yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] edgan:
No it doesn't. I created it. It is a hacked copy of normal su, with all the security checks taken out of it. It does rely on the file having the setuid bit, and the filesystem being mounted without nosuid. Which why even if you can write it to /preinstall, it is a waste of time. /preinstall is mounted with nosuid.
[Motorola Droid 3] edgan:
Please post a copy of /system/bin/loadpreinstalls.sh.
[Motorola Droid 3] tcrews:
#!/system/bin/sh

export PATH=/system/bin:$PATH

PRELOAD_APP_DIR=/system/preinstall/app

PRELOAD_HASH_DIR=/system/preinstall/md5

DATA_HASH_DIR=/data/preinstall_md5

PRELOAD_DONE_PROP=sys.preinstall.done

PRELOAD_LOG_FILE=$DATA_HASH_DIR/log.txt

umask 003

mkdir $DATA_HASH_DIR

for file in `ls $PRELOAD_APP_DIR`; do

echo "$file: comparing $PRELOAD_HASH_DIR/$file.md5 and $DATA_HASH_DIR/$file.md5"

echo "$file: comparing $PRELOAD_HASH_DIR/$file.md5 and $DATA_HASH_DIR/$file.md5" >> $PRELOAD_LOG_FILE

newMD5=`cat $PRELOAD_HASH_DIR/$file.md5`

oldMD5=`cat $DATA_HASH_DIR/$file.md5`

if [ "$newMD5" != "$oldMD5" ]; then

isInstalled=`pm path $file`

if [ -n "$isInstalled" -o ! -e "$DATA_HASH_DIR/$file.md5" ]; then

pm install -r $PRELOAD_APP_DIR/$file

ret=$?

if [ $ret -ne 0 ]; then

echo "$file: install failed, error: $ret"

echo "$file: install failed, error: $ret" >> $PRELOAD_LOG_FILE

else

echo "$file: install successful, copying $file.md5 to $DATA_HASH_DIR"

echo "$file: install successful, copying $file.md5 to $DATA_HASH_DIR" >> $PRELOAD_LOG_FILE

cp $PRELOAD_HASH_DIR/$file.md5 $DATA_HASH_DIR

fi

else

echo "$file: user has uninstalled, dont reinstall. copying $file.md5 to $DATA_HASH_DIR"

echo "$file: user has uninstalled, dont reinstall. copying $file.md5 to $DATA_HASH_DIR" >> $PRELOAD_LOG_FILE

cp $PRELOAD_HASH_DIR/$file.md5 $DATA_HASH_DIR

fi

else

echo "$file: install skipped, file unchanged"

echo "$file: install skipped, file unchanged" >> $PRELOAD_LOG_FILE

fi

done

retries=10

echo "preinstall finished, setting $PRELOAD_DONE_PROP to 1"

echo "preinstall finished, setting $PRELOAD_DONE_PROP to 1" >> $PRELOAD_LOG_FILE

setprop $PRELOAD_DONE_PROP 1

readback=`getprop $PRELOAD_DONE_PROP`

while [ "$readback" != "1" -a $retries -gt 0 ]

do

echo " property readback failed! expected 1, got $readback. retries left $retries..."

echo " property readback failed! expected 1, got $readback. retries left $retries..." >> $PRELOAD_LOG_FILE

retries=$(($retries-1))

sleep 2

setprop $PRELOAD_DONE_PROP 1

readback=`getprop $PRELOAD_DONE_PROP`

done

echo "preinstall exiting..."

echo "preinstall exiting..." >> $PRELOAD_LOG_FILE
[Motorola Droid 3] krazykrivda:
EDGAN:

It seems we are covering similar ground. Some information you are searching for is in the other thread.

I have attempted to contact you via PM.. (and gave you my gtalk).

Hope you can help our cause.
[Motorola Droid 3] Adam.h.ogle:
I played around with symbolic links (ln -s) a bit yesterday. Turns out there are a few interesting things that may help:

We can create symbolic links on the phone...hey, you have to start somewhere

Symbolic links can be chained: A -> B, B -> C; cat A actually cats C

Motobox (Motorola's implementation of toolbox) changes the rules on the CP command slightly:

Symbolic links are deferenced when copied, so A -> B; cp A C, C will be a new file with the contents of B.

Permissions of a file ARE MAINTAINED, even across file systems, as long as the user doing the copy has the appropriate permissions (is owner/root, etc). This includes setuid.

Permissions are maintaned through symbolic links

The umask on the loadpreinstalls.sh script is 003, which means 774 for directories and 664 for files. (correct?)

Why is this stuff important? Well, that loadpreinstalls.sh script has a copy command in it. The source file is coming from the /preinstall partition, which we have control over. I haven't had time to test it, but I believe this may be a way to get an executable somewhere else on the phone. The first step should be creating a file in /preinstall/md5 with root:shell, then checking the /data/preinstall_md5 to see if that file can be opened.
[Motorola Droid 3] elkay:
This sounds very, very promising.
[Motorola Droid 3] 3diord:
/data/preinstall_md5 is not accessible by shell.
[Motorola Droid 3] Adam.h.ogle:
You only have read permission on the directory, which means you can list the files, but you can't switch to it or see any extra information about the stuff in it. Try doing an "ls /data/preinstall_md5" and you should see a file list.
[Motorola Droid 3] Adam.h.ogle:
My original plan was to have the loadpreinstalls.sh script copy a symlink that pointed to /preinstall/tmp/myfile to /data/preinstall_md5. Once this was done, I could create the file /data/tmp/su, and create a symlink to that file as /preinstall/tmp/myfile. I would then copy su to the md5 file, chmod 6777 su, reboot the phone (deleting /data/tmp/su), and wait for the script to replace the file. In theory, that file would copy su to /data/tmp as root (or system...) with the proper permissions.

This does NOT work, though, since "motobox cp" deferences symlinks, which means you cannot copy/move a symlink. Also, before anyone suggests it, /data is mounted with nosuid, which is why /data/local is worthless. /data/tmp is a tmpfs, and does NOT have nosuid, so it is an epic win and will most likely be the temp location for su until /system can be remounted and su copied to /system/bin.
[Motorola Droid 3] 3diord:
Oh. I had previously tried to cd to it, but I guess we don't have execute permissions on it or something. Somehow we're able to list files... sorta.

shell@cdma_solana:/$ ls /data/preinstall_md5/*

/data/preinstall_md5/com.gameloft.android.VERIZON.GloftLGF2.md5: Permission denied

/data/preinstall_md5/com.gameloft.android.Verizon.GloftNOHP.md5: Permission denied

/data/preinstall_md5/log.txt: Permission denied

It's like "nope you don't have access to see this file is here"
[Motorola Droid 3] Adam.h.ogle:
The umask on that script does some weird things on the folder.

---

Another idea, if some of the BASH people would like to have fun, would be to change that CP command in the loadpreinstalls.sh script to copy a file from a location to /data/tmp. The line in question reads:

cp $PRELOAD_HASH_DIR/$file.md5 $DATA_HASH_DIR

If $file could be changed to "myfile ../tmp #blah", then it would copy that file to /data/tmp. What I have discovered about this idea is not promising, though:

I don't believe # will be interpreted as a comment, which was the same issue we ran into with other bash exploits

the file name cannot contain spaces, as 'ls <dir>' will split on them

cp's parameters (such as -r) must appear before src and dest

cp will not ignore extra parameters

I haven't tried using redirection ( > or >> ) or piping, but I assume they will have problems as the variable will be taken literally.
[Motorola Droid 3] pplude:
In simple commands, piping works as advertised
[Motorola Droid 3] doihaveto:
Not a DEV but could this be helpful or not

temp root on another device but it probably will not work on our D3 but anything could lead to something that will.

Link: http://xdaforums.com/showthread.php?t=1151735
[Motorola Droid 3] Jewremy:
doesn't work. device isn't supported. can't make /data/bin, can't use mount command.
[Motorola Droid 3] isaacgaretmia:
Been lurking in this thread for a while. Don't own the D3, don't plan to own the D3, but i thought i'd watch because it seemed amusing. (The script to brute force every possible filename out of the protected folder... lmao'd at that!)

Anyway, i've been watching several threads of discussion, and decided to try a few things on my *nix box.

now, some of you may have already tried this, explained why it won't work, and given up, but i may have missed it. (I don't believe so, i've rechecked at least twice now...)

But why can't we meld krazy's original idea with the whitespace and / modifications posted later? i.e. hijack pm install $var using ;<command list here> to cp an already permission'd su binary into tmp?

the syntax would be something like this...

pm install -r $PRELOAD_APP_DIR/$file

contents of $file:

;OIFS=$IFS;IFS=:;S1=sdcard;S2=su;S3=data;S4=tmp;cp$IFS$S$S1$S$S2$IFS$S$S3$S$S4;IFS=$OIFS;

That lesser studied members may benefit from my few hours of research, here is what that long string means:

IFS: Internal Field Seperator - what an acceptable whitespace character would be between commands. Changing it to ":" will allow colons to separate commands.

$S: the S variable (hopefully) contains a "/" which will allow us to use slashes to denote file structure. (I didn't see how he did this, it was just there)

the hijacked command would be equivalent to ; cp /sdcard/su /data/tmp/

Now, i didn't see anyone say why this wouldn't work... but i tested all of the commands except the escaped "/" on my linux, and it was working fine...

I'm going to keep testing, but so long as we can escape (or the equivalent) slashes into that code this should work... or am I off base?

EDIT: found out some juicy intel. Namely, how to use slashes. Including busybox with the preinstall.img allows us the use of the cut command, which basically is the equivalent of a charat() in java (at least the way i saw it), but he basically hijacked the $PATH variable and grabbed its "/" via the cut command. I believe the syntax was X1=$PATH;X2=-c$IFS-1;S=cut$IFS$X1|X2; which would cut the first character from $PATH and place it into the S variable, so every time we use $S it would be a slash.

More thoughts?
[Motorola Droid 3] Adam.h.ogle:
That has been the plan all along.

The semicolon isn't interpreted, it is taken as a literal. The final verdict was it would NOT work without using sh's eval command.
[Motorola Droid 3] pplude:
In zsh I know instead of semicolons we use &&
[Motorola Droid 3] neilrl79:
I've been watching this thread for a while now now and just wanted to say thank you to everyone working on rooting the Droid 3.
[Motorola Droid 3] pplude:
Going on that...what *is* Moto's default shell. It's not BASH...ZSH, ESHELL, something else? That'll help us determine how to script.
[Motorola Droid 3] Adam.h.ogle:
Looks like it is ASH, if I'm reading this right: http://android.git.kernel.org/?p=pl...00c4f346ebb3e4cfc9629df7b9d75030d9702;hb=HEAD
[Motorola Droid 3] pplude:
Not familiar to ASH, but what would be the equivalant to BASH semicolon?
[Motorola Droid 3] gissentml:
I am curious to know what is exactly needed to obtain root on the Droid 3. I have some resources that may be able to get what you guys need.
[Motorola Droid 3] elkay:
You sound like you're going to have the Mob go knock on Sanjay Jha's door.
[Motorola Droid 3] pplude:
A lot of it is just knowledge. Oh, and no fear of a brick.
[Motorola Droid 3] elkay:
Adding onto this, if you are serious, what would be really helpful is an SBF for the D3 so we can unbrick. If you have "those" kind of connections.
[Motorola Droid 3] pplude:
Well, could we find a su.elf file that's compiled for ARM-OMAP and use adb to push it to the device. And...afaik, you don't need root to check user id tables. We may be able to use the same exploit after some digging around.

EDIT: After some poking around, I ran a "id -u root" and got this output.

uid=10143(app_a143) gid10143(app_143) groups 1015(sdcard_rw),3003(inet)

So, by seeing this, we now know why GingerBreak and the like don't work! The uid is expected to be 0 (as found in the Gingerbreak source.

if (geteuid() == 0 && getuid() == 0 && strstr(argv[0], "boomsh"))
do_root();

The user/group ids should be 10143 (which iirc is the root uid on "hardened systems" and newer "true unices" ie. Soalris, OSX)

Also, the wheel group id seems to be called app_143.

Now I have no way to do development at my computer here, but if someone can make the necessary changes to GingerBreak and recompile and test, this may actually work!

NOTE 2: This is only 1 place I found uid references. If you do the modifications, PLEASE go through it with a fine tooth comb. I am as we speak and I may upload a CPP file that you can replace the standard one with later today.

NOTE 3: Ok, I lied. It seems that trying to obtain the root user id results in a loopback to the standard user (app_143). I stumbled across this because the standard shell is:

app_143@cdma_solena:/$

Though, I still think I have the right idea here.

-------------------------------------------

Well, both su and sudo exist. Now to just find them in the filesystem. Would it be possible to dd the main filesystem to the sd card so we had the SBF and the Kernel in hand?

--------------------------------------------

Standard Ultilites:

su: permission denied

sudo: permission denied

find: permission denied

lsdev: permission denied

lspci: permission denied

dd: APPROVED

mount: permission denied

umount: permission denied

cat: permission denied (some files)

nano: permission denied

cd: APPROVED

ls: APPROVED (most places)

So, what can DD do? Well, we could write a sudoers.conf file that includes app_143 and use dd to push it to the device, it apparently isn't checking for write permissions.

---------------------------------

Interestingly enough, there is a "preinstall" directory under /, though ls refuses to open the folder. If we can find the contents of that folder, I'm willing to bet there's an exploit to be found in the preboot files there.
[Motorola Droid 3] tcrews:
Here's all our mounts, not that it'll help but may give some indications of where to look...
[Motorola Droid 3] krazykrivda:
has anyone tried flashing the preinstall.img?
[Motorola Droid 3] cellzealot:
We tried flashing the unmodified Atrix preinstall image to an ENG unsecured DX running GB which has fastboot available, then tried to run dosu from ADB. Flashing the preinstall did work and the phone booted normally, but running dosu in ADB failed with permission denied.

We really need an unsecured Eng D3...that would really help move this along.
[Motorola Droid 3] elkay:
I would seriously not recommend anyone try that until we have a 100% proven unbrick method.
[Motorola Droid 3] elkay:
Brave souls. I wouldn't try that myself now that I'm outside my 14 day window and I've already done one exchange for a faulty Wifi chip.
[Motorola Droid 3] cellzealot:
We used an engineering DX to test the theory, not a D3 because we have all the files and means to recover that device. The Eng DX has fastboot available, unlike a stock device, so we knew we would be safe.
[Motorola Droid 3] elkay:
Ahh, gotcha. Nice. Wish we had a way to fully recover a D3 because that would make guess and check a lot more viable.
[Motorola Droid 3] cellzealot:
If it had worked on the eng DX I would have been happy to try it on my D3. The preinstall partition is unsigned so it should be absolutely safe to flash in fastboot, even using the Atrix image. The dosu binary itself was denied permission so we have to look further into that issue before we can expect success via this method.
[Motorola Droid 3] nerdslogic:
Well there is a supposed boot loader unlock for the X2 now and the method seems awfully similar to the Atrix.

http://rootzwiki.com/showthread.php?2303-Unlocking-The-DRIODX2-BOOTLOADER-Theory&p=47242#post47242
[Motorola Droid 3] Deodexed:
Damn I don't know what to do? Wait for the Droid Bionic or get the Droid 3! I want to play!
[Motorola Droid 3] tcrews:
Droid 3 :)

Who wants a first generation 4G chipset in their phone anyway. It's just internet speed, not phone operation/usage.
[Motorola Droid 3] taylorhome11:
http://wiki.rootzwiki.com/index.php/Motorola_Atrix

Im going to try this when i get mine tomorrow. The worse that would happen with this method is not work. And if for some reason it breaks it, off to verizon to get a new one. It "arrived" that way....
[Motorola Droid 3] Deodexed:
How long is the battery life lasting on the D3?
[Motorola Droid 3] elkay:
Proven untrue.
[Motorola Droid 3] elkay:
Seems to be a large variation. Some have great battery life, some have awful.
[Motorola Droid 3] RigWig:
On the extended battery I got just over 24 hours on moderate/light use
[Motorola Droid 3] 640k:
this has bene my confusion. true LTE is voip. i've been unlucky with scouring the internet for adequate documentation on the cost vs. cdma, etc. all that i know is that LTE is supposed to be significantly cheaper than current 3G standards. so all of this talk aabout how unlimited data is unsustainable, etc., is BS.

anyway, i digress, but i agreee. the internet speeds are worth it, but so is a brnd new $70 phone. here's hoping for a D4.
[Motorola Droid 3] sparkyman216:
Amazing
[Motorola Droid 3] Adam.h.ogle:
There is a file in /system/bin called "loadpreinstalls.sh". It looks like it just loads that stupid golf and FPS game:

#!/system/bin/sh
export PATH=/system/bin:$PATH
PRELOAD_APP_DIR=/system/preinstall/app
PRELOAD_HASH_DIR=/system/preinstall/md5
DATA_HASH_DIR=/data/preinstall_md5
PRELOAD_DONE_PROP=sys.preinstall.done
PRELOAD_LOG_FILE=$DATA_HASH_DIR/log.txt

umask 003

mkdir $DATA_HASH_DIR

for file in `ls $PRELOAD_APP_DIR`; do
echo "$file: comparing $PRELOAD_HASH_DIR/$file.md5 and $DATA_HASH_DIR/$file.md5"
echo "$file: comparing $PRELOAD_HASH_DIR/$file.md5 and $DATA_HASH_DIR/$file.md5" >> $PRELOAD_LOG_FILE
newMD5=`cat $PRELOAD_HASH_DIR/$file.md5`
oldMD5=`cat $DATA_HASH_DIR/$file.md5`
if [ "$newMD5" != "$oldMD5" ]; then
isInstalled=`pm path $file`
if [ -n "$isInstalled" -o ! -e "$DATA_HASH_DIR/$file.md5" ]; then
pm install -r $PRELOAD_APP_DIR/$file
ret=$?
if [ $ret -ne 0 ]; then
echo "$file: install failed, error: $ret"
echo "$file: install failed, error: $ret" >> $PRELOAD_LOG_FILE
else
echo "$file: install successful, copying $file.md5 to $DATA_HASH_DIR"
echo "$file: install successful, copying $file.md5 to $DATA_HASH_DIR" >> $PRELOAD_LOG_FILE
cp $PRELOAD_HASH_DIR/$file.md5 $DATA_HASH_DIR
fi
else
echo "$file: user has uninstalled, dont reinstall. copying $file.md5 to $DATA_HASH_DIR"
echo "$file: user has uninstalled, dont reinstall. copying $file.md5 to $DATA_HASH_DIR" >> $PRELOAD_LOG_FILE
cp $PRELOAD_HASH_DIR/$file.md5 $DATA_HASH_DIR
fi
else
echo "$file: install skipped, file unchanged"
echo "$file: install skipped, file unchanged" >> $PRELOAD_LOG_FILE
fi
done

retries=10
echo "preinstall finished, setting $PRELOAD_DONE_PROP to 1"
echo "preinstall finished, setting $PRELOAD_DONE_PROP to 1" >> $PRELOAD_LOG_FILE
setprop $PRELOAD_DONE_PROP 1
readback=`getprop $PRELOAD_DONE_PROP`
while [ "$readback" != "1" -a $retries -gt 0 ]
do
echo " property readback failed! expected 1, got $readback. retries left $retries..."
echo " property readback failed! expected 1, got $readback. retries left $retries..." >> $PRELOAD_LOG_FILE
retries=$(($retries-1))
sleep 2
setprop $PRELOAD_DONE_PROP 1
readback=`getprop $PRELOAD_DONE_PROP`
done

echo "preinstall exiting..."
echo "preinstall exiting..." >> $PRELOAD_LOG_FILE
[Motorola Droid 3] 640k:
just my personal observations, but ASH is missing alot of BASH key "ingredients"
[Motorola Droid 3] pplude:
I know that ASH is liscenced under a BSD style liscence. Since it's not a hugely popular shell, there may be an exploit to find there too.
[Motorola Droid 3] eww245:
Couldn't bash be included in the image? There's a few binaries floating around here. Should work but not enough space in /tmp to try it
[Motorola Droid 3] pplude:
Would it be possible to put the binary in /tmp and the dependencies on the sd card. In theory, because of the way ELF works, it should try to load from the system first, then if scripted, can use other directories.

Then place a small script to start BASH with those flags and it should work.
[Motorola Droid 3] Adam.h.ogle:
Getting bash/busybox/su/etc on to the phone isn't the problem. Getting stuff to use it over /system/bin/sh will be near impossible unless we can intervene before execution.
[Motorola Droid 3] pplude:
I'm not sure I entirely follow. I've been down the last few days. My Windows PC is down and I'm setting up my mac for ADB. (I kinda feel like a traitor, and XCode is freaking out with the new compilers). That, and I've been working with an unpopular and discontinued Huawei tablet.
[Motorola Droid 3] eww245:
the bash i've used, 4.3, has no dependencies it's 3mb. just tried a symlink , didn't work because of noexec on sdcard.

All I;ve used is a bashrc for it. Maybe some of the other versions are smaller.
[Motorola Droid 3] Adam.h.ogle:
We can copy stuff to various places, such as /preinstall, /data/local, /data/tmp; all of which allow execution. However, we can't modify the system-wide path, nor can we create files in the /system/bin folder, so there is no way to make our changes system-wide.

---

One trick I just picked up: ADB to your phone, copy busybox to /data/tmp, and chmod 6777 it. Now you can use sshdroid to connect to your phone, and run /data/tmp/busybox to become shell. Why is this better? Shell has more privs than any of the app* users.
[Motorola Droid 3] eww245:
lol I've been running ubuntu off an sdcard all my systems seem to have crashed. Hopefully soon it'll be up and running on my d3
[Motorola Droid 3] scottml:
The issue isn't so much as the semi-colon being something different, as it is that it's just not getting interpreted at all (along with anything else in the filename for that matter).

I was banging my head on this for quite a while trying to understand why the filename wasn't being executed.

It comes down to a very subtle difference in how vars are defined .vs how the execution is handled at each command in the interpreter.

Try these 2 exercises using essentially whitespace-less type execution scripts (similar to how you'd do it with a filename).

Example 1:

input:

file='0001$(Z1="$IFS";IFS=":";S1=":1";echo$S1;IFS="$Z1";).apk'

cat $file

output:

cat: 0001$(Z1="$IFS";IFS=":";S1=":1";echo$S1;IFS="$Z1";).apk: No such file or directory

Example 2:

input:

cat 0001$(Z1="$IFS";IFS=":";S1=":1";echo$S1;IFS="$Z1";).apk

output:

cat: 00011.apk: No such file or directory

The key is the single quote based definition of the var in example one. The single quotes mean "take this as a literal". And that's how filenames are parsed in the loadpreinstalls.sh script:

line 13: for file in `ls $PRELOAD_APP_DIR`; do

So even tho the full executable filename hits:

line 21: pm install -r $PRELOAD_APP_DIR/$file

The output error you get is something like:

can't find file "0001$(Z1="$IFS";IFS=":";S1=":1";echo$S1;IFS="$Z1";).apk" when it should be saying can't find file "00011.apk" (the extra "1" is coming from the echo if it executes.

So I'll have to agree (for now) with some of the posters earlier on who were saying this method might be dead in the water.
[Motorola Droid 3] onethreeteeh:
thats a backtick, not a single quote though
[Motorola Droid 3] Fr4gg0r:
And that would be?

You should not get more privs with a shell..
[Motorola Droid 3] 3diord:
shell is a user
[Motorola Droid 3] nerdslogic:
with elevated privileges right?
[Motorola Droid 3] isaacgaretmia:
Not by much, however. It goes something like this:

Root >> System >> Shell >> user (app)
[Motorola Droid 3] scottml:
To clarify:

I mentioned the single quote referring to my example where I define file var:

file='0001$(Z1="$IFS";IFS=":";S1=":1";echo$S1;IFS= "$Z1";).apk'

single quote = literal. It won't ever be executed unless you were to see something like:

pm install -r $PRELOAD_APP_DIR/`$file`

inside the script (note the addition of the backticks around $file telling the script to execute and send the results back to the script)

The backtick you're seeing in my posting is where I'm quoting line #13 from the loadpreinstalls.sh script:

line 13: for file in `ls $PRELOAD_APP_DIR`; do
[Motorola Droid 3] onethreeteeh:
ah ok, i misunderstood what you were trying to say.

i just tried a little test out and the file var is definitely being treated as a literal, so it looks like you're right, and it's time to move on from that method