[Moto X General] chrisp6825:
Yea absolutely, I'm currently backing up everything at the moment.. So I'm waiting on that.

I believe you're right, PIE includes an xbin.IMG and I think it mounts it during the exploit (no proof ATM)

After running PIE-root, a file called 'xbin.img' is placed at /data/local/atvc/xbin.img that apparently is being mounted over /system/xbin .

This directory consists of busybox, su, daemonsu, and a bunch of symlinks to busybox's utilities, among some other stuff.

So here is the contents of a few directories I could enter without root

(or more specifically, without PIE root, after running TowelRoot with temp switch 1) :

/system

shell@ghost:/system $ ls -la
drwxr-xr-x root root 2014-01-23 19:19 app
drwxr-xr-x root shell 2014-01-23 19:19 bin
-rw-r--r-- root root 8904 2014-01-23 19:19 build.prop
drwxr-xr-x root root 2014-01-23 19:19 etc
drwxr-xr-x root root 2014-01-23 19:19 fonts
drwxr-xr-x root root 2014-01-23 19:19 framework
drwxr-xr-x root root 2014-01-23 19:19 lib
drwx------ root root 1969-12-31 18:00 lost+found
drwxr-xr-x root root 2014-01-23 19:19 media
drwxr-xr-x root root 2014-01-23 19:19 priv-app
drwxr-xr-x root root 2014-01-23 19:19 tts
drwxr-xr-x root root 2014-01-23 19:19 usr
drwxr-xr-x root shell 2014-01-23 19:19 vendor
drwxr-xr-x root shell 2014-07-19 22:07 xbin

/system/bin

shell@ghost:/system/bin $ ls -la
-rwxr-xr-x root shell 26368 2014-01-23 19:19 ATFWD-daemon
-rwxr-xr-x root shell 5396 2014-01-23 19:19 PktRspTest
-rwxr-xr-x root shell 25996 2014-01-23 19:19 StoreKeybox
lrwxr-xr-x root shell 2014-01-23 19:28 [ -> motobox
-rwxr-xr-x root shell 21892 2014-01-23 19:19 adspd
-rwxr-xr-x root shell 210 2014-01-23 19:19 am
-rwxr-xr-x root shell 56971 2014-01-23 19:19 ap_gain.bin
-rwxr-xr-x root shell 27910 2014-01-23 19:19 ap_gain_mmul.bin
-rwxr-xr-x root shell 939 2014-01-23 19:19 apanic_annotate.sh
-rwxr-xr-x root shell 30256 2014-01-23 19:19 aplogcat
-rwxr-xr-x root shell 38332 2014-01-23 19:19 aplogd
-rwxr-xr-x root shell 9488 2014-01-23 19:19 app_process
-rwxr-xr-x root shell 53588 2014-01-23 19:19 applypatch
-rwxr-xr-x root shell 17884 2014-01-23 19:19 atrace
-rwxr-xr-x root shell 21776 2014-01-23 19:19 batch
-rwxr-xr-x root shell 21792 2014-01-23 19:19 batt_health
-rwxr-xr-x root shell 9504 2014-01-23 19:19 blkid
-rwxr-xr-x root shell 199 2014-01-23 19:19 bmgr
-rwxr-xr-x root shell 25872 2014-01-23 19:19 bootanimation
-rwxr-xr-x root shell 5284 2014-01-23 19:19 bootmodem
-rwxr-xr-x root shell 34376 2014-01-23 19:19 bridgemgrd
-rwxr-xr-x root shell 9576 2014-01-23 19:19 btnvtool
-rwxr-xr-x root shell 156 2014-01-23 19:19 bu
-rwxr-xr-x root shell 13616 2014-01-23 19:19 bug2go-bugreport
-rwxr-xr-x root shell 3505 2014-01-23 19:19 bug2go-bugreport-oem
-rwxr-xr-x root shell 5336 2014-01-23 19:19 bugreport
lrwxr-xr-x root shell 2014-01-23 19:28 cat -> toolbox
-rwxr-xr-x root shell 138108 2014-01-23 19:19 charge_only_mode
lrwxr-xr-x root shell 2014-01-23 19:28 chcon -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 chmod -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 chown -> toolbox
-rwxr-xr-x root shell 21776 2014-01-23 19:19 clatd
lrwxr-xr-x root shell 2014-01-23 19:28 clear -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 cmp -> toolbox
-rwxr-xr-x root shell 493436 2014-01-23 19:19 cnd
-rwxr-xr-x root shell 207 2014-01-23 19:19 content
lrwxr-xr-x root shell 2014-01-23 19:28 cp -> toolbox
-rwxr-xr-x root shell 9804 2014-01-23 19:19 crda
-rwxr-xr-x root shell 62744 2014-01-23 19:19 curl
-rwxr-xr-x root shell 9432 2014-01-23 19:19 dalvikvm
lrwxr-xr-x root shell 2014-01-23 19:28 date -> toolbox
-rwxr-xr-x root shell 38652 2014-01-23 19:19 dbvc_atvc_property_set
lrwxr-xr-x root shell 2014-01-23 19:28 dd -> toolbox
-rwxr-xr-x root shell 21720 2014-01-23 19:19 debuggerd
-rwxr-xr-x root shell 62736 2014-01-23 19:19 dex2oat
-rwxr-xr-x root shell 9384 2014-01-23 19:19 dexopt
lrwxr-xr-x root shell 2014-01-23 19:28 df -> toolbox
-rwxr-xr-x root shell 66964 2014-01-23 19:19 dhcpcd
-rwxr-xr-x root shell 9380 2014-01-23 19:19 diag_callback_client
-rwxr-xr-x root shell 5396 2014-01-23 19:19 diag_klog
-rwxr-xr-x root shell 18304 2014-01-23 19:19 diag_mdlog
-rwxr-xr-x root shell 9560 2014-01-23 19:19 diag_mdlog-getlogs
-rwxr-xr-x root shell 5284 2014-01-23 19:19 diag_mdlog-wrap
-rwxr-xr-x root shell 17968 2014-01-23 19:19 diag_socket_log
-rwxr-xr-x root shell 9736 2014-01-23 19:19 diag_uart_log
lrwxr-xr-x root shell 2014-01-23 19:28 dmesg -> toolbox
-rwxr-xr-x root shell 105796 2014-01-23 19:19 dnsmasq
-rwxr-xr-x root shell 50448 2014-01-23 19:19 drmserver
-rwxr-xr-x root shell 5284 2014-01-23 19:19 dropboxd
-rwxr-xr-x root shell 251 2014-01-23 19:19 dropboxhelper
-rwxr-xr-x root shell 58776 2014-01-23 19:19 ds_fmc_appd
lrwxr-xr-x root shell 2014-01-23 19:28 du -> toolbox
-rwxr-xr-x root shell 42268 2014-01-23 19:19 dumpstate
-rwxr-xr-x root shell 9436 2014-01-23 19:19 dumpsys
-rwxr-xr-x root shell 122500 2014-01-23 19:19 e2fsck
-rwxr-xr-x root shell 12108 2014-01-23 19:19 efsks
-rwxr-xr-x root shell 5284 2014-01-23 19:19 fips_loader
-rwxr-xr-x root shell 30184 2014-01-23 19:19 flatland
-rwxr-xr-x root shell 13636 2014-01-23 19:19 fmconfig
-rwxr-xr-x root shell 34372 2014-01-23 19:19 fsck_msdos
-rwxr-xr-x root shell 50648 2014-01-23 19:19 ftmdaemon
-rwxr-xr-x root shell 13528 2014-01-23 19:19 ftmipcd
-rwxr-xr-x root shell 27012 2014-01-23 19:19 garden_app
lrwxr-xr-x root shell 2014-01-23 19:28 getconfig -> motobox
lrwxr-xr-x root shell 2014-01-23 19:28 getenforce -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 getevent -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 getprop -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 getsebool -> toolbox
-rwxr-xr-x root shell 42392 2014-01-23 19:19 gpsone_daemon
lrwxr-xr-x root shell 2014-01-23 19:28 grep -> toolbox
-rwxr-xr-x root shell 9436 2014-01-23 19:19 gzip
-rwxr-xr-x root shell 6620 2014-01-23 19:19 hardware_revisions.sh
-rwxr-xr-x root shell 104532 2014-01-23 19:19 hci_qcomm_init
lrwxr-xr-x root shell 2014-01-23 19:28 hd -> toolbox
-rwxr-xr-x root shell 318472 2014-01-23 19:19 hostapd
lrwxr-xr-x root shell 2014-01-23 19:28 id -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 ifconfig -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 iftop -> toolbox
-rwxr-xr-x root shell 194 2014-01-23 19:19 ime
-rwxr-xr-x root shell 50580 2014-01-23 19:19 ims_rtp_daemon
-rwxr-xr-x root shell 99732 2014-01-23 19:19 imsdatadaemon
-rwxr-xr-x root shell 66904 2014-01-23 19:19 imsqmidaemon
-rwxr-xr-x root shell 201 2014-01-23 19:19 input
lrwxr-xr-x root shell 2014-01-23 19:28 insmod -> toolbox
-rwxr-xr-x root shell 30152 2014-01-23 19:19 installd
lrwxr-xr-x root shell 2014-01-23 19:28 ioctl -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 ionice -> toolbox
-rwxr-xr-x root shell 165480 2014-01-23 19:19 ip
-rwxr-xr-x root shell 191448 2014-01-23 19:19 ip6tables
-rwxr-xr-x root shell 196240 2014-01-23 19:19 iptables
-rwxr-xr-x root shell 5284 2014-01-23 19:19 irsc_util
-rwxr-xr-x root shell 21736 2014-01-23 19:19 isdbtmmtest
-rwxr-xr-x root shell 105776 2014-01-23 19:19 keymaster_test
-rwxr-xr-x root shell 38268 2014-01-23 19:19 keystore
lrwxr-xr-x root shell 2014-01-23 19:28 kill -> toolbox
-rwxr-xr-x root shell 9432 2014-01-23 19:19 kpgather
-rwxr-xr-x root shell 34420 2014-01-23 19:19 ks
-rwxr-xr-x root shell 63596 2014-01-23 19:19 linker
lrwxr-xr-x root shell 2014-01-23 19:28 ln -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 load_policy -> toolbox
-rwxr-xr-x root shell 46536 2014-01-23 19:19 location-mq
lrwxr-xr-x root shell 2014-01-23 19:28 log -> toolbox
-rwxr-xr-x root shell 13584 2014-01-23 19:19 logcat
-rwxr-xr-x root shell 13608 2014-01-23 19:19 logwrapper
lrwxr-xr-x root shell 2014-01-23 19:28 ls -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 lsmod -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 lsof -> toolbox
-rwxr-xr-x root shell 9496 2014-01-23 19:19 make_ext4fs
lrwxr-xr-x root shell 2014-01-23 19:28 masterclear -> motobox
-rwxr-xr-x root shell 9600 2014-01-23 19:19 mbm_spy
-rwxr-xr-x root shell 5360 2014-01-23 19:19 mcStarter
lrwxr-xr-x root shell 2014-01-23 19:28 md5 -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 md5sum -> motobox
-rwxr-xr-x root shell 36132 2014-01-23 19:19 mdm_helper
-rwxr-xr-x root shell 255336 2014-01-23 19:19 mdnsd
-rwxr-xr-x root shell 210 2014-01-23 19:19 media
-rwxr-xr-x root shell 13536 2014-01-23 19:19 mediaserver
-rwxr-xr-x root shell 136996 2014-01-23 19:19 memtest_mode
lrwxr-xr-x root shell 2014-01-23 19:28 mkdir -> toolbox
-rwxr-xr-x root shell 17716 2014-01-23 19:19 mkfs.f2fs_arm
-rwxr-xr-x root shell 157424 2014-01-23 19:19 mksh
lrwxr-xr-x root shell 2014-01-23 19:28 mkswap -> toolbox
-rwxr-xr-x root shell 17644 2014-01-23 19:19 mm-jpeg-dec-test
-rwxr-xr-x root shell 13540 2014-01-23 19:19 mm-jpeg-dec-test-client
-rwxr-xr-x root shell 21792 2014-01-23 19:19 mm-jpeg-enc-test
-rwxr-xr-x root shell 17636 2014-01-23 19:19 mm-jpeg-enc-test-client
-rwxr-xr-x root shell 25924 2014-01-23 19:19 mm-jps-enc-test
-rwxr-xr-x root shell 25836 2014-01-23 19:19 mm-mpo-dec-test
-rwxr-xr-x root shell 21828 2014-01-23 19:19 mm-mpo-enc-test
-rwxr-xr-x root shell 25876 2014-01-23 19:19 mm-pp-daemon
-rwxr-xr-x root shell 50516 2014-01-23 19:19 mm-qcamera-app
-rwxr-xr-x root shell 781056 2014-01-23 19:19 mm-qcamera-daemon
-rwxr-xr-x root shell 63840 2014-01-23 19:19 mm-qcamera-test
-rwxr-xr-x root shell 14476 2014-01-23 19:19 mm-qcamera-testsuite-client
-rwxr-xr-x root shell 217 2014-01-23 19:19 monkey
-rwxr-xr-x root shell 1999 2014-01-23 19:19 moto_com.sh
-rwxr-xr-x root shell 26064 2014-01-23 19:19 motobox
lrwxr-xr-x root shell 2014-01-23 19:28 mount -> toolbox
-rwxr-xr-x root shell 1881 2014-01-23 19:19 mount_ext4.sh
-rwxr-xr-x root shell 9440 2014-01-23 19:19 mountpds
-rwxr-xr-x root shell 38812 2014-01-23 19:19 mpdecision
-rwxr-xr-x root shell 9380 2014-01-23 19:19 msp430
-rwxr-xr-x root shell 17844 2014-01-23 19:19 mtpd
lrwxr-xr-x root shell 2014-01-23 19:28 mv -> toolbox
-rwxr-xr-x root shell 5284 2014-01-23 19:19 n_smux
lrwxr-xr-x root shell 2014-01-23 19:28 nandread -> toolbox
-rwxr-xr-x root shell 5284 2014-01-23 19:19 ndc
-rwxr-s--- root inet 5468 2014-01-23 19:19 netcfg
-rwxr-xr-x root shell 100044 2014-01-23 19:19 netd
-rwxr-xr-x root shell 160288 2014-01-23 19:19 netmgrd
lrwxr-xr-x root shell 2014-01-23 19:28 netstat -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 newfs_msdos -> toolbox
-rwxr-xr-x root shell 5284 2014-01-23 19:19 nl_listener
lrwxr-xr-x root shell 2014-01-23 19:28 notify -> toolbox
-rwxr-xr-x root shell 79204 2014-01-23 19:19 oatdump
-rwxr-xr-x root shell 21848 2014-01-23 19:19 oemwvtest
-rwxr-xr-x root root 26060 2014-01-23 19:19 ping
-rwxr-xr-x root shell 30420 2014-01-23 19:19 ping6
-rwxr-xr-x root shell 191 2014-01-23 19:19 pm
-rwxr-xr-x root shell 17736 2014-01-23 19:19 port-bridge
-rwxr-xr-x root shell 141852 2014-01-23 19:19 pppd
lrwxr-xr-x root shell 2014-01-23 19:28 printenv -> toolbox
-rwxr-xr-x root shell 13708 2014-01-23 19:19 profiler_daemon
lrwxr-xr-x root shell 2014-01-23 19:28 ps -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 ptf -> motobox
-rwxr-xr-x root shell 21884 2014-01-23 19:19 ptt_socket_app
-rwxr-xr-x root shell 28080 2014-01-23 19:19 qcks
-rwxr-xr-x root shell 1667 2014-01-23 19:19 qcookie
-rwxr-xr-x root shell 13528 2014-01-23 19:19 qdumpd
-rwxr-xr-x root shell 26196 2014-01-23 19:19 qmi_motext_hook
-rwxr-xr-x root shell 174760 2014-01-23 19:19 qmiproxy
-rwxr-xr-x root shell 67400 2014-01-23 19:19 qmuxd
-rwxr-xr-x root shell 17852 2014-01-23 19:19 qseecom_sample_client
-rwxr-xr-x root shell 9432 2014-01-23 19:19 qseecom_security_test
-rwxr-xr-x root shell 5380 2014-01-23 19:19 qseecomd
-rwxr-xr-x root shell 162700 2014-01-23 19:19 racoon
-rwxr-xr-x root shell 30024 2014-01-23 19:19 radish
lrwxr-xr-x root shell 2014-01-23 19:28 readlink -> toolbox
-rwxr-xr-x root shell 5284 2014-01-23 19:19 reboot
-rwxr-xr-x root shell 71232 2014-01-23 19:19 refuse
-rwxr-xr-x root shell 9780 2014-01-23 19:19 regdbdump
lrwxr-xr-x root shell 2014-01-23 19:28 renice -> toolbox
-rwxr-xr-x root shell 188 2014-01-23 19:19 requestsync
-rwxr-xr-x root shell 25816 2014-01-23 19:19 resize2fs
lrwxr-xr-x root shell 2014-01-23 19:28 restorecon -> toolbox
-rwxr-xr-x root shell 9496 2014-01-23 19:19 rild
lrwxr-xr-x root shell 2014-01-23 19:28 rm -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 rmdir -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 rmmod -> toolbox
-rwxr-xr-x root shell 19340 2014-01-23 19:19 rmt_storage
lrwxr-xr-x root shell 2014-01-23 19:28 route -> toolbox
-rwxr-x--- root shell 9432 2014-01-23 19:19 run-as
lrwxr-xr-x root shell 2014-01-23 19:28 runcon -> toolbox
-rwxr-xr-x root shell 17624 2014-01-23 19:19 sapd
-rwxr-xr-x root shell 5284 2014-01-23 19:19 schedtest
lrwxr-xr-x root shell 2014-01-23 19:28 schedtop -> toolbox
-rwxr-xr-x root shell 9384 2014-01-23 19:19 screencap
-rwxr-xr-x root shell 17796 2014-01-23 19:19 screenrecord
-rwxr-xr-x root shell 42352 2014-01-23 19:19 screenshot
-rwxr-xr-x root shell 17624 2014-01-23 19:19 sdcard
lrwxr-xr-x root shell 2014-01-23 19:28 sendevent -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 sendevent2 -> toolbox
-rwxr-xr-x root shell 244616 2014-01-23 19:19 sensors.qcom
-rwxr-xr-x root shell 5336 2014-01-23 19:19 sensorservice
-rwxr-xr-x root shell 9436 2014-01-23 19:19 service
-rwxr-xr-x root shell 9588 2014-01-23 19:19 servicemanager
lrwxr-xr-x root shell 2014-01-23 19:28 setconfig -> motobox
lrwxr-xr-x root shell 2014-01-23 19:28 setconsole -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 setenforce -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 setfattr -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 setprop -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 setsebool -> toolbox
-rwxr-xr-x root shell 178 2014-01-23 19:19 settings
-rwxr-xr-x root shell 5336 2014-01-23 19:19 setup_fs
lrwxr-xr-x root shell 2014-01-23 19:28 sh -> mksh
lrwxr-xr-x root shell 2014-01-23 19:28 sleep -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 smd -> toolbox
-rwxr-xr-x root shell 9492 2014-01-23 19:19 ssr_diag
lrwxr-xr-x root shell 2014-01-23 19:28 start -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 stop -> toolbox
-rwxr-xr-x root shell 13720 2014-01-23 19:19 subsystem_ramdump
-rwxr-xr-x root shell 5284 2014-01-23 19:19 surfaceflinger
-rwxr-xr-x root shell 192 2014-01-23 19:19 svc
lrwxr-xr-x root shell 2014-01-23 19:28 swapoff -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 swapon -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 sync -> toolbox
-rwxr-xr-x root shell 67188 2014-01-23 19:19 tc
-rwxr-xr-x root shell 434904 2014-01-23 19:19 tcmd
-rwxr-xr-x root shell 42408 2014-01-23 19:19 tcmdhelp
lrwxr-xr-x root shell 2014-01-23 19:28 test -> motobox
-rwxr-xr-x root shell 9492 2014-01-23 19:19 test_diag
-rwxr-xr-x root shell 13980 2014-01-23 19:19 test_gemini
-rwxr-xr-x root shell 68200 2014-01-23 19:19 thermald
-rwxr-xr-x root shell 17688 2014-01-23 19:19 time_daemon
-rwxr-xr-x root shell 5284 2014-01-23 19:19 timedexec
-rwxr-xr-x root shell 143120 2014-01-23 19:19 toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 top -> toolbox
lrwxr-xr-x root shell 2014-01-23 19:28 touch -> toolbox
-rwxr-xr-x root shell 3814 2014-01-23 19:19 uiautomator
lrwxr-xr-x root shell 2014-01-23 19:28 umount -> toolbox
-rwxr-xr-x root shell 291688 2014-01-23 19:19 updater
lrwxr-xr-x root shell 2014-01-23 19:28 uptime -> toolbox
-rwxr-xr-x root shell 34176 2014-01-23 19:19 v4l2-qcamera-app
-rwxr-xr-x root shell 5284 2014-01-23 19:19 vdc
lrwxr-xr-x root shell 2014-01-23 19:28 vmstat -> toolbox
-rwxr-xr-x root shell 91780 2014-01-23 19:19 vold
lrwxr-xr-x root shell 2014-01-23 19:28 watchprops -> toolbox
-rwxr-xr-x root shell 9432 2014-01-23 19:19 wdsdaemon
lrwxr-xr-x root shell 2014-01-23 19:28 wipe -> toolbox
-rwxr-xr-x root shell 190 2014-01-23 19:19 wm
-rwxr-xr-x root shell 802116 2014-01-23 19:19 wpa_supplicant
-rwxr-xr-x root shell 649372 2014-01-23 19:19 xtwifi-client
-rwxr-xr-x root shell 87560 2014-01-23 19:19 xtwifi-inet-agent

/system/xbin

shell@ghost:/system/xbin $ ls -la
-rwxr-xr-x root shell 13528 2014-01-23 19:19 backup
-rwxr-xr-x root shell 59748 2014-01-23 19:19 dexdump
-rwxr-xr-x root shell 223 2014-01-23 19:19 run_backup
-rwxr-xr-x root shell 222 2014-01-23 19:19 run_restore

/xbin

shell@ghost:/xbin $ ls -la
-rwxr-x--- root root 235476 1969-12-31 18:00 qe
-rw-r--r-- root root 3 1969-12-31 18:00 qee.dat
-rw-r--r-- root root 256 1969-12-31 18:00 qem.dat

I'm not able to view /sbin with this elevation. Not until I execute PIE.

SU is not found above.