yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] krazykrivda:
Well I've exhausted that script. I've asked (and irritated to know end) people from all differen communities via IRC.. linux/ubuntu/bash and I think what I"'m trying to do is simply impossible. I think it is time to move on from that. BUT.. for the last time I will try to express my thoughts on what I WAS working on.. maybe someone else can run with it or it will spark other ideas.

Script found @ /system/bin/loadpreinstalls.sh runs on boot and has elevated priviledges at this time. http://pastebin.com/6C7rcuQ6

I do not have ANY control over how this script is written, or when it runs..

I DO have control over the'file' variable and it's contents (which gets loaded into newMD5 via the 'cat' cmd @ line 16)

if I call file '$newMD5' and in the file.. the text reads '; cp /preinstall/su /system/bin' <(this part is where the issue lies, and is why I was asking hwo to declare this variable properly)

So what would happen is.. @ line 16 newMD5 will = "; cp /preinstall/su /system/bin" via the cat command (or w/e the variable SHOULD say/be)

then when line 19 runs.. isInstalled=`pm path $file`, it would be the equivalent of `pm path $newMD5`.. which is equivalent to w/e we stored in the file earrlier. (in my case the "; cp /prei.....")

This was an attempt of basically hijacking the pm function, ending it with the ';' and continuing onto the necessary cp command.

ISSUE is that when using this as a variable it will not properly evaluate, anthing after the first space is ignored or seen as extra arguments for the initial command.

But note - to test

pm path ; cp /sdcard/x /sdcard/y

WOULD work.. not using the variable...

so yeah.. time to look for a new exploit for me. again.. maybe someone can run with this, or do something benificial. Or at LEAST not waste time on something I have devoted way to much time to.

Thank you all who helped research and lookinto and try various solutions.
[Motorola Droid 3] :
If you haven't tried already, one potential source of an answer to your shell scripting question is StackOverflow. The people there are very knowledgeable, and will be able to tell you whether or not what you're trying to do is possible, and if so, how to do it.
[Motorola Droid 3] idkwhothatis123:
Thank you for all of your hard work and dedication but I have to say it...

:-( I don't wanna wait till October for an unlocked bootloader.

Lulz

Double fisting with my D3 and TBolt using the XDA app that costs money.
[Motorola Droid 3] ajbattaglia83:
You really think they're going to unlock the bootloader? I wouldn't hold my breath...
[Motorola Droid 3] randallman:
Heh, this is BOTH VZW & Moto we're talking about....

P(moto unlocks)=0.5

P(VZW unlocks)=0.01

P(moto & vzw unlocks)=0.005 (or 0.5%)

:-)

(Sorry, in MAT300/statistics now)

EDIT - that being said I am still going to buy a D3... I just have to get over the idea that I'll have a linux box attached to my belt that I do not have root on (at least yet).... This is tough for an Enterprise Infrastructure Architect/RedHat Certified Engineer/17 year linux dork...

--Randallman
[Motorola Droid 3] redddog:
moto might. VZN will never.
[Motorola Droid 3] idkwhothatis123:
Idk. I have a 3g xoom and out of the box it was unlockable. Hoping for the best lol
[Motorola Droid 3] SS2006:
Thats cause like the nexus s and one

The xoom was a 'pure google experience' so it has to be unlockable

But hey moto did say there gonna start unlocking and the atrix technically they unlocked it
[Motorola Droid 3] Jewremy:
I'm betting that the Atrix unlock/2.3.4 root method is the best bet that we have for rooting the Droid3. 2.3.4 hasn't been rooted yet, except for on the Atrix (using dosu after fastboot flashing /preinstall) and the nexus devices which come unlocked. Last I checked, the Gingerbreak hole was patched after 2.3.3.

Either way, that nosuid is going to be a ***** to get around. Is there a way to dump /system from an unrooted device? There's a slim chance that we can fastboot flash that. I don't want to try unless I'm flashing something that I know won't bork it.
[Motorola Droid 3] oostah:
like this one

http://xdaforums.com/showthread.php?t=1164736
[Motorola Droid 3] Jewremy:
Nope. We need a .img file, same as from a nandroid backup (or dd if=/dev/block/partition of=/sdcard/file.img) - pulling the system's files is easy to do (adb pull /system). It's modifying the img while keeping everything intact, then flashing it back that's the hard part. Can't push, seeing as we have no root.

Question:

Is there ANY way to create/modify a .SBF file? I know somebody came out with an OdinMaker application for Samsung devices. SBF_Flash/RSD and .sbf files are Motorola's equivalent of Odin. I highly recommend not using RSD - I've bricked too many devices with that. Easier to use VirtualBox/VMWare with Ubuntu or Mac OS to SBF...Not that we have a file to flash yet.

Info on Fastboot, from my point of view -

Fastboot is Google's supposedly universal method of flashing. "Google Experience" devices (Nexus One and S, as well as Motorola Xoom - not sure on the GTab10.1) as long as the bootloader is unlocked (ie Atrix) you can fastboot flash system, boot, recovery, pretty much anything. You can even **** it up (fastboot flash boot system.img) and just boot back into fastboot and flash the proper image. With fastboot and locked bootloader, generally you can only flash userdata (/data) and cache.

However, we can flash /preinstall on the D3 (like the Atrix) and I think that could be our way in for root. On the downside, /preinstall has nosuid and is only used in the event of a factory reset. In this case, we'd have to wipe to get root. I think that's what Krazykrivda is working with at the moment.

I'm going to try to dump /system and see if it's flashable through fastboot.

EDIT: Nevermind. Permission denied.

Can anybody do up a list of what we've tried so far?
[Motorola Droid 3] taylorhome11:
Yeah im sticking by what i said before. Someone figure out a way to skip device check on flashing sbf and i can almost bet i could get root in 5 minutes. Sbf_flash checks device, and obviously so does rsd.
[Motorola Droid 3] st33med:
Modifying the SBF to read as the device will do it.
[Motorola Droid 3] mwmeyer:
Can you issue any shell commands before it gets run? In particular, setting PATH to include a directory you can write on may let you execute arbitrary commands, unless they reset it before running this script.
[Motorola Droid 3] Jewremy:
Or get [MBM] to give us a modified sbf_flash (he built it from source) that skips device check.
[Motorola Droid 3] Jewremy:
Talked to the guys in #[mbm], it won't work. Can't flash Atrix bootloader to a Droid3. The phones are similar, but not that much.
[Motorola Droid 3] taylorhome11:
Not looking to do that. I have a recovery only sbf. It is a temp one that will be gone after first boot. But it allows unsigned.zip.
[Motorola Droid 3] taylorhome11:
Even if it is for another device im not worried about bricking. Because its only temp
[Motorola Droid 3] nerdslogic:
Just thought you guys would get a kick out of this.

http://youtu.be/Rt087kzT-hk
[Motorola Droid 3] taylorhome11:
forget it....nvm
[Motorola Droid 3] st33med:
Run the apps and show me they work. Then tell us how you did it. :p
[Motorola Droid 3] elkay:
I want to see the popup that says something was granted root permissions, such as Root Explorer, then browse one of the inaccessible folders.
[Motorola Droid 3] dpwhitty11:
^This.

I have superuser and titanium backup installed too. Doesn't mean they work.
[Motorola Droid 3] slow88lx:
Jackass! Obviously that phone does not have root.

Back on topic.
[Motorola Droid 3] calash:
Kind of like a MySQL injection. I would think it could work but my experience is not that extensive so I would not go by that.

I am curious about part of the script you posted. It would seem that the script pulls the file names via the ls command from the preinstall directory, and works with that to lookup the md5 hash.

If this is the case there is no real check outside of the MD5. Several pages back there was talk of successfully flashing this partition (at the time I believe it was with the atrix file). Forgive my slightly noobish question but couldn't a file be crafted that added the SU files+hash, flashed, and then on boot it would be executed bu this script?
[Motorola Droid 3] RigWig:
I have been looking into the same thing, the only real problem I've run into is how to actually create an sbf file. I was under the impression that we could not flash custom sbf's because the bootloader is locked, am I wrong?
[Motorola Droid 3] nerdslogic:
I meant get a kick out of it not due to it being rooted (cause its not) but because Google automatically restored those apps when I activated my phone. I thought it was ironic as rooting is "bad" yet they restore your rooted apps.
[Motorola Droid 3] elkay:
Carriers consider them bad, not Google. On an unlocked Google device, Google could care less what you run.
[Motorola Droid 3] nerdslogic:
Right....but you know what I mean....I just thought I would post up what the goal is......what we all want this phone to have.....legit though of course
[Motorola Droid 3] 3diord:
If anyone still has Nova and that golf game installed, check what user they run as. If its root (0) or to a lesser extent, system (1000) I have an idea.
[Motorola Droid 3] eww245:
nova is 10122 sorry
[Motorola Droid 3] punee:
lurk lurk..

..translation : marclar marclar marclar & i get marclar so it's marclar.

man i wish i knew what all this is.. sounds super fun (not sarcastic)

anyway sorry, carry on..
[Motorola Droid 3] taylorhome11:
you don't need an sbf to mess with the preinstall directory. you need to a preinstall.img and flash it to the preinstall partition. Which we already confirmed works.
[Motorola Droid 3] estobaughn:
Not to repeat myself, but i am in the middle of moving so i dont have time to look into this. But as someone said earlier about the atrix using the hd dock to root it. I had mentioned what was running when the phone is being charged. It seems to at leat get past the boot loader and run a binary. Can anyone see what is going on and if anything can be done while the phone is in that state.
[Motorola Droid 3] taylorhome11:
There are people that can strip down an sbf from a device and inject what they want. The problem is they need one from the device. Mainly because of the ramloader portion. If we can get the sbf that is our ticket to root.
[Motorola Droid 3] 3diord:
I figured they wouldn't be that dumb. Oh well. Not sure where to go from here, I think preinstall is a lost cause, excepting some buffer overrun type thing.
[Motorola Droid 3] Seirÿu:
Im still curious if there's an expliot to be found through the corporate sync/ device admintrators... no one seemed to answer :(
[Motorola Droid 3] 3diord:
Explain more, I'm confused as to what you mean by that.
[Motorola Droid 3] volcanomike:
Couldn't an apk be created that would install su. Be placed in the app dir of preinstall and be executed by loadpreinstalls.sh?
[Motorola Droid 3] eww245:
Trying to expand on your idea krazy. It's that for file in ls that messes it up.

I can create an empty file called (cd sdcard; sh rootit.sh) then cat '$path/$file.md5 executes the script and the test copy works. Went as far as ($(echo -e "\057")sdcard$(echo -e "\057")rootit.sh) but that can't be a file name because of the slashes not sure if there's another way for char codes that doesn't break or include the slashes. Several variations work from the terminal when not using the for loop.

The for loop causes cd sdcard sh rootit.sh run as individual commands. In order to do something like this the file that would point to a script would have contain no white spaces. So I just wasted a bunch of time.

The point of the extra file is because there's no way to directly run the rootit script unless it's in the current working directory which is / .

Thought I was close.

I don't believe pm path is even needed in this case "if [$newmd5" should directly execute cat $path/$file.md5 hence run rootit.sh where ever it may be.
[Motorola Droid 3] Jewremy:
loadpreinstalls.sh doesn't execute said app...I don't think. I believe it just installs them like normal (market or pm install or adb install)
[Motorola Droid 3] volcanomike:
thought so....
[Motorola Droid 3] Cyrus221:
Anyone try to mess with the camera yet? Adam was onto something there... maybe we could write a camera program to hijack its permissions and elevate from there? Sure wish I took some basic computer so I could help more....
[Motorola Droid 3] elkay:
Dumb question, but don't slashes need to be escaped? Shouldn't it be \\? Just talking as a programmer that hasn't messed with shell scripts enough to recall since it's been about a year.
[Motorola Droid 3] idkwhothatis123:
http://angrywhitedude.com/wp-content/uploads2/2010/05/are-you-wizard.jpg
[Motorola Droid 3] nerdslogic:
What about through the ffc? I saw a bunch of conversation on motodev about it including something about permissions
[Motorola Droid 3] taylorhome11:
Can you point us to the thread you are talking about
[Motorola Droid 3] scottml:
I was also playing around with this last night on my unix box.

Figured out that the "for ls" statement was breaking on spaces and tried to come up with a way of sending whitespace in a filename without it actually being a space. IE: tab control character was my best guess. Something along the lines of $'\x09' works in bash but not sh script.

So you might have some filename looking like:

/system/preinstall/app/temp.apk;cd$'\x09'sdcard;sh$'\x09'rootit.sh

/system/preinstall/md5/temp.apk;cd$'\x09'sdcard;sh$'\x09'rootit.sh.md5

But I could never get the non-space characters to execute properly.

I looked into changing the shell var "IFS" temporarily to something like ":", and that didn't work either. (Filename of something like):

temp.apk;oldIFS="$IFS";IFS=":";cd:sdcard;sh:rootit.sh;IFS="$oldIFS"

But IFS only works on stdin and I wasn't sure how to pipe the command that way.

Can also use "&&" or "||" instead of the ";" command seperator to cause the right return codes but they need whitespace.

The other thing I thought about was letting the script copy a file from the sdcard to the system/bin, by changing PRELOAD_HASH_DIR and DATA_HASH_DIR values since there's a "cp" command executed when the file installs successfully or is already installed. For that to work tho you needed "/" characters in the filename which I couldn't seem to get either.

Justsome thoughts, maybe someone can put a different spin on them.
[Motorola Droid 3] scottml:
UPDATE: this filename seems to work for adding the whitespace needed to execurte commands. (The ":" acts like a space for commands).

temp.apk;oldIFS="$IFS";IFS=":";CMD1=":sdcard";CMD2=":rootit.sh";cd$CMD1;sh$CMD2;IFS="$oldIFS";

The only issue would be the slash in front of sdcard. Perhaps a sed replacement of another char like "^" into "/" since you could execute sed with the ":" for spaces.
[Motorola Droid 3] volcanomike:
can we try to place the dosu executeable on /data/local with +x permissions. instead of adding to the command line with long commands that break with spaces just execute dosu as root? don't know if this makes any sense to anyone... could just be me blabbering
[Motorola Droid 3] scottml:
Here's a filename complete with a way to do slashes:

oldIFS="$IFS";IFS=":";S1=":$PATH";S2=":-c1";S=`echo$S1|cut$S2`;E3="sdcard";E4="rootit.sh";sh$IFS$S$E3$S$E4;IFS="$oldIFS";

NOTES:

- the $S is the slash

- runs a script from /sdcard/rootit.sh

- HAVEN'T ACTUALLY TESTED IT YET ON THE PHONE. DON'T FLAME IF IT'S NOT PERFECT

Have at it Root Gods.
[Motorola Droid 3] taylorhome11:
Im willing to give it a shot. But can you write to data/local?

EDIT: cant write to data/local
[Motorola Droid 3] eww245:
A few problems with this, it does work fine from the terminal but it can't be a file name.

quotes "" don't work, no problem use tick ' instead. pipe | and colon : can't be in a file name.

cut is not a command included with android, busybox would be needed. That doesn't mean that busybox couldn't be included in the preinstall.img.

I'm not event sure if this idea will work at all. The assumption is the file name will be read as a string, not the actual file contents, which I haven't gotten far enough to try. I don't know where else to go with this.

Thanks though I didn't think it was possible to do what you did.
[Motorola Droid 3] taylorhome11:
Why not do a simple test with a filename that will do something. Just so you arent working all through this for nothing...
[Motorola Droid 3] eww245:
/data/tmp can be written to then chmod 755. I have been using busybox this way. I think someone already tried this though, no?
[Motorola Droid 3] scottml:
You can use all of those in file names.

The only char you can't use is the / (forward slash).

The others have to be escaped in the actual command to create the file. (with a \). Or you can use a graphical UI and it will escape it all automatically and create the file for you.
[Motorola Droid 3] 3diord:
Yeah, /data/local/ is free to mess around in. Although I still think the method of crafting a filename to break the script is nigh impossible. I've tried all the methods listed here so far and have yet to get it to even create a directory.
[Motorola Droid 3] eww245:
I agree time to pass on it.
[Motorola Droid 3] taylorhome11:
Completely sounds like you are close... but you arent doing this on phone are you? Just on *nix?
[Motorola Droid 3] eww245:
How did you create that file? I can't do it on the phone and XP actually tells me what chars can't be uses. Haven't tried on linux yet. As long as it can be created and its in the img then that part could work.
[Motorola Droid 3] 3diord:
That's the problem. pasting it on its own is very different from it running as a variable in a script. If you can make the following line execute a cp, mv, mkdir, or anything but cat, you win.

cat $foobar

Rules:

you can set $foobar to anything

you can't change anything else, the command you execute has to be "cat $foobar"

If you can't, this method is busted. (I already believe it is)
[Motorola Droid 3] scottml:
I'm working on a linux box. Can't make that file in Windows.

Yeah, I ditched the rootit.sh portion. I'm testing the filename now with direct commands. I'll have something shortly.
[Motorola Droid 3] eww245:
This is what i've been using for post-login automation in connectbot

cat /proc/$(cd sdcard;sh busy.sh).md5;
PATH=/tmp/bin:$PATH

busy.sh

cp /sdcard-ext/download/busybox-a* /tmp/
chmod 755 /tmp/busy*
if [ ! -f /tmp/bin/ls ]; then
mkdir /tmp/bin
for i in $(/tmp/busy* --list); do
ln -s ../busybox-armv6l /tmp/bin/$i;
done
fi

So if you can work your magic scottml this can get 'cut' for us.
[Motorola Droid 3] saintlikesniper:
Sorry for not posting any relevant data pr knowledge to this thread but on a percentage scale how close are we you guys from getting root. 80% or what?
[Motorola Droid 3] royolpunk:
I'm getting my Droid 3 on Wednesday....it's on backorder. hopefully we achieve root by then...im coming back from the i*phone :)

$25 to the person who gets it...
[Motorola Droid 3] eww245:
Did anyone edit preinstall.img and copy su to the app directory?

nevermind, even with the "sticky" bit set it mounts as nosuid

I didn't try to flash this but I don't see the point.

Kind of forgot why this whole variable thing got started, many pages ago I can see where it was discussed.
[Motorola Droid 3] 3diord:
From what I've seen, not very close. :(
[Motorola Droid 3] Pokelover980:
Well, in my opinion, we could be close, or not at all. It just seems to be one of those things that you can't really measure, because we could stumble upon it by a stroke of luck or a bit of work, and we could think we're close but just randomly find out what we're doing won't work at all (like we have several times in this thread).
[Motorola Droid 3] krazykrivda:
I'm going to say I have to assume someone is close. The path i WAS pursuing was merely one (impossible?) step away. I don't know..

how close are you to figuring something out that you do not know is a very hard question to answer. You will probably GET the phone rooted before an actual answer is given.
[Motorola Droid 3] royolpunk:
They're going to get this rooted sooner or later...
[Motorola Droid 3] edgan:
I worked on it today. I made a bit of progress. I can tell you the odds are something like 90%+ that the exploit to get root on this phone will come from a kernel exploit. About the only other small chance is some universal Android exploit.

Unlike many other phones the Droid 3 has a newer 2.6.35.7 kernel. Which makes finding a usable kernel exploit a fair amount harder. Another complicating factor is that most exploit code is written for x86/x86_64. Security researchers look in the x86/x86_64 part of the kernel source tree more too. So many exploits are even x86_64 only.

Overall it will probably just be a matter of time before some security researcher finds something usable. When the right kernel exploit comes along, there are some aspects of the phone that will make an exploit very quick and easy.

P.S. I did find a hint of something fishy going on, and it might be a real lead. I tried reproducing it on my phone, but didn't have any luck. I am going to put some more time into it, but don't get your hopes up.
[Motorola Droid 3] 3diord:
Details?
[Motorola Droid 3] evulhotdog:
+1
[Motorola Droid 3] nerdslogic:
I know right...it's like one of those cliff hangers you get at the end of a True Blood or Dexter episode or something:eek:
[Motorola Droid 3] 640k:
he wasn't able to reproduce the issue at the time of the post. could have been a fluke.
[Motorola Droid 3] cdorwart:
Have an awful feeling they are just waiting for someone to find root, patch it, and in that patch include all the fixes for the device forcing us to update. e.g. a camera update.
[Motorola Droid 3] 640k:
software development doesn't work like this. moto.mob is already working on their next release. they're most likely load/testing and adjusting as necessary. a code change this late in the game would either push the release (update) back significantly or simply be scheduled for the next release

we have all yet to see an update that specifically gets sent out to thwart root exploits. updates HAVE been issued that thwart said exploits, but they have never specifically called out that purpose.

it's a cat and mouse game. finding root means your system has security holes. patching these holes is what keeps your system secure. while I want root, i also want a secure system. difficulty in achieving root is a good thing, even if its frustrating.

there's lots of good stuff in here, but i've yet to see any hard evidence that we're any closer to achieving root. everything is exploratory at this point.
[Motorola Droid 3] cdorwart:
I agree and I am a developer. I feel like you kind of hit my point, but I don't want to get too sidetracked. I was just explaining how it would be very easy to almost force everyone to update, even if it removes root, if it is an improvement over the phone in it's current state, which is above average but does need some fixes. Specifically, the camera is really awful compared to Droid X or even the iPhone.
[Motorola Droid 3] 640k:
based on all of moto's previous models and based on root exploits that i've personally explored over the last 2+ years, once you have root, you can block updates. "free time" devs will attempt to root the update and then you wait to update, with the rooted update.

historically, every update has removed root, but i'd say 90% of teh time, the original exploit still applies. i've yet to see the first release (update) to close the exploit. that's why i say moto.mob has their own schedule. patching the exploit would require a kernel change (most likely), which would push us into a second or third update, which is fairly rare.

i had to go back and think about what i said. the only time that i've seen an exploit closed is when Android itself is issued an update, which usually comes from Google first, and then moto.mob (or htc, or samsung, etc.) needs to fit into their release schedule before issuing a new update.

so we'd most likely hit Android v2.4 before we see whatever exploit that is discovered, patched.