[Connected Car] donaldta:
I tried the Java APK generator and used the the -b switch which makes the tool exploit bug# 9695860 that was mentioned in his previous blog entry. (We were originally using the bash script to exploit bug# 8219321)

The only caveat here was that I had to upgrade to JRE7.

Creation:

root@Microknoppix:/home/knoppix# java -jar /usr/local/bin/AndroidMasterKeys.jar -b -a ASTEROID_Messenger_1.100.53.apk -z Framaroot-1.6.1.apk
root@Microknoppix:/home/knoppix# ls -l
total 10029
-rw-r--r-- 1 knoppix knoppix 3248536 Oct 28 01:31 ASTEROID_Messenger_1.100.53.apk
drwxr-xr-x 2 knoppix knoppix 72 Oct 28 12:42 Desktop
drwx------ 9 knoppix knoppix 544 Oct 28 17:33 Downloads
drwxr-xr-x 5 root root 192 Oct 28 01:48 frama-modded
-rw-r--r-- 1 knoppix knoppix 912017 Oct 27 21:37 frama-modded.apk
-rw-r--r-- 1 knoppix knoppix 929956 Oct 26 16:28 Framaroot-1.6.1.apk
-rw-r--r-- 1 knoppix knoppix 914291 Oct 28 00:38 Framaroot-1.6.1.zip
-rwxr-xr-x 1 knoppix knoppix 1158 Oct 26 16:20 masterkey.bash
-rw-r--r-- 1 root root 4237292 Oct 28 17:03 MasterKeysModded-ASTEROID_Messenger_1.100.53.apk
root@Microknoppix:/home/knoppix#

Install:

C:\>adb install apk\Masterkey\MasterKeysModded-ASTEROID_Messenger_1.100.53.apk
190 KB/s (4237292 bytes in 21.747s)
pkg: /data/local/tmp/MasterKeysModded-ASTEROID_Messenger_1.100.53.apk
Success
C:\>

Logcat:

10-28 20:40:46.779: D/AndroidRuntime(9298): >>>>>> AndroidRuntime START com.android.internal.os.RuntimeInit <<<<<<
10-28 20:40:46.779: D/AndroidRuntime(9298): CheckJNI is ON
10-28 20:40:47.309: D/AndroidRuntime(9298): Calling main entry com.android.commands.pm.Pm
10-28 20:40:47.471: D/dalvikvm(554): GC_EXPLICIT freed 7K, 54% free 2546K/5511K, external 716K/1038K, paused 40ms
10-28 20:40:47.479: W/ActivityManager(61): No content provider found for:
10-28 20:40:48.179: W/ActivityManager(61): No content provider found for:
10-28 20:40:48.199: D/PackageParser(61): Scanning package: /data/app/vmdl-1575653462.tmp
10-28 20:40:48.449: D/PackageManager(61): Scanning package com.alephzain.framaroot
10-28 20:40:48.459: I/PackageManager(61): Unpacking native libraries for /data/app/com.alephzain.framaroot-1.apk
10-28 20:40:48.879: D/installd(35): DexInv: --- BEGIN '/data/app/com.alephzain.framaroot-1.apk' ---
10-28 20:40:49.049: D/dalvikvm(9313): DexOpt: load 26ms, verify+opt 66ms
10-28 20:40:49.059: D/installd(35): DexInv: --- END '/data/app/com.alephzain.framaroot-1.apk' (success) ---
10-28 20:40:49.059: D/PackageManager(61): Activities: com.alephzain.framaroot.FramaActivity com.alephzain.framaroot.FramaAdbActivity
10-28 20:40:49.080: I/ActivityManager(61): Force stopping package com.alephzain.framaroot uid=10039
10-28 20:40:49.189: I/installd(35): move /data/dalvik-cache/data@app@com.alephzain.framaroot-1.apk@classes.dex -> /data/dalvik-cache/data@app@com.alephzain.framaroot-1.apk@classes.dex
10-28 20:40:49.189: D/PackageManager(61): New package installed in /data/app/com.alephzain.framaroot-1.apk
10-28 20:40:49.490: D/PackageAddedReceiver(202): package added com.alephzain.framaroot
10-28 20:40:49.809: D/dalvikvm(61): GC_EXPLICIT freed 1003K, 45% free 5087K/9223K, external 3307K/4129K, paused 99ms
10-28 20:40:49.869: D/AndroidRuntime(9298): Shutting down VM
10-28 20:40:49.879: D/dalvikvm(9298): GC_CONCURRENT freed 101K, 72% free 295K/1024K, external 0K/0K, paused 1ms+3ms
10-28 20:40:49.879: D/jdwp(9298): Got wake-up signal, bailing out of select
10-28 20:40:49.889: D/dalvikvm(9298): Debugger has detached; object registry had 1 entries
10-28 20:40:54.799: D/dalvikvm(693): GC_EXPLICIT freed 3K, 54% free 2539K/5511K, external 716K/1038K, paused 90ms
10-28 20:40:59.829: D/dalvikvm(240): GC_EXPLICIT freed 217K, 51% free 2899K/5895K, external 716K/1038K, paused 80ms
10-28 20:41:05.029: W/ProcessStats(61): Skipping unknown process pid 9401
10-28 20:41:05.029: W/ProcessStats(61): Skipping unknown process pid 9402
10-28 20:41:05.239: D/dalvikvm(254): GC_EXPLICIT freed 440K, 40% free 5398K/8967K, external 907K/1038K, paused 196ms
10-28 20:41:05.400: D/Finsky(254): [1] 5.onFinished: Installation state replication succeeded.
10-28 20:41:10.109: D/dalvikvm(554): GC_EXPLICIT freed 8K, 54% free 2543K/5511K, external 716K/1038K, paused 60ms
10-28 20:41:15.289: D/dalvikvm(202): GC_EXPLICIT freed 131K, 49% free 3151K/6151K, external 716K/1038K, paused 203ms

The application Framaroot showed up in the app drawer even with its customized icon. :victory:

Execute's Logcat:

10-28 20:42:10.739: I/ActivityManager(61): Starting: Intent { act=android.intent.action.MAIN cat=[android.intent.category.LAUNCHER] flg=0x10200000 cmp=com.alephzain.framaroot/.FramaActivity } from pid 128
10-28 20:42:10.959: I/ActivityManager(61): Start proc com.alephzain.framaroot for activity com.alephzain.framaroot/.FramaActivity: pid=9703 uid=10039 gids={1006}
10-28 20:42:11.649: D/dalvikvm(9703): Trying to load lib /data/data/com.alephzain.framaroot/lib/libframalib.so 0x40515258
10-28 20:42:11.749: D/dalvikvm(9703): Added shared lib /data/data/com.alephzain.framaroot/lib/libframalib.so 0x40515258
10-28 20:42:11.749: D/dalvikvm(9703): No JNI_OnLoad found in /data/data/com.alephzain.framaroot/lib/libframalib.so 0x40515258, skipping init
10-28 20:42:12.299: I/ActivityManager(61): Displayed com.alephzain.framaroot/.FramaActivity: +1s349ms
10-28 20:42:18.009: D/dalvikvm(128): GC_EXPLICIT freed 90K, 50% free 3093K/6087K, external 4600K/5687K, paused 82ms
10-28 20:42:22.849: W/InputManagerService(61): Window already focused, ignoring focus gain of: com.android.internal.view.IInputMethodClient$Stub$Proxy@406d2bc8

Activity Manager:

C:\>adb shell am start -n com.alephzain.framaroot/com.alephzain.framaroot.FramaAdbActivity --es exploit Gimli --ei action 0
Starting: Intent { cmp=com.alephzain.framaroot/.FramaAdbActivity (has extras) }

C:>

Logcat:

10-28 20:50:20.029: D/AndroidRuntime(12068): >>>>>> AndroidRuntime START com.android.internal.os.RuntimeInit <<<<<<
10-28 20:50:20.029: D/AndroidRuntime(12068): CheckJNI is ON
10-28 20:50:20.819: D/AndroidRuntime(12068): Calling main entry com.android.commands.am.Am
10-28 20:50:20.849: I/ActivityManager(61): Starting: Intent { flg=0x10000000 cmp=com.alephzain.framaroot/.FramaAdbActivity (has extras) } from pid 12068
10-28 20:50:20.899: D/AndroidRuntime(12068): Shutting down VM
10-28 20:50:20.909: D/dalvikvm(12068): GC_CONCURRENT freed 102K, 69% free 321K/1024K, external 0K/0K, paused 1ms+0ms
10-28 20:50:20.909: D/dalvikvm(12068): Debugger has detached; object registry had 1 entries
10-28 20:50:20.939: I/AndroidRuntime(12068): NOTE: attach of thread 'Binder Thread #3' failed
10-28 20:50:21.749: I/ActivityManager(61): Displayed com.alephzain.framaroot/.FramaAdbActivity: +883ms

:good: Looks good, so far. We just need a guinea pig to test it out.