset (which is what I thought). Furthermore, the output log is NOT viewable by shell, and the property set by the script is not set-able by shell, meaning the script is ran by another user/group. If we can find an exploit in this script, it may be our ticket to getting root.
[Motorola Droid 3] Skurvy_Pirate:
Yeah. Uninstalled both, then I did a factory reset and they were back.
[Motorola Droid 3] eww245:
It looks like the script checks if they are installed first. So uninstall at least one, make an apk and md5 and flash? That's what im thinking anyway.

Another thing this ril is horrible!!!! I get constant loss of service from what I believe is US Cellular on my "A side". There's gotta be a hole there. vzw is trying their best to resolve it for me. Already on the second phone.
[Motorola Droid 3] taylorhome11:
What would the apk do though? It would still need root to modify or execute from system
[Motorola Droid 3] krazykrivda:
I feel though I'm getting very close but I'm not sure what my error is.. if anyone knows adb/linux well please join me in IRC room #krazyk
[Motorola Droid 3] eww245:
Yeah I'm thinking too simple. The script is root:shell so it wouldn't work, at least to get su somewhere.

Anyone use busybox from /data/tmp it works along with any other arml binary, not sure how much it'll help but it's some extra tools.
[Motorola Droid 3] estobaughn:
Whats running on the phone when you turn it off and charge it.
[Motorola Droid 3] Jewremy:
charge_only_mode is the binary.
[Motorola Droid 3] krazykrivda:
I CAN ALMOST GUARANTEE ROOT IF ANYONE CAN SOLVE THIS PROBLEM:

File 'fileX' needs to contain 2 cmds (ex - cmd1...;cmd2... aka - cp file /dir; cp file2 /dir) such that you can do the following in terminal and both commands run:

EDIT: when i say contains.. it shoudl be a simple txt file that all it has in it is the 2 'cp' cmds

testing=`cat fileX`
$testing

if you can answer this.. then i should be able to provide root.

Thank you.
[Motorola Droid 3] randallman:
Krazykrivda,

I don't know if this is helpful, but on a full busybox on ubuntu and on my Droid 1 using testing=$(cat foo) since I couldn't find the ` char in the terminal emulator :)

# busybox sh

BusyBox v1.13.3 (Ubuntu 1:1.13.3-1ubuntu11) built-in shell (ash)

Enter 'help' for a list of built-in commands.

simba:~$ cat foo

eval echo foobar; echo baz

simba:~$ testing=`cat foo`

simba:~$ echo $testing

eval echo foobar; echo baz

simba:~$ $testing

foobar

baz
[Motorola Droid 3] krazykrivda:
randallman:

that's awsome.. and i thought that is exactly what i have been looking for.. issue is it need to be at very start.

i have

pm path $testing[code]

so it appears that using eval at that point is too late

ughhhhhh
[Motorola Droid 3] eww245:
on the droid 3 eval only echos both commands. Using busybox touch as both commands

eval /tmp/busy* touch /sdcard/touch1; /tmp/busy* touch /sdcard/touch2

testing=`cat /sdcard/test`

$testing

/tmp/busy* touch /sdcard/touch1

/tmp/busy* touch /sdcard/touch2

touch1 and touch2 didn't get created
[Motorola Droid 3] krazykrivda:
what you did works fine for my initial question! using $testing on it's on

however it is in the script that I cannot change as:

pm path $testing

i was hoping there was a way to set 'testing' such that when it is called there it can cancel/finsish the 'pm path' command and then STILL EXECUTE the cp i need.
[Motorola Droid 3] Jewremy:
Sounds like you need $testing=(pm path ;cp x x1)
[Motorola Droid 3] hunter9604:
Cheering ya'll on! Getting closer, can feel it in my bones!

Outstanding job, the Android community, as well as D3 owners applaud all of you!

Thank you so much for all of your hard work and dedication to Android!
[Motorola Droid 3] Seirÿu:
So this may sound dumb (probably is). I'm just throwing this out there since I'm barely beginning to learn... What's making me think of this is the bug with the Corporate Sync keeping you from add Active Sync without a work around.

At any rate, could there be a way to use the device administrator settings to try and find an exploit that way? Just a thought, probably dumb...
[Motorola Droid 3] krazykrivda:
REWORDED QUESTION:

I can execute 3 consecutive 'cp' functions by doing using the following structure:

testing="cp 1...; cp 2...; cp 3...
$testing

the issue is the line to execute is:

pm path $testing

instead of just '$testing'

is there anyway to declare variable 'testing' so I can achieve the same concept by:

testing="..."
pm path $testing
[Motorola Droid 3] eww245:
alias maybe
[Motorola Droid 3] taylorhome11:
Would it not be more useful to figure out how the preinstall script is ran and elevated?
[Motorola Droid 3] superkeest:
alias 'testing=cp 1; cp 2; cp3'
[Motorola Droid 3] rweb:
I'm not sure if I really understand your goals, or maybe I'm even stating the obvious. But maybe executing by backslashes is what you need.

testing='`cp ... ; cp ...`'

This will have the cp commands executed first.

EDIT: I see it doesn't work when invoked by another command.
[Motorola Droid 3] mh73024p:
thumbs up for the progress ya'll have made. krazy, your programming in java correct?
[Motorola Droid 3] aross6:
Cheers on the progress you guys have made thus far... hopefully we can have root very soon (if it happens this weekend, it sure would make spending time with my in-laws over the next couple of days alot more bearable for sure)!
[Motorola Droid 3] pplude:
Nope, shell scripting.

As much as I know about Linux and permissions and security and such...they just went above my head too.
[Motorola Droid 3] donwhall70:
All I can say is ;)
[Motorola Droid 3] saintlikesniper:
I've been following this thread from day one and im amazed by the progress I hope you guys get it. Seems like you guys are on the edge of breaking it and gaining root I hope its soon
[Motorola Droid 3] sic4672:
I second this, the next week with my parents and my in-laws will be much nicer if I can tinker with my new toy :D