yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] 640k:
Then try 1 instead of 0 lolol. Default ping packet is 32b so my guess is any size will be too large.
[Motorola Droid 3] nicholasb:
I had a thought for you guys.. Probably discussed before and failed, but I would be remiss if I didn't throw it out there.. I don't own a d3 btw.

Would it be possible to exploit the built in (assuming its in there) update ability? It would seem logical that the update mechanism would have root access and that it would use a web-service to check for updates.

If the system uses whatever active network connection there is to make contact with a server, it would seem possible to hijack that transmission at the router level and forward it to your own service on your network. If this mechanism is weak, it could be exploitable.
[Motorola Droid 3] RigWig:
I'm by no means a dev so don't quote me on this, but I would imagine that all the update system does is allow for the download of a signed update from moto, and then tells the phone to flash it. So even if we could hijack the connection and have it download our own update, it would still fail to flash because our's would not be signed.
[Motorola Droid 3] nicholasb:
My assumption would be the same about the signed keys. But, if the data is not validated and filtered on your device, you may be able to feed it malformed data from your 'source' that would allow you to exploit a crash.
[Motorola Droid 3] whoopsiedaisy:
I have a droid 3 that its front face camera takes the picture upside down....can this help in the journy to root??

I miss cyanogen on my dx cas I always had 200+m of ram and blur drags me down -150m :(

Im rooting for you guys!

Pun intended
[Motorola Droid 3] royolpunk:
LOL I think that's a manufacturer error then, the ffc was installed upside down?

Yeah the main reason Is because of the bloatware
[Motorola Droid 3] Willis111:
when I run ping6 on my droid 3 I get permission denied. The exploit is with ping6, not ping correct?

I did maybe find an exploit that may help us, I saw one acpi exploit that allowed privilege escalation on laptops due to how lid_open and lid_closed are handled. I would hope this would be the same as keyboard out/in. There is a proof of concept at http://jon.oberheide.org/files/american-sign-language.c but I've been having trouble cross-compiling it for android. I have both code-sourcery and crossdev but poor coding skills. The exploit says in the text something about kernel 2.33 but it's marks on cve as still affecting kernel 2.6.35.7+. Perhaps one of our leet coders could check it out.
[Motorola Droid 3] elkay:
Android is 32-bit as of now. I'm not sure that we could leverage this exploit due to the comments regarding the 64-bit only payload.
[Motorola Droid 3] Willis111:
:( no idea how I missed that, but a payload being 64bit != size perhaps? I've read a few bug reports indicating this affects x86 and 64.
[Motorola Droid 3] elkay:
Actually if it was strictly 64-bit width speaking that would be better. If it has to be 64-bit executable, it's a no go. You can fit 2 32-bit instructions in one 64-bit instruction's memory space, so if this is a buffer overflow exploit, it would still be a possibility.
[Motorola Droid 3] onethreeteeh:
im pretty sure the payload for that is written for x64 processors. unless you can convert it from hex to x64 asm, and then from x64 asm to arm asm, and then from arm asm to hex it wont work

edit: same goes for any exploit with a payload in hex
[Motorola Droid 3] :
Hey, original author of american-sign-language.c here.

If debugfs is mounted on the droid3 and custom_method is available and world-writable, then yes, this exploit will work (although it might need a little porting but I'd have no problem doing that if someone can get me remote access to a droid3).

If you run:

ls -l sys/kernel/debug/acpi/custom_method

That should tell you if things are exploitable or not.

Regards,

Jon Oberheide
[Motorola Droid 3] pplude:
shell@cdma_solana:/$ ls -l sys/kernel/debug/acpi/custom_method

ls -l sys/kernel/debug/acpi/custom_method

sys/kernel/debug/acpi/custom_method: No such file or directory

shell@cdma_solana:/$
[Motorola Droid 3] onethreeteeh:
No debug folder under /sys/kernel
[Motorola Droid 3] Willis111:
* The payload is 64-bit only and depends on the existence of a LID device

* (eg. laptop), but the exploit will still tell you if you're vulnerable

* regardless. If you don't know how to work around these limitations, you

* probably shouldn't be running this in the first place. :-P

I assumed the "but the exploit will still tell you if you're vulnerable regardless" might be looking into but yeah, I guess someone would probably end up having to convert the payload for our use of the su binary.

you mean #define CUSTOM_METHOD "/sys/kernel/debug/acpi/custom_method"?

how about#define CUSTOM_METHOD "/data/tmp/custom_method"?

IDK, just throwing it out there.

Edit: Obviously an exploit for x86 or ia64 is not going to work straight out of the box but perhaps with a little work .... I'm thinking since it seems to be easier to exploit the kernel maybe that would be what we should be looking at.
[Motorola Droid 3] onethreeteeh:
That's what jon was getting us to test by running the ls. As there's no acpi, it won't be able to exploit whatever vulnerability there is.

I'm assuming the bit about working around the limitations was the fact the payload was for x64, and would need to be translated into x86, or in our case, arm. I'm sure jon could enlighten us further if there's anything I've missed
[Motorola Droid 3] :
Yep, if there's no /sys/kernel/debug, it means debugfs isn't mounted, which means a-s-l.c isn't going to help you here.

Sorry! ;)
[Motorola Droid 3] onethreeteeh:
There were a couple of other privilege escalation vulnerabilities that I saw on exploit-db that had shellcodes in hex (for x86) which I ignored because i don't really have the skills to convert it to arm. ill post them here when I have access to my computer and hopefully someone here is able to do it
[Motorola Droid 3] rynosaur:
I've done a couple of things that have made my D3 hard reboot. Are you saying there's no way to panic the kernel and make it drop into a debug shell?
[Motorola Droid 3] elkay:
Pretty sure it just immediately reboots on panic.
[Motorola Droid 3] Willis111:
That pretty much settles that right there lol.
[Motorola Droid 3] pplude:
Exactly. See my source thread where I talk about pause_on_oops, panic_on_oops, and to a lesser extent halt_on_oops
[Motorola Droid 3] Willis111:
I checked exploit db but didn't really see anything that I thought would be useful. I'm not saying it's not there, just I didn't see it (like the priv escalation through econet flaw). I'm looking forward to seeing what you have to post, hopefully you saw a few things I missed.
[Motorola Droid 3] onethreeteeh:
one of the ones i thought might work was www.exploit-db.com/exploits/8673

we'd need to precompile the .c file that it creates & then executes in the line beginning with "echo\" (just after the includes), and convert the shell code. it may have been patched in our kernel, but we wont know unless we try it, right?

i thought there was another one, but i cant seem to find it any more
[Motorola Droid 3] djrbliss:
Don't bother - this vulnerability has been patched, I verified this in the available kernel source.

Hi, I'm the original author of the full-nelson kernel exploit linked earlier (the one that leverages Econet). To be clear, that exploit will not work on this phone because it requires causing an OOPS to trigger an exploitable condition, and this kernel has panic_on_oops enabled, meaning the kernel will not continue running in such a scenario.

Rooting this device is going to take more work than just browsing exploit-db and hoping to find an exploit that works. There are no public exploits, kernel or userland, that will work on the kernel shipped with this phone.

I'm willing to invest some time into auditing the Android application stack and kernel to find a suitable vulnerability that can root the device (I do this professionally). I don't have access to a physical device, so in the event that I find a usable vulnerability, I may need a hand in actually testing exploit code. I also won't refuse a donated test device. ;-)
[Motorola Droid 3] slow88lx:
We D3 owners would be forever grateful to have you on board!

If you were interested in getting a D3 to hack on see this thread. I believe KrazyK was looking to give this device away to a potential "rooter".
[Motorola Droid 3] Willis111:
I compiled the sploit using gentoo's arm toolchain though have been having trouble finding a place to execute it from on the phone. I think I've triedn everywhere on the phone that people have been saying they've been running this from (1 user was saying he had busybox running from ?/data/tmp?. Anyways, I read the above comment that says this has been patch but figured if anyone else wanted to give it a go and maybe waste a little time I've uploaded the compiled binary and source code. I've been messing around with this thing all night reading over whitepapers, compiling sources etc and am in some dire need of sleep. Before I go I would like to make 1 request that any executable partition/directory would be placed and maintained somewhere on the front page of this thread or even another thread. This would be an invaluable services for people when they get too tired to remember their own name.

Best Regards,

Will

Edit: I don't particularly mind recompiling code that others have tried before, is it redundancy or perserverence? If you stumble across and exploit, especially for linux kernel 2.6.35(2.6.35.7) feel free to shoot me an email or better yet post it here some some elite coders can give the yes or no (I'll still compile and give a shot at running it)
[Motorola Droid 3] dpwhitty11:
I get this:

app_162@cdma_solana:/$ ls /data/preinstall_md5/
com.gameloft.android.Verizon.GloftNOHP.md5
com.gameloft.android.VERIZON.GloftLGF2.md5
log.txt
[Motorola Droid 3] Adam.h.ogle:
Yes and yes :p

I didn't find anything interesting as of yet.
[Motorola Droid 3] psouza4:
I still have CityID on my Droid 3 as well and that's the exact output I get too (except app_199@cdma_solana).
[Motorola Droid 3] superkeest:
I got cityid still installed too, i installed the sdk, but as i said im a bit noob,Ill try to figure it out
[Motorola Droid 3] tcrews:
Looking through my /system/app I still have CityID.apk listed.....even after being asked to "remove it" when canceling CityID demo time.

It's 569.38k (according to root explorer)
[Motorola Droid 3] krazykrivda:
ls /preinstall/md5/

will work! finally. Now we can get the files. Please post output again!

cat /preinstall/md5/*

in case you wanna see what they are

Maybe I can put dosu into /preinstall/md5/ and work with it from there

... we are really killing this thread btw
[Motorola Droid 3] pplude:
Interesting, thats a different username than me. Care to post the results of "id"?
[Motorola Droid 3] psouza4:
Sure:

app_199@cdma_solana:/$id
uid=10199(app_199) gid=10199(app_199) groups=1015(sdcard_rw),3003(inet)
[Motorola Droid 3] tcrews:
I don't even get that...I get "shell@cdma_solana"

shell@cdma_solana:/$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009
(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
shell@cdma_solana:/$
[Motorola Droid 3] Adam.h.ogle:
I assume you're using some sort of terminal application for your phone. You can use ADB to connect to the phone, which will log you in as "shell". Shell can see a lot more stuff, as well as use the program "run-as".
[Motorola Droid 3] pplude:
Ok, that's interesting. This suggests that the user and group id's are unique to the device and randomized during initial setup. Look at app_###. Then, the user/group id is 10###. Whatever we use to give permissions, we need to have a safeguard in place so as not to change permissions across the phone incorrectly, rendering the device unbootable.
[Motorola Droid 3] psouza4:
Different terminal app, perhaps?

I'm using: https://market.android.com/details?id=jackpal.androidterm
[Motorola Droid 3] superkeest:
shell@cdma_solana:/$ ls /data/preinstall_md5
ls /data/preinstall_md5
com.gameloft.android.VERIZON.GloftLGF2.md5
log.txt
com.gameloft.android.Verizon.GloftNOHP.md5
shell@cdma_solana:/$
[Motorola Droid 3] eww245:
You're probably using Terminal emulator or Connectbot?

If you do a ps you'll see the user is app_199 for the emulator and any processes attached to it, like sh ls ps, which is the user assigned to the app when installed. I guess adb may work the same way but I don't see adbd running, while in connectbot anyway. Mine is app_136.
[Motorola Droid 3] pplude:
This kinda rules out a universal set permissions on su to be owned by 10143 with 777 permissions. The 10143

NEEDS

to be replaced with your app_### in the format 10###. This means we all need a *nix system to change the permissions accordingly.
[Motorola Droid 3] superkeest:
ls /preinstall/md5
com.gameloft.android.VERIZON.GloftLGF2.md5
com.gameloft.android.Verizon.GloftNOHP.md5
shell@cdma_solana:/$ cat /preinstall/md5/*
cat /preinstall/md5/*
166207450aa66380ea0348faae7f6028
067ea0a9ddaa6f35b7dff7c650383f84
shell@cdma_solana:/$
[Motorola Droid 3] tcrews:
eh...I see for me...I was using adb shell.

My info..

Terminal (on phone)

app_199@cdma_solana:/$id
uid=10199(app_199) gid=10199(app_199) groups=1015(sdcard_rw),3003(inet)
app_199@cdma_solana:/$

ADB Shell (over USB)

shell@cdma_solana:/$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009
(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
shell@cdma_solana:/$
[Motorola Droid 3] krazykrivda:
are you able to pull anything with

ls /preinstall/app/
ls /preinstall/install/
[Motorola Droid 3] pplude:
Hmm, shell is not just a symlinked/piped account. Meaning a universal script can still be used over adb. Interesting indeed...

So we shouldn't be looking for root through the main user account...we should be looking for holes in ADB.
[Motorola Droid 3] psouza4:
I installed another one and got:

uid=10200(app_200) gid=10200(app_200) groups=1015(sdcard_rw),3003(inet)

Then I installed ConnectBot and got:

uid=10201(app_201) gid=10201(app_201) groups=1015(sdcard_32),3003(inet)

So they're sequential -- based on the order you installed the app.
[Motorola Droid 3] djrbliss:
As I said, this exploit and all other public kernel exploits do not work on the D3 kernel. If anyone *really* thinks they've found something that will work, feel free to post it and I'd be happy to give a yes/no.
[Motorola Droid 3] pplude:
Though, panic_on_oops is dependent on the Watchdog integrity checks. If the application runs within a 500ms window and send the command

watchdog::watchdog_timer.set false;

(thats the code in theory, though that is for C++ on WindRiver Linux)

it would effectively disable panic_on_oops. (according to watchdog.h and panic.h on the source)

EDIT: Don't take that watchdog code verbatim. I don't have the source in front of me so I can't reference the API.
[Motorola Droid 3] djrbliss:
Can you clarify? If *what* application runs *what* within a 500ms window of *what*?
[Motorola Droid 3] onethreeteeh:
thanks for clearing that up, it's great to see someone who actually knows what they're doing here. I was always just an enthusiastic amateur.

KrazyKrivda just reached his target for donations towards a droid 3 for a serious dev, you should get in contact with him
[Motorola Droid 3] rweb:
Glad you are here. :-)

Guys, we have to face the truth.

I guess there are 4 ways for us to get root:

1) Motorola / Verizon open the bootloader. Likelihood?

2) Motorola built in a vulnerability in the update mechanism. The likelihood of this is hard to assess, I guess. But I wouldn't bet on this, considering Motorola really did a good job locking down this device so far. We'll see after the first update ...

3) Out of an SBF. I have not enough knowledge to qualify this. Someone here mentioned we'd still need a root exploit, even with having an SBF. I cannot assess, I'm completely clueless on this topic.

4) Out of a Linux exploit.

Regarding 4), we have to face the fact there is *no* known exploit which could help us. There is even no known vulnerability which could help us. Not even a new exploit has to be written, also a new vulnerability needs to be found.

djrbliss wrote the full-nelson exploit. Really cool, I tried it out on an unpatched Ubuntu. I really think the only *chance* for us to have a Linux exploit is the help of a guy like him!
[Motorola Droid 3] suzook:
Wow...this is bad news. Sounds like droid3 will never b rooted
[Motorola Droid 3] whoopsiedaisy:
Im retarded

If there was any preinstalled app that could be used in finding root, id think it was 3g mobile hotspot, cas when I was on gingerblur rooted on my dx and tried to use wifitether it wouldn't work and 3g mobile hotspot would suddenly start so it knows something about root right idk like I said im retarded
[Motorola Droid 3] Shoop_D_Woop:
Way to saty positive, we have some of the best devs XDA has to offer, I'm hopeful
[Motorola Droid 3] royolpunk:
Lol it will be.

the only sad thing is that the bionic will go through the same process if we haven't found root by then. But we still have aroundish 3 weeks :D
[Motorola Droid 3] pplude:
Whatever application we may write to exploit root, it has to run within the 500ms window determined by watchdog.h, or else you will invoke a kernel panic (panic_on_oops) and it *may* have something to do with eFuse (don't quote me on this, I havn't looked into any kernel calls to the FPGA)

Basically, with any kernel exploit, we are ***** to the FPGA, whose firmware is even harder to find than an SBF.
[Motorola Droid 3] isaacgaretmia:
For those of us who haven't heard...

http://t.co/Xg0gNoE

How did we miss THIS?!?!
[Motorola Droid 3] Darksurf:
djrbliss is my HERO. Reading this made me feel like a 13yr old script kiddy again :)
[Motorola Droid 3] cellzealot:
Congratulations to all who participated!

Djrbliss did a beautiful job on this in amazingly short order.

Let's all maake sure he is properly compensated for his efforts.
[Motorola Droid 3] 640k:
holy flip hell about time!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
[Motorola Droid 3] oostah:
great job to all involved. i have been watching this thread and others since they began. im ordering my d3 tomorrow. will be more than happy to donate for every ones hard work.

can some one put a link to the ones involved in this so we can donate to the proper people. thanks
[Motorola Droid 3] slow88lx:
One Click, get your one click---->

http://rootzwiki.com/showthread.php?t=3714
[Motorola Droid 3] Trigonous:
I have lurked in this thread from almost day one, every day, and sometimes four or five times a day, not wanting to post out of respect for the hardworking devs as I have nothing to contribute except a derailment, but holy ****, you guys did it. It is awesome to see such a community. Thanks a billion, I wish I had money to contribute now :)

Sent from my DROID3
[Motorola Droid 3] daimerion:
noob

ok just rooted d3 successfully. how do i remove the bloatware. please explain as simple as possible.

Thanks
[Motorola Droid 3] Trigonous:
Get titanium backup. Be careful what you remove though, until a definite list of what is safe is posted.

Sent from my DROID3
[Motorola Droid 3] neilrl79:
I've read every post of this thread hoping that the next one would say "We've got Root", but not having anything constructive to add there was no need to post. Now that root has been achieved I'd like to say thank you to everyone that worked on getting this done, i really appreciate every one who spent countless hours trying to figure this out.
[Motorola Droid 3] Darksurf:
I've already removed all the verizon bloatware except my verizon. Then I removed their stupid backup client utility. That was redundant considering google already backs up everything to your gmail account anyway. I'm a little too leery of removing the blur bloat tho.
[Motorola Droid 3] Matthileo:
Same here about the blur stuff. I removed all of it and started getting FCs every time I tried to open someone's quick contact menu.

I don't think the blur stuff does anything unless you're using the blur accounts though

[sent from my droid]
[Motorola Droid 3] escalavee:
Many thanks to all the devs that worked so hard to achieve root. I have been following this thread from day one, and it has been really exciting, even though I have just been cheering from the sidelines! Great job, djrbliss! A donation will be made by me as soon as I can.
[Motorola Droid 3] Shoop_D_Woop:
Now my D3 is freezing up aok the time. Why!!??!? I'm having to restart all the time! :(
[Motorola Droid 3] somemadcaaant:
What did you remove/freeze/rename/edit? With more information some1 will be able to assist you.

Check the General threads for more info.

-smc
[Motorola Droid 3] psouza4:
I just posted the list of apps I've found safe to remove (55 in total) and some scripts to automate it:

http://xdaforums.com/showthread.php?p=17057761
[Motorola Droid 3] Shoop_D_Woop:
I didn't remove anything! I think my overclock widget was refreshing too much, I turned down the refresh rate and it cleared it up.

Also, need help finding a version of clockworkmod or some other recovery tool for the D3.
[Motorola Droid 3] jediman:
Probably time to close this thread :)
[Motorola Droid 3] NeoS:
Seeing root has been achieved, this thread can be closed.

Good luck guys.
[Motorola Droid 3] pplude:
This means that apps are sandboxed. There *is* a user account, but it is spawning sandboxes for each application...presumably to keep us from digging into system files.

Now, it looks like the "shell" account has some more permissions, and logout is denied (sandbox, go figure). That may be where our hole is.

Is it possible to run BASH from a fastboot or bootloader shell? If so, I *KNOW* we can find a hole.

REASON: The sandbox is a service. When we use fastboot, no extensions are loaded.

BTW, can we modprobe?
[Motorola Droid 3] dpwhitty11:
If anything needs to be done via adb instead of a terminal on the phone, i'll be able to get on my laptop in around 30 minutes and try things.
[Motorola Droid 3] psouza4:
Likewise I can ADB right now if need be.

C:\adb_test>adb shell
shell@cdma_solana:/$ id
id
uid=2000(shell) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
shell@cdma_solana:/$

Good to go.
[Motorola Droid 3] superkeest:
shell@cdma_solana:/$ ls /preinstall/app/
ls /preinstall/app/
com.gameloft.android.VERIZON.GloftLGF2
com.gameloft.android.Verizon.GloftNOHP
shell@cdma_solana:/$ ls /preinstall/install/
ls /preinstall/install/
/preinstall/install/: No such file or directory
shell@cdma_solana:/$
[Motorola Droid 3] eww245:
Don't know if anyone is aware but the app's user names work the same on all Android systems, rooted or not. So each app "user" can get su permissions. That's why we use SuperUser.apk.

Sorry if i'm stating the obvious.
[Motorola Droid 3] pplude:
Well, I'll check in later. I got a job interview...with Apple of all companies. Needless to say, my phone is staying HOME!!!

Good luck!
[Motorola Droid 3] gierso:
Droid 3 :) come and play !!!!

Enviado desde mi DROID3 usando Tapatalk
[Motorola Droid 3] dpwhitty11:
How dare you, sir :P
[Motorola Droid 3] pplude:
Best Buy isn't cutting it anymore.
[Motorola Droid 3] dpwhitty11:
I don't blame ya. Moving onto bigger and better things. Just don't get an iphone! Haha good luck man.