yashsingh1/xdaforums huggingface dataset:
[Motorola Droid 3] royolpunk:
): I wish moto would just be nice to us and release an sbf already
[Motorola Droid 3] Androidsims:
Verizon should already have it. Just need it to be leaked.
[Motorola Droid 3] royolpunk:
Do the reps have it as well? Cuz I know a few friends that work for vz that could you know....sneaky sneaky
[Motorola Droid 3] idkwhothatis123:
Nothing in store. Just checked.
[Motorola Droid 3] elkay:
Yeah, I have a friend I've known for 20 years that works at Verizon. Nada.
[Motorola Droid 3] royolpunk:
Darn. Guess well have to wait till tbh leaks it or something then :/
[Motorola Droid 3] oostah:
in the china thread they are talking about a back words root. some thing about the "PPP dial-up file"

http://www.diypda.com/viewthread.php?tid=298161&extra=page=1
[Motorola Droid 3] royolpunk:
If they achieve root it won't be long before we get it a well

EDIT!!!!!

http://xdaforums.com/showthread.php?t=1216131

PHOTON 4G just got root without the webtop dock. Could a similar method be used to root the Droid 3?
[Motorola Droid 3] idkwhothatis123:
Edit: never mind. Wrong root exploit lol
[Motorola Droid 3] royolpunk:
so this method wont work on the droid 3? to my understanding the photon runs on 2.3.3, and the d3 2.3.4...
[Motorola Droid 3] volcanomike:
pulse audio not present on droid 3
[Motorola Droid 3] royolpunk:
Darn..I realllllly need root as well...
[Motorola Droid 3] Pokelover980:
I don't believe that's the same exploit, I took a look and it doesn't appear to do anything with Pulse Audio like the HD Dock exploit, unless the library it deals with is one for Pulse.

Anyways, the same exact method wouldn't work for us (I think, I haven't tested, someone should just to make sure. I think the exact library it uses isn't present on our phone though), but I'm going to take a wild guess and say something similar could possibly work If someone did some work on it.
[Motorola Droid 3] royolpunk:
Someone close to edgan should ask him since hes the one who found it in the first place
[Motorola Droid 3] elkay:
I asked on that thread.
[Motorola Droid 3] royolpunk:
Nice hopefully he can help us out
[Motorola Droid 3] 3diord:
He's been in the irc channel for D3 stuff, but nothing solid has happened yet. There is something very random that might help us out a lot, if anyone here has a bunch of free time to try. The process goes like this...

1. Start camera, it creates a file /data/tmp/webtop_overlay owned by system, the permissions are seemingly completely random

2. Check permissions for suid or sgid (---S----wx or ---s----wx or ------s-wx) at minimum

3. Do not restart if you have those permissions! The file will be lost forever!

4. Come into the irc channel, or post here

You have to restart in between tries, permissions don't change until reboot.
[Motorola Droid 3] royolpunk:
Someone try that^^^^^I don't know what he's talking about
[Motorola Droid 3] eww245:
I got -r----S-wx but that wont help it's not readable so we need the last 3 bits to be rwx

[edit] So I can cat su into webtop_overlay as long as it's writable and all permissions will keep. But this wont get root even if the sticky bit is set for system. Hmmm interesting.

[edit2] tried with busybox but I get applet not found. But the premissions this time are --wxr-xrwx so it wont run as system anyway. I'll keep tring to see what I come up with.
[Motorola Droid 3] royolpunk:
Still, good that were making overall progress! Can't wait to get this baby rooted
[Motorola Droid 3] 3diord:
Don't actually NEED it to be readable, only writable and executable. capital S in the group won't work for it, and busybox doesn't work with suid or sgid anyway. Capital S will however work for user.
[Motorola Droid 3] eww245:
I was hoping for system access with busybox then put a copy maybe on preinstall to at least retain the access, don't know what else to do with it. If I get 'S' i'll tar it up.
[Motorola Droid 3] mrcastillo:
i got

permisions:rw-rwSrwt

is that what u need?
[Motorola Droid 3] idkwhothatis123:
Goddamn we are close aren't we?
[Motorola Droid 3] 3diord:
Almost. It goes

- usr grp oth

S or s in user will work, but only s in group will work. If you had a lowercase s there, it'd be great.
[Motorola Droid 3] royolpunk:
Lol I hav no idea what's going on but this sounds good. Photon just got a pic of an unlocked bootloader....we need to get one soon!
[Motorola Droid 3] pplude:
join the room #krazyk on IRC Freenode
[Motorola Droid 3] royolpunk:
Are we close?
[Motorola Droid 3] pplude:
As we said before, there's no progress bar for what we're doing. Though, *IF* the path that we are trying works, then yes, we are very close. Please try this yourself and see of you can get these permissions.
[Motorola Droid 3] daimerion:
Im new to this but I have programming exp. How do I see what permissions I have? Id love to help!
[Motorola Droid 3] 3diord:
ls -l /tmp/webtop_overlay
[Motorola Droid 3] daimerion:
Is this using a program on computer or through the phone? I've got 2 weeks with nothing to do, no job or responsibilities. As stated before pc programming exp and knowledge. Tell me what I need and I will devote all my time to root!
[Motorola Droid 3] 3diord:
You can use terminal emulator on the phone to check permissions
[Motorola Droid 3] BryanNL:
Tell me the commands pls.
[Motorola Droid 3] volcanomike:
Bleh
[Motorola Droid 3] 3diord:
ls -l /data/tmp/webtop_overlay
[Motorola Droid 3] BryanNL:
Thanks, i'm gonna try.
[Motorola Droid 3] daimerion:
When I try to use ls-l I get permission denied but jus ls works

Edit: nevermind typing error
[Motorola Droid 3] smoshism:
I got:

--w---xrw- system system 14 2011-08-13 22:22 webtop_overlay

Sent from my DROID3
[Motorola Droid 3] daimerion:
I got

-rw--wSrwT system system
[Motorola Droid 3] mrcastillo:
u have to have ---s------ the "s" can be upper or lower case n it has to be in the 4th place

Or ---------t this needs to be at the end (the "--------"can be letters instead, what matters it the "s" in the 4th place or the "t" at the end)

either one of this report here or on IRC freenode #KrazyK

u must restart ur phone every time u do this once U get the right results do not restart or U will lose the file
[Motorola Droid 3] smoshism:
Thanks for clarifying what we were looking for ^_^

Sent from my DROID3
[Motorola Droid 3] daimerion:
It was said to report either s in 4th pos or t in last well I have:

-rwx---rwt
[Motorola Droid 3] gravenimage:
So... i have a rooted Tablet now, was wondering if i could set my phone to storage mode, connect it to my tablet, and use its root to get anywhere productive?
[Motorola Droid 3] snareplayer1993:
i have -r---w---t system system 14 2011-08-14 03:52 webtop_overlay
[Motorola Droid 3] jweber228:
I'm getting...

-r----S-wt

Is that close to what your looking for?
[Motorola Droid 3] daimerion:
Looking for lower case s in 4th or 7th pos last I was told
[Motorola Droid 3] 3diord:
Upper case S in 4th would work as well :)
[Motorola Droid 3] daimerion:
Yes, sorry forgot
[Motorola Droid 3] rweb:
Could please someone explain what is hoped to achieve? I'm sorry but I doubt webtop_overlay will help us.

I tried something:

Rebooted, cd to /tmp, created webtop_overlay (mode 666). Then started camera -> my webtop_overlay was overwritten.

Then tried the same with mode 644, and now nothing was overwritten anymore. This let me doubt there is something going on with root privileges.
[Motorola Droid 3] onethreeteeh:
the 2 s's are the setuid and setgid bits. if a file has one of those set, then when it's executed it is run with the permissions of the owner or group.

as the file is both owned by system, and has the group of system, it will run with a higher level of privileges than either a file owned by shell or an app

edit: also, the capital S means it isnt executable, which is why the capital S in the 7th position (group) wont help. could someone explain why it would help if it's capital S in the 4th position (owner)?
[Motorola Droid 3] rweb:
But the nonesense in webtop_overlay can't be executed. And if it is overwritten by something else, the bits will be removed.

I hope I just didn't get it ...
[Motorola Droid 3] eww245:
As long as its writable for others it can be written to and retain the same permissions.
[Motorola Droid 3] rweb:
Do I really miss something? Linux removes s-bits if a file is altered. Droid 3 does this security precaution as well, I just tried it out with 2 different terminal emulators (to have different user IDs).
[Motorola Droid 3] smoshism:
I just got an upper case T in the last position.. is this something that we're still looking for? : /

Sent from my DROID3
[Motorola Droid 3] royolpunk:
No we need a lower case ): I have absolutely no experience but if someone gave me step by step I could give it a try
[Motorola Droid 3] eliguy620:
I got -r-x-wSr-x system system
[Motorola Droid 3] erismaster:
Download terminal emulator from the market.

Reboot phone

Open camera

Back out, then open terminal emulator

Type in "ls -l /tmp/" press enter

The first line should be the webtop_overlay. We need a lower case s in the 7th position or a upper case or lower case in the 4th.

If you get that hop on the freenode channel #krazyk

You need to reboot after every try.

I think I got all that correct haha. If you need more help pm me
[Motorola Droid 3] royolpunk:
How do I join the freenode xD
[Motorola Droid 3] erismaster:
http://webchat.freenode.net/
[Motorola Droid 3] Adam.h.ogle:
Okay, there's a lot of mis-information here, so let's start at the beginning:

The whole idea behind /tmp/webtop_overlap is that it exists on a tmpfs partition that does not have noexec or nosuid set in the mount properties, which means we can execute a program as another user with on it. The /tmp/webtop_overlap file gets created by /system/lib/libmirror.so whenever the camera is initialized. The file initially belongs to system:system, but when the file is created using creat(), the permissions assigned to the file are fetched from an uninitialized variable--meaning they are almost random. From what I can tell, the variable is local (not a dangling pointer), because no matter how many times you delete the file, it will always come back with the same permissions. Only a reboot changes the permissions.

This is correct, I believe.

I'm not sure about this.

Correct.

We found this out a few days ago. We need g+xs in order for setgid to take effect. My guess is that getuid needs u+xs, also, which means the permissions need to be one of the following, where ? doesn't matter:

-??s????wx
-??s????wt
-?????s?wx
-?????s?wt
-??s??s?wx
-??s??s?wt
-??s?wx???
-??s?ws???

This list may not be exhaustive

This is wrong. The sticky bit (o+t) is worthless.
[Motorola Droid 3] royolpunk:
I think we might achieve something today. P3droid has said to watch the tbh app, and he says its not going to be dcharge related.

Just now, he's talking about his d3 and how it will turn intonsomethin in 15 minutes, not sure. Everyone should check out his twitter
[Motorola Droid 3] Adam.h.ogle:
For those of you on Windows, here is a batch script that will automatically reboot the phone, start the camera, print out the permissions of the file, and prompt you to do it again. Please do not clutter this thread with questions about this code.

:starts

adb reboot
adb wait-for-device
adb wait-for-device

adb shell "mkdir /data/tmp/tmp2"
adb shell "chmod 7777 /data/tmp/tmp2"
adb shell "cp /preinstall/su /data/tmp/tmp2/myfile"
adb shell "ln -s /data/tmp/tmp2/myfile /data/tmp/webtop_overlay"
adb shell "rm /data/tmp/tmp2/myfile"
adb shell "am start -a android.media.action.IMAGE_CAPTURE"

pause Unlock your phone now

adb shell "sleep 5"

adb shell "ls -l /data/tmp/tmp2"
adb shell "ls -l /data/tmp/tmp2" >> "adb runs.txt"

echo "Again? [y/n] "
set /p doitagain=
if /i "%doitagain%" neq "n" goto :starts
[Motorola Droid 3] royolpunk:
looks like p3droid couldn't make it

http://twitter.com/#!/p3droid

EDIT!:

me and a few others on the IRC chat have found a 2.3.4 sbf on china forums. as of this time, its downloading incredibly slow, and it looks like my interne speed is the fastest. as soon as the SBF is done downloading, i'll upload it to mediafire. hopefully this leads us somewhere.
[Motorola Droid 3] tombarr:
Any use for a Chinese SPF of 2.3.4?

http://download.diypda.com/diypda-d....5.1-1_GC-35-test-keys-ChinaTelecom-CN.sbf.gz
[Motorola Droid 3] elkay:
Downloading before it gets ganked. About 1 hour remaining for me, limited by the sender.
[Motorola Droid 3] GoogleAndroid:
Another mysterious SBF from a chinese forum? Let's hope it's legit like the DX2's. Is it the same forum?

EDIT: The Photon bootloader is unlocked with an unlocked SBF. Wonder if this is unlocked?
[Motorola Droid 3] royolpunk:
we're downloading right now. we'll know in about an hour.
[Motorola Droid 3] saintlikesniper:
I'm downloading as well to retain the information
[Motorola Droid 3] aross6:
x2... not gonna lie, getting a little excited about the possibility now!
[Motorola Droid 3] saintlikesniper:
Signed with test keys or something not retail what does that mean
[Motorola Droid 3] dpwhitty11:
I started downloading about 30 minutes ago as well. Hopefully we found something useful here.
[Motorola Droid 3] Willis111:
Judging by the other thread it means if you try to flash it you will end up with a $600 paperweight. Perhaps it's a dev key or even just some asian user signing it with "test" keys that he's making up?
[Motorola Droid 3] oostah:
i have been trying to get at this for days. thanks for putting this on the other thread. there D3 started out as 2.3.3 then they got an upgrade to 2.3.4 i have been hunting for that as well.

heres what there's is under for the 2.3.4 update

It is licensed Chinese telecommunications. . . Version is not the same, unreasonable brush it - -

there are official ROOT SBF words are not like the straight brush. . .

if we got that update could we get there license to achieve root?
[Motorola Droid 3] royolpunk:
Read what cellzealot said on the main post. The reason I created a seperate one was because I didn't want things to get cluttered
[Motorola Droid 3] kahless1984:
so are we going after this SBF file or is there still promise in the camera apps file with random permissions?
[Motorola Droid 3] elkay:
As of right now, I don't think either have much chance of getting us root. We can't flash or resign the SBF and the permissions we want don't seem to be happening on the attempted camera exploit.
[Motorola Droid 3] pplude:
Apparently a few people have different projects. I'm working on the camera, some are working with the SBF, some are looking for dev builds on the motorola servers.
[Motorola Droid 3] royolpunk:
I was on the irc for a few hours today. It was a good run, because we found that chinese sbf even though it didnt help. Still, were making progress
[Motorola Droid 3] elkay:
Right. It's progress in the sense that we've tried more things. I'll reiterate what others have said. It's zero progress on root until it just happens, then it's 100%. It's not like a progress bar.. 10%.. 20%.. 30%.. it just doesn't happen that way. It's pretty much all or nothing.
[Motorola Droid 3] royolpunk:
Tomorrow I will try to push forward and get more devs on this. Were really making the push now because we want to get this rooted before the bionic comes out
[Motorola Droid 3] elkay:
The Atrix root didn't apply to us. Unless it's a universal 2.3.4 root, Bionic owners will be at square one just as we are now. I'm very much looking forward to the Bionic release, though, because that will add more people to the unrooted pile, and have more people looking into a new universal root method.
[Motorola Droid 3] Framework43:
I would love to help out on this, but I don't have the funds too :|

Hope you guys get root soon!
[Motorola Droid 3] royolpunk:
I see. Well, I'm asking lots and lots of friends to help out, even the slightest bit can help. Right now we literally just need the full sbf, and even that doesn't guarantee root
[Motorola Droid 3] rweb:
I don't want to sound knowing-all-better, but from my understanding, it is impossible you'll see the wanted permissions. It is a Linux security precaution to remove all s-bits if a file is altered. So maybe webtop_overlay is created with an s-bit, but shortly after something is written into this file and the s-bit is removed. This is why you never saw the "right" permissions (despite created randomly) and this is why the attempted exploit wouldn't have worked anyway.

I hate to say this because I'm eager for root as all of you.
[Motorola Droid 3] edgan:
There is an exception to the rule. If root changes it, it doesn't lose setuid. On the other hand, even if a user owns the file, and only the owner can do anything with it, if the file has setuid it loses it when the file is altered by any user other than root. Change of ownership always takes it away.
[Motorola Droid 3] Androidsims:
Google just announced they will be aquiring Motorola. Unlocked bootloaders on the horizon? Is there anything Google can't aquire, lol. http://goo.gl/i3TKd

EDIT: I'm willing to bet the Ice Cream Sandwich update will be stock with an unlocked bootloader.
[Motorola Droid 3] calash:
Just to start, I am very new at Android hacking but I do have some experience with Linux (Ubuntu) so I am trying to apply what i can to this.

Has anybody played around with the \data\dontpanic directory? On bootup both log files in that area are having their permissions and ownership reset (root:log) but the contents are not being altered. In playing around I got the su binary owned by root:log, however I can not get the s bit to stick so it is fairly useless.

There is a script in /system/bin that is pulling info from this directory. Not sure if it is at boot or during a crash. (bugtogo.sh). I am still browsing it to try and see what it is doing and if it is sanitizing all the variables before running.

Edit: Tried every trick I know and the best I can get is a non-executable SU owned by root:log. Unless somebody else has any ideas this may end up being a dead end.
[Motorola Droid 3] cdorwart:
You gotta think this was the plan the whole time. Brilliant move for Google.
[Motorola Droid 3] Matthileo:
I had to look online and make sure the whole Google/Moto thing wasn't some kind of sick joke.

Sadly I doubt it means much for us Droid 3 owners. I hope it does, but I have a feeling that's just a fool's hope.

[sent from my droid]
[Motorola Droid 3] elkay:
They purchased Motorola's mobile sector specifically to get all of their patents. It's to counter the Apple/Microsoft purchase of all of the Nortel patents simply to block Google from getting them. They've also stated that Motorola will continue to run as its own entity, further backing this up, and making it very unlikely that we'll see any of our devices unlocked or altered in any drastic way due to the acquisition.
[Motorola Droid 3] :
It's not going to mean much to D3 owners in the short-term, but we'll probably see some nice benefits looking into the future. However, the deal isn't expected to close until late 2011 / early 2012, and it must be approved by regulators.

So, while this is ultimately good news for the D3 community, let's keep pressing forward with our search for root.
[Motorola Droid 3] evulhotdog:
Hahaha same here! Im like are you serious!?
[Motorola Droid 3] psouza4:
I don't mean to jump into a debate about this, and certainly let's not let this thread derail much further -- but actually Apple and Microsoft asked Google to partner with them to buy up those patents and Google turned them down. They didn't buy them to block Google from getting them, I'm afraid. :)
[Motorola Droid 3] Darksurf:
I'm not so sure. Evidently google claims that apple and microsoft had it written up where google would get the short end of the stick and google realized after reading the offer that they were being played.

And microsoft is known for foul play.
[Motorola Droid 3] 640k:
This. Google knows wthat its doing. Its going to be an interesting ride, for sure.
[Motorola Droid 3] elkay:
Yeah, this isn't the thread for that argument, but there is more to the story. Let's carry on with rooting since it won't affect us anytime this year anyway.
[Motorola Droid 3] royolpunk:
Yeah. I agree with elkay. I'm out right now, but when I get home I'm going to be on the irc for an hour, and then a few hours at night
[Motorola Droid 3] calash:
Another random observation:

There is a world read/write/execute file in /pds/camera/module1/cameracal.bin.

In testing I can swap out the contents via a cat > command but I can not chmod it. Not sure what this file does....google was not very helpful. Guess I could open up a hex editor and see if I can tell what it is.
[Motorola Droid 3] edgan:
I already noticed it. It is Camera calibration data.
[Motorola Droid 3] Bobbar:
Reading over the Droid 3s camera calibration data made me feel a little blue. ;)
[Motorola Droid 3] elkay:
Ahahahaha. Nice.
[Motorola Droid 3] royolpunk:
So did anything new happen today? I havent been on the irc
[Motorola Droid 3] psouza4:
Nope -- nothing new.
[Motorola Droid 3] Darksurf:
I just thought of something that could be of relevance! The city ID program that is supposed to be like caller ID. It is a system app isn't it? Well its also a free trial and when the trial ends it allows you to uninstall it and requires a reboot! There has to be some root privileges somewhere here.
[Motorola Droid 3] royolpunk:
<psouza4_> Probably not. You don't require root to use any part of it and it's the OS that actually uninstalls... but you can mention it to a dev and see what they say.
[Motorola Droid 3] Darksurf:
I do understand where are you are coming from, but if the OS can remove files could is possibly add files?
[Motorola Droid 3] elkay:
City ID is installed to /data/app, not /system/app. That's why it can be uninstalled. The same goes for Let's Golf 2 and N.O.V.A.
[Motorola Droid 3] nerdslogic:
Curious if that photon unlock will help us
[Motorola Droid 3] somemadcaaant:
@elkay

cityid.apk resides in the systems/app folder on my droid 3, which I can't uninstall.

-smc
[Motorola Droid 3] pplude:
even with chmodding 7777, I'm getting permission denied

-------------------------------------------

FALSE, AND A BREAKTHROUGH!

Ok, here's the thing.

1) Unpack the files from Photon Torpedo to the desktop

2) Use ADB to push to /data/tmp

3) Load up adb and shell

4) "chmod 7777 /data/tmp/*"

5) "sh /data/tmp/su"

/data/tmp/su: 1: Syntax error: word unexpected (expecting ")")

What from here?
[Motorola Droid 3] elkay:
Hmm.. I didn't look because it allowed uninstall like the 2 games so assumed it was in the same place. That might be looking into then, because the app can definitely uninstall itself.
[Motorola Droid 3] royolpunk:
GUYS WE GOT ROOT!!!!!!!!!

not.
[Motorola Droid 3] pplude:
hmm, I'm still thinking there may be a preboot.img file there. any way to run file sizes now that we know specific locations, and compare that to the size of the folder?
[Motorola Droid 3] gravenimage:
I dunno if its just my phone... but there's A LOT of gibberish in that post
[Motorola Droid 3] Adam.h.ogle:
Same in the web browser. I'm not fluent in ELF, though, so I may be missing something amazing.

In other news, I'm writing a brute force script to pull every possible file from that preinstall folder. I don't expect to find anything, but brute force is simple and fun :D