yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] isaacgaretmia:
Personally, I think we have a better chance of brute-forcing our way into changing the default shell to allow us to shell-inject than abusing shell injection with ASH the way it is.

AFAIK, root usually comes from manufacturers modifications and oversights. Just because preinstall is one of the only weak spots we've found doesn't mean it's the only one. I think we'd have a better chance of finding a new avenue of search if we could get System privileges...
[Motorola Droid 3] limaxray:
Is anyone familiar with the potential privilege escalation vulnerabilities in this kernel?

CVE-2010-3904

CVE-2011-1017

CVE-2010-3859

CVE-2011-2022

Just to name a few. I'm not familiar with these vulnerabilities or the modules the exploit. I also don't have a D3 yet nor do I know if any of these modules are included in the stock kernel.

If anyone is looking for some homework to help along the effort, it would be very helpful if we could get one of the processes running as root to crash.
[Motorola Droid 3] isaacgaretmia:
Earlier in this thread we were discussing some exploits... maybe some of the ones you mentioned. From what i remember, near to all of them exploited modules not present in our kernel. What am i saying? THEIR kernel. :)

Don't own the phone, can't really check myself, but i wanted to give you some response... Don't take this as a discouragement, I'm just saying that there was some searching done into the matter. Wish i could help more.
[Motorola Droid 3] idkwhothatis123:
Honestly this is probably a really dumb question but have we tried booting into fastboot and entering fastboot oem unlock?
[Motorola Droid 3] isaacgaretmia:
Not a stupid question, but I'd be willing to place money on it being one of the very first things they tried. That, and all of the existing gingerbread exploits. >.>

Somewhere in the middle of this thread there was some discussion of either Moto or Verizon bringing an unlock... and we determined that we'd be wearing parkas in a frozen hell before that reality arrived.
[Motorola Droid 3] taylorhome11:
It doesn't work. Already tried. Atrix now has dev bootloader that allows that.
[Motorola Droid 3] lordgodgeneral:
While we're all pretty sure Verizon won't allow for an unlocked bootloader, what happens if one of the other versions of the droid 3 (Milestone 3, and whatever its called in canada). If one of these ends up getting an unlocked bootloader, will that help us in the US with the verizon version?
[Motorola Droid 3] isaacgaretmia:
My first smartphone was the Motorola Droid. In europe, their version was the Milestone. As I recall from my early rooting days (It was a flashable update.zip. I performed the update before we even had a recovery image) there had to be separate updates for both the Droid and the Milestone.

That was that root method. From what i've seen, root methods across phones and OEMS and carriers are all different. Some are an unlock, some are an update, some are an exploit.

Long story short (too late :D ) it depends on the method we find. If it's an update, no dice. If it's an exploit, maybe not. If it's an unlock, then yes.

Unlocks = we'll check back in 10 years to see if they've unlocked it yet. Knowing them, they probably won't have. We'll have unlocked it ourselves.

Updates = maybe. Unlikely though... this hack has happened to them before. They should know better by now.

Exploits = this is what you should be hoping for.

If the Milestone 3 has an unlocked bootloader (read earlier in this thread for the chances of this happening) then we may have a better chance of finding an exploit that will work on THEIR device. That doesn't mean it's transferable.
[Motorola Droid 3] elkay:
I have a feeling that I may be on an unlocked HTC keyboard device before we see this thing rooted. Not trying to be a pessimist, I've just gotten the sense from this thread and many others that both Google and Motorola have gotten just smart enough to lock all of the blatant holes and the time it's going to take someone to find something like a buffer overflow exploit just isn't worth the time on a Moto device with the bad name they've given themselves at this point.

At least this thing is more usable than the X2 was out of the box.
[Motorola Droid 3] Adam.h.ogle:
I get the same feeling. I just wish HTC or Samsung would release a good, top-end, un-lockable slider. I had a Droid Incredible before this phone, and it was a fun phone to root and mod, but typing/txting was annoying and I ended up using the phone quite a bit for work. I really fear that if the D3 isn't unlocked in the next month or so, the development community is going to pass us over...
[Motorola Droid 3] saintlikesniper:
Htc if you haven't heard may be locking the bootloader. Then and think about it motorolas beats htc in build quality and overall power. Sure the sensation is clocked at 1.2ghz overclock the TOI OMAP, to 1.2ghz and see who wins overall power and so sure htc has looks aluminum unibodys but motorola has quality and phone power. Find a dual core phone clocked @ 1.0 and beats the D3. I'm may adore motorola, and but htc is great for on sprint they make great phones for sprint, on verizon htc is lacking vs motorola. The no dual core and there 4g streak is ending with the bionic
[Motorola Droid 3] elkay:
Exactly. It's a shame. All Moto needed to have this be a flagship, top notch phone that everyone loved and the dev community embraced was an unlockable bootloader. Even if that comes in December, it might be too late for me, as there are other sliders on the horizon. I can't "blame" Motorola for this, as I bought it knowing this could very well happen, but it doesn't keep me from being disappointed at the same time.
[Motorola Droid 3] elkay:
I'll have what he's having.
[Motorola Droid 3] misterpat1975:
I just wanted to throw this out there. I tried connecting with adb and while that worked fine, i also found SSHDroid, a free app which allows you to connect via Putty(Windows) or in terminal on Linux. Is it possible that more Linux commands could be used?
[Motorola Droid 3] Seirÿu:
I wonder if a script xfering an executable as root using scpwin could work? Just a throught i know ive done this to a linix server before but only using the data account
[Motorola Droid 3] saintlikesniper:
Thank you elkay, and but the ram issue see how that fares when aosp hits the D3 and compare it to a galaxy S2 clocked to 1.0 yeah I think it might lose. I sure hope motorola unlocks this phone even then a good bootstrap dedicated dev community this phone can dominate the 3G waves and all of verizons 3G phones

Has no one noticed how much of a back order I on this phone? I'm sure motorola is shocked and I hope it sends the signal that this phone is popular and could be popular with the dev community if they do the right thing

Edit: sorry for not posting any relevant information I hope this motivated some people to push for root
[Motorola Droid 3] elkay:
I'll concur with the backorder statement, and as a matter of fact Motorola themselves came forward with the fact that they were shocked at how well it sold. That fact alone is scary and tells me that the people of power high up in Motorola have no f'n idea what the heck they're doing. The D3 *should have been* the device of the year.
[Motorola Droid 3] royolpunk:
Just got my droid 3 today and im loving it :] not really used to the keyboard yet nut I guess that just takes time. Hopefully we get this rooted soon!
[Motorola Droid 3] saintlikesniper:
To me it really is great screen high power and it really is popular and motorola will get the hint on how special this device is to the community I hope
[Motorola Droid 3] royolpunk:
Hopefully one of the devs can root this baby soon
[Motorola Droid 3] sr20s13:
i needzzz me rootssssss!

coming from a D1 running GPA16, I feel like I need my stock android but I might get used to this new skinned version but would like less bloatware
[Motorola Droid 3] beard0:
+1 to this

/droid3
[Motorola Droid 3] royolpunk:
I guess we'll see what happens in the next few days. Hopefully a really advanced developer can help us :P
[Motorola Droid 3] punee:
the reality of this situation may just mean Moto&Verizon dont have to give 2 skits abt the dev community. In their minds, they just proved to themselves & everyone else that a heavily locked & skinned device will sell even without the modding communities support. what they wont realize is how unhappy many of those D1 users will be 6mo.s from now.

they probably also forgot the opportune timing of this release. vast majority of D1s coming up for upgrade, back2school for many teenagers, & them dropping the price to a BOGO 150$ for contract renewals.
[Motorola Droid 3] mangamaster99:
I agree as I am available for upgrade in December. Hopefully the D3 will be rooted by then.

coming from a D1 CM 6.1.2
[Motorola Droid 3] DoubleYouPee:
Same here!

Thanks everyone for the work :D keep it up
[Motorola Droid 3] Cyrus221:
I think the camera is legit the way into this phone. There are a LOT of reports about crashes, bugs, and motorola even confirmed they are working on a 'fix.'

Earlier we identified that the camera app has elevated privileges (I cant recall the exact place but I don't feel like crawling through 30+ pages). If we run another camera app, say 'camera 360' or the like, can we determine if that app is also given the same elevated status? If so... we could inject code that way.

... just a thought :)
[Motorola Droid 3] isaacgaretmia:
I don't think anyone checked the privileges of the app. I'll check earlier in the thread - someone posted a list of all the root processes... this might be promising...
[Motorola Droid 3] isaacgaretmia:
Bad news: I can't find the camera process. :(

Good news:

And:

Could someone please find everywhere tf-daemon appears on the phone and see whether this exploit may still exist? Forget the fact that we may not be able to break into system/bin... the post said the script is called by root!!! I don't think we should ignore this avenue...
[Motorola Droid 3] superkeest:
tf_daemon is there at:

/system/bin/tf_daemon
[Motorola Droid 3] isaacgaretmia:
Alright, we need to do some experimenting now that we know it exists.

Todo list:

-Try to kill the process. Force close it, try to break it, research on google and try to find what Moto is using it for.

-Break into /bin and try to delete the file. Back it up if you can, first. See if that has any effect.

-Break into /bin and try to replace the file.

Maybe more later. See what you can come up with...
[Motorola Droid 3] superkeest:
tf_daemon is not running as root, its running as UID=mot_tpap
[Motorola Droid 3] isaacgaretmia:
Noticed that. But it's not app_xxx. That means it might not be sandboxed, it might actually have more permissions. Maybe it operates more like shell. maybe not. Maybe it runs closer to system. Maybe it's better than system. Has anyone ever heard of mot_tpap? I havent.

In fact, besides sandboxed apps, System, shell, and Root, there are only a few other groups:

radio

mot_tpap

mot_accy

vpn

bluetoot

media

,,,

Ok, i lied. There are a lot of them. Perhaps more research is in order...

Still, this one is motorola. That means there is potential for screwups.
[Motorola Droid 3] slow88lx:
I know on the DX that the camera and youtube(video) were intermingled. You Tube crashes and has just as many problems as does the camera. Just thought I'd float that one out there in case it should be looked at along with the camera app....
[Motorola Droid 3] isaacgaretmia:
Someone more AOSP-read please look at page 14 of this thread and try to identify the camera (youtube?) process. For the life of me i can't.
[Motorola Droid 3] cdorwart:
tf_daemon appears to be a dead end unless you can write to /systen/bin .
[Motorola Droid 3] escalavee:
I have been lurking in this thread all morning, and this is where I am now.... it is like an exciting adventure for tech lovers! I have had a rooted Eris and a rooted Incredible, and I have the utmost respect for everyone that is working on root as well as those devs that build ROMs and themes. THANK YOU ALL SO MUCH FOR DONATING YOUR TIME TOWARD THIS CAUSE! I have a degree in Web Development and I am working on another, and this stuff is over my head. I have always been interested in Android development, and I even played with adb when I had my Eris... I also donate whenever I can. Good luck, and keep up the great work!

Back to topic now...
[Motorola Droid 3] royolpunk:
Ill be so happy when we achieve root on this thing.
[Motorola Droid 3] superkeest:
PID CPU% S #THR VSS RSS PCY UID Name
250 6% S 65 211656K 70052K fg system system_server
10967 6% S 9 128884K 35272K fg app_102 com.motorola.Camera
179 5% S 21 145072K 6304K fg media /system/bin/mediaserver
623 1% S 9 104960K 22092K fg app_45 android.process.media
10965 0% R 1 1016K 424K fg shell top
468 0% S 34 133292K 29288K fg app_18 com.google.process.gapps
24 0% R 1 0K 0K fg root mboxd
57 0% S 1 0K 0K fg root media_cache_mgm
75 0% S 1 0K 0K fg root mmcqd
199 0% S 1 0K 0K fg root pvr_workqueue
341 0% S 9 109184K 29980K fg system com.android.systemui
376 0% S 27 122176K 26184K fg system com.motorola.process.system
259 0% S 1 0K 0K fg root pvr_display_syn
17 0% S 1 0K 0K fg root kblockd/0
19 0% S 1 0K 0K fg root omap2_mcspi

Second process.
[Motorola Droid 3] isaacgaretmia:
Huh. Well I'll be. If you knew me, you wouldn't be surprised... i'm quite blind to what stares me in the face.

Camera seems to be no go. It's sandboxed tight.
[Motorola Droid 3] Bomb001:
Don't know if this is of any use but found a way to force close Process com.motorola.home. No idea if it has root privilege, tested it on friends phone and it force closed also. Needs go launcher Ex then long tap on homescreen -> add to screen -> shortcut -> app groups -> all apps -> tap all apps -> long tap any app -> add to home.
[Motorola Droid 3] isaacgaretmia:
Home either must be passive, or wasn't running at the time of the log, because it doesn't appear anywhere within the running processes report on page 14 of the thread.

Don't believe it's usable. Thanks for trying though... see if you can find any root processes to break! As mentioned, page 14.
[Motorola Droid 3] superkeest:
454 0% S 16 155400K 68156K bg app_31 com.motorola.blur.home
[Motorola Droid 3] misterpat1975:
I found this while poking around in system/bin/startup_smc.sh

###########################################
# check if smc_pa_ctrl and tf_daemon exist #
###########################################
if [ ! -f /system/bin/smc_pa_ctrl ] ; then
echo "SMC PA CTRL /system/bin/smc_pa_ctrl is not found"
exit
fi

if [ ! -f /system/bin/tf_daemon ] ; then
echo "SMC Daemon /system/bin/tf_daemon is not found"
exit
fi

and this.

########################
# Start up SMC daemon #
########################
echo "Starting TF daemon..."
/system/bin/tf_daemon -c /system/etc/smc_android_cfg.ini &
ret=$?
if [ $ret -eq 0 ]
then
echo "Starting TF Daemon: OK"
else
echo "Starting TF Daemon: Failed"
exit
fi

Hope this helps.
[Motorola Droid 3] royolpunk:
Are we any closer to finding root than we first started? Sorry I'm just wondering on how much progress our incredible developers have made.
[Motorola Droid 3] saintlikesniper:
I wonder everyday the stress low ram no. Asop and no Super charger scripts for quick response to task switching I Hope we get root soon it seems close tho
[Motorola Droid 3] Cyrus221:
What about the way it stores pictures/video? Anyway to figure that out? I'll start reading some man pages so I can be more helpful... will take a while though since Im on my honeymoon hahah.
[Motorola Droid 3] royolpunk:
Can't wait until we achieve root. Then the low ram will almost seem like not even an issue for us.
[Motorola Droid 3] isaacgaretmia:
Mm... It's interesting. I'd sure like to know what the actual meaning of line

/system/bin/tf_daemon -c /system/etc/smc_android_cfg.ini &

is...

Regardless, we'd still need a way into /system/bin for this to work. It'll have to be placed on backburner until we get elevated privileges.

Also, i'd just like to make a quick note, i realize how excited everyone is to see root, but you have to understand: THERE IS NO PROGRESS BAR. This isn't Windows 98. We aren't 56% through, there's no ETA to completion.

Asking us how far we are is like asking cancer researchers how close they are to a cure.

In short, right now we're 0% finished. The day we get root, we'll be 100% finished. There is no in-between. So as a panacea to all those who ask how close we are,

WE ARE 0% COMPLETION.

/endrant
[Motorola Droid 3] superkeest:
if you run tf_daemon -h (for help) you see that usage is:

tf_daemon -h
TFSW Normal-World Ext Daemon
SMCAG01.04.0

usage : tf_daemon [options]
where [options] are:
-h --help Display help.
-c <conf> Configuration file path.
-d Turns on debug mode. If not specified, the daemon will fork itself
and get detached from the console.
shell@cdma_solana:/system/bin$

Figured id post the contents to that file, in anticipation of your next question:

shell@cdma_solana:/system/etc$ cat smc_android_cfg.ini
cat smc_android_cfg.ini
#
# Normal-World Configuration File for the SMC / Android.
#

[Global]

#
# The SMC Secure Storage relies on 4 files stored in the Main OS Environment for
the effective storage on the device of the protected data
# (all the security properties of the SMC Secure Storage are managed in the Secu
re Environment):
# - a general purpose storage file (used through the Secure Storage Normal World
API, i.e. the SSTxxxx functions, and the SSDI SFilexxx functions).
# - a mandatory system keystore file (used through the PKCS#11 normal world API
with the CKV_TOKEN_SYSTEM token and the CKV_TOKEN_SYSTEM_SHARE token and the PKC
S#11 of SSDI)
# - an optional user keystore file (used through the PKCS#11 normal world API w
ith the CKV_TOKEN_USER token and the CKV_TOKEN_USER_SHARE token
# - a mandatory Monotonic Counter file: it contains the monotonic counter values
associated with each of the 3 files above. It is advised to store, if possible,
this file in a separated physical partition as the 3 above files.
#
# The path of each of the above files has to be specified in the following param
eters:
#
# Absolute pathname and name of the general purpose storage file
filesystem.storage.fileName: /pds/security/storage.bin
# Absolute pathname and name of the system keystore file
filesystem.keystore.fileName: /pds/security/system.bin
# Absolute pathname and name of the user keystore file
filesystem.keystore.user.fileName: /data/tpapi/user.bin
# Absolute pathname and name of the Monotonic Counter file
filesystem.mc.fileName: /pds/security/counter.bin
shell@cdma_solana:/system/etc$
[Motorola Droid 3] dtdlurch:
I don't know if this is relevant or not, but I thought id throw it out there. I am not a developer (wish I was) and been following this for awhile so I wanted to contribute if possible.

Someone mentioned trying to get a root process to break? Would this mean force close issues would be valid? Yesterday, I had some issues trying to get video to play over HDMI. The videos would stall in the middle of loading. Id back out, choose, another video, and only then would I get the error to force close or wait. Had to reset the phone to get it to work again. Never had this issue before and it only occurred on my first experience using the HDMI out.

Again, don't know if this helps. But, I thought maybe this means there is some kind of vulnerability through video or HDMI. Might this have any relevance considering the root gained through the dock for the Atrix?
[Motorola Droid 3] isaacgaretmia:
@the daemon

It seems we found a portion of the secure sector controls for the sd card. This might be a dead end. Seems that the implementation just isn't there the way it was with the hack.

@HDMI breaking

on the list of root processes, HDMI Work was listed as a process. If you can get that to break, then that counts, and might be usable. Remember, the photon was rooted based on the HDMI HD dock.

Also, i'm not a dev either. :) I have some slight experience with MySQL-injection, a fair bit of C++, Java, and C# experience, and some spare time. That's all.
[Motorola Droid 3] tlgem:
First I have no idea what might help the efforts here

One thing I have found odd is that the power off screen will come up over the lock screen? (dont recall that being possible with any of the previous android phones I've had)(just tried it on my thunderbolt & it doesnt work)

When powering off the phone thru the menu the phone will go thru the shut down process & then shortly after reboot itself.

Powering off the phone a 2nd time will actually shut the phone off

Again this info may be way off base but thought I would throw it out there anyway
[Motorola Droid 3] isaacgaretmia:
You're testing a feature from one manufacturer (MOTO) on a phone from a different manufacturer. (HTC?)

I tested it on my OG DROID and it works that way. The feature you speak of is normal.
[Motorola Droid 3] evulhotdog:
Yep. Always has been that way for me.
[Motorola Droid 3] tlgem:
Must have missed it on the x I had Oh well :)
[Motorola Droid 3] AcidRoot:
I just got my D3 today and I'm excited to see this bad boy rooted soon. So I wanted to ask if anybody tried using a flash exploit of some kind. I'm just starting to kind of get into exploiting and pentesting and all that so I'm not sure if this would work but would it be possible to downgrade flash on the device and then use an older flash exploit to obtain root access?
[Motorola Droid 3] Shoop_D_Woop:
As it pertains to this radio (and I may be connecting apples and elephants here but...) I've read about a wifi hotspot hack on the D3 using a radio something. (The thread is here on XDA dev. somewhere, don't have the link here on my phone...) maybe a lead...?
[Motorola Droid 3] elkay:
That's an NVRAM hack, totally unrelated to rooting.
[Motorola Droid 3] Shoop_D_Woop:
Gotcha, just an idea. Keep up the good work y'all!
[Motorola Droid 3] scottml:
What scripts are you using to setup your ARMv7 compile environment? I'm on Ubuntu and the only up-to-date script I found for rebuilding the tool-chain is:

http://buildroot.uclibc.org/buildroot.html#about

But, I noticed in the config that there wasn't an ARMv7 specific option. Just ARM with a variant of Cortex-A8.

EDIT: Just noticed there are "gcc/g++" options for ARM arch in the Package Manager.. trying that first. Duh?
[Motorola Droid 3] Adam.h.ogle:
I hadn't gotten around to setting up a stack because there aren't good instructions on the net and it was going to be too time consuming. I think I would rather try to get an environment setup on /data/local so I could run stuff directly on the phone.
[Motorola Droid 3] idkwhothatis123:
I'm dying without root. Why am I not a genius like you all lol. I'd love to help but I'm rendered useless. Thank you all for your hard work and dedication on this project.
[Motorola Droid 3] royolpunk:
Were most likely to find root b4 the bionic arrives, because it will be in similar circumstances as the d3 is in right now
[Motorola Droid 3] sparkyman216:
Does this file help any. Using root explorer. Go to system/etc/security. The 3 zip files the 3 one is what I most wonder about
[Motorola Droid 3] elkay:
Once more devices come out with 2.3.4+, we'll have better odds of more devs working on finding a universal root that will work for us.
[Motorola Droid 3] elkay:
I can't speak for every file in there, but otacerts.zip is the file containing certificates used to verify and allow over-the-air updates to be verified before installing. Renaming that file is how you block OTAs. Not sure how that directory will help us.
[Motorola Droid 3] idkwhothatis123:
Can block otas in the settings of the phone too.

Idk if this is even relevant but can this work?

http://xdaforums.com/showthread.php?t=1216073
[Motorola Droid 3] elkay:
If we had an SBF I'd try it. My phone is my lifeline right now, as my significant other is on a trip for the next 10 days so I can't be without my phone, in case she needs to get a hold of me. The pulseaudio exploit was already discussed. I'm not sure if it was determined yet if it was a possibility. I know part of the webtop functionality is in our phones, not sure if the services that are exploited are running/used, though.
[Motorola Droid 3] Jewremy:
Tried it. Won't run, obviously.