[E 2015 Q&A, Help & Troubleshooting] DBlake1:
StageFright PoC crash log...

Hopefully this can help someone get started on a root exploit for our phones. I would, but I have absolutely NO knowledge of Android's inner workings or C++ASM.

I/DEBUG ( 277): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 277): Build fingerprint: 'motorola/surnia_verizon/surnia_cdma:5.1/LPI23.29-17/18:user/release-keys'
I/DEBUG ( 277): Revision: 'p300'
I/DEBUG ( 277): ABI: 'arm'
W/NativeCrashListener( 814): Couldn't find ProcessRecord for pid 18799
I/DEBUG ( 277): pid: 18799, tid: 18847, name: generic >>> /system/bin/mediaserver <<<
E/DEBUG ( 277): AM write failure (32 / Broken pipe)
I/DEBUG ( 277): signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr --------
I/DEBUG ( 277): r0 00000000 r1 0000499f r2 00000006 r3 00000000
I/DEBUG ( 277): r4 b50b3dd8 r5 00000006 r6 0000000c r7 0000010c
I/DEBUG ( 277): r8 0000000c r9 ffffffff sl b6f44de4 fp 00000000
I/DEBUG ( 277): ip 0000499f sp b50b2fe8 lr b6effe21 pc b6f25eac cpsr 60070010
I/DEBUG ( 277):
I/DEBUG ( 277): backtrace:
I/DEBUG ( 277): #00 pc 0003ceac /system/lib/libc.so (tgkill+12)
I/DEBUG ( 277): #01 pc 00016e1d /system/lib/libc.so (pthread_kill+52)
I/DEBUG ( 277): #02 pc 00017a3b /system/lib/libc.so (raise+10)
I/DEBUG ( 277): #03 pc 000141b1 /system/lib/libc.so (__libc_android_abort+36)
I/DEBUG ( 277): #04 pc 00012718 /system/lib/libc.so (abort+4)
I/DEBUG ( 277): #05 pc 00001479 /system/lib/libstdc++.so
I/DEBUG ( 277): #06 pc 00000c69 /system/lib/libstdc++.so (operator new[](unsigned int)+16)
I/DEBUG ( 277): #07 pc 000a2949 /system/lib/libstagefright.so (android::SampleTable::setSampleToChunkParams(long long, unsigned int)+124)
I/DEBUG ( 277): #08 pc 0008042f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1798)
I/DEBUG ( 277): #09 pc 0008013f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1046)
I/DEBUG ( 277): #10 pc 0008013f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1046)
I/DEBUG ( 277): #11 pc 0008013f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1046)
I/DEBUG ( 277): #12 pc 0008013f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1046)
I/DEBUG ( 277): #13 pc 0008013f /system/lib/libstagefright.so (android::MPEG4Extractor::parseChunk(long long*, int)+1046)
I/DEBUG ( 277): #14 pc 00081653 /system/lib/libstagefright.so (android::MPEG4Extractor::readMetaData()+58)
I/DEBUG ( 277): #15 pc 00081843 /system/lib/libstagefright.so (android::MPEG4Extractor::countTracks()+4)
I/DEBUG ( 277): #16 pc 000abe2d /system/lib/libstagefright.so (android::ExtendedUtils::MediaExtractor_CreateIfNeeded(android::sp<android::MediaExtractor>, android::sp<android::DataSource> const&, char const*)+60)
I/DEBUG ( 277): #17 pc 00090a91 /system/lib/libstagefright.so (android::MediaExtractor::Create(android::sp<android::DataSource> const&, char const*)+568)
I/DEBUG ( 277): #18 pc 0005bc59 /system/lib/libmediaplayerservice.so (android::NuPlayer::GenericSource::initFromDataSource()+140)
I/DEBUG ( 277): #19 pc 0005c635 /system/lib/libmediaplayerservice.so (android::NuPlayer::GenericSource::onPrepareAsync()+428)
I/DEBUG ( 277): #20 pc 0005cf77 /system/lib/libmediaplayerservice.so (android::NuPlayer::GenericSource::onMessageReceived(android::sp<android::AMessage> const&)+58)
I/DEBUG ( 277): #21 pc 0000c533 /system/lib/libstagefright_foundation.so (android::ALooperRoster::deliverMessage(android::sp<android::AMessage> const&)+166)
I/DEBUG ( 277): #22 pc 0000beb5 /system/lib/libstagefright_foundation.so (android::ALooper::loop()+220)
I/DEBUG ( 277): #23 pc 00010559 /system/lib/libutils.so (android::Thread::_threadLoop(void*)+112)
I/DEBUG ( 277): #24 pc 0001012f /system/lib/libutils.so
I/DEBUG ( 277): #25 pc 00016607 /system/lib/libc.so (__pthread_start(void*)+30)
I/DEBUG ( 277): #26 pc 0001451b /system/lib/libc.so (__start_thread+6)
I/DEBUG ( 277):
I/DEBUG ( 277): Tombstone written to: /data/tombstones/tombstone_03
I/BootReceiver( 814): Copying /data/tombstones/tombstone_03 to DropBox (SYSTEM_TOMBSTONE)
W/AudioSystem( 814): AudioPolicyService server died!
W/AudioSystem( 278): AudioFlinger server died!
W/AudioSystem( 814): AudioFlinger server died!
W/IMediaDeathNotifier( 4892): media server died
E/MediaPlayer( 4892): error (100, 0)
W/AudioSystem( 4892): AudioFlinger server died!
E/MediaPlayer( 4892): Error (100,0)
D/VideoView( 4892): Error: 100,0
D/PopVideoPlayer( 4892): onError what 100 extra 0
I/ServiceManager( 234): service 'media.audio_policy' died
I/ServiceManager( 234): service 'media.audio_flinger' died
I/ServiceManager( 234): service 'media.player' died
I/ServiceManager( 234): service 'media.camera' died
I/ServiceManager( 234): service 'media.sound_trigger_hw' died
E/AudioService( 814): Media server died.