yashsingh1/xdaforums huggingface dataset:
[Security Discussion] Yattaze:
Since the run-as process has the root uid I added a line to call 'su' in the c file

Search DirtyCowAndroid on Github, I can't post outside links yet
[Security Discussion] cloud1250000:
We need a way to bypass selinux. Because right now, even if we get root privilege, it won't do anything since the root user can't do anything anyway (because of selinux).

AND if you discover a way to push su binary in system. You will trigger dm-verity. Your phone won't boot because of it. Thats why systemless root exist. systemless because you can't modify/edit your system file without fearing dm-verity.

Edit: it seems the people might be on the right track about how to bypass selinux on your link [MENTION=5569318]kirbyfan64sos[/MENTION] :D
[Security Discussion] Scorpius666:
Why wouldn't it? Care to explain?

In my mind you could reboot into recovery and the custom recovery you flashed should work.
[Security Discussion] vysea:
init taken down, too tired to write shell code, painful to insmod a kernel module
[Security Discussion] cloud1250000:
not so sure about this, the kernel should be signed with the right key If it's not signed right, it will break the chain of trust and won't boot. That's why we need to unlock the bootloader.

When we unlock the bootloader, we say that it's fine to run whatever even if it breaks the chain of trust.
[Security Discussion] freddierice:
Well done! I gave up on init.

I just pulled the recovery image on a galaxy s7 active. Root here I come :D
[Security Discussion] Geofferey:
It really depends on the device manufacturer. My Nexus 5X is fully re-locked running modified stock software. Of course I unlocked & made my changes before relocking so I don't know if that makes a difference.

Anyways I'm looking forward to gaining a root shell but I am afraid I will end up bricking my moto 360 attempting to flash a modified boot image with dm-verity removed because of locked bootloader (especially being moto). I want to use this as a way to root my 360 without a hacked up cable.

Remember guys anything on 6.0 + will probably attempt to verify the system partition every boot using the boot.img. If you get a root shell somehow and manage to get the su binaries on System partition you may end up bricking your device especially if on a locked bootloader/fastboot as there will be no way to restore device and verification will stop it from booting. To be able to root 6.0 in system mode remove verify from the fstab in ramdisk using appropriate tools.

So to wrap it up. At very least we should extract the boot.img / recovery.img and modify the boot.img on marshmallow and above to disable verification of the system partition but device with unlockable bootloaders may thwart it. Scary stuff lol
[Security Discussion] P05TMAN:
Anyone with an LG V10 on AT&T? If not, how can I attempt to extract the boot.img and recovery.img? Does it differ by carrier? I may be able to test on a friend's T-Mob version
[Security Discussion] Geofferey:
dd if=/dev/block/bootdevice/by-name/boot of=/sdcard/boot.img

Youll need a root shell for that tho.
[Security Discussion] P05TMAN:
Thank you!

I think that's a good starting point. I'll play around with it and see if I can do it :)

So reading further on Dirty Cow it seems you need to have a linux box (not a problem, I have a few VMs) but has anyone tried this natively on OSX? Just curious...

Derp... It's likely recommended to use a Linux box that has an affected kernel version as well... ignore me
[Security Discussion] vampirefo:
That's the hard part getting root shell, I haven't been able to get root shell.
[Security Discussion] craigrs84:
I finally got root shell but in wrong context, same as everyone else I think
[Security Discussion] DamnCampers:
First I want to thank everyone that has been working on getting dirty cow to work. I've been lurking watching the progress you guys have been making and it's exciting as I'm on a AT&T Note 4 with a locked bootloader. Over in the AT&T Note 4 forum another user linked this post http://xdaforums.com/showpost.php?p=69312919&postcount=148 and I wanted to share it with everyone in case you haven't seen it. I haven't read the complete thread, but this might be promising as I know many of you are looking for the same thing.
[Security Discussion] Geofferey:
Yeah the OSX kernel is BSD based so it's not affected at all by this particular exploit.

Can anyone post a pre-compiled binary of this:

https://github.com/jcadduono/androi...mmit/aeb76c239181289b2e7cda6b6865335a06d5c14b

I really don't wanna set up NDK/Tool chain to compile this and test it.
[Security Discussion] vampirefo:
Can you share how you got root shell?
[Security Discussion] freddierice:
Some of you might want to check out:

http://xdaforums.com/general/security/farm-root-recovery-image-pulling-t3490089
[Security Discussion] mrmazak:
Does that script really work to pull recovery from phone
[Security Discussion] freddierice:
Yup! I pulled the recovery partition for the Galaxy S7 Active.
[Security Discussion] Root-Maniac:
Some one got it to work on a kindle fire tv...

http://xdaforums.com/showthread.php?t=3489922
[Security Discussion] refi64:
Unfortunately, that doesn't seem like it'll work on normal Android devices. I have no clue how the heck `ip` was given the SELinux context necessary to mount a partition, but I'm guessing it was a really bad oversight on Amazon's part.
[Security Discussion] craigrs84:
I would but I don't feel it's very good or consistent. It worked on my galaxy s3 but not on the galaxy s5. My code is very similar to the other code already floating around on github. At a high level I hijacked the run-as process and executed the setcap, setresuid, setresgid, and setcon methods inside the c code.

The setcap, setresuid, and setresgid methods are failing on the galaxy s5. On the s3 it seems to work ok and actually says "root" when I run the id command but I still can't modify any of the system files due to selinux.
[Security Discussion] vampirefo:
It was worth a shot, didn't work but at least worth a try.
[Security Discussion] christianrodher:
how to spawn a shell is there explained to the letter in all the troubles and erros explained as they happen.

https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-257123629

once you get a root shell you can extract the mmcblock partitions by

as root

cd /data/local

mkdir backup

chmod 7777 backup

cp dev/block/mmcwhatever /data/local/backup/mmcwhatever

chmod 7777 mmcwhatever

as shell

cp /data/local/backup/mmcwhatever /sdcard/mmcwhatever

the pull it out with adb pull.

this is the steps for people with tight selinux like me that cant read sdcard or /data/local/tmp like me. BLU R1 HD
[Security Discussion] vampirefo:
Sadly I don't have time to read a book if you could just post what is needed to get root shell that would be great.
[Security Discussion] christianrodher:
ok compile the mod recowvery-app_progress64.c

dirtycow it into app_process32 or 64 depents of the phone

toybox nc localhost 11112

and you have root.

lol for all the questions about compiling read the post and dont be lazy.
[Security Discussion] vampirefo:
Don't worry about it, if you don't want to post the info, that's OK, but I am not going to waste what little time a

I have reading books, it's not that important to me.

---------- Post added at 09:58 PM ---------- Previous post was at 09:57 PM ----------

Don't worry about it, if you don't want to post the info, that's OK, but I am not going to waste what little time

I have reading books, it's not that important to me.

---------- Post added at 09:59 PM ---------- Previous post was at 09:58 PM ----------

Don't worry about it, if you don't want to post the info, that's OK, but I am not going to waste what little time

I have reading books, it's not that important to me.
[Security Discussion] 5318008:
Ok but what about wasting what little time you have reading books, is that important to you? I wasn't clear on that part.
[Security Discussion] vampirefo:
I don't know you, so I will just block you.
[Security Discussion] 5318008:
Lighten up man. It's a joke about your accidental triple quote, plus the other guy gives you exactly the info you ask for and you're like "no no, dumb it down for me plz, ain't nobody got time to read".
[Security Discussion] Geofferey:
Can anybody help me out here? I'm having issues cross-compiling this stuff.

geoffereysair3:~ geofferey$ export PATH=$PATH:/Users/geofferey/android-ndk-r13
geoffereysair3:~ geofferey$ ndk-build
Android NDK: Could not find application project directory !
Android NDK: Please define the NDK_PROJECT_PATH variable to point to it.
/Users/geofferey/android-ndk-r13/build/core/build-local.mk:151: *** Android NDK: Aborting . Stop.
geoffereysair3:~ geofferey$ clear

geoffereysair3:~ geofferey$ cd /Users/geofferey/android_external_dirtycow-android-6.0
geoffereysair3:android_external_dirtycow-android-6.0 geofferey$ ls
Android.mk	dirtycow.c
Makefile	recowvery-app_process64.c
README.md	recowvery-applypatch.c
cow-exec.c	run-as.c
geoffereysair3:android_external_dirtycow-android-6.0 geofferey$ make build
ndk-build NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=./Android.mk APP_PLATFORM=android-21
[arm64-v8a] Compile : cow-exec <= cow-exec.c
[arm64-v8a] Executable : cow-exec
./obj/local/arm64-v8a/objs/cow-exec/cow-exec.o: In function `main':
/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:39: undefined reference to `__android_log_print'
/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:52: undefined reference to `__android_log_print'
/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:54: undefined reference to `__android_log_print'
/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:57: undefined reference to `__android_log_print'
/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:59: undefined reference to `__android_log_print'
./obj/local/arm64-v8a/objs/cow-exec/cow-exec.o:/Users/geofferey/android_external_dirtycow-android-6.0/./cow-exec.c:63: more undefined references to `__android_log_print' follow
clang++: error: linker command failed with exit code 1 (use -v to see invocation)
make[1]: *** [obj/local/arm64-v8a/cow-exec] Error 1
make: *** [build] Error 2
geoffereysair3:android_external_dirtycow-android-6.0 geofferey$
[Security Discussion] christianrodher:
edit android.mk

include $(CLEAR_VARS)

LOCAL_MODULE := cow-exec

LOCAL_SRC_FILES := \

cow-exec

LOCAL_CFLAGS += -DDEBUG

LOCAL_SHARED_LIBRARIES := liblog

LOCAL_LDLIBS := -llog

include $(BUILD_EXECUTABLE)

you will get more erros with the cowrecovery-app_process64... everything is explained to detail in

https://github.com/timwr/CVE-2016-5195/issues/9#issuecomment-256776647
[iPAQ rw6828, XDA Atom Software Upgrading] brian_2cool4u:
Hi all!

I wanted to know if it's possible to extract the .cab file from .exe? what I want to do is install everything from PPC instead of using PC via activesync. is this possible? tnx in advance for all your help
[iPAQ rw6828, XDA Atom Software Upgrading] alipi2007:
yes u can.

simply use serch for it.
[iPAQ rw6828, XDA Atom Software Upgrading] sadhu_s60:
u wanna extract cab form exe with ppc, w/o using pc .... u can do tat if u r lucky... just rename the exe to .zip & .rar & see if they open.... not every exe can b opened this way
[iPAQ rw6828, XDA Atom Software Upgrading] udayrulz:
http://legroom.net/software/uniextract

Download and install this^
[iPAQ rw6828, XDA Atom Software Upgrading] brian_2cool4u:
done that and it's working great! now all apps are being installed directly from PPC. no need for activesync lahh. only use activesync for flashing ROM. hehehehe im a bit lazy
[HTC One Mini] f4ke:
fastboot_adb>fastboot flash zip 0P8BIMG.zip

target reported max download size of 800227328 bytes

Invalid sparse file format at header magi

>fastbot oem lock

...

(bootloader) [ERR] Cmd18 polling status timed out, MCI_STATUS: 0x4C2000

(bootloader) [ERR] sdcc_command: sdcc_poll_status error, rc: 2

(bootloader) [SD_HW_ERR] read data fail in CMD18

(bootloader) CMD18: cmd failed

(bootloader) [SD_HW_ERR] SD: Read data fail..

(bootloader) [PG_ERROR] htc_pg_hdr_get(117):

(bootloader) sd_read_sector error

(bootloader) [PG_ERROR] htc_pg_part_hdr_get(169):

(bootloader) htc_pg_hdr_get failed

(bootloader) Lock successfully...

(bootloader) mipi_dsi_panel_off

(bootloader) pm8038_vreg_disable function, vreg_id = 1

(bootloader) pm8038_vreg_disable function, vreg_id = 9

(bootloader) TZ_HTC_SVC_DISABLE ret = 536739196 (0x1FFDFD7C)

FAILED (status read failed (Too many links))

finished. total time: 1.264s

Nothing really seems to work

S-ON
[HTC One Mini] :
remove sdcard and use the tools from here to restore.
[HTC One Mini] f4ke:
Okay thanks. My phone doesnt have a sd card slot.

What tool do I have to use first? I have pretty much no idea

Do I need Linux for that?
[HTC One Mini] :
if you phone dont have an sd card slot then id say you in the wrong place. this is for HTC one mini 2.

no you dont need linux. Pc or MAC works. look for videos in youtube. Make sure of you r phone model as the tools i give you is for HTC One Miini 2
[HTC One Mini] f4ke:
Ah yea its the mini 1 sorry about that..

But still other tutorials dont work for me as the fastboot commands dont work

I always get errors like :

FAILED (status read failed (Too many links))

And I cant get into Recovery mode I am kind of stuck in fastboot

I also tried fastboot erase cache

******** Did you mean to fastboot format this partition?

erasing 'cache'...

FAILED (remote: erasing error!) <--------------------------------

finished. total time: 0.037s

I also get a lot of errors like this one FAILED (remote: .....(different types))
[HTC One Mini] :
Like i said the tools i gave you are wrong. You need to find the proper ones.

Post your question in HTC One Mini forum
[HTC One Mini] f4ke:
I found a thread about my problem but theres no solution

http://xdaforums.com/htc-one-mini/help/bootloader-t3431549
[HTC One Mini] :
If you want to restore to stock just use RUU. its easier.

NOTE-Bootloader must be locked with stock restore
[HTC One Mini] f4ke:
yea but thats the problem fastboot oem lock doesnt lock my phone!

>fastboot oem lock

...

(bootloader) [ERR] Cmd18 polling status timed out, MCI_STATUS: 0x4C2000

(bootloader) [ERR] sdcc_command: sdcc_poll_status error, rc: 2

(bootloader) [SD_HW_ERR] read data fail in CMD18

(bootloader) CMD18: cmd failed

(bootloader) [SD_HW_ERR] SD: Read data fail..

(bootloader) [PG_ERROR] htc_pg_hdr_get(117):

(bootloader) sd_read_sector error

(bootloader) [PG_ERROR] htc_pg_part_hdr_get(169):

(bootloader) htc_pg_hdr_get failed

(bootloader) Lock successfully...

(bootloader) mipi_dsi_panel_off

(bootloader) pm8038_vreg_disable function, vreg_id = 1

(bootloader) pm8038_vreg_disable function, vreg_id = 9

(bootloader) TZ_HTC_SVC_DISABLE ret = 536739196 (0x1FFDFD7C)

FAILED (status read failed (Too many links)) <---------------------------------------

finished. total time: 1.257s

Phone stays unlocked
[HTC One Mini] :
ok you need to start from beggining again.

What recovery you have installed?

what ROM you had before this problem?

forget what fastboot tells you and look at bootloader yourself and see if says lockeded or Reloocked tempered.

are you using original HTC usb cable?
[HTC One Mini] f4ke:
The only information I get is this:

https://gyazo.com/4c123b4288f2de831f5b693e77334d38
[HTC One Mini] :
you can either install stock recovery and relock bootloader and RUU i provided before

or find and install TWRP and use a recovery TWRP rom to restore phone.
[HTC One Mini] f4ke:
I have the .img file what exactly am I supposed to do now? Everything I tried from tutorials didnt work because of errors that I posted before.
[HTC One Mini] :
Check this link here where it says Going back to stock
[HTC One Mini] f4ke:
My device is already unlocked right? So I started with :

fastboot flash recovery C:\Users\aleX\Downloads\recovery.img

target reported max download size of 800227328 bytes

sending 'recovery' (9756 KB)...

OKAY [ 1.207s]

writing 'recovery'...

FAILED (remote: image update error) <--------------

finished. total time: 1.363s

If I try fastboot boot:

fastboot boot C:\Users\aleX\Downloads\recovery.img

creating boot image...

creating boot image - 9994240 bytes

downloading 'boot.img'...

OKAY [ 1.219s]

booting...

OKAY [ -0.000s]

finished. total time: 1.219s

Nothing happens, phone stays in "fastboot" and doesnt boot or reboot
[HTC One Mini] :
Have try entering recovery using phone buttons?

And put the tools and img in same folder to prevent error
[HTC One Mini] f4ke:
Phone buttons have no effect I can choose whatever I want but nothing happens it just reboots in fastboot
[HTC One Mini] :
Then you need to flash a boot.img and a recovery.img.

Make sure you have the proper ones for your firmware
[HTC One Mini] f4ke:
I cant boot into bootloader because "adb devices" doesnt find my phone. Or am I doing something wrong? Maybe you have time for a short teamviewer session to have a look yourself?
[HTC One Mini] :
I didn't say boot phone.

I said install boot.img and recovery.

That's all done is fastboot

Alternatively you can send me the phone for repair.
[HTC One Mini] f4ke:
fastboot flash boot C:\Users\aleX\Downloads\boot.img

target reported max download size of 800227328 bytes

sending 'boot' (6824 KB)...

OKAY [ 1.046s]

writing 'boot'...

FAILED (remote: image update error)

finished. total time: 1.195s
[HTC One Mini] :
Use command fastboot erase.

Then try again with different versions of recovery and boot.img

There's a few reasons for this kinds of errors, image version is the most common.

Also you can try twrp versions too
[HTC One Mini] f4ke:
>fastboot erase flashall

erasing 'flashall'...

FAILED (remote: not allowed)

finished. total time: 0.005s

What does that mean? I always get remote: errors
[HTC One Mini] :
your bootloader might be showing the wrong info.

try to unlock it again with dev HTC. get new token. dont use the same one.
[HTC One Mini] f4ke:
C:\Users\aleX\Desktop\Neuer Ordner (2)\fastboot_adb>fastboot flash unlocktoken "

C:\Users\aleX\Downloads\Unlock_code (1).bin"

target reported max download size of 800227328 bytes

sending 'unlocktoken' (0 KB)...

OKAY [ 0.155s]

writing 'unlocktoken'...

(bootloader) unlock token check successfully

OKAY [ 0.010s]

finished. total time: 0.166s

C:\Users\aleX\Desktop\Neuer Ordner (2)\fastboot_adb>fastboot flash boot C:\Users

\aleX\Downloads\boot.img

target reported max download size of 800227328 bytes

sending 'boot' (6824 KB)...

OKAY [ 1.038s]

writing 'boot'...

FAILED (remote: image update error)

finished. total time: 1.196s

C:\Users\aleX\Desktop\Neuer Ordner (2)\fastboot_adb>fastboot erase flashall

< waiting for device >

erasing 'flashall'...

FAILED (remote: not allowed)

finished. total time: 0.005s
[HTC One Mini] :
Good old times of HTC one mini.

Try this...

-create a new zip file named "PG58IMG.zip".

-Put the recovery.img and the android-info.txt in it. The MID and CID in the txt-file have to match your device.

-copy the PG58IMG.zip to your adb/fastboot folder in PC

-then connect the phone from bootloader to PC

-then open command prompt from your adb/fastboot folder and type these commands one by one

-fastboot erase cache (if failed ignore it )

-fastboot oem rebootRUU (black screen with green HTC )

-fastboot flash zip PG58IMG.zip

-fastboot reboot-bootloader (reboot to bootloader )

-cross your fingers and pray
[HTC One Mini] f4ke:
What is the android-info.txt do I only have to type the MID and CID there nothing else?
[HTC One Mini] :
will be faster if you search a bit yourself...

fastboot getvar all

replace info inside file with yours
[HTC One Mini] f4ke:
-fastboot oem rebootRUU (black screen with green HTC )

phone gets black screen but reboots into fastboot cant see "green HTC"
[HTC One Mini] :
you don't have OS so its unlikely. Have you tried the next steps???

Its kind of hard to help from here. you best send it to HTC for recovery as your bootloader might be corrupted somehow.

I been in your situation and it takes a lot of testing to get it unbricked.

-Did the screen to unlock show?

-have you tried different recovery versions?
[HTC One Mini] f4ke:
Do you have a little time for Teamviewer? You could check it fast you know what to search for and where it is I always need hours to find something.
[HTC One Mini] :
Sorry but i dont do that. I know its frustrating but the only advice i can give now its to contact HTC. I sent my 3 times and they never charged me. If yours if in good condition you might get lucky too.

PS: im in UK, if you want me to have a go ill do it free of charge (just for the challenge)

you just pay the return post.
[HTC One Mini] f4ke:
I get a new error by the way does it tell you anything?

fastboot oem rebootRUU

(bootloader) [ERR] Cmd18 polling status timed out, MCI_STATUS: 0x4C2000

(bootloader) [ERR] sdcc_command: sdcc_poll_status error, rc: 2

(bootloader) [SD_HW_ERR] read data fail in CMD18

(bootloader) CMD18: cmd failed

(bootloader) [SD_HW_ERR] SD: Read data fail..

(bootloader) [ERR] partition_read_emmc(876): error 2

(bootloader) Start Verify: 3

(bootloader) [ERR] Cmd25 polling status timed out, MCI_STATUS: 0x4C0000

(bootloader) [ERR] sdcc_command: sdcc_poll_status error, rc: 2

OKAY [ 0.132s]

finished. total time: 0.132s
[Sprint Samsung Galaxy S III] venom20078:
I currently have CARBON installed, but that was when I was using it as a phone. Now I have a Note 5 and want to turn my S3 into a car entertainment system. But what rom should I choose?

It needs to be

Slick and Smooth

Fast

Easy navigation

Big buttons

Suited for car use

Support for Spotify, Offline GPS apps, Bluetooth, etc.

Can anybody recommend something?
[Galaxy Note 4 Q&A, Help & Troubleshooting] gtamark:
I have a N910F 6.0.1 stock. when I go to settings and I try to change fingerprint and fingerprint backup password it says that password is wrong, but it's correct. it doesn't recognize my finger too. is there any way to reset it and add a new fingerprint without format all? I've already tried to clear fingerprint app data and cache but with no success. another way? please help.
[Galaxy Note 4 Q&A, Help & Troubleshooting] Chamaka:
I have same problem. I think this happen because I use dual boot patcher to dual boot note 4 with cm 13 and then I try to add fingerprint in cm13. I didn't found any solution for this.
[Android General] XDM inc:
I was wondering in a inid script how would I get a root command to execute a root command on a systemless install of SuperSU.

Because the

#!/system/bin/sh

Doesn't work
[Xiaomi Redmi Note 3 Questions & Answers] agUNg.XENOS.inc:
how to order the application data / obb in internal memory moved to the memory external? position rn3p i've unlock bootloader and have had a root access and already put twrp...
[ZenFone 2 Q&A, Help & Troubleshooting] jaswanth007:
Hello Xda

My Zenfone 2 ZE551ML was dead,last thing i had done is had wiped data partition using CM recovery,It was hardbricked after doing that, I rebooted for few times,OK its hardbricked ,So i thought to flash to fix the hardbrick and my phone is dead after connecting to Laptop.I ran to service center to fix it. and i told him to just solve the dead issue and he returned me the phone . I took the phone and entered into recovery mode after reaching and it gone dead again..Help me Please
[ZenFone 2 Q&A, Help & Troubleshooting] dredremon:
try to remove the battery manually
[ZenFone 2 Q&A, Help & Troubleshooting] lamp216:
can u access to bootloader?
[ZenFone 2 Q&A, Help & Troubleshooting] NiTesh:
Arey you able to access recovery? If yes try to flash official latest firmware directly with recovery.
[ZenFone 2 Q&A, Help & Troubleshooting] jaswanth007:
Nope i cant accss neither bootloader no recovery.. Its dead (no vibration)
[ZenFone 2 Q&A, Help & Troubleshooting] jaswanth007:
Nope i cant access neither bootloader no recovery.. Its dead (no vibration)
[Google Pixel XL Questions & Answers] egren58:
I am on the verge of purchasing this phone from Verizon but I am just wondering do you guys think that the devs will be able to unlock the boot loader?. Or is it highly unlikely?
[Google Pixel XL Questions & Answers] nxt:
You should buy it from Google Store, that's an honest opinion.