[Android General] jersacct:
Disclaimer - this is your vehicle you are messing with. If you are not comfortable with potentially permanently damaging the head unit, stop here.

Now for the good stuff.

Credit where credit is due: this method relies on the recent "dirtycow" exploit. I used the POC Android exploit code located here:

https://github.com/timwr/CVE-2016-5195

This exploit in simple terms takes advantage of a Linux kernel bug that allows a (small) file to be "overwritten", when a user only has read access to that file. It doesn't actually modify filesystem contents, but any application that reads the file after the exploit is used will read the "new", post-exploit contents instead of the original.

The scripts attached use the dirtycow binary to overwrite the "/system/etc/factory_reset.sh" shell script with a nefarious version. This script is executed when you perform a factory reset operation through the settings menu, and gets executed as the root user :).

The nefarious script is quite simple - it just calls another script that is uploaded and performs a reboot. The second script mounts the /system partition as R/W, then copies over an su binary and sets appropriate permissions, then syncs and mounts read only again.

Please note that the attached "rootme.sh" script is intended to be run from a Linux machine - if I get the time (or enough donations), or if someone else cares to, it can be ported over to a Windows batch file easily enough.

Updated the attached zip to include a Windows batch file.

Steps:

Download the attached zip file

Extract to a machine capable of connecting to your Pilot over ADB

Modify "rootme.sh" (*nix) or "rootme.bat" (Windows) to use the correct IP

- Change the "172.16.1.217" lines to reflect the correct IP for your Pilot

Execute "rootme.sh" (*nix) or "rootme.bat"

- ./rootme.sh should do it for *nix

- for Windows, open a command prompt, navigate to "rootme.bat" location and type "rootme.bat"

- Watch output for completion

Perform factory reset operation

- Note - should the exploit function correctly, this step should NOT perform any factory reset operations. However, you should fully expect everything to be reset if the exploit failed or some other problem occurred when attempting to use a nefarious factory_reset.sh script.

After the Pilot reboots, you should be able to get a shell over ADB as normal, except now issuing an "su" command will drop you to root!

Update - thanks to purespin figuring out the signature mechanisms, we can now install apps! I've attached OneClick.zip, which contains a series of scripts to automate the rooting & app installation process.

That said, be careful, use these at your own risk, etc.

Extract zip file to some folder then open up a command prompt in that folder. Also drop the APKs you wish to install to that folder.

Type OnceClickInstall.bat [YourHeadUnitIP] [APKToInstall.apk]

The script will root your device if it's not already, then go ahead and perform steps necessary to install the APK (one reboot required if already rooted).

This basically performs the steps described in purespin's post to get a signature of the APK, download and modify the whitelist XML file, upload it back, reboot, then install the APK.

There's one prompt in the script that asks you too look things over -

pay attention here

, if any issues crop up at this point damage can be avoided, continuing in a bad state will have undefined results.

Updated the scripts to back up the white list on each run to /data/local/tmp/whitelist-(timestamp).xml.

Updated to handle APKs with more than one signature.

Edit: As suggested by wpg_moe, a Git Hub project has been set up here:

https://github.com/jersacct/2016PilotOneClick.git

Changes & suggestions are encouraged and welcomed, but this is a part time hobby project for me, so expect movement to be "lumpy", as I'm mostly only able to work on this during the weekends.