yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] Adam.h.ogle:
This is going to sound negative: Finding a bug in ADB would be both insanely impressive and highly unlikely. The stuff I've been digging through today has dealt with the Android OS code--not Motorola or the Droid 3. Finding an exploit would mean we've effectively hacked ALL Android devices, not just ours. In saying that, I've been reviewing some of the source code related to any executable that elevates to root and they all say the same thing: Keep this simple, it will be elevated and is a potential source of exploit. The programs, such as run-as and dd are crazy simple C programs with little to no outside dependencies. The only hope I see of us "stumbling" upon root would be that Motorola was careless in their final production rom and left something in there that they shouldn't have (which is why we've been digging around in /preinstall so much).

As an update, I'm to 3-letter words on looking inside the preinstall folder...nothing interesting yet.
[Motorola Droid 3] eww245:
If were looking for a hole in adb, adbd can be killed, it just restarts. I've read it is a way to get temp root on some devices, but not here.

Also while looking at ueventd.mapphone_cdma.rc, /dev/camera0 is root with 0777, along with some other devices I don't recognize , so I guess the camera runs as root. Could this be a way in?
[Motorola Droid 3] jenntas:
Originally Posted by Deodexed Page 4 of this tread

How long is the battery life lasting on the D3?

I went on Droid Forums and someone recommended that whe you first get your Droid 3 you let your battery die completely 3 times and reacharge each time to 100% uninterupted. I did that after I got a new batter because my battery life sucked. Upon heavy usage my battery will last almost all day. If have low/moderate usage, I can get a over 1 day.
[Motorola Droid 3] psouza4:
Wrong thread/off topic. :P
[Motorola Droid 3] nerdslogic:
and this helps us root how?:confused:
[Motorola Droid 3] elkay:
The funniest part is that what they posted isn't even true. The LiPo batteries Moto uses now don't have the memory effect that older NiCad technology did.

But, back on topic..
[Motorola Droid 3] jenntas:
Some one asked about the battery life for the Droid 3 on page 4 of this thread...
[Motorola Droid 3] psouza4:
Actually it is true because it helps out the batterstats.bin file that the OS maintains to track the life and capacity of your battery. When the OS has built a better file, it displays the correct percent usage rather than thinking it's almost out even when it's not.

Cool. They're off topic too, then. :P You could have saved some backlash though and quoted them. ;)

But anyway, I agree with elkay: back on topic of this possible Droid 3 root exploration...
[Motorola Droid 3] Pokelover980:
I'm willing to help out on anything as long as I'm not putting anything on my phone that could brick it (I know, I'm not really offering much help by saying that, but I've got ADB up and everything, and I've done an adb pull on my system. Something interesting is you can see most/all the uid's if you go to /acct/uid/ after pulling the system with adb. It all seems to contain mostly useless files to us though).
[Motorola Droid 3] shane1:
Well you see if you got better battery life you have more time to find a way to root

....duh.....lol
[Motorola Droid 3] nerdslogic:
didn't see it from that angle.....way to contribute to the cause :rolleyes:
[Motorola Droid 3] tacosrdelicioso:
lp

I found the battery life to b much better using launcher pro. And of course having background data and things of the like off
[Motorola Droid 3] estobaughn:
On this preinstall partition, is that where the motorola software is. I think ir ead somewhere that there are install files for your computer. Is there any way in from that? I have no idea what i am talking about, still trying to learn all of this kinda stuff.
[Motorola Droid 3] krazykrivda:
who can clarify any of this?

shell@cdma_solana:/$ HOSTNAME=root
shell@root:/$ ls -l /system/preinstall/md5
-rwxrwxrwx app_55534 root 28440 2011-06-04 00:06 dosu
-rw-r--r-- root root 33 2011-08-02 17:08 com.noshufou.android.su.md5
-rwsrwsrwx root root 26264 2011-05-24 10:32 su
-rwxrwxrwx root root 24120 2011-05-24 11:19 sqlite3
shell@root:/$ su
su: permission denied
shell@root:/$ /system/preinstall/md5/su
Permission denied
shell@root:/$ /system/preinstall/md5/dosu
/system/preinstall/md5/dosu: not found
shell@root:/$ id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)

I can get Superuser.apk to preinstall, but that is irrelevant.

I got dosu to no longer be OWNED by root, but idk what app_55534 is anyway.

simply doing 'su' vs '/system/preinstall/md5/su' gives different responses (although both say permission denied) while the dosu says not found.

I'm not sure if i'm getting closer.. or just more confused.. ! any linux pros clear any of this up?
[Motorola Droid 3] Adam.h.ogle:
You need the sticky bit (s) set on su, then it will execute as root.

EDIT: How did you manage to get the files owned by root?
[Motorola Droid 3] bose301s:
This looks promising, we may almost be there :)
[Motorola Droid 3] krazykrivda:
What do u mean the sticky bit SET on su?

also, the files have always been owned by root? isn't that the issue..

today has been a long day and I"m getting more confused as i go. bare w/ me if you can
[Motorola Droid 3] superkeest:
Im pretty sure your going to want dosu owned by root. as it probably needs to run as root. im not sure what ap_xxxxx is, but im sure that user does not have the priveleges root does.

-sorry, app_xxxx is either the owner or the group, most likely the group.
[Motorola Droid 3] Adam.h.ogle:
When I pushed some files to /preinstall/app using ADB, they were owned by "shell", not root. This is very important: How are you getting the files onto your phone?

The sticky bit, to be more precise, the setuid bit, tells a program to use the owner's uid instead of the current user's uid when starting the process. Therefore, any permission checks in that application will use the owner's uid. Normally, this isn't very interesting, except when the file is owned by root (such as you have done).

As for patience, you're really close to getting temp root...I have no problems explaining stuff I know :p
[Motorola Droid 3] pplude:
Wasn't there a recent MacOSX exploit with the sticky bit to achieve root?
[Motorola Droid 3] krazykrivda:
you tell me mr apple.

EDIT - adding something useful

shell@root:/$ cd /system/preinstall/md5
shell@root:/preinstall/md5$ ls -l
-rwxrwxrwx root root 28440 2011-06-04 00:06 dosu
-rw-r--r-- root root 33 2011-08-02 17:08 com.noshufou.android.su.md5
-rwxrwsrwx root root 26264 2011-05-24 10:32 su
-rwxrwxrwx root root 24120 2011-05-24 11:19 sqlite3
shell@root:/preinstall/md5$ ./su
Permission denied
shell@root:/preinstall/md5$ ./dosu
./dosu: not found

who can tell me why one responds one way, the other command says not found?
[Motorola Droid 3] pplude:
Hmmm.I think the response has to with the permissions...667 vs 666.

Other than that, that was the vector that the Mac Defender virus used, though I have no idea where you'd find the source.
[Motorola Droid 3] psouza4:
This? http://xdaforums.com/showthread.php?t=1152101
[Motorola Droid 3] cellzealot:
I believe the reason krazykrvda has those files owned by root is because he flashed the entire Atrix preinstall partition in fastboot and did NOT push them with ADB.
[Motorola Droid 3] pplude:
Same vector, yes
[Motorola Droid 3] elkay:
If flashing the preinstall partition doesn't have a check, couldn't we fix that permission preventing running dosu before flashing it?
[Motorola Droid 3] pplude:
As a sidenote...I know we're looking for a universal method for 2.3.4 devices, but I think we're going to end up with a D3 only method because of the partition structure.

Any way this can be done from the sd card?
[Motorola Droid 3] krazykrivda:
yes i did use fastboot, you cannot adb push to preinstall
[Motorola Droid 3] cellzealot:
OK I was confused because that is what the other poster was suggesting and I wasn't sure if the method used was clearly stated.
[Motorola Droid 3] taylorhome11:
im going to try some crazy stuff...i will get back to you guys... not worried about bricking like most
[Motorola Droid 3] Androidsims:
Just install the drivers and plug it in
[Motorola Droid 3] Adam.h.ogle:
Bad news. The /preinstall mount has nosuid set, which is why SU will not elevate...
[Motorola Droid 3] st33med:
Is it possible to get an apk of sorts on /preinstall to install su?

Just throwing out an idea.
[Motorola Droid 3] elkay:
Don't you have to at least buy dinner before you just go and plug it in?
[Motorola Droid 3] elkay:
So is that "absolute dead end" on this proposed method? Is nosuid not set on the Atrix and that's why it worked?
[Motorola Droid 3] Adam.h.ogle:
I would guess so. The only partition we have RW access to and no NOSUID setting on is /data/tmp. However, copying files changes their permissions, files can't be moved across block devices, and from what I can tell, we can't mount a loopback device (still looking into this one).
[Motorola Droid 3] taylorhome11:
Well does android have an fstab? I know you can remove nosuid from that on *nix
[Motorola Droid 3] krazykrivda:
This may not be root.. but this may be getting us closer! try this from shell NOT RECOMMENDED USING A TERMINAL EMULATOR

./su
./dosu
bootanimation

ctrl+c to exit on your cpu

^^ realistically you only need the 3rd line, and yes.. this does absolutley nothing helpful.. just airing out some frustration.. and showing off the only thing i figured out today! :-) sorrrrry
[Motorola Droid 3] Adam.h.ogle:
I believe it is hard-coded into the source.

Even worse news: Android (in general) only supports mounting one loop device: /dev/block/loop0. So, scratch the idea of mounting an existing ext3 partition.
[Motorola Droid 3] krazykrivda:
yeah it does have the equiv to an fstab... BUT.. you need root to edit it

see /etc/vold.fstab

Edit: this seems to only b for sdcard
[Motorola Droid 3] eww245:
As far as I know there is no limit to loop mounts for Android just as there is none for *nix. Or at least up to some multiplication of 256??. We just don't have access to mount a looped device or a partition so were out of luck.

[edit]Scratch that, it depends on the kernel for loop mounts and how many. I just can't find any way to mount either. Always returns Operation not permitted.
[Motorola Droid 3] nerdslogic:
so....what did you try? I take it, it didn't work
[Motorola Droid 3] Adam.h.ogle:
I am currently looking for a way to get root by loading SU and getting its setuid bit set. Most of the partitions that I can put SU on with the proper permissions have NOSUID set when mounted--meaning the bit is worthless. On the mounts that don't have NOSUID, either the user/group is locked (sd-cards) or the filesystem is tmpfs (promising). Currently, we don't have permission to mount or remount a filesystem, even if it is loopback. It is also not possible (without root) to copy a file with the correct permissions from one FS to another.

I'm still digging around, hoping that they've forgotten to set one permission correctly, and that we can use it for root. Right now, it doesn't look promising.
[Motorola Droid 3] krazykrivda:
has anyone confirmed that the atrix users didn't have nosuid for the /preinstall partition
[Motorola Droid 3] st33med:
Here's to you man. You are doing good.

I think this phone will be one tough cookie to crack. I feel it is possible, just that Motorola has gone out of their way to make root as tough as possible.
[Motorola Droid 3] elkay:
I'm curious about this too, and what's different that allowed their 2.3.4 root to work while keeping the bootloader locked.
[Motorola Droid 3] nerdslogic:
That is what I want to know unless our was an ota
[Motorola Droid 3] elkay:
It wasn't a pre-root. The root was done with the Atrix already on stock 2.3.4.
[Motorola Droid 3] pplude:
hey...anyone know what's up with this default.prop in the / directory?

shell@cdma_solana:/$ cat default.prop

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.service.adb.enable=0

shell@cdma_solana:/$

ro.secure=1

ro.debuggable=0

persist.service.adb.enable=0

THOSE are the two lines I'm interested in. ro...read only. Secure Read Only...hmm, keeping us out of system folders perhaps?... read only debuggable, not able to use adb in those directories (as adb actually has mount permissions, if root owns the system, it would stop adb from using mkdir and mounting anything), and killing the adb service after every command, therefore if we could execute su, it'd reboot and it'd all be for naught.

EDIT: uploaded a modified default.prop

http://www.mediafire.com/?m5gnpc7mbh6nzrj

I'm going to try dd with this...

-------------------------

Nope, read only filesystem. Any solutions here. I think this may finally be the weak point.
[Motorola Droid 3] pplude:
And in true form I keep poking around. adb exists, access is denied.

I loved "/system/bin/fsck_msdos" in /system/bin/vold :)

-------------------------------------------

Still going, I'll edit this post if I find anythign interesting here

-----------------------------

hey, I fount the encryption method in vold

"/dev/block/dm-%u crypt twofish %s 0 %s 0"

-----------------------------------------------

output of an export probe:

ANDROID_ASSETS
ANDROID_BOOTLOGO
ANDROID_DATA
ANDROID_PROPERTY_WORKSPACE
ANDROID_ROOT
ASEC_MOUNTPOINT
BOOTCLASSPATH
EXTERNAL_ALT_STORAGE
EXTERNAL_STORAGE
HOSTNAME
LD_LIBRARY_PATH
LOOP_MOUNTPOINT
PATH
PWD

---------------------------------

also, /tmp has write permissions. can someone PLEASE PLEASE PLEASE just copy a su binary from an X2 or Atrix?
[Motorola Droid 3] krazykrivda:
The export you see, I'm not sure what the value of that is? all of those vars can be seen normally with 'set' command and you can change any of them freely by simply doing 'HOSTNAME=root' or 'ANDROID_ROOT=/data' instead of /system. Haven't found any usefulness with this.

As for using /tmp (which is linked to /data/tmp) when you move the binary there you permissions are not preserved as adam.h.ogle mentioned before.

about your earlier post about the default prop. Those 4 settings I BELIEVE are just default settings.. most of which correlate to SETTINGS>APPLICATIONS>DEVELOPMENT which can easily be changed (mock locations, usb debugging, etc)

and for your use.. running 'set' returns:

shell@cdma_solana:/$ set
ANDROID_ASSETS=/system/app
ANDROID_BOOTLOGO=1
ANDROID_DATA=/data
ANDROID_PROPERTY_WORKSPACE=9,69632
ANDROID_ROOT=/system
ASEC_MOUNTPOINT=/mnt/asec
BOOTCLASSPATH=/system/framework/core.jar:/system/framework/bouncycastle.jar:/system/framework/ext.jar:/system/framework/framework.jar:/system/framework/android.policy.jar:/system/framework/services.jar:/system/framework/core-junit.jar:/system/framework/com.motorola.android.frameworks.jar:/system/framework/com.motorola.android.widget.jar
EXTERNAL_ALT_STORAGE=/mnt/sdcard-ext
EXTERNAL_STORAGE=/mnt/sdcard
HOSTNAME=cdma_solana
IFS='
'
LD_LIBRARY_PATH=/vendor/lib:/system/lib
LOOP_MOUNTPOINT=/mnt/obb
OPTIND=1
PATH=/sbin:/vendor/bin:/system/sbin:/system/bin:/system/xbin
PS1='\u@\h:\w\$ '
PS2='> '
PS4='+ '
PWD=/
_='HOSTNAME=cdma_solana'
[Motorola Droid 3] danimalfi:
Saw this morning that the Photon has root already. I cant post the link because I havent posted enough in the forums, but it is in the Photon thread under android development. They found root but you have to use a HD dock to obtain it. Not sure if the Photon has 2.3.4 but how can they gain root to that in 2 days and the D3 has been out now for weeks? Thanks for everything you guys do, looks like your making some sort of headway.
[Motorola Droid 3] Shoop_D_Woop:
Wow, I've just read this entire thread and you guys know your stuff...I wish I could help because I really need to fix my D3. accidentally loaded a D2 mod and now my touchscreen does not respond. I really hope you guys get this D3 rooted! Again, thanks for all the hard work!
[Motorola Droid 3] taylorhome11:
question is does anybody have a dock?
[Motorola Droid 3] 3diord:
Would this help at all? I've never really dabbled into getting root on systems before.

-rwsr-s--- root shell 59832 2011-06-12 23:57 /system/bin/run-as

If I'm reading that correctly, the shell group (the one we get when we `adb shell`) can run that as root, unfortunately, it asks for a package name, at which point I'm stumped.

shell@cdma_solana:/system/bin$ run-as

Usage: run-as <package-name> <command> [<args>]

-edit-

Well I can run things from /data/tmp so it seems that I'd just need to get the right file there. Now to learn assembly...
[Motorola Droid 3] tcrews:
Someone on DroidForums.net is offering devs a donated Droid 3 to help achieve root.....some of the more skilled individuals may want to investigate the offer ?

http://www.droidforums.net/forum/droid-3-hacks/163376-root-status-3.html#post1670967
[Motorola Droid 3] kerryrey:
AWESOME

All you smart guys ROCK... Keep it up. and

THANK YOU TO ALL OF YOU
[Motorola Droid 3] Adam.h.ogle:
I spent a good hour reading through the source of run-as...it is short:

http://android.git.kernel.org/?p=pl...f371ca2a4d66a3ddbf65d377ff2d98e8036f0;hb=HEAD

Simply put, this program allows you to SU into another application's environment to test shell commands (such as why your application can't write to a folder). This is part of the android core, so finding a bug in it would be highly unlikely. There are a few different methods of exploiting this (such as switching to the system user, then using that to edit the packages.list to create a malformed entry that switches to root), but everything I've seen has been air-tight.

---

EDIT: ARG!!! run-as is completely out. 1) there is a check to make sure the uid is not below the first app uid (10000). For the record, root is 0 and system is 1000. 2) run-as will only load in the first 8k of the package.list file. The one on my phone is ~17k, and none of the first apps either run as system or have the debug flag set. I believe this route is a dead end.
[Motorola Droid 3] nerdslogic:
Have we considered using the vendor flash mode?
[Motorola Droid 3] 3diord:
I thought root was something else in the D3? Saw it earlier in this thread or on another forum.

-edit-

Oh nevermind, on Page 3 the guy was mistakenly thinking it was 10143
[Motorola Droid 3] psouza4:
I do (two, one at home and one at work), and am ADB ready right now and for the next several hours before I leave for vacation.
[Motorola Droid 3] calash:
I also have the dock up in my bedroom. I am on vacation and outside of a trip this morning can dedicate time if we need it.
[Motorola Droid 3] 3diord:
The HD Dock like the Photon? Where you can run a full version of Firefox, have full keyboard and mouse?
[Motorola Droid 3] psouza4:
I don't know what kind of dock the Photon has.

This is the Droid 3 multimedia dock with HDMI:

http://www.verizonwireless.com/b2c/store/accessory?action=accessoryDetails&archetypeId=12684&accessoryId=47631
[Motorola Droid 3] tcrews:
The Droid 3 doesn't support webtop like the Photon, Atrix and Bionic so this probably won't be a way to gain root.
[Motorola Droid 3] calash:
I was just reading the instructions and realized that as well. The Droid 3 dock does have HDMI out but with no Webtop we are still not looking good for that method.
[Motorola Droid 3] 3diord:
Google says otherwise, but that info was all pre-release. Although I thought I saw something like webtop when I was mucking around in the system files.
[Motorola Droid 3] Adam.h.ogle:
I looked at their exploit and it appears that they're using a race condition with Pulse Audio--most likely something interesting happens when it switches between phone and HDMI.
[Motorola Droid 3] psouza4:
I like interesting things!
[Motorola Droid 3] pplude:
I'll. Confirm that webtop does exist. That pulse-audio thing looks promising. That would mean it can be invoked anytime (because I don't believe that the D3, or any Linux for that matter still uses ALSA by default)
[Motorola Droid 3] psouza4:
Excellent... this thread is starting to give me a bad case of the gimme-gimme's.
[Motorola Droid 3] pplude:
We should also look into zygote and how that works a bit (the application root runs to spawn all these sandboxes).
[Motorola Droid 3] elkay:
Well if all it needs is HDMI and not a dock, I have an HDMI cable if you need me to try anything. I'd prefer something that doesn't brick my phone if you can avoid that. ;-)
[Motorola Droid 3] volcanomike:
I bought the HD Dock for Droid 3, should have it tomorrow. I'll let you know what I find out.
[Motorola Droid 3] dotson817:
This thread is getting exciting! Lol I am checking constantly, thanks a lot to all who are doing testing and searching for a possibility for root! I think I can speak for a lot of people following the thread, thanks for your efforts!
[Motorola Droid 3] pplude:
No dice, the HDMI daemon runs in a zygote sandbox. Damn, I wish there was a way to shut that service down!
[Motorola Droid 3] elkay:
So how are they exploiting it on the Photon then? Not sandboxed there?
[Motorola Droid 3] pplude:
i never chose an output for hdmi probably, and one was the hardware wrapper. I chose to mirror and a new process als_wq spawned.

Set to Media,a new root process spawns: HDMIWORK

Looks a little dev to me.
[Motorola Droid 3] effinay:
THANK YOU!!!!

I've been checking in on this thread for several days now and just wanted to give a huge THANK YOU to everyone who is working on rooting the D3!

I'm almost ready to renew my contract and am looking for an upgrade for my trusty rooted Eris and the D3 seems right up my alley.

KEEP UP THE GOOD WORK!!!!! Communities like these are the reason I'm sticking with Android. :D
[Motorola Droid 3] psouza4:
I agree wholeheartedly. Hundreds others are probably lurking and anxiously waiting too -- we all greatly appreciate any and all efforts here. :) Go team!
[Motorola Droid 3] PWn3R:
Can we use the set to set the root directory to another location (say the SDCARD with a copy of the root FS long enough to execute an SU binary and then copy the required files into the real system directory running as root?
[Motorola Droid 3] eww245:
We would probably need chroot for this. Also the sdcard it mounted with noexec.
[Motorola Droid 3] pplude:
Im thinking the /temp folder is probably our best bet for excecuting an exploit, as it has 777 permissions
[Motorola Droid 3] PWn3R:
but if we tell it to mount the sdcard as root in / wouldn't it use the standard permissions for the / directory instead of those already assigned to sdcard?
[Motorola Droid 3] nerdslogic:
Newb question but why can't we sign a file as a "vender" and flash it in the vender flash mode? Or is that a dumb question?
[Motorola Droid 3] Adam.h.ogle:
You need root in order to do that.

I believe it is safe to say that there are no legitimate ways to load and elevate an executable. This leaves exploits. I looked through most of the exploits on cvedetails.com for the 2.6.35.7 kernel and none of them look promising as they either require modules that we don't have loaded, or they've been out long enough to have already been patched by Motorola when they built the kernel. The search continues...
[Motorola Droid 3] volcanomike:
So webtop does start just in its own sandbox?
[Motorola Droid 3] redddog:
If I were a Moto/dev, I would love to be watching you guys zero in on this. You guys are geniouses.
[Motorola Droid 3] sparkyman216:
What about the dbug file sits on sdcardex in transmits to Motorola. It called dbug.
[EVO 4G General] hells_punisher:
I posted before about rooting my eve. The problem I had was that I had updated it to the newer software and did not know I couldn't root it with the new update. My question is, if I reset it back to factory settings, will that rollback my software settings or am I still stuck with the new update. Thank you anybody who can help.
[EVO 4G General] firket2000:
No it won't roll back the update. Your just stuck
[EVO 4G General] roids87:
Unfortunately you are screwed with GB for now. You sure aren't alone though.
[EVO 4G General] hooover:
Edit: This is ridiculous!