yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] krazykrivda:
So i have managed to flash the atrix preinstall.img on to the D# ( i would not recomment for other until sbf is around)

The /preinstall partition on D3 usually contains 285 mb. Please confirm this ('df' in adb shell). i'm hoping that this is about the same size as Nova game and Golf game(the only stock apps I found uninstallable).

While I cannot yet run dosu or su off the preinstall, the files are there properly and I can cp them or even install from this directory.

As for the preinstall.sh or w/e it was. Yeah it installs anything with a matching md5sum. On the atrix, the blockbuster app, among others are installed with this, however, we cannot uninstall the BBuster app (at least I cannot) so either the D3 and atrix differ in this way, or there is a way to install to /system/app using this script.

I also noticed the /system/preinstall folder however I cannot acces this, and if I cd it, it takes me to /preinstall not /system/preinstall although there are no symlinks or hard sings (at least not that I found via adb)

If you can help or want to assist my efforts, msg me on twitter (@KrazyKrivda), or pm here.

Thanks
[Motorola Droid 3] Adam.h.ogle:
Good news, I think. The two apps combined are ~235mb in size (using ls), and the MD5 hashes in the md5 folder are 33 bytes a piece (as expected). So there is another ~40mb of data on that partition.
[Motorola Droid 3] tcrews:
here's a DF off mine...
[Motorola Droid 3] krazykrivda:
helpful.. so we are missing about 20-30 mb of files. Are there any other apps that anyone knows of that come w/ stock that CAN be uninstalled?

also, can somebody grab the /data/preinstall_md5/log.txt of there d3 and post here?
[Motorola Droid 3] tcrews:
Yes, the golf game and the nova game (which I have uninstalled). CityID can also be removed by "canceling" the demo time and then it asks if you want to remove the app (which I also did).

tried pulling /data/preinstall_md5/log.txt and I get "does not exist"

EDIT -

When adb shell, I can ls /data/preinstall_md5 and see log.txt but I can not CP it to the /sdcard (permission denied) or adb pull it (does not exist)
[Motorola Droid 3] krazykrivda:
try

ls /data/preinstall_md5/

I also removed City ID, so I donot know its file size :-\

Edit:

Your edit beat my post apparenlty, but what other files are shown in that dir?
[Motorola Droid 3] Adam.h.ogle:
Even weird-er, "ls" works, but "ls -l" doesn't return any files. I'm a little rusty on my *nix permissions, but if you can browse a folder structure (dir has R permission), can't you also see the file sizes? Something isn't adding up.

EDIT: Directory contents

shell@cdma_solana:/$ ls /data/preinstall_md5
ls /data/preinstall_md5
com.gameloft.android.Verizon.GloftNOHP.md5
com.gameloft.android.VERIZON.GloftLGF2.md5
log.txt
shell@cdma_solana:/$
[Motorola Droid 3] tcrews:
shell@cdma_solana:/$ ls /data/preinstall_md5
ls /data/preinstall_md5
com.gameloft.android.Verizon.GloftNOHP.md5
com.gameloft.android.VERIZON.GloftLGF2.md5
log.txt

is what I get..
[Motorola Droid 3] pplude:
From what I see, the only program not checking rwx permissions is dd. Seeing how many mount points there are, we should be able to recreate our partitions to our liking and use dd to reflash it without a wrx or signature. It would be a LONG process though, as adb pull skips a lot of files. We just need access for user account app_143 somewhere, even if its the /temp partition.

Is it possible to use adb to set up a chroot jail for the phone's /temp partition so we can flash it? Afaik that only clears on reboot or use of swap (does this kernel even use swap?)
[Motorola Droid 3] dpwhitty11:
DF of mine, nova and golf uninstalled but city id is still there.

app_162@cdma_solana:/$df

Filesystem Size Used Free Blksize

/dev 219M 76K 219M 4096

/mnt/asec 219M 0K 219M 4096

/mnt/obb 219M 0K 219M 4096

/system 320M 307M 13M 1024

/data 1G 383M 1G 4096

/cache 535M 16M 518M 4096

/data/tmp 2M 12K 1M 4096

/pds 3M 1M 2M 1024

/preinstall 477M 258M 218M 1024

/mnt/sdcard-ext 14G 4G 10G 32768

/mnt/sdcard-ext 14G 4G 10G 32768

/mnt/sdcard 11G 5G 6G 8192

/mnt/secure/asec: Permission denied

/mnt/sdcard/.android_secure: Cross-device link

/mnt/sdcard 11G 5G 6G 8192

/mnt/asec/com.qualcomm.qx.neocore-1 8M 6M 1M 512
[Motorola Droid 3] pplude:
Hell...someone upload a su that's been tested on a similiar phone...I'll try it.
[Motorola Droid 3] superkeest:
seems to me we need to look at that dosu binary, as krazy said the preinstall did flash , but the dosu failed. anyway we can pull that out? Im able to help out but im noob. I do have a cs degree if that helps ;)
[Motorola Droid 3] krazykrivda:
superkeest: i can get you the dosu binary file, if that is what you are asking for that atrix users used.

dpwhitty11: isince you are the only one with city ID still, i would need what

ls /data/preinstall_md5/

since I'm trying to determine if cityID is part of preinstall.
[Motorola Droid 3] pplude:
afaik, the dosu binary relies on the system su file which is in an unusual location. If we can use the Atrix su and modify the dosu script to use su from the /temp location, we can flash that all over and should get at least temproot.
[Motorola Droid 3] tcrews:
Has anyone else done a "ls -R" ? you better pipe it out to a txt file LOL
[Motorola Droid 3] nerdslogic:
if there is anything I can do to help I am down. I have all the stock files and apps on my device. In addition I have my replacement showing up today so should we need to test something I would most likely be down for that. Providing it is a good idea and not some dingle berry saying...."here....flash this D2 file"
[Motorola Droid 3] elkay:
Die.

/10char
[Motorola Droid 3] RigWig:
I just jumped out of bed and nearly died for that...
[Motorola Droid 3] pplude:
EDIT: Looking on SuSE forums, the error I'm seeing is part of CSH/ASH. I'm working on getting BASH up, and that would allow me to run that su binary from /data/tmp
[Motorola Droid 3] Shoop_D_Woop:
1st.) You're an ass.

2nd.) My heart actually skipped a beat, and thus showing me just how big of a geek I am.

Also, you're an ass. Lol
[Motorola Droid 3] dtdlurch:
Not cool, dude....

On another note, has anyone checked out Script Manager on the Market?

Im not a developer but I am learning. As I am getting acquainted with Linux and Java, I came across the app the other day. Seems to me that it MAY be a useful tool for this process. It has a cool file browser that lists all the permissions next to each file and shows some other seemingly good info.

Just wanted to throw it out there just in case it helps.
[Motorola Droid 3] somemadcaaant:
@ Shoop_D_Woop

lol hillarious...

@ dtdlurch

Root explorer has had this ability also, a far more useful app imho.

-smc
[Motorola Droid 3] royolpunk:
Calm down. If anyone knows I'm still helping with finding root and an sbf, so don't call me an ass when you're not even helping.
[Motorola Droid 3] psouza4:
I know you were having fun, but I have to agree with others: it was a **** thing to say when we're all so desperate for root. Keep in mind that we all get notifications of this kind of stuff sent to our e-mail and most of that goes right to our phone. No sense riling people up. :P
[Motorola Droid 3] royolpunk:
I know, I'm sorry lols0809614237we
[Motorola Droid 3] minhgi:
Dam..it. got me almost doing the donation dance..to bad...
[Motorola Droid 3] dsexton702:
im not sure if the droid 3 can use odin, but if you can there might be a way to root you
[Motorola Droid 3] elkay:
I think Odin is a Samsung-specific program.
[Motorola Droid 3] idkwhothatis123:
It is. Still no sbf in store.
[Motorola Droid 3] Shoop_D_Woop:
You must understand I hold no ill will against you. I'm not contributing for lack of trying, btw...if donations are what will help, I can make donations to the cause. I merely lack the knowledge to assist with the scriptzors.
[Motorola Droid 3] Pokelover980:
Just tried this. Unless you have any idea as to where you would want to push BASH aside from /data/tmp, it won't work. I just compiled BASH 4.1 for ARM, and it's too big to fit in /data/tmp. If you can find a way to make it small enough to fit or can find another place for it to go, that'd be great and we could move along with this idea.
[Motorola Droid 3] pplude:
since you have the build tools set, what about compiling zsh or csh, moving the buffer from 64 to 128? I think the latest builds of zsh already have this enabled.
[Motorola Droid 3] royolpunk:
To be blunt.

Money won't help us get root. even if you had $1000000000. What we need is an SBF. If you can get that, we're golden and we will bow down to you everyday.

:)
[Motorola Droid 3] Matthileo:
I don't know. With that much we could just buy moto out from under Google and make them unlock it. ;-)

[sent from my droid]
[Motorola Droid 3] elkay:
Nope. We'd need more than 12.5x that.
[Motorola Droid 3] Matthileo:
Guess you're right. I suck at counting zeros.

[sent from my droid]
[Motorola Droid 3] royolpunk:
hey pplude can you get on the IRC right now? rhcp is here to help and we need you to test drive something :)
[Motorola Droid 3] saintlikesniper:
Please be an exploit for root
[Motorola Droid 3] rynosaur:
I was hoping for free Ponies for all D3 owners.:D
[Motorola Droid 3] Shooperman:
I read in a previous page that getting a root process to break could help. Is the browser a root process? I found a repeatable way to have com.android.browser force close, but I am not a developer and have no clue if it is useful or not. I'll post instructions if its a usable exploit.
[Motorola Droid 3] Matthileo:
If getting a system app to forceclose is a possible path to root, I think you can cause com.motorola.home to crash.

While using ADW EX as the launcher, open the browser, go to bookmarks, and add one to home as a shortcut. FC every time for me.

[sent from my droid]
[Motorola Droid 3] royolpunk:
You guys should get on the IRC chat and mention this to the devs. Maybe this could be of use, as of rigt now I think jcase is helping as well.
[Motorola Droid 3] Pokelover980:
~658kb will fit on the /data/tmp partition, right? ;)

I haven't been able to test it myself yet, but I've compiled zsh for ARM (after hours of work of getting gcc to comply with my demands >_> compilers are like voodoo to me, always have and always will be), and I'll upload it for you guys to mess around with in a minute.

EDIT: Link here, have at it and tell me what you can do with it: http://www.mediafire.com/?5f34pu7lpbuvrnn
[Motorola Droid 3] pplude:
It's not running using my process. Looks dead here.
[Motorola Droid 3] Pokelover980:
Dang. I'll see if I can get csh compiler or bash to a smaller size. As I said, compilation is voodoo to me. If anyone else wants to take a stab at this, go ahead, but I'll continue for the time being.
[Motorola Droid 3] Matthileo:
I'm not terribly familiar with IRC, could you tell me how to get on / what channel?
[Motorola Droid 3] pplude:
download xchat (says you have to pay, recently GPL'd, so it's free. Select Freenode as your server, and use "KrazyK" as your room.
[Motorola Droid 3] eww245:
You sure you compiled for arm? I get not found when trying to run. A quick google I see ARCH=arm CROSS _COMPILE="arm -eabi-"
[Motorola Droid 3] chaoss13:
ADW FCing Moto-home, repeatable crash

I can confirm that this is a repeatable bug across phones. I've had the same issue with moto-home FCing. Also crashed on the free ADW launcher. Just checked
[Motorola Droid 3] Pokelover980:
Yup. I used an ARM gcc toolchain and set -march to armv7, as well as some other options needed to get it to compile correctly. When running 'file zsh', it says that it's an ARM executable.

However, I think I know why it won't work. After running file on it, I see that it's dynamically linked and not statically like it should be, which is odd since I set it to link statically. That would explain the small file size in comparison to bash, which was statically linked. I'll compile again and see if I can get it to statically link.

EDIT: I got a working stripped version of bash! http://www.mediafire.com/?b71lcdpnqn07egj I tested it this time to make sure it works :P
[Motorola Droid 3] timesarchangel:
Possibility?

So, search is temporarily down, so I couldn't search for this, but I was wondering would using Unrevoked be a possibility to be used to root this device? If not now, but maybe down the road? I rooted my friends device remotely using Teamviewer. I tend to usually do remote tech support for friends.

unrevoked.com

Hope this helps or may provide some insight.

Thanks

John
[Motorola Droid 3] escalavee:
I have been following this thread for days... and you aren't alone. My heart skipped a beat as well!
[Motorola Droid 3] royolpunk:
You have to think that we've tried every pre-droid3 root method available. Gingerbreak, z4, superoneclick, etc. None of them worked :P

Jcase said that he could get us the sbf, but he doesn't want to. At least thhats what someone in the irc said, so don't quote me on that
[Motorola Droid 3] Matthileo:
I hope that isn't true... Or that it is... Whatever

[sent from my droid]
[Motorola Droid 3] royolpunk:
If it is, it still doesn't matter. TBH is looking as hard as they cannto try and find us this droid 3 sbf file :P
[Motorola Droid 3] Shoop_D_Woop:
Ok...so this JCase guy can get us the key ingredient (or our strongest lead) but won't? Why not?
[Motorola Droid 3] royolpunk:
don't know if it's true. Again don't quote me

One thing that was funny is that when the thunderbolt was being rooted, a htc rep was inside the irc chat. Lol
[Motorola Droid 3] suzook:
He might be working on root as we speak, and collect the bounty. Just a thought.
[Motorola Droid 3] calash:
I was looking over the rooting instructions for the Photon and, if I read everything correctly, it is related to this exploit:

http://seclists.org/fulldisclosure/2010/Oct/257

I did not see any mention of this on the thread so far. I played with the instructions a bit but the lack of GCC prevents the last part from working.

I am assuming it was patched or not applicable in our version of Android however I cannot find any notes that it was patched.
[Motorola Droid 3] gravenimage:
What are the connection details for the irc?
[Motorola Droid 3] rweb:
How did you create the hardlink? If you create it on another mountpoint, ln -s silently creates a softlink, which is not exploitable.

Maybe it is not fixed, but we cannot exploit as long as we cannot write a hardlink to a suid binary.

Another problem could be to find a proper suid binary. AFAICS, ping is not usable because it is not suid root.
[Motorola Droid 3] neilrl79:
Someone in this thread at motorola owners network just posted about recieving an update.

https://supportforums.motorola.com/message/446512
[Motorola Droid 3] calash:
I ended up using a softlink. I was more testing the overall function and getting a good idea of how everything worked than actually getting it working.

I did try it on a webtop_overlay that was marked as executable (no s bit, just x :( )but ran into the issue with GCC. I also do not get the expected output when I export LD_AUDIT (at least not the same errors as I get on my Ubuntu system) so i am not sure if this exploit is working....or if I am doing it right ;)

Edit:

I am going to ramble a bit...mostly because it is the best way I learn ;)

Assuming the exploit is still available am I correct in assuming that a world RWX version of webtop_overlay could be used to escalate your current shell to the system account? I am thinking the GCC code would have to be pre-compiled externally (I am seeing TOOLCHAIN mentioned alot, so I will have to look into that). We can hard-link to webtop_overlay and if it has full world access (I have seen thin on a few reboots) I can cat > in whatever binary we need.
[Motorola Droid 3] onethreeteeh:
/system/bin/pppd-ril

/system/bin/run-as

are both suid root
[Motorola Droid 3] tcrews:
An update was pushed out, though I don't believe to a retail phone ("this is an eval unit....."). However, the user got three updates....each one catching him up to the release level and the third taking him to a higher release...

If the update will have anything to help ROOT that would be great....but I'd like to hear of retail phones getting it
[Motorola Droid 3] calash:
Ah...ignore my rambling. I did not connect suid binary with the s bit in the permissions. That, as far as I understand, remove the ability to use webtop_overlay since getting that bit seems next to impossible, at least from what I have seen).

So, for this to even be feasible to work, we would need a suid binary on the same mount as a writable area that we can create hard links too.

See....im learning ;)
[Motorola Droid 3] rweb:
Yes, but not world executable, only by group shell/radio. But maybe there is a way to gain group shell/radio privileges.

However, this is still useless as long as we cannot write to /system partition.
[Motorola Droid 3] onethreeteeh:
if you push busybox to /data/tmp using adb, and then run ./busybox/sh you're shell, aren't you?

but, as you say, we cant hard link to anywhere except system...
[Motorola Droid 3] 640k:
Push as "catch up" updates for the eval phones. All of the retail units have more recent builds. System version on retail phones are higher.
[Motorola Droid 3] kep0ne:
Not true...my retail phone has lower versions for all 3; system, baseband, and kernel.
[Motorola Droid 3] 640k:
Your system version should be 5.5.959, which is higher than the test/eval units. There's no update being pushed to retail phones as of now.
[Motorola Droid 3] beard0:
The test phones got 5.6.850 I believe..or something like that (5.6.xxx)

/droid3
[Motorola Droid 3] tcrews:
Yes, as posted...this update pushed it beyond retail versions. The user stated they got 2 updates that brought it to "retail version" then another that went beyond. Check the post and check your versions, his are greater.

However it was an "eval phone" so this doesn't mean much to us retail phone owners.....but it does give validity to an update being prepped for the D3 soon.

Retail phone current...

Baseband - N_03.18.16P

System - 5.5.959.XT862

Kernel - 2.6.35.7-g42f0276w30471@il93lnxdroid42#1

Eval phone updated....

Baseband - N_03.18.29P

System - 5.6.890.XT862

Kernel - 2.6.35.7-g790a33cw30471@il93lnxdroid42#1
[Motorola Droid 3] 640k:
Ah, I had looked at the three digit identifier, instead of the point before. Had not realized it was 6 vs. 5.
[Motorola Droid 3] rweb:
I looked a little bit around, found this:

http://linuxkommando.com/2010/12/new-root-exploit-for-linux-kernel.html

http://seclists.org/fulldisclosure/2010/Dec/85

The exploit code will most likely not work on Android, the developer deliberately wrote it in a way so it only works on a few dedicated distributions. He said however it could be easily ("easy" from his point of view) ported to other platforms.

Droid 3 should be vulnarable to this. However I guess you have to be an experienced kernel hacker to write a suitable exploit for Android. This is definitely beyond my skills, so I'm sorry I cannot help any further. But maybe someone reading this has knowledge and time to give it a try ...
[Motorola Droid 3] slow88lx:
#krazyk

10chars
[Motorola Droid 3] isaacgaretmia:
I believe this exploit is usable so long as the line
[Motorola Droid 3] Pokelover980:
I can compile it. I have an ARM toolchain of GCC, and I successfully compiled BASH with it (link to download a few pages back. There's also a link to a broken zsh around there as well, don't use that, it won't work because GCC hates me and compiled it to be dynamically linked and not statically), so hopefully something like this would be trivial in comparison.
[Motorola Droid 3] rweb:
How do you intend to create a hardlink under /system?
[Motorola Droid 3] isaacgaretmia:
^^^

Is he wrong/mistaken?

Edit:

I remember him having trouble not being able to execute commands because of permissions. I believe he didn't know that running busybox in /tmp allows shell permissions...

I'm not an expert, so i can't be sure, but does that do it for us? haven't done enough research into actually performing the actions described, i only know the theory of how they work...

Edit #2:

what are the permissions on /system/bin/<insert root suid binary here>?
[Motorola Droid 3] calash:
That is the million dollar question. /tmp/, and actually all of /data/ is on it's own mount points so the hard linking will not work. As I understand it we need a suid binary somewhere in /data/, or other writeable mount, to even have a chance for this to work.

Does anybody have the directory structure for /data? I have stumbled on a few directories so far but would like to poke around more to see what is there. You can ls the high levels of that partition so you have to know what you want to open.

Busybox will load as shell:shell, the same user and group you get via ADB. It works but you don't get any more permissions. I dropped it in /data/local/tmp in case I need it. You need to give it execute permissions but it does run.

./busybox
[Motorola Droid 3] rhcp011235:
YOu may want to try changing the ASM to ARM asm. It may help.

*sigh* and if that works. LOL!
[Motorola Droid 3] Pokelover980:
I'm gonna go ahead and say that the exploit calash provided us probably won't work unless we can find something perfect to link with. Since hardlinks aren't allowed between different mount points apparently, I tried a few times with webtop_overlay with different permissions each time, just to see if we could at least get escalated to system permissions (if I'm even on the right track with that). Every time I get stuck on the line 'LD_AUDIT="\$ORIGIN" exec /proc/self/fd/3' as my farthest (sometimes I couldn't even get that far due to insufficient permissions on webtop_overlay), which won't work. I'll check out the exploit rweb posted and see if I can work with that, though probably not >_>
[Motorola Droid 3] idkwhothatis123:
Holy Jesus I want root. This is driving me nuts. Not being rude as I have no idea how to find a possible exploit, just frustrated with the way this thing is locked down.
[Motorola Droid 3] royolpunk:
Find us a official sbf that we can use and we will go from there :)
[Motorola Droid 3] idkwhothatis123:
I look every single day I'm at work and were on six day work weeks lol.
[Motorola Droid 3] royolpunk:
this post has been removed.
[Motorola Droid 3] mrcastillo:
Ok U got ur 65.00 now
[Motorola Droid 3] evulhotdog:
Hes got it all:

http://www.mrcellphoneunlocker.com/droid3.html
[Motorola Droid 3] scottml:
FYI, the non-HD Dock root for Photon 4G uses the same LD_AUDIT exploit, but they don't use a hard link to /system/bin.

Here's the Full Disclosure link for the 2nd root method (based on the 1st one):

http://seclists.org/fulldisclosure/2010/Oct/344

It centers around a lib file on the Photon 4G:

-rw-r--r-- 1 root root 5496 2010-10-12 03:32 /lib/libpcprofile.so

Unfortunately libpcprofile.so doesn't exist on the D3.

[ADDED:]

The same article goes on to say you can find libs with additional constructors by performing the following "find" command:

find /system/lib -maxdepth 1 -type f -exec objdump --headers --section=.ctors {} \;

When I tried it on my D3, the find command came back empty. However, there may be libraries on the D3 which access environment vars in their contructors which leaves them open to exploit.
[Motorola Droid 3] onethreeteeh:
The only time you can make a hard link rather than a symlink is if they're on the same partition. If you try making a hard link to a different partition, ie to /data/tmp, you'll get a cross device link error (or something along those lines, can't remember exactly).

When I tried to compile that bit of code last night using the arm-none-linux-gnueabi-gcc cross compiler from codesourcery, which has been used to compiler static binaries for android, I got a compile error. My knowledge of c is very limited, so maybe someone else could take a look.

Someone mentioned earlier that this exploit will only work with hard links, rather than soft links. While I don't know if this is true or not, the example given did use a hard link. If someone manages to compile that bit of code, we can still give it a shot