yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] Volvogia:
I would love to have root. If you can this to us, than many thanks will be headed your way. Im still on the old firmware(N1E). I would love to have that darn Software Update Notification to go away! You would be my hero! Best of luck to you!
[AT&T Samsung Galaxy Note 4] holywhitebread:
I'm giving whoever gives us root at least $100.
[AT&T Samsung Galaxy Note 4] Venom0642:
Be aware your phone will take the update automatically you won't be able to stop it just thought i let you know!
[AT&T Samsung Galaxy Note 4] Volvogia:
Appreciate it! It keeps giving me the option to postpone it so thats what I do. Hopefully it wont force it, but if it does then I guess o well. Cant say I didnt try! lol
[AT&T Samsung Galaxy Note 4] ooxteme:
Mine forced it last night.... Hope its not the end for me!
[AT&T Samsung Galaxy Note 4] Clienterror:
I'm hoping man. I'm on the edge but I'm pretty sure any exploit would work for both being they're almost identicle.
[AT&T Samsung Galaxy Note 4] funnycreature:
I'm on the Edge too and was hoping an exploit for the Note 4 might work on it. Please keep us posted!
[AT&T Samsung Galaxy Note 4] windstrings:
You should be able to go to the bottom and view "more apps" or hit the search tool then open Facebook to find it that way
[AT&T Samsung Galaxy Note 4] b3asty:
+2

+3

+4
[AT&T Samsung Galaxy Note 4] RockRatt:
It did not show up that way, until I enabled it for system apps as well. You need to have the donation package for that.

Also if you do it looks like you can greenify many things like att firmware update among others. [MENTION=2167478]windstrings[/MENTION] Thanks for pointing me to dig deeper.
[AT&T Samsung Galaxy Note 4] MrPlNK:
How likely (if your root method works) would it be that it work for the AT&T note edge (N915A)
[AT&T Samsung Galaxy Note 4] dabl198327:
I wish there was something I could do either by sharing files or testing things myself etc etc. I'm not desperate but I want root :) let me know if and how I can help.
[AT&T Samsung Galaxy Note 4] allenjthomsen:
I have make the rooted system.img but its giving me errors when i try to tar it
[AT&T Samsung Galaxy Note 4] Ghstudent:
What errors is it giving?
[AT&T Samsung Galaxy Note 4] allenjthomsen:
I figured out what my issue was going to try to tar it again
[AT&T Samsung Galaxy Note 4] jorgasm209:
Fixed...

https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2^!/#F1
[AT&T Samsung Galaxy Note 4] jpfulton248:
So I have a little time right now and have downloaded the source from here: http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=910v

I'm assuming I just have to find reference to this function: "checkAndGetTcObjectClass()". If it exists anywhere that means it's been patched. If not then the exploit still exists.

Now, where in the source do I start looking?

EDIT: Please don't shame me if this is completely wrong, but I untarred Platform.tar and then used textcrawler to search through all of it for "checkAndGetTcObjectClass()" ... nothing found.

---------- Post added at 12:34 PM ---------- Previous post was at 12:29 PM ----------

Right, but I think the belief is that with a minor modification zxz0O0's kernel exploit should work on our phones. Am I wrong?
[AT&T Samsung Galaxy Note 4] jorgasm209:
Yes... I was more or less referring to the users who were installing the APK on their phone and posting screenshots of it failing, which at this point is fruitless. The point I was trying to make is that even if we got the apk to work, there is still work to be done. ;)
[AT&T Samsung Galaxy Note 4] jpfulton248:
Good point.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Would be good to get someone with a dev phone to confirm the kernel they have. Is it sufficient that the version match? Or should we md5 the files?

About kallsyms, apparently they can be extracted from boot.img from an Odin tar md5 according to Surge1223 here: http://xdaforums.com/note-4-verizon/general/talk-root-t2908919/post56262197#post56262197

Via: http://xdaforums.com/note-4-att/gen...estigating-t2924831/post56415618#post56415618

As far as I know there are four different combinations for AT&T and Verizon (non-dev) phones.

AT&T users got an ota (I think and may be wrong) starting in November and it started being forced in December (It was forced on mine in mid-December).

It has been confirmed that AT&T and Verizon users can use Odin to downgrade back to stock firmware from tar md5 files.

Info for reference:

AT&T (stock):

NIE

Baseband: N910AUCU1ANIE

Kernel: 3.10.0-2774708 dpi@SWDD5508 #1 Tue Sep 16 22:10:28 KST 2014

Build number: KTU84P.N910AUCU1ANIE

AT&T (ota):

NK3

Baseband: N910AUCU1BNK3

Kernel: 3.10.0-3164227 dpi@SWDD5809 #1 Wed Nov 12 11:15:56 KST 2014

Build number: KTU84P.N910AUCU1BNK3

Verizon (stock):

NI1

Baseband: N910VVRU1ANI1

Kernel: 3.10.0-2774708 dpi@SWDD6007 #1 Tue Sep 16 18:55:45 KST 2014

Build number: KTU84P.N910VVRU1ANI1

Verizon (ota):

NJ5

Baseband: N910VVRU1ANJ5

Kernel: 3.10.0-3239494 dpi@SWDD5702 #1 Wed Nov 12 02:16:29 KST 2014

Build number: KTU84P.N910VVRU1ANJ5

N910AUCU1ANIE kallsyms attached here: http://xdaforums.com/showpost.php?p=56419752&postcount=4

Hm so we can't check the kernel source to find out if the AT&T or Verizon Note 4 phones are vulnerable to CVE-2014-7911 (ObjectInputStream), but as someone holding out hope that our phone is somehow vulnerable but the vulnerability-ness isn't being detected, what are some good tests to run?

---------- Post added at 09:57 AM ---------- Previous post was at 09:54 AM ----------

More info:

https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-7911

http://redmine.replicant.us/issues/1113

https://www.google.com/search?q=738c833d38d41f8f76eb7e77ab39add82b1ae1e2
[AT&T Samsung Galaxy Note 4] jpfulton248:
Wait, why can't we check the source to find out if the phones are vulnerable to CVE-2014-7911?
[AT&T Samsung Galaxy Note 4] FiniteTime:
Ah sorry, was in a rush and for some reason I was thinking the posted source is only for the kernel. I don't know that for sure. Since it's not a kernel exploit we need more than the kernel source, which may be in the posted source.

Btw for AT&T source code, for anyone that wants it but doesn't have it:

http://opensource.samsung.com/reception/receptionSub.do?method=sub&sub=F&searchValue=Sm-n910a

SHA1 and SHA256 for the N910AUCU1ANIE kernel source zip that I downloaded, for reference:

99e00529ce613548664f3c986cd7df886b54caa0 SM-N910A_NA_KK_Opensource.zip

9a5dfcbcd1b77367507b9374afd4f1e1afd505255ff48b4d37 79b235974650c0 SM-N910A_NA_KK_Opensource.zip

Also N910AUCU1ANIE odin tar md5:

http://xdaforums.com/note-4-att/general/stock-to-stock-odin-flashable-tested-t2915915
[AT&T Samsung Galaxy Note 4] waco2hot33:
Maybe this guy can help he just posted a question about DE note 4

http://xdaforums.com/showthread.php?t=3013742

[Q] Developers Edition ROM Question - N910VOYU1ANJ5
[AT&T Samsung Galaxy Note 4] tylerch:
I'm not really sure what I can help with, but here is some information from my Verizon Note 4 DE

Kernel Version: 3.10.0 dpi@SWDD6111 #1 Thu Nov 27 16:32:08 KST 2014

Baseband: N910VOYU1ANJ5

Build number: KTU84P.N910VOYU1ANJ5

Hardware Version: N910V.05
[AT&T Samsung Galaxy Note 4] Surge1223:
https://github.com/android-rooting-tools/helper_tools/blob/master/extract_address_and_disassemble

But obviously a system exploit wouldn't be enough for tethered root so I'm assuming that this two part system that I hear about eventually leverages the kernel? The kernel for dev edition is similar but not the same it's addresses would be slightly different.
[AT&T Samsung Galaxy Note 4] zxz0O0:
Tried this script on a boot.img from Note 4 firmware and it said "Unsupported compressions".
[AT&T Samsung Galaxy Note 4] Surge1223:
http://xdaforums.com/note-4-verizon/general/talk-root-t2908919/page23

We did it before with the original boot.img that came with the vzw note 4. Not sure if sir Athos had to decompress the zimage first or not, but as you can see it is definitely doable to get kallsyms from just the boot.img

P. S. Sorry the link doesn't lead right to where I wanted it to, but there's a small convo between me and Sir Athos early in that thread and he obtains the kallsyms from the boot.img, I'll link the correct spot once I get to a pc.
[AT&T Samsung Galaxy Note 4] Monsi:
This?

http://xdaforums.com/showpost.php?p=56376783&postcount=220
[AT&T Samsung Galaxy Note 4] Surge1223:
Yep thanks.
[AT&T Samsung Galaxy Note 4] zyamys:
I have N910A with Kernel 3.10.0-2774708 with date Sept 16 2014.
[AT&T Samsung Galaxy Note 4] android-DEP:
here you go my friend, taken from my ~/WORKING_DIRECTORY/Kernel/out

system.map full size is 3,795KB unzipped, just zipped it up for the sake of being able to upload it here, hope it helps
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
The patch wouldn't be in the kernel source, it would be in the system image. Hence it's an OS exploit not a kernel exploit. And has anyone checked this out to see if Samsung back ported the 7911 exploit patch???

This is where our friend [MENTION=3975929]zxz0O0[/MENTION] comes in ;)

Yes, [MENTION=3975929]zxz0O0[/MENTION] knows the kernel exploit for writing to memory.

You'll have to use Android Image Kitchen to split the boot.img into ramdisk & split_img. I've already done this and attached the zImage from the NIE baseband below.
[AT&T Samsung Galaxy Note 4] zxz0O0:
Thanks. I've already figured it out.
[AT&T Samsung Galaxy Note 4] GabrielOspina:
How much bricked notes would it take to get root???
[AT&T Samsung Galaxy Note 4] iRashawn229:
Lol that's funny

*I'll be quiet now & let you guys get back on topic*
[AT&T Samsung Galaxy Note 4] Surge1223:
To be clear

1. The Samsung open source ZIPs are just kernel source, and in order to get the System.map you have to compile the kernel

2. Apparently this exploit is a system vulnerability? If so that won't cut it to gain root.

3. I assume the exploit dev uses the system exploit to use another exploit to leverage the kernel, in which case I doubt he posted the source for it so when I referenced the kernel source I was more meaning for him to go look and see if his exploit would effect this kernel since he alone is the one who would be able to check. Unless the cve he leverages is known, in which case anyone can check it
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
1. The source code has 2 main files (kernel.tar.gz & Platform.tar.gz) so I was assuming the plat

form.tar was everything but kernel. Since it is 1.1GB zipped :eek: Also that explains why I couldn't find that elusive system.map! I wasn't about to compile that project!

2. Yes CVE-2014-7911 is a system exploit, it will gain us System status, which is needed to get our kernel exploit to elevate us to Root.

3. I'm unsure if the exploit zxz0O0 is all his work or if it's a known exploit. Maybe he can chime in on that part.
[AT&T Samsung Galaxy Note 4] zxz0O0:
The kernel exploit is CVE-2014-4322.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Glad to see you Surge1223! ZPaul2Fresh8 is doing a great job leading the charge here and reaching out to devs with proven root methods. :highfive: And awesome that zxz0O0 is around today.

To summarize my understanding of the current situation:

We need two exploits: one to get to SYSTEM and one for the kernel. giefroot uses "CVE-2014-7911 (by Keen Team) and CVE-2014-4322 (by zxz0O0)" aka ObjectInputStream and qseecom.

If our Note 4 phones aren't vulnerable to CVE-2014-7911 (ObjectInputStream), then hopefully they are to CVE-2014-8609 (BroadAnywhere) and also hopefully it will do for the SYSTEM exploit we need.

More information on CVE-2014-8609 (BroadAnywhere) from a previous post of mine:

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58244115#post58244115

I'm not sure if we've confirmed that CVE-2014-4322 (qseecom) affects our kernel. I'm really hoping it does; since if not, then we need to also find a 3.10.0 kernel exploit (happy to do so myself. I haven't yet since I'm hoping CVE-2014-4322 (qseecom) works).

giefroot uses CVE-2014-7911 (ObjectInputStream) for SYSTEM and CVE-2014-4322 (qseecom) for the kernel:

http://xdaforums.com/crossdevice-dev/sony/giefroot-rooting-tool-cve-2014-4322-t3011598

giefroot builds on the work that went into the Mate 7 root that uses CVE-2014-7911 (ObjectInputStream) for SYSTEM and a custom kernel exploit that hasn't been detailed or given a CVE or been detailed publicly anywhere besides decompiling the exploit apk:

http://xdaforums.com/mate-7/general/wip-mate-7-root-bl-unlock-t2995086

Above thanks to the work of Liang Chen, flanker017, idler1984, and zxz0O0

Current focus is getting giefroot to run on the AT&T Note 4, but only if it's vulnerable to the exploits. ZPaul2Fresh8 of definitely knows more since he's either the furthest in investigating or is working with who is (maybe Liang Chen).

[MENTION=2634071]tylerch[/MENTION]

Thanks for helping out. If you could run these commands over adb on your dev Verizon Note 4 and post the output and upload the kallsyms file (Google Drive, mega.co.nz, wherever) it would be great:

from http://xdaforums.com/crossdevice-de...-2014-4322-t3011598/post58391696#post58391696

You probably know this but just to be sure, this is how to get the kallsyms from your phone after the above commands:

adb pull /data/local/tmp/kallsyms

[MENTION=3975929]zxz0O0[/MENTION] and [MENTION=4558078]ZPaul2Fresh8[/MENTION] would be the ones to tell you what else is needed.

I'm pretty sure zxz0O0's kernel exploit is CVE-2014-4322 (qseecom) since it lists it on the giefroot post, but definitely any information and clarification from zxz0O0 would be great.

EDIT: Ah yep, well. Here's hoping our phones are vulnerable to CVE-2014-4322 (qseecom) as well.
[AT&T Samsung Galaxy Note 4] idler1984:
I haven't checked the platform source from Samsung yet but I doubt if they do update it soon enough after every OTA release.

In our apk we just check it in runtime, like:

Class m_objStreamClassObj = ObjectStreamClass.class;
Method[] methods = m_objStreamClassObj.getDeclaredMethods();
for (int i = 0; i < methods.length; i++) {
Method method = methods[i];
String methodName = method.getName();
if ( methodName.equals("checkAndGetTcObjectClass")) {
// Not vulnerable...
}
}
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I also believe that Samsung did not patch this, but if the source is in the platform.tar.gz then I'm about to make a pot of coffee and get down to the bottom of this to finally see if 7911 is the real deal or if Sammy's R&D team plugged this hole!

Here's what Liang Chen had to say via Email:
[AT&T Samsung Galaxy Note 4] Surge1223:
Well if anyone has the kernel source downloaded, check if these patches are applied

1. https://www.codeaurora.org/cgit/qui.../?id=b9470692c228608ef0ec60747ac2732ad7ffedf0

2. https://www.codeaurora.org/cgit/qui.../?id=e909d95e6bded328e388d5b8d123297bbbb70728

Note the path drivers/ that's on the unzipped kernel dir

I'd look at the exploit myself but I see the a file is using a false header and another lzma header that I'd have to dd off, then decompress and then analyze in ida. Also noticed the gcc 4.6 obfuscation, I don't care enough to find out myself.
[AT&T Samsung Galaxy Note 4] zxz0O0:
For CVE-2014-7911 you can also check /system/framework/core.odex and search for string "checkAndGetTcObjectClass"
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I think I can confirm that the kernel exploit has NOT been patched as shown in the photos below.
[AT&T Samsung Galaxy Note 4] android-DEP:
string doesn't exist inside the odex, cannot find it
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I'm finding it in IDA. Img below.

So if I'm reading this right from [MENTION=3669069]idler1984[/MENTION] on POST #605 then exploit 7911 was addressed and will not work on our system?

I'll have to double check which Baseband I downloaded...I may have gotten the latest one... double checking now....

OK UPDATE: That search for the exploit was on the newer Baseband, so I'm trying the initial baseband (NIE) now...
[AT&T Samsung Galaxy Note 4] jpfulton248:
So does that mean it is patched?
[AT&T Samsung Galaxy Note 4] idler1984:
Yes, if this method exists then the vulnerability has been patched on this particular ROM.
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Which baseband did you search? I searched the newest one (NK3 / AT&T) and I found the function existed. I'm downloading the old baseband (NIE / AT&T) now but it's going REALLY slow. I'll update when I get it.

I bet it's not there, this would explain the possible OTA... but then again, who knows :laugh:
[AT&T Samsung Galaxy Note 4] android-DEP:
I searched the original NIE that the phone came with, not NK3
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
This makes me happy to hear :) :fingers-crossed:

This brings the question to mind , if isn't to be found in the original firmware, then why is Mr. Chen's exploitService.app denying the vulnerability???:confused:
[AT&T Samsung Galaxy Note 4] android-DEP:
something interesting i stumbled into, check out this apk made by the same person that found the broadAnywhere bug, use Chainfire's ADBMagic tool to watch the ADB logcat and launch this APK CVE201479xx.

Then press the button in the app, it's the only thing you can do in it. Watch the logcat and wait until it hits "sparying.. .. 1900" then hit the button again and do the same thing and then hit the button again and this time when it hits that spots, the phone will reboot
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
I see it's labeled CVE201479XX, but the broadAnywhere exploit is CVE-2014-8609.

Maybe it's a tool for heap spraying?...
[AT&T Samsung Galaxy Note 4] android-DEP:
it's a tool to get root for Nexus 5 on 4.4, supposedly it creates a file.txt on the system partition before restarting the device.

***AIRPLANE MODE HAS TO BE ENABLED WITH WIFI TURNED OFF***

It's the only POC for 7911 that I've been able to execute successfully on this phone, but it's really supposed to work with CVE-2014-4322_poc... this is the comment from MainActivity.java from inside this app

/*
* CVE-2014-7911 exploit for Nexus Android 4.4.4
*
* author: retme retme7@gmail.com
* website: retme.net
*
the poc will write "file.txt" into /system ,and reboot

CVE-2014-7911: app -> system
CVE-2014-4322: system -> root
*
* */

the github link to that is https://github.com/retme7/CVE-2014-7911_poc

just hoping this somehow makes it easier to implement 7911 for our purposes
[AT&T Samsung Galaxy Note 4] FiniteTime:
Awesome find android-DEP! While looking for more info I found another Github project also by retme7, here'es the previously linked Github with the one I found:

https://github.com/retme7/CVE-2014-7911_poc

https://github.com/retme7/CVE-2014-4322_poc
[AT&T Samsung Galaxy Note 4] Surge1223:
Where's the link to the latest kallsyms? That or the latest boot.img
[AT&T Samsung Galaxy Note 4] K-alz:
Sorry if this is off topic (not really), but does this sound/look legit considering that he's a junior member and he has only one post?

http://xdaforums.com/showthread.php?t=3014019
[AT&T Samsung Galaxy Note 4] android-DEP:
are these the kallsyms files you're talking about?
[AT&T Samsung Galaxy Note 4] borijess:
Just want to check. Are u guys having connection issues with xda app? Sorry for the going off topic.
[AT&T Samsung Galaxy Note 4] Sam3gX:
No issues here.
[AT&T Samsung Galaxy Note 4] idler1984:
I'm not sure what he's asking for since aboot.mbn can always be extracted from ROM tar pack directly and throw into IDA for analysis.

P.S. I did check aboot extracted from a SM-N9106W and bad news is that system partition MMC write protection is enforced in bootloader as long as androidboot.warranty_bit is still 0. I'm really interested in any idea of bypass...
[AT&T Samsung Galaxy Note 4] zxz0O0:
CVE-2014-4322 will not work like that so you can save your time compiling it.

[MENTION=4657780]android-DEP[/MENTION] did you actually try the exploit app to see if it's vulnerable to CVE-2014-7911?
[AT&T Samsung Galaxy Note 4] liquidaluminum:
This is probably useless to post, but I'm running stock 4.4.4 and I have the update service shut off. This is the info currently listed in my phone. Hope I'm not wasting time posting.

I should note that I purchased the phone in November and have received no updates since I disabled the update service.
[AT&T Samsung Galaxy Note 4] just501337:
I actually created an account to just make that one post. I know its a long shot that devs dont know how to specify a target at boot to get to a specific shell before the system daemon is handed power. However, I have been working in the linux community for ~10 years and using a target to specify a shell is how we have always obtained root on SELinux machines that have been 'locked' by ACLs.

Just trying to help!! I am pretty much a noob when it comes to android, but Im a guru with linux =]

E
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Any help is apriciated man
[AT&T Samsung Galaxy Note 4] just501337:
Is there a specific thread that the devs hang out in?

Sorry im just at work and cant dig around too much to find it.

E
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
I know the devs I work with have hangouts they hang out in
[AT&T Samsung Galaxy Note 4] just501337:
Thats exactly what I have been looking for. So what you want to do is interupt the boot process and specify a target. This will give you a shell with semi-sudo privleges before the root power is passed to the system daemon.

To interupt the boot process, you want to find the boot configuration file (which i would guess is a binary on android' and append a line to specify a target to the kernel.

On linux this is the line that starts with LinuxXX.

Once you are to a shell, you want to run a remount command to remount the FS to read write.

Then you want to run the command 'chroot /sysroot'

That should get you a sudo shell where you can run 'passwd root'

Dont forget to create a .autorelabel file so that your changes are persistent.

I really hope this helps guide you guys in the right direction. I have seen most of the discussion pointed to finding exploits. This is one that should let you aquire root despite the ACLs on a file system.

E
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
Very good insight. This is much welcomed...
[AT&T Samsung Galaxy Note 4] Surge1223:
The thing is, we can't alter any of the bootloaders or alter the kernel before boot without a bypass in the bootchain they are are signed and a failure to pass checks at any point just stops the whole boot process (secureboot 3 for reference) . Also in order to edit any binaries we'd need root. Leveraging the kernel via a custom library or binary is prob the most likely scenario here for the near future. Also our bootloaders ate encrypted but if you want to analyze aboot you can load it into ida
[AT&T Samsung Galaxy Note 4] just501337:
Ahh OK. That explains all the fuss. I'll think on it when I get home. The first thing I would do in this case is see whether ssl certs are self signed. If so, I would figure that is the weakest point in the bootloaders security. A self signed cert will be stored in a folder called pki within the virtual machine. It will contain a public keytab. That will be paired to a private keytab stored on the virtual host. The host/public keytabs will be how the virtual host controls the virual machine i.e your android OS.

E

--EDIT--

I completely misunderstood what you meant by cert. I didnt know its using UEFI secure boot. Ill deff have to do some digging when I get home and hoepfully come up with something.