[Eee Pad Transformer Android Development] Z!L0G80:
hi,

when i run system_server in adb shell on new b70 unrooted tf it crashes

crashlog here>

09-26 18:32:29.100: INFO/DEBUG(2988): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
09-26 18:32:29.100: INFO/DEBUG(2988): Build fingerprint: 'asus/WW_epad/TF101:3.2/HTJ85B/WW_epad-8.6.5.9-20110816:user/release-keys'
09-26 18:32:29.100: INFO/DEBUG(2988): pid: 6845, tid: 6845 >>> system_server <<<
09-26 18:32:29.100: INFO/DEBUG(2988): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000000
09-26 18:32:29.100: INFO/DEBUG(2988): r0 00000000 r1 a7b01863 r2 00010004 r3 59d64681
09-26 18:32:29.100: INFO/DEBUG(2988): r4 a7b02250 r5 a7b01744 r6 a7b01863 r7 a81177a9
09-26 18:32:29.100: INFO/DEBUG(2988): r8 a7b01883 r9 00000000 10 00000000 fp 00000000
09-26 18:32:29.100: INFO/DEBUG(2988): ip a7b022bc sp bef2db50 lr ad335a1d pc ad335674 cpsr 60000030
09-26 18:32:29.100: INFO/DEBUG(2988): d0 447a00003f800000 d1 3f80000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d2 000000003f19999a d3 0000000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d4 0000000000000000 d5 41b42fdb75000000
09-26 18:32:29.100: INFO/DEBUG(2988): d6 3f19999ad2f1a9fc d7 3f80000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d8 0000000000000000 d9 0000000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d10 0000000000000000 d11 0000000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d12 0000000000000000 d13 0000000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): d14 0000000000000000 d15 0000000000000000
09-26 18:32:29.100: INFO/DEBUG(2988): scr 00000010
09-26 18:32:29.210: INFO/DEBUG(2988): #00 pc 00035674 /system/lib/libandroid_runtime.so (_ZN7android14AndroidRuntime9getJNIEnvEv)
09-26 18:32:29.210: INFO/DEBUG(2988): #01 pc 00035a18 /system/lib/libandroid_runtime.so (_ZN7android14AndroidRuntime10callStaticEPKcS2_)
09-26 18:32:29.210: INFO/DEBUG(2988): #02 pc 00001658 /system/lib/libsystem_server.so (system_init)
09-26 18:32:29.210: INFO/DEBUG(2988): #03 pc 0000861a /system/bin/system_server
09-26 18:32:29.210: INFO/DEBUG(2988): #04 pc 00014aa0 /system/lib/libc.so (__libc_init)
09-26 18:32:29.210: INFO/DEBUG(2988): libc base address: aff00000
09-26 18:32:29.210: INFO/DEBUG(2988): code around pc:
09-26 18:32:29.210: INFO/DEBUG(2988): ad335654 68cb6801 bd104798 0005a860 47702001
09-26 18:32:29.210: INFO/DEBUG(2988): ad335664 bf004770 4a08b507 6812447a 4a056810
09-26 18:32:29.210: INFO/DEBUG(2988): ad335674 698b6801 4798a901 2000b108 9801e000
09-26 18:32:29.210: INFO/DEBUG(2988): ad335684 bf00bd0e 00010004 000530cc 44784801
09-26 18:32:29.210: INFO/DEBUG(2988): ad335694 47706800 0005a81e 460cb570 e0062500
09-26 18:32:29.210: INFO/DEBUG(2988): code around lr:
09-26 18:32:29.210: INFO/DEBUG(2988): ad3359fc 0003a03b 0003a03f 0003a042 0003a04d
09-26 18:32:29.210: INFO/DEBUG(2988): ad335a0c 0003a073 41f3e92d 4690460e fe26f7ff
09-26 18:32:29.210: INFO/DEBUG(2988): ad335a1c b1604604 f7ff4631 4605ff09 4914b950
09-26 18:32:29.210: INFO/DEBUG(2988): ad335a2c 4a142006 44794633 f7ef447a f04fed9e
09-26 18:32:29.210: INFO/DEBUG(2988): ad335a3c e01a4000 46206822 46294b0f 71c4f8d2
09-26 18:32:29.210: INFO/DEBUG(2988): stack:
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db10 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db14 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db18 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db1c 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db20 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db24 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db28 00000004
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db2c 00000001
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db30 0000f8c8
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db34 0000a000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db38 0000f7f8
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db3c 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db40 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db44 aff13f17 /system/lib/libc.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db48 df002777
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db4c e3a070ad
09-26 18:32:29.210: INFO/DEBUG(2988): #00 bef2db50 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db54 a7b01863 /system/lib/libsystem_server.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db58 a7b01883 /system/lib/libsystem_server.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db5c ad335a1d /system/lib/libandroid_runtime.so
09-26 18:32:29.210: INFO/DEBUG(2988): #01 bef2db60 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db64 a7b01863 /system/lib/libsystem_server.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db68 a7b02250
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db6c a7b01744 /system/lib/libsystem_server.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db70 00000000
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db74 a81177a9 /system/lib/libbinder.so
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db78 0000f7f8
09-26 18:32:29.210: INFO/DEBUG(2988): bef2db7c a7b0165b /system/lib/libsystem_server.so
09-26 18:32:29.390: INFO/BootReceiver(710): Copying /data/tombstones/tombstone_05 to DropBox (SYSTEM_TOMBSTONE)

dissassembly

text:AD335668 _ZN7android14AndroidRuntime9getJNIEnvEv ; CODE XREF: android::AndroidRuntime::callMain(char const*,int,char const* const*)+1Cp
.text:AD335668 ; android::AndroidRuntime::callStatic(char const*,char const*)+8p ...
.text:AD335668
.text:AD335668 var_C = -0xC
.text:AD335668
.text:AD335668 PUSH {R0-R2,LR}
.text:AD33566A LDR R2, =(off_AD38873C - 0xAD335670) ; _ZN7android14AndroidRuntime7mJavaVME
.text:AD33566C ADD R2, PC
.text:AD33566E LDR R2, [R2]
.text:AD335670 LDR R0, [R2]
.text:AD335672 LDR R2, =0x10004
.text:AD335674 LDR R1, [R0] <- crashed here R0=0
.text:AD335676 LDR R3, [R1,#0x18]
.text:AD335678 ADD R1, SP, #0x10+var_C
.text:AD33567A BLX R3
.text:AD33567C CBZ R0, loc_AD335682
.text:AD33567E MOVS R0, #0
.text:AD335680 B locret_AD335684
.text:AD335682 ; ---------------------------------------------------------------------------
.text:AD335682
.text:AD335682 loc_AD335682 ; CODE XREF: android::AndroidRuntime::getJNIEnv(void)+14j
.text:AD335682 LDR R0, [SP,#0x10+var_C]
.text:AD335684
.text:AD335684 locret_AD335684 ; CODE XREF: android::AndroidRuntime::getJNIEnv(void)+18j
.text:AD335684 POP {R1-R3,PC}
.text:AD335684 ; End of function android::AndroidRuntime::getJNIEnv(void)
.text:AD335684
.text:AD335684 ; ---------------------------------------------------------------------------
.text:AD335686 ALIGN 4
.text:AD335688 dword_AD335688 DCD 0x10004 ; DATA XREF: android::AndroidRuntime::getJNIEnv(void)+Ar
.text:AD33568C off_AD33568C DCD off_AD38873C - 0xAD335670

when _ZN7android14AndroidRuntime7mJavaVME is uninitialized = 0 it crashes

Iam not exploit writer only little bit rewerse engineer if this could be exploited let me now iam owner of nonrootable new tf 101 with new SBK B70KAS25 :/

Enjoy