yashsingh1/xdaforums huggingface dataset:
[Galaxy Note 4 Developer Discussion (Devs., Only)] DroidHelp101:
[MENTION=4939386]Surge1223[/MENTION] Hopefully this hasnt been covered but i found this stuff and wanted to share. Since its "Developer Information" i figured this is the place to leave it. I hope this will help us out...

Proof of concept exploit that allows a local application to gain system privileges via CVE-2014-7911 and then root via CVE-2014-4322. The exploit included is for a Nexus 5 with Android 4.4.4 (KTU8P). The exploit may also work on other devices if the offsets of the rop chain are modified.

Title:Local root exploit on Android 4.4.4

Author:

retme (retme7@gmail.com) [MENTION=2056652]return[/MENTION]sme on twitter.com [MENTION=6290515]retme[/MENTION] on weibo.com

homepage:

https://github.com/retme7

Related CVE Number:

CVE-2014-7911,CVE-2014-4322

Description:

A local application may gain system privilege by CVE-2014-7911,and then gain root by CVE-2014-4322.

Here is an exploit working on Nexus 5,Android 4.4.4(KTU8P).The exploit may works on you own device with Qualcomm soc and Android < 5.0 only if you modify the offsets of rop chain.

How-to-build:

1.build APK

import ./CVE-2014-7911_poc/cve20147911 into eclipse workspace,build with Android sdk.

2.build ./CVE-2014-7911_poc/cve20147911/asserts/msmattack

msmattack is the binary of file of CVE-2014-4322,you can build it with Android ndk:

$ cd ./CVE-2014-4322_poc

$ ndk-build

Details about CVE-2014-7911:

http://seclists.org/fulldisclosure/2014/Nov/51

http://researchcenter.paloaltonetwo...oid-system-service-vulnerability-exploitation

Details about CVE-2014-4322:

https://www.codeaurora.org/projects...emory-corruption-qseecom-driver-cve-2014-4322

Downloads for CVE-2014-4322_poc & CVE-2014-7911_poc.

http://packetstormsecurity.com/files/download/130112/android-root.zip
[Galaxy Note 4 Developer Discussion (Devs., Only)] mynameherebro:
It was discussed in this thread that the CVE-2014-7911 was patched in the early builds of the device firmware. Due to this, that particular exploit is non effective on these phones unfortunately. :( We are on the right track however. Keep the information coming. This is how we will obtain root in the long run. :o
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=6157272]DroidHelp101[/MENTION]

Looking above info over, but possibly previously discussed. Will send you pm after review.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
ADB Backup and Restore

Like I have been saying for over a month, ADB backup and restore seem like a good avenue to go, due to the ability to write to system.

http://seclists.org/fulldisclosure/2015/Apr/51

http://seclists.org/fulldisclosure/2015/Apr/52

Even though this is not a full fledged vulnerability because of not being able to overwrite files owned by root or system, it is an example of a start in that direction.
[Galaxy Note 4 Developer Discussion (Devs., Only)] mynameherebro:
CVE-2014-7953 I like this one.. If we can spoof system level UID 1000 There might be a way to set system and root folders to r/w. The unfortunate part is that lollipop isn't vulnerable.

Which by way of of OTA's makes it only a partial root for the device. Knowing that some users either like lollipop or don't know how to downgrade.

But yes great find. Ill be executing more code against it today. I'd like to see the full potential of this exploit.:cowboy:
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Indeed, I thought the same thing. I am looking at it as well.
[Galaxy Note 4 Developer Discussion (Devs., Only)] zxz0O0:
To hit the race condition wasn't hard.

shell@D5803:/ $ ps | grep dosomder
ps | grep dosomder
system 6597 615 887548 45948 ffffffff 00000000 S com.dosomder.testapp2

Finally struggled a bit with ddms but in the end it worked.

shell@D5803:/ $ ls -la /data/app/testSystem
ls -la /data/app/testSystem
-rw------- system system 0 2015-04-19 15:19 testSystem
shell@D5803:/ $

Any dev with correctly set up Android Studio wants to test (in the best case with N910VVRU1ANJ5)?
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Yeah, PM me. I'll take a look at what you have. And I do have Verizon and running on J5.
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
I've got Android Studio set up as well. You can send the stuff over to me too since I'm on AT&T version of Note 4.

I'm on C2 update so I'll roll back for the J5 for this.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Trak-X:
As i said here: http://xdaforums.com/showpost.php?p=60262647&postcount=1353 i have both the S5 and Note 4 with Lollipop and KK. I am willing to go back and forth on both of them to help on this. Also have the Android Studio setup as i'm into developing.

If i can help with anything, let me know.
[Galaxy Note 4 Developer Discussion (Devs., Only)] thelgog:
ill be happy to compile an apk for you guys like when the g2 got root for kitkat if thats ok for you guys which contains the automatiojn for the modded kernal or whatevers going down here
[Galaxy Note 4 Developer Discussion (Devs., Only)] mynameherebro:
OK so I've been looking and haven't yet found a way to use this to make system writable all attempts have failed.. Its nice because it offers hope but still an unrealized success at this point I'm afraid. Has anyone else been having any success aside from the initial exploit.
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
We are getting there.. Update..

So an update. We have been successful in escalating system privileges and are able to write to any area, where system uid has access, on the Note 4. Now we are moving onto coming up with a root exploit leveraging system level access.

Also, the exploit zxz0O0 came up with used with giefroot does not work to obtain root. We tested it :) Just a note. There are three devs. involved with this, not just one guy saying this and that. We all can verify this works and can be reproduced. The three of us are [MENTION=3975929]zxz0O0[/MENTION], [MENTION=4939386]Surge1223[/MENTION] and myself. For now, we are keeping the development of this amongst us until further notice. It is not a matter of not wanting others involved, but just trying to keep this manageable and somewhat structured.

Thanks to [MENTION=3975929]zxz0O0[/MENTION] for initial exploit related to CVE-2014-7953 that we modified and tweaked.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=3178012]gatesjunior[/MENTION],

I haven't received any further information from your pm you sent me. You indicated you would contact me this morning. I have yet to receive a reply. Do you not still want my assistance as I offered? From your pm it was my understanding you welcomed my input.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Yeah sorry about that. It's been a crazy couple of days. At this point we will call on you when we're in validation mode. Thanks for volunteering. You are first for testing prior to release or posting.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
I'd prefer to offer my assistance & be a part of the "Development in obtaining a root exploit leveraging system level access" as well as any testing that might come forth. If that's ok with you & the two other devs you mentioned. I don't care about any bounties or commissions, if thats of some concern. I prefer to contribute any knowledge I can in the achieval & developement of root for the Note 4 along with the recognition. That's suitable for me, lol. Let me know if that's suitable with you & the others.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
The development team has been decided, nothing against you personally. But we are already underway and this has nothing to do with bounty but to do with where we are already at and what has already been accomplished. Lets keep this to PM's if possible and keep the thread clean.
[Galaxy Note 4 Developer Discussion (Devs., Only)] KennyG123:
Thread cleaned

The suggestion was to move to PMs

It was a good suggestion

FNSM
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
Mods;

I'm posting my developement information as it does pertain to developement communications between developers in the obtaining of root on the Note 4 along with the progress that I've made as so far as it may be viably beneficial for any other developers that might read this and be able to assist with further developement of a exploit to obtain root.

For several months I've been working on obtaining root on the Note 4. 5 months ago I was successful in escalating system privileges and have been able to write to multiple areas where the system UID has access. I have ideas concerning possible deployment and delivery of an exploit. Kernel exploits may be a possibility on KitKat that I'm also looking into. I've read the CVE's and am aware of all patches.

I mentioned in a previous post that the best route to obtain root I felt was thru ADB or FastBoot as I mentioned in another post here:

http://xdaforums.com/showpost.php?p=59332181&postcount=68

I will continue to dilligently work on obtaining root on the Note 4 & welcome any other developers that have ideas.

I have contacted multiple outside resources who were successful in the rooting of other devices along with person(s) who discovered the security exploits and encouraged them to contact me in our effort to obtain root. Currently I'm brainstorming on a delivery process to give root.
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
Upon looking at my research over ADB communication and Fastboot I would have to agree with [MENTION=2260077]Android.Ninja[/MENTION] as a mean to do final root push. The other areas have been achieved and geifroot doesn't seem ideal from what I read and gatesjunior confirming my assumption that it didn't work.

I would strongly suggest you devs to work together to break down ADB communication and use that as a tool to get root situated.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
I'm so close, it's almost feels like Christmas Morning. Thank you for you input. heXacode I'm not sure how far you got in your work, but if you could pm me & let me know, I'll have a good idea how close we are. I have someone who is looking at my work and they agree during a specified point the communication process opens a door that we need to access, via ADB. I believe Mr. Pink quoted someone who could build a delivery package for me, (apk). I have a high probability if I can get a little info from you.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
I believe if we can get a complete log on ADB communication we will find some answers in there. When I say complete I mean hooking the Note 4 up to the PC/laptop and start with flashing a rollback of KK even if you are already on KK. I'm not sure what else to flash or perhaps a command to give a run down of everything that will show up in the log while on ADB. Any type of communication should be saved and posted here for us to look at so we can break it down.
[Galaxy Note 4 Developer Discussion (Devs., Only)] KennyG123:
I started handing out warning infractions, will go to full infractions and bans next!

This section is clearly marked for Developers ONLY

If you are not a developer and want to ask a question do so in your General section root thread or in Q&A

Or you WILL have a few days off from XDA
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
For those of you who want to help with ADB communication logs to post here visit this to familiarize yourself with ADB:

http://developer.android.com/tools/help/adb.html

Use this for setup, capturing and logging:

https://developer.android.com/sdk/index.html

You will need latest Java jdk tools from Oracle which you will find through download and installation of Android Studio or here's the site:

http://www.oracle.com/technetwork/java/javase/downloads/index.html

For ADB log:

http://developer.android.com/tools/help/logcat.html

Or use Gear icon to use float mode. You can Google: ADB log Android Studio for more info.

********Posts all results of ADB communication logs in Private Message for me and [MENTION=2260077]Android.Ninja[/MENTION] to review.*********

Any questions please use Private Message only.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Surge1223:
Complete ADB logs? This is going to lead to a bunch of people posting random logcat logs instead since they will get confused. It might be better served to monitor the adb communications via a debugger with breakpoints.

So in looking at the ADB protocol in android source, where do you see having the ability to leverage control over adb? Even if you are system user you won't be able to choose modified files to read/write unless you have control over the adb backup and restore process.. So what I'm asking is how you plan to hijack the adb protocol without being root user?
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
A complete ADB log is better than a pinpointed area. You don't have to support this as you are working with gatesjunior and the other dev. Android.Ninja and I are looking more into this area for ADB because we want to and feel there's more to it than previously discussed.
[Galaxy Note 4 Developer Discussion (Devs., Only)] KennyG123:
Please have them PM you the logs. We do not want non-devs posting logs then asking questions. Thank you.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Surge1223:
Did you execute the code for bindBackup in native thread?
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=3508760]heXacode[/MENTION];

•I have received quite a few logs from XDA contributors.

In the process of examining logs with additional support outside of US.

(Thank You to all contributors, however please do not post here, contact me via pm.)

•Emailed Linux Research contact to look at my findings. Possible security breach located.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
Request for knowledgeable developer with experience building package file (apk.) Contact me via pm ONLY.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=3508760]heXacode[/MENTION];

WooHoo! Informed by Linux Security contact there's a very high probability my original & initial findings were correct. A modified exploit may indeed work for the Note 4. I'm awaiting responses from other sources to confirm. Fingers crossed!

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] elliwigy:
So you mean the original findings by [MENTION=481303]Keen[/MENTION]Team will work? Surely it will since they are well known! Happy modding!

http://seclists.org/oss-sec/2015/q2/333
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Nice
[Galaxy Note 4 Developer Discussion (Devs., Only)] heXacode:
Excellent. Keep me informed as I continue looking at that area and also the new find by TeamKeen.
[Galaxy Note 4 Developer Discussion (Devs., Only)] hsbadr:
Developers Disscussion

To all devs here,

I do respect your decission & right to do whatever you wish with your work/progress; closed groups are also the best way to go if you're very close to put the final touches. However, I'd rather prefer to work together in order to achieve root access for these devices sooner than later. Time is really a very important factor (soon, we'll add Note 5 to the list with more challenges & likely less interest in Note 4 development) unless we end up with a generic method that breaks security barriers for many devices.

To be honest, I'm a bit dissappointed here b/c I was expecting devs sharing technical info that could help other devs building on it instead of reinventing the wheel. That being said; I'd be glad to offer my help with no credit required, just to make this happen if possible at all.

BTW. These two devices (N910V/A) now have many recovery solutions: FlashFire, MultiSystem (MultiROM & Recovery Replacement), & probably other options in the works. Yes, for me, I've tested MultiSystem on VZW Note 4 DevEd & it doesn't require unlocked bootloader (actually designed for the most locked-down devices). It has also been released for VZW Note 3 & being tested for other devices.

All of these great things are pending root access. So, let's get it done ;)

Best,

hsbadr
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
Implementation of modified security exploit on Note 4 is on the board. (High Probability)

•Reviewing new findings by KeenTeam pertaining to S6 to see if it will work on Note 4.

•I've received pm's from XDA members volunteering to test.

(When we're ready to start testing, I'll open a new thread in the appropriate forum for Alpha/Beta testing.)

•If security exploit can be modified to work on Note 4, I will need a qualified developer to assist in package delivery.

•I have received reply from overseas developer willing to assist in Linux issues.

•Anyone with ideas please pm me. We all want root.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] hsbadr:
I'd be glad to assist in testing & packaging + could also fix issues if any + no credits required. Let me when you're ready & if you need any help!
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=5868929]hsbadr[/MENTION],

I'll be honored if you will assist in the package etc. I'm endowed in code, however lack some intermediate knowledge in the packaging. I'll pm you when ready.

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] hsbadr:
Great! I'll be eagerly waiting for your PM. Good luck!
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
[MENTION=3508760]heXacode[/MENTION]

I've sent a modded exploit to my Linux Security Specialist for his overview and thoughts. He replied the exploit was shut down due to a slight oversight on my end. I corrected issue and resent to him again for advisory summary. We are closing in..

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
In the process of attempting to develop a tool which will implement root / install Super User. It will trip Knox, however you will not lose root when you reboot. ?

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] KennyG123:
http://xdaforums.com/showpost.php?p=60394236&postcount=148

'Nuff said?

You have threads in your General sections...THAT is where your questions belong!

Final warning. Non-Dev posts earn 5 point infractions from this point forward

Other option is we close this thread...then any developer can PM us when they are ready to post
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
So, for everyone's clarification. Implement root, meaning you already have it and are just looking at being able to build a tool to exploit your vulnerability correctly to gain root and install Super User ? Because that is the way your post reads. Also, care to provide any evidence of your progress to a moderator, our group has already done this and has shown the system level escalation as evidence to him first hand. After all, they moderate these threads. The least we can do is show them the "proof in the pudding" as it is said. Especially due to past people coming in and making claims that cannot be backed up and getting everyone's hopes up.
[Galaxy Note 4 Developer Discussion (Devs., Only)] Android.Ninja:
Let's see....

•Evidence would be in the form of releasing a tool (app) or a method (?), with proper detailed instructions, If and when, the accomplishment, research, & testing is finalized, perfected, and polished, & a new thread opened stating such. To clarify further, we will clearly state that just for you.

•Let's keep this thread clean by sending pm's of this nature. You may refer to the prior post:

Developers don't need no stinkin' signature!

If I've been able to help you, please hit the "Thanks" button. ;)
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Note 4 rooted, VZW, Build NI1.. Use Kingroot v4
[Galaxy Note 4 Developer Discussion (Devs., Only)] jolly_roger_hook:
its temporary roboot removes it and no superuser able to be downloaded only kinguser
[Galaxy Note 4 Developer Discussion (Devs., Only)] cstayton:
temp root only, after restart you'll lose root (at least in my test that happens) even modded the apk to install SuperSU 2.46 and updated binary still lose root after restart. any thoughts on that?
[Galaxy Note 4 Developer Discussion (Devs., Only)] gatesjunior:
Root achieved, Kingroot v4 NI1 build VZW Note 4.
[Galaxy Note 4 Developer Discussion (Devs., Only)] TechBSwift:
to all be careful using kingroot... I've successfully rooted my Verizon note edge. I've tried to replace kinguser (su) with supersu and it will not allow you to do so. kinguser appears to have embedded code all over the system files, and is contacting multiple sites in the background. I'm not saying it's stealing your data, I'm merely saying be careful until devs have a chance to see if there's any real danger before you go installing on your devices.

ALSO

I've successfully rooted a tmobile s5 just now as well using kingroot from stock, installed a custom recovery, and successfully flash supersu 2.49 in recovery. this process remove kinguser and I still retained root after the reboot on the s5.

here's note edge proof

Sent from my SM-N915V
[Galaxy Note 4 Developer Discussion (Devs., Only)] sfld:
So even with replacing king user with su it still is only a temp root?
[Galaxy Note 4 Developer Discussion (Devs., Only)] cstayton:
that was my experience however, i did modify the kingoroot apk to have SuperSU and binary as the components nothing was modded as far as how or what exploit was used to inject the files.
[Galaxy Note 4 Developer Discussion (Devs., Only)] TechBSwift:
just an fyi PingPongRoot dropped for the s6, instructions can be found here, and it also explains how to push supersu instead of kinguser... this is not a temp root for the s6, but yet to be confirmed working for the Verizon & AT&T versions.

http://xdaforums.com/showthread.php?p=60600131

Sent from my SM-N915V
[Galaxy Note 4 Developer Discussion (Devs., Only)] jolly_roger_hook:
Can u release the moded apk so others can mess with it

Sent From The EDGE
[Galaxy Note 4 Developer Discussion (Devs., Only)] cstayton:
nope sorry, copyright laws prohibit that (since i work in the legal profession i tend to be a stickler on that sort of thing)

i made the mods for my own purpose and to provide info to the devs working on full root for us, i am currently back on 5.0.1 OEM and don't plan on going backwards again until we have full root and either flashfire or multisystem confirmed working.
[Galaxy Note 4 Developer Discussion (Devs., Only)] jolly_roger_hook:
I understand thanks

Sent From The EDGE
[G2 Q&A, Help & Troubleshooting] Costas195:
I start from recovery mode and i remove all system, data and twrp recovery mode what can i do right now??
[G2 Q&A, Help & Troubleshooting] d00lz:
Return to Stock via Download Mode.
[G2 Q&A, Help & Troubleshooting] tchapa:
hi I have a problem for lg g2 32gb at the sim card it detects the card only for moments