yashsingh1/xdaforums huggingface dataset:
[AT&T, Rogers HTC One X, Telstra One XL] dalewest:
Possible exploit?

For those smarter than me... does the info in this post in the Wildfire S General forum potentially apply to us?

*fingers crossed*
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Since its a used phone, and the trader said it had never been rooted doesnt mean it had never been rooted:) its atleast worth a try to boot into your bootloader and check you cid with fastboot. I think the command is

Fastboot oem readcid

If it says 11111111 your in luck. Like i said its atleast worth a try
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Ok, in 1hr I will officially be a re: re: re: one x owner.....on 2.2x....locked.....YES!!!
[AT&T, Rogers HTC One X, Telstra One XL] robstunner:
23hrs for me :)
[AT&T, Rogers HTC One X, Telstra One XL] pengueen:
Congratulations on your locked device!! lol

I know it's been said before, but I really don't have much beef with the stock ROM. I just wish I could get rid of all the ATT bloat and change some little config stuff like hosts. I just keep trying to remind myself that being stuck in a locked OS could be much worse.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The backup doesn't matter. The exploit is in the process. However backup/restore operations on OUR phone can't seem to handle dealing with system or root owned files....rendering this exploit useless for us. I think its a dead end.....
[AT&T, Rogers HTC One X, Telstra One XL] skanman911:
Per my investigation..

I think this can be very helpful..

Upon looking and looking, I found that the /acct/uid/10221 folder is writable

and in that folder the cgroup.event_control file is not readable.. but is writable

My thoughts are this is a library that gets called.. not sure what calls it but it seems to run at the system level..

I was thinking it could be possible to get the file from an already rooted device, or a 4.04 sdk

and should it be written in Java, leave the current instructions intact, but add ones that import su,

verify and then restore the original file so the phone doesn't try and root itself every 5ms or something.

I'm pretty new to android programming and only have trolling experience, xda saved my SE X10a from being worthless..

But through those adventures with that phone got a good handle on ADB, the SQLite, and config files such as build.prop

To save time, I'm looking for:

1) A readable "cgroup.event_control" file from a 4.04 HTC install so I can rewrite and attempt this..

2) Information regarding the ability to call a java library from an app that's located on the SDCARD.

3) Victims who will try this.. my thoughts out there that some of you have unlocked bootloaders and can

just re flash your phone should things go ape ^%@*.

If any other developers want to use this information.. please do and god speed!
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
From what I'm looking at, the restore process *normally* creates a file99 in /data/data/com.android.settings/a which is sym-linked to a modified local.prop. The problem is this file99 is never created on our phone, nor is the folder 'a', so the sym-link always fails. I'm not sure if it's an issue with our phone, or something that can be changed in the fakebackup.ab to work in our favor.

I'm not too hopeful either, but this is the best lead we have at this point, so I'll keep chugging away.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
The file is never created because the phone won't tolerate backing up or restoring system or root owned files. Try for yourself with some other packages....it doesn't work.
[AT&T, Rogers HTC One X, Telstra One XL] :
Where would it import the SU binary at? Would it have to be a writable location? Or does the file do some sort of permitted writing that can be used to push/create/whatever the SU binary.

As for the call in Java, I am assuming you want to call a function from a library or a program? If it's from a library, I think you could just include it in the "include" directive. or I believe "imports" in Java

Edit: You wouldn't need to call a library from an app if its using a function that is included in Java, like the C standard library, for example. Unless they created their own library in Java, for that specific app. I'm not sure I understand what you are asking in that regard.
[AT&T, Rogers HTC One X, Telstra One XL] skanman911:
Well I think that cgroup.event_control file is part of a system process which has permissions, not sure what it does cause its not readable, only writable, so I could replace it blindly.. I'm thinking it could be modified to move the SU binary into place..

I'm gonna download an uncompiled 4.04 and see if that file is there, and what exactly it does, for now all I know is it's writable and something else calls it to run at the system level, which should have permission to change permissions..

Basically what it comes down to is that it's an unprotected system file.. and its directory is wide open for creating sub directories and new files..

I have no idea what it does, but I know that's the kind of vulnerability that let's people get root.

Edit:

According to http://zimowisko.linux.gda.pl/2011/papers/cgroups.pdf

It handles change events to disk, memory, and cpu information.. and behaviors there of..

so it definitely has permissions to modify the system, just need to make a new one to move the SU binaries, as well as

do the job the original one does.

Make a script to push it in, let it run, then push the original back so the phone doesn't add the binaries every boot.

If that were to work, than you could root almost anything lin based.. as they all use cgroups

Looks like quite a dangerous file to tool with..
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
You should google what cgroup is. /acct isn't exactly a real file system.....
[AT&T, Rogers HTC One X, Telstra One XL] :
Do you see any hope for this method?

User level code may create and destroy cgroups by name in an
instance of the cgroup virtual file system, specify and query to
which cgroup a task is assigned, and list the task pids assigned to
a cgroup. Those creations and assignments only affect the hierarchy
associated with that instance of the cgroup file system.

On their own, the only use for cgroups is for simple job
tracking. The intention is that other subsystems hook into the generic
cgroup support to provide new attributes for cgroups, such as
accounting/limiting the resources which processes in a cgroup can
access. For example, cpusets (see Documentation/cgroups/cpusets.txt) allows
you to associate a set of CPUs and a set of memory nodes with the
tasks in each cgroup.

http://www.kernel.org/doc/Documentation/cgroups/cgroups.txt
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
I don't really. But honestly I can't say I fully understand it either...
[AT&T, Rogers HTC One X, Telstra One XL] :
I have no clue what the file does that he is talking about. but what I think he wants to do is:

Rewrite it to include a function to push/create/whatever SU *somewhere* and chmod to 755 or whatever needs to be done with it.

Now, does that file have write permissions? Does the file have permission to chmod, assuming that's what needs to happen?

I am assuming since the directory is writable, a stock user could adb push the modified file there, unless it is signed.. Then I don't see how this would work

Correct me on any of this. I haven't dug this deep into android before.
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Why doesn't someone who's rooted post the file here so anyone who is interested can mess around with it?
[AT&T, Rogers HTC One X, Telstra One XL] :
And I can get that by flashing the 2.20 ROM?

This is what I'll be using. http://www.scottsroms.com/downloads.php?do=file&id=194

Hope it works..
[AT&T, Rogers HTC One X, Telstra One XL] GuyIncognito721:
Just adb pull /acct/uid/cgroup.event_control c:/whatever
[AT&T, Rogers HTC One X, Telstra One XL] :
Root explorer won't let me change permissions. Im thinking we need execute permissions to pull it. I am on MIUI 2.9.7 (JB).. So if you want I'll flash 4.0.4 (ICS)

Tried again but on Stock ICS
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Beaups..........

Have u held true to sleeping on the couch you had mentioned before?

There may be new members, unaware. But I will not forget:D

Oh my hox seller was m.I.a. so I'm still without:(
[AT&T, Rogers HTC One X, Telstra One XL] :
I think a few of us are going to be taking his place on the couch for a while.
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
LOL that was your commitment, not mine :)

I'd been working on root still, but had to lend the phone to my son for a couple weeks (long story)....I'll get back working on it in a few weeks.

---------- Post added at 08:04 PM ---------- Previous post was at 07:53 PM ----------

You got an error pulling it because your slashes are all wrong....
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Im not worried if ur working on it:) phones come in just under last on priorities. I was just curious about the couch:beer:
[AT&T, Rogers HTC One X, Telstra One XL] :
Then why does

adb pull /sdcard/com.speedsoftware.rootexplorer.apk "C:\%userprofile%\Desktop" work?

I'm not trying to argue or fight. I am asking because I want to help.

edit:

here's an interesting one, beaups. I pulled /acct/uid

It's only failing to pull /acct/uid/cgroup.event_control
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Because that command is right :)

Too hard to read on the phone but your pull command had a wrong direction slash near the end.
[AT&T, Rogers HTC One X, Telstra One XL] :
Even if I got it to pull, it would read 0KB just like every other file. :(
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Because I dont think we are dealing with actual files....
[AT&T, Rogers HTC One X, Telstra One XL] :
Hmm, then what do you think they are?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Imaginary files?

...

iFiles? Lol

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] ECEXCURSION:
I remember this one time... In math class... We were dealing with imaginary numbers... Blew. My. Mind.
[AT&T, Rogers HTC One X, Telstra One XL] Megadave123:
/acct/uid # mount | grep acct

none on /acct type cgroup (rw,relatime,cpuacct)

Its like the /proc filesystem on a linux machine.

or devfs

Its a "virtual" filesystem.. you can't actually store any files there, it doesn't correspond to any actual sdcard/flash storage.
[AT&T, Rogers HTC One X, Telstra One XL] gunnyman:
3 it's a magic number.
[AT&T, Rogers HTC One X, Telstra One XL] Drak_Thing:
I bought the HOX because I enjoyed the phone at the store alot, but should of looked more into it onto it's rooting abilities. Does rooting 2.20 seem near impossible? I'm thinking of returning it now :crying:
[AT&T, Rogers HTC One X, Telstra One XL] :
If you got the phone solely to root, and can't wait for root, then just return it.

This isn't the phone for you.
[AT&T, Rogers HTC One X, Telstra One XL] noonanjs:
I am no dev, but I have been following this thread closely and I would say we are more likely to get jelly bean before we get root

---------- Post added at 01:33 PM ---------- Previous post was at 01:31 PM ----------

Which leads me to a question will a jelly bean release do anything in terms of providing different exploits to potentially gain root?
[AT&T, Rogers HTC One X, Telstra One XL] :
And comments like that don't help either..

A lot of people here are helping any way we can, or trying to crack it.

edit: I don't think there are confirmed exploits for jellybean right now.

But there is always a chance for a security hole later down the road
[AT&T, Rogers HTC One X, Telstra One XL] noonanjs:
Sorry if I offended anyone, I am aware of all of the hard work that has and is going into rooting 2.2, just trying to give an honest answer to a new comer to the thread
[AT&T, Rogers HTC One X, Telstra One XL] iceman99393:
The kindle fire hd received root and it is also running ics and was supposely very secure, could that help in anyway?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
No, they are very different.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Any exploit is always worth looking at. Not the scripts used for a certain device but always the actual exploit that was found
[AT&T, Rogers HTC One X, Telstra One XL] skanman911:
Shedding a little light..

I started this mess, and I apologize for that

alllllll righty... 1st off, the cgroup.event_control is seeming to be a unicorn (mythical creature) is because they are created

by the system for apps.. 10xxx sub directories are created by the system for the apps while they are running and the files

in them temporarily hold memory cpu and disk namespace.. none of us will have the same architecture because we all have

different apps, providers, branding so as the machine gets customized it changes a lot.. SO!! my crappy task at hand..

tonight.. I will

1) make a list of all my apps

2) restore my phone to factory settings (data wipe)

3) cry profusely

4) install each app until i find the one that created the odd properties of my 10221 directory

5) use my emulator to make a virtual 4.04 device

6) install the app on the emulator

7) image and extract the files in the emulator

8) take the data it created

9) unpack the app and borrow its signature

10) use it to break down the extracted data and compile a new shiny cgroup.event_control

11) push it into my r/w folder my app created over the old one {should be able to, i was able to create directories in it and push text files to it to test}

12) install process tracking apps on the phone so i can watch what the app does

13) see if my phone takes a &^%! when i restart it

14) post results here

If anyone has any reason or previous experience with tips or tricks on tonight's endeavor.. I will read them

before I attempt this.. I really don't want to reset my phone, but I martyr-ish when it comes to the greater good.

I can always march right into AT&T and run this:

echo "I DONT KNOW WHAT HAPPEND?!?! IT JUST CRASHED!! I JUST BOUGHT IT 8 DAYS AGO!!";

if $ATT_REP = "FAIL"{

echo "BUT.. BUT.. I DONT KNOW WHAT HAPPEND?!?! IT JUST CRASHED!! I JUST BOUGHT IT!!";

}

else {

echo "YAY!! I got a new phone to break again!!";

end

}

I hope that get's a smile from some of you guys.. and yes I know what I wrote is totally incomplete and messed up!:cowboy:
[AT&T, Rogers HTC One X, Telstra One XL] :
I have to 10221 directory on stock (root) 4.04. only thing I had installed was root explorer

Also mentioned early, these are all a virtual filesystem, and can't be directly accessed, hence why the read 0KB on a pull.

If you can find a way to access/read them in memory, or wherever they are located.. This could help

AND as long as you don't flash the new hboot, you won't have to cry as profusely :)
[AT&T, Rogers HTC One X, Telstra One XL] skanman911:
I wonder why others dont have that dir if you have it on a stock system

so maybe a good idea would be to follow through with the emulator.. make a memory dump?

and sift through that..

I wonder how that works.. does that work like a ram drive or something where it creates files and dirs but they sit in memory
[AT&T, Rogers HTC One X, Telstra One XL] HaKKeD:
Simply fu$king awesome, in a really bad mood after getting a replacement HOX with 2.20 firmware and reading this made me smile ...thanks :)
[AT&T, Rogers HTC One X, Telstra One XL] nhshah7:
Jack Johnson!
[AT&T, Rogers HTC One X, Telstra One XL] grayfoxmg1:
1 it's the loneliest number.
[AT&T, Rogers HTC One X, Telstra One XL] vodka7:
Is there not a way to ghost images from one users internal storage to a new phone? Has anyone tried this?? IT nerds chime in, I know linux partitions are different buy cant remember all the ins and outs, its been a while.
[AT&T, Rogers HTC One X, Telstra One XL] Nocturnal_50:
suggesting one could mount the entire device as a disk drive and that the commands were available to do so it wou...... no
[AT&T, Rogers HTC One X, Telstra One XL] rivlocs83:
Man this is a bummer to hear. I finally got rid of my Htc Evo4g which I loved and had for the last two years not to mention its were I learned to root and pretty much tweek every thing imaginable on.

I went to great extends to get the HOX ( if you consider switching service provider) only to find out that root is not possibl. Its a real disappointment considering I've gone through about 26 different roms on the Evo :( Should I be optimistic? Any thoughts if it's possible in the near future for root access?
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Is this the right thread for evita one X? How do I know if this phone is rooted or not?
[AT&T, Rogers HTC One X, Telstra One XL] :
Ill let you know yesterday

edit: I thought you were joking, i hope you were joking
[AT&T, Rogers HTC One X, Telstra One XL] borets.boris:
I think this is the international one x, because it asks you what language you speak the first time you turn it on.

As far as knowing if your phone is rooted, I think you need to check here:

http://xdaforums.com/showthread.php?p=28860274
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Cough cough.... psssst he was being sarcastic...
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
Cough cough he was playing along ;)

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] bvrr0:
I can't believe I pressed that update button from 1.85! I should have checked to see if it affected root.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Ok, so I got a hoax last night and its locked down on 2.2x. I was able to get it into qshusb mode a couple times but wasn't seeing the emmc window in tinycore like I was hoping for. Not saying it wasn't there but may have been patched. I'll talk to beaups after I get some sleep.......feels good to have a hox back in my hand tho:D
[AT&T, Rogers HTC One X, Telstra One XL] Root-Maniac:
Happy to see you back bro!!! Guys get ready to see some accomplishments :)
[AT&T, Rogers HTC One X, Telstra One XL] Luisit0:
we share the evo 4g past bro, hurt me like a knife wound on the neck to sell it... but i was lucky enough to get a 1.73 hox :D still, u shouldnt give up, nothing's impossible and im sure the hox 2.20+ will get root some day
[AT&T, Rogers HTC One X, Telstra One XL] rivlocs83:
Yeah I hope this happens soon I feel like a law abiding citizen from not being rooted lol, anywho the Evo was a great phone, it started it all I think
[AT&T, Rogers HTC One X, Telstra One XL] xnerdx:
Is this really the only place where root is being discussed? I mean wouldn't everyone benefit from rooting 2.20 ie:devs, new users, ect.
[AT&T, Rogers HTC One X, Telstra One XL] :
What are you even asking..?

We haven't found a root method for 2.20, that's why this thread exists. and it would obviously benefit everyone, but we don't have it.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
I feel like I can taste it:) getting closer maybe
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
That's why it's in general discussion...

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] :
I was told once that TAMPERED meant the SU binary was installed. Is that the case here, or what did you do :)
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
It doesn't.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] :
And what does it mean for the One X?

My last phone being the HTC aria, didn't show any flags, such as LOCKED/UNLOCKED or TAMPERED
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
It means the system partition has been modified. Rooting (adding su binary) will trigger the tampered flag.
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
So if the SU binary is installed it will say tampered, but not necessarily the other way around.

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Correct. Perhaps there are other situations that will cause that as well. I haven't spoken to 18th.abn in a few days, but looks like good progress. I've got a few fresh ideas myself, by won't have my hox back until at least next weekend.
[AT&T, Rogers HTC One X, Telstra One XL] TonyBoes:
I just want to voice my appreciation for you guys working on this.

Sent using Florence, my carrier pigeon.
[AT&T, Rogers HTC One X, Telstra One XL] Mister J:
I can feel it coming in the air tonight...

Ohhh ohhhhhh
[AT&T, Rogers HTC One X, Telstra One XL] TheEmpyre:
Yes, all of you who have knowledge of these systems thank you! I am excited to learn how to root and unlock the boot loader! Android first timer here, so much better than iphone ugh
[AT&T, Rogers HTC One X, Telstra One XL] Obie911:
I want to express my gratitude for the hard work this geniuses are putting on this! Thanks all of you!:)
[AT&T, Rogers HTC One X, Telstra One XL] :
Well I was partially correct, thanks.
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
omgggg!

Imagine if we can get this!!!!! Project butter! Extreme fps! Over clock and take just absolute advantage of our screen!
[AT&T, Rogers HTC One X, Telstra One XL] superchilpil:
Ummmm we already have this? Check development out
[AT&T, Rogers HTC One X, Telstra One XL] bts0uth:
Some do, most don't :(
[AT&T, Rogers HTC One X, Telstra One XL] omario8484:
Most do some don't * :eek:
[AT&T, Rogers HTC One X, Telstra One XL] Luisit0:
wt do u mean by that? which do? o.O
[AT&T, Rogers HTC One X, Telstra One XL] ronii1123:
I swear these developers can cure cancer! Hurrah for progress :highfive:
[AT&T, Rogers HTC One X, Telstra One XL] iceman99393:
So...what are those pictures indicating for us?
[AT&T, Rogers HTC One X, Telstra One XL] samiam0295:
He was able to write to system partitions, something we couldnt do because of WP with the latest update. I would assume he found a temp root and changed SuperCID. or something completely different.
[AT&T, Rogers HTC One X, Telstra One XL] TheEmpyre:
+1 I would like a brief explanation if anyone is willing to give one!
[AT&T, Rogers HTC One X, Telstra One XL] iceman99393:
Great I can't wait. I had sold my first one x rooted,came back recently to 2.20. :'(
[AT&T, Rogers HTC One X, Telstra One XL] beaups:
Lol no, you are ahead of yourself. And there is no wp on system partition.
[AT&T, Rogers HTC One X, Telstra One XL] samiam0295:
read only, my bad.
[AT&T, Rogers HTC One X, Telstra One XL] 18th.abn:
Ok, atm my new hoc is in pretty rough shape...ok, bad shape....still working but no need for any over excitement..... I've ruu 4 times now and still not fixing my issues. The ruu removed the tampered flag, so once I get my phone back in order I need to recreate the condition that set the flag, from there hopefully we can put it all together and make this happen:beer:
[AT&T, Rogers HTC One X, Telstra One XL] TheEmpyre:
Hang in there! You got this!
[AT&T, Rogers HTC One X, Telstra One XL] xnerdx:
I was saying are there other forums discussing this other than xda, I've been following this thread for over a month and was considering if rootzwiki or some other android site had found anything. I was on reddit the other day reading about the 2.20 and a couple thread lurkers were wondering the same thing it was just a general question of whether this thread is our only hope for root.

---------- Post added at 10:31 PM ---------- Previous post was at 10:28 PM ----------

I can see very good progress has been made recently here though. :good::)
[AT&T, Rogers HTC One X, Telstra One XL] ronii1123:
It's nice to see progress!
[AT&T, Rogers HTC One X, Telstra One XL] Kole_Ackerson:
I have a feeling we are finally right around the corner!
[AT&T, Rogers HTC One X, Telstra One XL] Shryvone21:
Curious!

So I'm curious.... if we get root:)!(coming soon!!) Ha would I lose my service if i switched to another rom?
[AT&T, Rogers HTC One X, Telstra One XL] wlmeng11:
No, the OS doesn't affect your SIM card/chip (does at&t use sim cards? Lol)

Sent from my HTC Rezound
[AT&T, Rogers HTC One X, Telstra One XL] Luisit0:
yep and one x uses micro sim
[AT&T, Rogers HTC One X, Telstra One XL] patstock11:
I remember literally checking the thread numerous times a day when we had a 1.85 bounty going. Hope root happens for 2.20, it ultimately benefits everyone. I was one of the knuckle heads that ran the leaked 1.85 ruu. Good luck guys, rooting for ya. No pun intended.