yashsingh1/xdaforums huggingface dataset:
[AT&T Samsung Galaxy Note 4] munjeni:
Its not obfuscated if you think about file called "main"! It is 7z archive but removed first 2 bytes "7z" or hex "377A", just simple open "main" file with hex editor and append 2 bytes 37 7A to the start of the file and save them! :) It is password protected 7z archive and you must research for password in asembly if you think to open them with 7z ;) I stil have no idea what is purpose of these "main" file (malware?) when there is another one "main" file (tar.gz) which is extracted when you execute file "a", but I know thats a two diferent "main" files!
[AT&T Samsung Galaxy Note 4] munjeni:
I don't know if you see them but I can see that you are allready a system user, see your seccond log, you can see system@trlteatt!
[AT&T Samsung Galaxy Note 4] zxz0O0:
Any other proof like a real firmware or a screenshot, etc.? If he is right, what are you waiting for? Flash the firmware and root it.

[MENTION=4120742]munjeni[/MENTION] he just changed USER variable. He does not have system privileges.

shell@D5803:/data/local/tmp $ export USER=root
export USER=root
root@D5803:/data/local/tmp $

Would be too easy, right
[AT&T Samsung Galaxy Note 4] Trip64:
? Is there any reason to believe that 5.0 would be easier to root? Or harder?
[AT&T Samsung Galaxy Note 4] howellcp:
Harder. Let's focus on the current road.
[AT&T Samsung Galaxy Note 4] jpfulton248:
The 7911 exploit apk checks for "checkAndGetTcObjectClass" and then halts if it finds it, right? Can we just remove that check and see if it runs?

I mean, the assumption is that it is stopping and showing "Device seems not vulnerable" because it actually found "checkAndGetTcObjectClass" but it could be an error in the code that's causing that... slim chance but possible.
[AT&T Samsung Galaxy Note 4] jorgasm209:
Not sure how to prove something that isn't there... hard to prove a negative. APK is claiming not vulnerable even with the apparent absence of checkAndGetTcObjectClass in the firmware. Someone much smarter than me can attempt to find out why :) My bet is on [MENTION=4657780]android-DEP[/MENTION] ... see post above regarding ServiceExploitActivity.java.
[AT&T Samsung Galaxy Note 4] NYYFan02:
I don't know what any of this means but i like the fact it's been busy and there's lots of talk about stuff i dont understand, keep up the good work phone hacker people :)
[AT&T Samsung Galaxy Note 4] munjeni:
Yes, its nothing :)
[AT&T Samsung Galaxy Note 4] munjeni:
I think you guys need to look into logcat at the same time when you run bat file, just for for more info and idea, and post log here for analyse!

on your device using terminal emulator you can start loging:

cd /data/local/tmp

logcat >logcat.log

on PC start system exploit by runing bat file...

post your log from /data/local/tmp/logcat.log
[AT&T Samsung Galaxy Note 4] Surge1223:
I think we are looking at two different files lol. I'll try to find the link and download to take a look.
[AT&T Samsung Galaxy Note 4] FiniteTime:
Just to see what it does, this seems worth trying to me. Say while doing logcaat like munjeni is saying.
[AT&T Samsung Galaxy Note 4] jpfulton248:
So I know enough java to print "Hello World" so if someone thinks it's worth taking a stab at it please do. Do we have enough source to modify and recompile the apk?
[AT&T Samsung Galaxy Note 4] turbofirefox:
I don't know that it will do any good... but, here's my logcat file from NJ5... I removed all of the lines until the apk install... it's still over 1700 lines. I do have the full log file if it will help.

PS - if I can find source, I can attempt to run the program from Android Studio in debug mode... I am thinking that if we are getting a specific error or issue which is causing the exploit to fail, that error might be easier to see in Android Studio.
[AT&T Samsung Galaxy Note 4] howellcp:
Nj5 is patched. Anything that is tested needs to be on stock firmware.
[AT&T Samsung Galaxy Note 4] zxz0O0:
So to confirm it one more time, I've downloaded lowest firmwares for AT&T and Verizon to verify

Verizon N910VVRU1ANI1: CVE-2014-7911 patched

AT&T N910AUCU1ANIE: CVE-2014-7911 patched

How did I verify: Opened system.img.ext4 in hexeditor and searched for checkAndGetTcObjectClass, both have them.
[AT&T Samsung Galaxy Note 4] howellcp:
Damn it.
[AT&T Samsung Galaxy Note 4] jpfulton248:
Oh wow
[AT&T Samsung Galaxy Note 4] DroidHelp101:
S.O.B. back to square one huh?
[AT&T Samsung Galaxy Note 4] iRashawn229:
You beat me to it lol
[AT&T Samsung Galaxy Note 4] jpfulton248:
Is there another CVE that looks promising for obtaining system?
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Check this out..

What about CVE-2014-8609 ???

Heres the description on it:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-8609
[AT&T Samsung Galaxy Note 4] mikeius89:
Isn't that similar to what the lowest part is?
[AT&T Samsung Galaxy Note 4] zyamys:
Looks good, but how would you use it to gain root? I'd be willing to play with this exploit if someone has an idea on how to make use of it.
[AT&T Samsung Galaxy Note 4] android-DEP:
yes sir, hit the nail on the head, but thats when you're in adb shell, if it crashes and you get kicked from it and have to restart adb shell, everything will be back to normal.

I was just trying to see the extent of how much can be modified "temporarily", pointless really, dont know why i did that
[AT&T Samsung Galaxy Note 4] FiniteTime:
To confirm zxz0O0's findings, did some checking. untar, simg2img, mount, grep and:

checkAndGetTcObjectClass is present in system.img.ext4 from ALL_ATT_N910AUCU1ANIE_N910AATT1ANIE_CL2774708_QB2373670_REV00_user_low_ship_MULTI_CERT.tar.md5 in the files:

/mnt/framework/core-libart.odex

/mnt/framework/core.odex

Not present anywhere in the NIE or NK3 source code though (SM-N910A_NA_KK_Opensource.zip), so I guess that means the source doesn't match our actual ROMs exactly. That's kind of concerning.

Requoting since we need a new CVE, good resource for CVEs.

Quoting this again since until we find another workable exploit, it's a longshot but something to try, right? Someone with a build environment mind putting together a test apk?

Seconding wondering about CVE-2014-8609 (BroadAnywhere), would it work to get to SYSTEM?
[AT&T Samsung Galaxy Note 4] android-DEP:
those 3 have been the main topic of discussion for a the last 100 posts or so, it's really all there is to exploit on this phone. If those 3 could be combined, it would be a solid way to root.

i think best bet would be to goto the source, contact the guy that wrote some of these POC exploit apps, see if he's of any help
[AT&T Samsung Galaxy Note 4] ZPaul2Fresh8:
To clarify, CVE-2014-4322 is NOT patched in ANY baseband version on our devices. CVE-2014-7911 is the patched.

From [MENTION=3669069]idler1984[/MENTION] , here's the explanation of the 'a' and 'main' files. HERE.

It's been confirmed by me that exploit CVE-2014-7911 has been patched in the latest OTA (NK3 on AT&T) and I believe [MENTION=3975929]zxz0O0[/MENTION] confirmed it on the earlier baseband too. If you're in doubt and you're running the earlier build, just go to system/framework/core.odex and you'll find the function is located there...

Now if you're just skimming through here let me catch everyone up to speed here;​

At this point in order to achieve root for our devices we will need a combination of exploits. There are a ton of CVE's being thrown and I can see why people are getting confused so I'll try to make it easier to understand. I'll break it down by CVE #.

CVE-2014-7911 - Patched so it doesn't matter. Android OS exploit to gain System UID. Not Root

CVE-2014-8609 - Android OS exploit. Possibly our next venture for gaining System UID, I've been told otherwise but it looks suspect if you ask me.

CVE-2014-4322 - Kernel exploit. Un-patched. Used to get Root while in System status.

So we need an exploit to get us System status and from there we pretty much have CVE-2014-4322 exploit to get Root from there.

Now, you may have read about Root solutions such as geifroot & 2014-79xx but forget about them because they are all based on Team Keen's exploit of CVE-2014-7911 which we confirmed has been backported and patched from day 1 on our devices. So in order to proceed we need a new exploit to get System status first...

Finally home after work to check this forum :) Now my question to all, Are we sure CVE-2014-8609 won't get us system uid? Is not a pending intent with system uid viable?
[AT&T Samsung Galaxy Note 4] zyamys:
Agreed.
[AT&T Samsung Galaxy Note 4] badboyg200:
I am on a Verizon pre-OTA and clicking on "open terminal as system UID" does nothing at all.
[AT&T Samsung Galaxy Note 4] stvn1337:
Okay, what about the receive fake sms from 911? That one is unmodified and if your vulnerable to this exploit it will work.
[AT&T Samsung Galaxy Note 4] junjlo:
The fake text from 911 works on per ota vzw note 4
[AT&T Samsung Galaxy Note 4] stvn1337:
okay,Im going to recheck the intent used to open terminal emulator and make sure I used the right intent and did it properly. Thanks for your help guys.
[AT&T Samsung Galaxy Note 4] iRashawn229:
It didn't work for me. NI1 vzw

I can make fake 911 texts all day tho
[AT&T Samsung Galaxy Note 4] DroidHelp101:
Same result NIE at&t
[AT&T Samsung Galaxy Note 4] stvn1337:
Yeah, it looks like the intent to open the terminal is handing off correctly but the amount of time it takes for the terminal to open is longer than the amount of time the pending intent has before it exits, killing the settings thread and essentially the intent it was passed. I may be wrong though.. I'll look into this more tomorrow and see what I can come up with.
[AT&T Samsung Galaxy Note 4] jpfulton248:
Mine opens the settings app on NI1
[AT&T Samsung Galaxy Note 4] thanitos:
To be accurate, if you close all recent apps then push the button nothing happens but if you hit the button after looking at settings it brings up settings
[AT&T Samsung Galaxy Note 4] EMDrNote:
Could this load timeout issue be ameliorated by simply i trying the exploit in ART instead of Dalvik instead? Not sure whether that would ruin the exploit itself but if not and it's a simple timeout problem, it would seem that precompiling the app might allow it to beat the expiration time.
[AT&T Samsung Galaxy Note 4] jpfulton248:
Yeah I ran it again after. If settings app is running then it pops up... if not nothing happens.
[AT&T Samsung Galaxy Note 4] waco2hot33:
Bad link !!

Edited: My Bad.. Bad Browser !!
[AT&T Samsung Galaxy Note 4] jpfulton248:
It's from September 7th. Our kernel is September 16th. Should be interesting to see if they patched it.
[AT&T Samsung Galaxy Note 4] :
Unless I'm searching wrong I could not find any of the lines in red or green the NI1 build. I decompiled SecSettings and searched AddAccounts.smali. I'm pretty new at this thing so I might be searching for the wrong thing. Attached is the file to search if anyone wants to take a look.

View attachment 3137977
[AT&T Samsung Galaxy Note 4] jpfulton248:
Would inclusion of the red/green lines indicate that the patch has been made? Should the other portions of text from the link be included as well? Because I'm not finding that either.
[AT&T Samsung Galaxy Note 4] :
Same here, I searched for those too.
[AT&T Samsung Galaxy Note 4] jpfulton248:
Related question... when I press "Receive Fake 911 Text" I see a window flash and disappear very quickly. I can't really see much of it except at the top it says "Add Account". Any idea what it is or why? Also, I don't receive a 911 text.
[AT&T Samsung Galaxy Note 4] munjeni:
I don't know, I stil receiving sms from 911, only unable to get terminal emulator on button click
[AT&T Samsung Galaxy Note 4] jpfulton248:
No my phone is receiving sms in general but just doesn't receive the 911 text. This is what was happening for me on the previous version of this apk too.
[AT&T Samsung Galaxy Note 4] munjeni:
Than its sure that your phone is not vulnerable to this exploit.
[AT&T Samsung Galaxy Note 4] DroidHelp101:
I have the same results you do. No terminal opening. But 911 sms works. AT&T NIE
[AT&T Samsung Galaxy Note 4] jpfulton248:
Is this expected behavior? See screenshot...
[AT&T Samsung Galaxy Note 4] stvn1337:
Yes for the 8609 exploit to work the code has to inject a fake/null account. Once that happens we get back a pendingIntent which we are attempting to use to gain system uid in a terminal right now.
[AT&T Samsung Galaxy Note 4] jpfulton248:
EDIT: Got the fake SMS working now.
[AT&T Samsung Galaxy Note 4] Surge1223:
BTW terminal emulator is open source, searching it should be relatively painless.
[AT&T Samsung Galaxy Note 4] munjeni:
Not sure but from my first look into logcat before I implemented terminal emulator into exploit apk, I had seen something about uid 1000 before it tried to open terminal emulator, anybody confirm this? If that is right than probably why we need terminal? Why not write direct root exploit call from it?! I will modify function superuser and write echo "id" to the tmp folder tommorow to see which user runing command
[AT&T Samsung Galaxy Note 4] jorgasm209:
[MENTION=4939386]Surge1223[/MENTION] Just wanted to say thank you for helping us along. I know you have moved on from these locked down devices, yet you still take the time to post here and try to help move us along in the right direction. I commend you and personally thank you sir. There aren't many like you and it truly is appreciated by all.
[AT&T Samsung Galaxy Note 4] munjeni:
I have downloaded terminal emulator this day, now I got another terminal emulator update notification, probably its patched maybe some days ago after maintainer found info about cwe
[AT&T Samsung Galaxy Note 4] hiperglyde:
What if an older version of that app was used?
[AT&T Samsung Galaxy Note 4] jorgasm209:
Older version from June here. http://m.apkhere.com/down/jackpal.androidterm_1.0.61_free
[AT&T Samsung Galaxy Note 4] stvn1337:
I'm not sure if system user can root without the kernel being invloved. Invoking the supersu install binary intent would be too easy right?[emoji30]
[AT&T Samsung Galaxy Note 4] xlr8shun:
Only one way to find out.. right? Following closely, this is very interesting. Thanks to all involved.

Oh.. and looky there you got post 777.. maybe thats a sign... ;)
[AT&T Samsung Galaxy Note 4] swaj:
I'm actually working on the CVE-2014-8069 exploit on my Verizon Note 4, too. So far I've got the apk executing my custom authenticator, but terminal emulator will not launch. I'm going to try that older APK and see if it works. I'm gonna try to get an `id` output from it if I can.
[AT&T Samsung Galaxy Note 4] vsn4:
Really appreciate the work you guys are putting forth! Very exciting! Thank you all!
[AT&T Samsung Galaxy Note 4] mva1985:
I downloaded that older emulator and it installed just fine and executed for me on my verizon note 4

sorry I know this is the at&t thread just wanted to reply
[AT&T Samsung Galaxy Note 4] jolly_roger_hook:
Using old terminal emulator I got the command to run but it just opened about phone settings (note 4 edge vzw)
[AT&T Samsung Galaxy Note 4] junjlo:
Pre OTA GN4 vzw with old terminal still doesn't open terminal.
[AT&T Samsung Galaxy Note 4] swaj:
If it creates the terminal but doesn't bring it to the FG, we can issue a command directly into the terminal emulator as outlined here: https://github.com/jackpal/Android-...erminal-Emulator-for-Android-from-another-App

I'm in the process now of backing my phone down to the NI1 firmware, because I can't get any intents to launch with this method on NJ5.

---------- Post added 29th January 2015 at 12:27 AM ---------- Previous post was 28th January 2015 at 11:52 PM ----------

I have another idea which actually doesn't involve the terminal emulator at all. Going to see if I can make it work tomorrow.
[AT&T Samsung Galaxy Note 4] munjeni:
I have redirected output from Our CVE-2014-8609 of command "id" and it reports uid 10206 which is unprivileged user, so its not working!

Strange thing CWE succesfully add account with uid 1000:

Probably we can try with android.os.SystemProperties to change something in prop if we are realy a system user?

String secure = null;

try {

Class<?> c = Class.forName("android.os.SystemProperties");

Method get = c.getMethod("get", String.class);

secure = (String) get.invoke(c, "ro.adbsecure");

} catch (Exception ignored) {

}
[AT&T Samsung Galaxy Note 4] zxz0O0:
The exploit lets you send broadcast with system uid, but not execute code. So this won't work.
[AT&T Samsung Galaxy Note 4] turbofirefox:
I thought that's what they were testing... if the exploit lets you send a broadcast with system permissions, then modify it so that it fires off the CVE-2014-4322 - Kernel exploit with system permissions... am I wrong?
[AT&T Samsung Galaxy Note 4] zxz0O0:
This is not how broadcasts work. "Firing off" would be running code, which is, as I mentioned before, not possible.
[AT&T Samsung Galaxy Note 4] jpfulton248:
So back to looking for another CVE to get system?
[AT&T Samsung Galaxy Note 4] turbofirefox:
Correct, the broadcast cannot run any code. But, in the exploit instead of calling the broadcast, it would call the exploit apk. (are we saying the same thing, just in a different way?)

Per the link that [MENTION=4558078]ZPaul2Fresh8[/MENTION] posted here: http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post58471550#post58471550 , the exploit for CVE-2014-8609 does "fire off" an intent with elevated permissions. In the case of the POC, they are sending an "android.provider.Telephony.SMS_RECEIVED" intent action... but, I'm saying I think it could be changed to fire of an intent action to open the exploit.apk with system permission. Does that make sense? ...if not, don't worry about it. It wouldn't be the first time I don't explain myself very well. lol
[AT&T Samsung Galaxy Note 4] Ghstudent:
Okay, fingers crossed!
[AT&T Samsung Galaxy Note 4] ryudosama:
Definitely appreciate the time invested and the positive attitude. I hope you get it rooted successfully. :thumbup:
[AT&T Samsung Galaxy Note 4] hnic32:
What were the errors?
[AT&T Samsung Galaxy Note 4] allenjthomsen:
I got an error saying system.img was invalid

Fixed it already just got busy with cm12 for note 4 will try to get you guys the tar today

So you guys can test

Please be patient am currently working on 6 differnt things in 3 differnt threads
[AT&T Samsung Galaxy Note 4] Simsron1:
Yes, I was a freelance Mobile Security Analyst for novice applets beginning on Android. Since moved on from it, but I have been involved in exploitation for a little bit now. As of yet the only thing I have to do with it is root, on the end user side. It seems as if you're not intrigued by the thread, due to most of your comments having a negative stature. Nonetheless, that's not what this thread was designed to do. I appreciate your question, but let's stay on topic, perhaps?
[AT&T Samsung Galaxy Note 4] Simsron1:
Good luck buddy! Thanks for keeping us updated! :)
[AT&T Samsung Galaxy Note 4] pr0cl1v1ty:
Sweet! Just knowing someone is looking into root is amazing! Thank you.
[AT&T Samsung Galaxy Note 4] hnic32:
No problem, we just want to know if we can be of any help. Thanks for keeping us posted.
[AT&T Samsung Galaxy Note 4] JimmyJunk:
This is very exciting, thanks for your efforts! I have my donation ready to send[emoji4]
[AT&T Samsung Galaxy Note 4] Xak:
When you say you fixed it does that mean you got it working at least for you? If so cool as product1v1ty said glad someone is working on root for us. I'll be glad to test as well after 2 people say it works just not before that because only one phone at the moment and need it for college. >.<

My sig is shown wrong but its correct on the control panel on how i want it, sgn4 att is my current device
[AT&T Samsung Galaxy Note 4] Volvogia:
Im loving that someone is working on this but I do have a question if someone is able to answer it. This being built on the N1E update or the NK3? Since most of us have the NK3 now, (I believe?) or will it matter at all if we are on N1E or NK3? Maybe none of this matters at all. Thats why I am asking. Im here to learn!

Also, has anyone here saw this yet???

http://www.techworm.net/2014/12/new-fakedebuggerd-android-vulnerability.html#prettyPhoto
[AT&T Samsung Galaxy Note 4] Monsi:
Same question here
[AT&T Samsung Galaxy Note 4] holywhitebread:
I know this was posted in the Verizon Note 4 bounty thread, so I think someone has already jumped on it. Not getting my hopes up, but it's a good sign!
[AT&T Samsung Galaxy Note 4] Volvogia:
Oh okay, great! I havent checked over there yet. Guess that may be a good idea lol! Does look like a good sign!
[AT&T Samsung Galaxy Note 4] Simsron1:
Verizon users are reporting updates to their phones. I do not know how true this is, but many believe it is the patch to this exploit (Fakedebuggerd). Defiantly DO NOT UPDATE.
[AT&T Samsung Galaxy Note 4] Volvogia:
If that is what the NK3 update is for for us AT&T users, then most of us didnt have a choice. I got forced to do it yesterday evening. After 4 times of hitting postpone throughout the day, it finally didnt give me the option and restarted on its own and did the update. Sure hope it doesnt fix the Fakedebuggerd exploit. I do have a question then... The articles i read about the exploit said it works on every version for android, especially aimed at 4.x. Now since it works on all versions, wouldnt that have to do with the Android OS itself having the vulnerability or could a patch from AT&T, Verizon, ect fix that?
[AT&T Samsung Galaxy Note 4] Simsron1:
I do not know if that update patched it, I do not believe so.
[AT&T Samsung Galaxy Note 4] Xak:
Even if it's NK3 that stops us a factory master reset i think should bring back before the nk3 update.
[AT&T Samsung Galaxy Note 4] Volvogia:
Do you know if anyone has confirmed that doing a Odin flash back to stock firmware (N1E) works coming from the NK3 update? I saw some people posting in the NK3 Update post about that being asked but no one answered it I dont believe.
[AT&T Samsung Galaxy Note 4] FiniteTime:
For anyone that had the update forced, did you disable automatic security policy updates? I don't want to jinx it but I get a "learn how you can protect your device more by enabling..." notification every so often but I just clear it. I haven't gotten anything about any updates. Also in Play Store set to not auto update any apps.

The NIE and NK3 firmware both list the same kernel but do have a different number after the - (from screenshots), so it might be fixed. Fakedbuggerd issue, if all it uses is CVE-2014-3153 might even be fixed in NIE since it was disclosed publicly in June. Really hoping allenjthomsen has some powerful magic.

EDIT:

Definitely seconding this, I haven't installed the update yet but would really like to know if this is possible. For root and other things.
[AT&T Samsung Galaxy Note 4] scoder:
From what I understand, the exploit is that the broadcasts can be intercepted or sent by other/rogue applications. This doesn't change the way the broadcasts themselves work, so calling any kind of code from a broadcast wouldn't be possible.
[AT&T Samsung Galaxy Note 4] zxz0O0:
You can open other apps using broadcast, that's correct. However, this won't change the user id of the app you just opened. That is controlled by android:sharedUserId.
[AT&T Samsung Galaxy Note 4] stvn1337:
So in other words, we can hit intents that only system user can normally hit by using this cve. However we can't launch another app with uid 1000 because of the shared userid.
[AT&T Samsung Galaxy Note 4] TTA1326:
Never mind...
[AT&T Samsung Galaxy Note 4] zxz0O0:
Android uses bionic, not glibc.
[AT&T Samsung Galaxy Note 4] TTA1326:
Thanks, I figured that out by reading several different sites lol. So, why is Clean Master warning me on my phone?