yashsingh1/xdaforums huggingface dataset:
[E 2015 General] kryz:
Let's see what's going on ;)

-Are you using the apk or adb script?

-If you use the apk and don't restore init what happens?

-If you restore init is laggy or reboot?

-Can you try the adb script and tell me if you also get a reboot?

-Finally if you can attach these files:

/sdcard/init.dmp

/sdcard/init.patch

Regards,

---------- Post added at 01:33 AM ---------- Previous post was at 01:16 AM ----------

First about the sdcard, i will look after that bug that i know what's happening,please don't remove/mount/umount for now.

Do you have a computer to do some checks?

You say that with the new version there is not reboot but laggy, can you check if there is some process eating the cpu with top:

/data/local/tmp/busybox top

I suspect there is the last process restauring init that is eating the cpu, check for this or ;

ps | grep dirtycow

If that is the case kill it and we will know if is the responsible of that lag.

In other hand can you attach these files:

/sdcard/init.dmp

/sdcard/init.patch

Guessing that you are using the apk, what happen if you don't restore init?

Is laggy or just unstable, don't start wifi/bluetooth you can't change settings are like locked.

Have you tried the script adb version, can you try and tell me if you have the same issue?

Best regards,
[E 2015 General] jcpowell:
Let's see what's going on ;)

-Are you using the apk or adb script?

Apk

-If you use the apk and don't restore init what happens?

It freezes and reboots

-If you restore init is laggy or reboot?

Laggy before freezing then ultimately reboots

-Can you try the adb script and tell me if you also get a reboot?

I'm give it a shot in a bit. Was a bit unsure on how.

-Finally if you can attach these files:

/sdcard/init.dmp

/sdcard/init.patch

Here are the files

https://drive.google.com/folderview?id=0B26uDxbLACN6V2IzM1VvOTlnNk0

[MENTION=2109949]kryz[/MENTION]
[E 2015 General] kryz:
You told me before, that you got root little bit unstable but you got with the first version?

I attach a new version with some changes reverted and i think will work, tell me if you get root.

In this version doesn't ask for restore when is finish but you can do it after in tools/restore init.
[E 2015 General] jcpowell:
Got root, but still lags a bit and reboots within minutes if I attempt to open apps etc.. unless I clean init afterwards. Then I get a bit more stability, but still reboots.
[E 2015 General] kryz:
The last check i think is try the adb script because is not using the same method.

In the apk im hijacking fsck_msdos and i don't release it, is possible that the phone detected to much time in the process and reboot it?

Have you try only check permissions, not get root, and just work with the phone to see if you get rebooted anyways, if you get rebooted i need to clean the fsck_msdos process (the sdcard check).

Thank you for testing
[E 2015 General] jcpowell:
Yea it reboots in the check as well.

---------- Post added at 04:36 AM ---------- Previous post was at 04:05 AM ----------

I'm a little confused on the ADB. Where exactly am I extracting the rar? Onto my device internal SD?
[E 2015 General] kryz:
If it reboots just checking permissions the problem is the fsck_msdos process not the shellcode in init, i saw in the files that you attach all is ok.

I've updated the apk in the main post, now it will release the sdcard, please check that version in the same way, first before get root, click "check perm" wait to see the results and work with the phone to see if reboots again for a while.

If all is working with "check perm" and you don't get reboot, try get root, is very probably that now doesn't reboot.

I think with the adb script will work because it overwrites run-as, anyways ive updated the apk for release the sdcard check process and it'll return ok status.

The instructions for the rar and adb.

First you need adb installation in your computer, i mean connectivity with the device via adb.exe.

When you have adb working you need to put all the content of the rar in the path /data/local/tmp/.

So extract the rar in your computer in a folder and with adb push copy all the files to that folder:

(in the folder of the rar contents)

adb push * /data/local/tmp/

Then get a shell with adb:

adb shell

Execute the script to exploit it:

cd /data/local/tmp
./exploit.sh

Wait the logs and if all is ok execute:

run-as -s2

Wait 5 seconds and:

su

If all is ok you will have a root shell, this method is more stable even doesn't clean the init you can do it in the app, but test all before.
[E 2015 General] jcpowell:
That last apk causes me immediate reboot. Maybe it was not the fsck_msdos cause I was able to do a check and not get a reboot with the debug apk you gave me. I am trying the adb method but I think I am messing up some steps. Will let you know when I get through it.
[E 2015 General] fenlon:
[MENTION=2109949]kryz[/MENTION] I should have some time tomorrow to test the shell commands. Thank you again for taking your time to do this.
[E 2015 General] jcpowell:
[MENTION=2109949]kryz[/MENTION] I'm getting permission denied when trying to execute the ./exploit.sh
[E 2015 General] bibikalka:
You are missing permissions, do this :

cd /data/local
chmod -R 0755 tmp
cd tmp
./exploit.sh
[E 2015 General] jcpowell:
I finally got it to run, but the exploit but this happened
[E 2015 General] bibikalka:
see this

busybox needs execute permissions too ! That's why I was doing 755 on the entire /data/local/tmp directory!

[MENTION=2109949]kryz[/MENTION] - the adb script turned out to be a bit mean on XT1528 :( I had SuperSu installed too, so hard to say whose fault this was. But, after I ran the exploit, and it printed something, I could not get back into the task manager (square button) on the phone! Even after reboots the UI would freeze after I'd press the square button and it kept crashing. Sweating a factory reset, I used Debloater to freeze both SuperSu and CrooWt, then moved stuff out of /data/local/tmp . Finally, after several tries, I managed to get the task manager back, and the UI stopped crashing, so it seems to be back to normal.

Scary stuff ! :D
[E 2015 General] jcpowell:
# Device:surnia_att
-Getting uid 0./exploit.sh[117]: /data/local/tmp/busybox: can't execute: Permission denied
->Ok
-Dump policy->Ok
./exploit.sh[134]: /data/local/tmp/supolicy: not found
-Dump init./exploit.sh[143]: /data/local/tmp/busybox: can't execute: Permission denied
getFileNameTargetSepolicy: ./exploit.sh[144]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/readelf: not found
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
FIRST:
SECOND:
getOpcodeDataSection: ./exploit.sh[145]: /data/local/tmp/busybox: can't execute: Permission denied
Final opcode:

Error searching shellcode addr, already patched?
[E 2015 General] kryz:
Hi, you are missing many files in the /data/local/tmp, the rar EXPLOIT_ADB.rar contains:

-busybox

-exploit.sh

-libsupol.so

-patch-init

-readelf

-run-as-dirtycow

-su.img

-supolicy

All this files have to be in /data/local/tmp

After you have to give exec permissions to exploit.sh that you did it already, but missing the other files the exploit.sh will fail.

Btw execute the exploit.sh in this way:

./exploit.sh 1

With the 1 parameter to see debug logs, will be useful.

I attach the rar here, password nox.
[E 2015 General] kryz:
Waw had a scare time ehhehe you are welcome to exploit testing ;)

But anyways is strange i got reboots trying but after reboot always all come to the normal because the changes are not written to disk.

So if i understand well, after execute the script your system freeze and no root?

Until when the script arrived, did you get root?

Is good to execute the exploit like this:

./exploit.sh 1

Because with the arg 1 you get log information and we can see all the details, if you are not scare enough try it and post the logs here to analyze.

But ive tried in a Moto G lollipop and the script was working good and the system was stable, probably another vendor because this devices is from Peru...
[E 2015 General] jcpowell:
10|shell@surnia_umts:/data/local $ chmod 0755 -R tmp
Unable to chmod tmp/busybox: Permission denied
1|shell@surnia_umts:/data/local $ sudo chmod 0755 tmp/busybox
/system/bin/sh: sudo: not found
[code]
[E 2015 General] jcpowell:
I understand. BusyBox fails repeatedly by following the correct directions.

So now I'm just baffled.
[E 2015 General] Nick N:
Looking forward to the day I can run CM14.1 on this device. Bought 4 of them last Black Friday for $10 each thinking they would eventually be unlocked, sold or gave away all but one. Keep up the good work guys.
[E 2015 General] kryz:
Mmmm, something wrong we are doing, do this:

adb shell

cd /data/local/tmp

chmod 755 busybox

ls -la busybox

./busybox ls

And post the results.

---------- Post added at 09:18 PM ---------- Previous post was at 09:16 PM ----------

Have you tried the app to get root?
[E 2015 General] Nick N:
Not yet but I plan to give it a try.
[E 2015 General] edjocute:
I was able to get temp root using both methods (apk/adb) but the phone gets unstable and reboots within 10 minutes when using other apps.
[E 2015 General] kryz:
Ok, thanks for the testing, so the problem is not the apk, is something related to the root some checking or to clean the init process.

I've updated the apk with a fix to restore init with another method can you try this version please, just when you get root, go to tools and click restore init.

https://mega.nz/#!AQ92QLrA!SD8RNe7tP...L99WbdKQNkTYrk

Have you tried to mount /system with write permissions:

mount -o remount,rw /system

Because if is possible to mount with write permissions maybe you can install a permanent su.

To fix the reboot can you try to mount /system with the "abort" option, i think the reboot is more related to the unstable state of the filesystem and journaling issue, but if you mount with abort option, the /system partition will be read only without chance to mount in write until reboot.

mount -o remount,abort /system

Check the restore init and also mount with abort to see if the system is stable then.
[E 2015 General] edjocute:
Hi,

I tried downloading the file but MEGA is asking for a decryption key.

I previously tried remounting system as rw but it immediately rebooted. I will try mounting with abort once I manage to dl the file. Thanks for working on this!
[E 2015 General] kryz:
The same happens to me in a Oppo device try to mount with abort option, the new link:

https://mega.nz/#!AQ92QLrA!SD8RNe7tPtEiCT8u1HkEPUORCfrMoL99WbdKQNkTYrk

First of course try the apk and restore init and mount with abort,but there is another way to root it in permanent way, is more complex but once one person did for one device is easy to implement in the apk.

In the next post i will do a tutorial how to make a permanent root.
[E 2015 General] Sparksys:
Woaaah! Sounds super great!

Will surely try this on my free time soon
[E 2015 General] fenlon:
Tested again with apk downloaded on 1/8. I want to make sure I am understanding this correctly.

1) Install app

2) Click get root

3) Select method 1,click ok

4) Click ok at the prompt

5) Click OK at Unmount SDCard

6) Click Unmont SD Card

7) Click OK at the prompt

8) Go back to CrootWt

9) After the unmount is complete, Remove SD Card and reinsert

I got a successful root, but it rebooted in less than a minute while viewing root checker.

[MENTION=2109949]kryz[/MENTION] Is the above process how you intended the apk to work?
[E 2015 General] kryz:
Is correct but i think the point 6 is wrong type you wanted to say "mount".

And the point 9 is not correct, better don't remove the sdcard.

So once you have mounted the sdcard go back to the app.

(Optional to avoid reboot) When you get root go to tools and click "Clean init"

Can you make one test please to see what's going on?

1-Reboot the phone in a clean state

2-Click the Check Perms

3-Follow instructions (umount/mount sdcard)

4-Go back to the app.

5-Work with the phone long time to see if it reboots

This test is important because to know if the dirtycow exploit is restarting the phone or the su installation.

Thanks

---------- Post added at 06:10 PM ---------- Previous post was at 05:55 PM ----------

I need some information of your device, can someone post a list of the folder /etc in Moto E ?

ls -la /etc
[E 2015 General] bibikalka:
This kind of looks very dangerous. What if Android crashes as you are overwriting /system (if the dd access works like that in the first place) ?

It could be possible perhaps to package this system.patched into an update zip file, and then use FlashFire since it knows how to overwrite the system that's running.
[E 2015 General] fenlon:
Steps and Results of Check Perm

Attempt 1:

1) Device rebooted - first thing done: Open Croowt

2) Click Check Perm

3) Your Prompt: "Check root - Check permissions to obtain root. Do you want to Continue" Click OK

4) Your Prompt: "Unmount sdcard - Go to setting and unmount and remount your sdcard" Click OK

5) This brings up Storage Settings

6) Click Unmount

7) System Prompt: "Unmount SD card ..." - Click OK

FREEZE and REBOOT

Attempt 2:

1) Device rebooted - first thing done: Open Croowt

2) Click Check Perm

3) Your Prompt: "Check root - Check permissions to obtain root. Do you want to Continue" Click OK

4) Your Prompt: "Unmount sdcard - Go to setting and unmount and remount your sdcard" Click OK

5) This brings up Storage Settings

6) Click Unmount

7) System Prompt: "Unmount SD card ..." - Click OK

FREEZE and REBOOT

Attempt 3:

1) Device rebooted - first thing done: Open Croowt

2) Click Check Perm

3) Your Prompt: "Check root - Check permissions to obtain root. Do you want to Continue" Click OK

4) Your Prompt: "Unmount sdcard - Go to setting and unmount and remount your sdcard" Click OK

5) This brings up Storage Settings

6) Click Unmount

7) System Prompt: "Unmount SD card ..." - Click OK

8) At storage settings, click Mount SD Card

9) Click Square button, go back to Croowt

Box says:

File: /dev/bloc/bootdevice/by-name/boot: Ok

File: /dev/bloc/bootdevice/by-name/system: Ok

File: /init: Ok

File: /sepolicy: Ok

All appears to be running well, with one exception. It may be unrelated, but here it is anyway. The google now tiles on my home screen appear, but are blank. Clicking on it does nothing. Opening Google, will display now tiles. Resizing the widget, looks to have fixed the issue.

About 5 minutes and no issues.
[E 2015 General] kryz:
Well i know is maybe dangerous so i said HAVE A RECOVER AND STOCK ready to flash.

This process is only required one time one user, after i have a code to make a patch and the patch is applied to the system in few seconds.

Im not sure how is FlashFire handling the system partition, but i thought the root in adb was stable if you don't use the phone gui.

Anyways i think the phone is rebooting not because the init patch but just for overwrite on file in /system because the journaling.

Can someone verify that just overwriting run-as binary the device reboot?

cd /data/local/tmp
./run-as-dirtycow /system/bin/run-as /data/local/tmp/run-as-dirtycow

If the phone doesn't restart, then i have one safe method to root it without reboots ;)

---------- Post added at 08:05 PM ---------- Previous post was at 07:57 PM ----------

With this test we just overwritten one file in /system

/system/fsck_msdos

If i understand well, the reboots are random, so you tried 3 times and the first and second reboots the third stable.

This can bring a more stable root, at least 1 of 3 times, but i don't understand why really, im waiting one user to check if mounting system with the abort option fix the issue:

mount -o remount,abort /system

Waiting this test...
[E 2015 General] fenlon:
[MENTION=2109949]kryz[/MENTION] can you explain what the options in the apk under tools do?
[E 2015 General] jcpowell:
When do you want us to do this?

mount -o remount,abort /system

After we get root with the app?
[E 2015 General] edjocute:
I'm having some problems setting the SELINUX context with chcon. I keep getting this error using Ubuntu:

chcon: invalid context: ‘u:object_r:system_file:s0’: No such file or directory

ls -Z shows ? for the context currently and the preceding steps work fine.

I tried chcon manually with and without sudo all of which have the same error. Any idea how to get past this?

EDIT: I think I got around this error by using chcon with the --reference option e.g.:

chcon --reference=$ETC/voicemail-conf.xml $XBIN/sugote
chcon -t zygote_exec $XBIN/sugote
[E 2015 General] jcpowell:
ls -la /etc[/QUOTE]

shell@surnia_umts:/ $ ls -la /etc
lrwxrwxrwx root root 1971-03-07 19:55 etc -> /system/etc
shell@surnia_umts:/ $
[E 2015 General] edjocute:
Command runs and doesn't reboot. I'm not sure how to check if it actually worked or not.

The command returns:

mount: Read-only file system

Phone does not restart.
[E 2015 General] kryz:
Yes:

-Flash (flash a image backup to system/boot partition)

-Backup (do a backup of system/boot partition)

-Clean init (restore original init file, clean status but not the root).

-Clean adb (restore adb, actually not working)

Clean init perhaps is the useful option now, it restore the init file, but sometimes the system reboot.

---------- Post added at 02:52 AM ---------- Previous post was at 02:49 AM ----------

Yes after you get root with the su command:

su
mount -o remount,abort /system

This command is for avoid the reboot, and keep the system partition in stable state, because dirtycow keep the system little unstable in some devices like the yours.

---------- Post added at 03:01 AM ---------- Previous post was at 02:52 AM ----------

I'm using linux mint and i didn't get that error, i was also surprise to can change context not existent in my linux but it worked well.

So you were able to backup system without problems i think, how stable is your root?

Before flash again the system patched, please be sure you have a stock rom ready to flash in the recovery, if the system reboot may keep the partition little bit unstable, it depends until when the copy arrives.

If you achieve permanent root with this, please keep these both files:

system.img

system.patched

Will be the key for making the process fast later.

---------- Post added at 03:07 AM ---------- Previous post was at 03:01 AM ----------

The first command is just using the exploit dirtycow to overwrite on file in /system/bin, nothing does.

This test is for verifying that dirtycow is not the responsible of the reboots and if the system doesn't reboot is a good signal.

Im trying to figure out whats going on in your device because in the others all is working good with no reboots.

The command:

mount -o remount,abort /system

You have to execute it after get root with root privileges to see if the system keep stable and not reboot if that the case and you execute it after get root and no reboot then we found the issue.

So did you executed after get root and no more reboots?

---------- Post added at 03:09 AM ---------- Previous post was at 03:07 AM ----------

shell@surnia_umts:/ $ ls -la /etc
lrwxrwxrwx root root 1971-03-07 19:55 etc -> /system/etc
shell@surnia_umts:/ $

[/QUOTE]

Sorry, i had a wrong type this is the correct command to see the /etc folder contents:

ls -la /etc/
[E 2015 General] jcpowell:
/etc folder contents

https://docs.google.com/document/d/1qt7dwqVMZfs2PVnZ0udo5qomXYJb1ihsf5dFz9lqVjU/mobilebasic
[E 2015 General] edjocute:
Yup, I was able to backup system and pull it to the computer. Temp root was with your newer apk with restore init, and system mounted with abort. Root is more stable than before I think but I'm still getting occasional reboots when using phone.

I pulled logcat but didn't see any errors before reboot.

So I tried writing the patched system to the phone (after obtaining temp root) with:

su
mount -o remount,abort /system
dd if=/sdcard/system.patched of=/dev/block/bootdevice/by-name/system bs=4096

but I don't see any changes after rebooting the phone i.e. patched files are missing and no root at all. It doesn't seem like the dd write is sticking. I did have my system.patch on the external sdcard (/storage/sdcard1). I don't think that should make a difference though.

I do have the original system.img and the new system.patch if you want to take a look at them.
[E 2015 General] kryz:
Great work, but sadly seems that there is some kind of protection to overwrite the system partition, this Moto is being hard to hit lol, but we are more and better XD

So move on, this method will not work, next post next method ;)
[E 2015 General] edjocute:
Nice! Managed to get root working with the new method. Phone seems more stable than the previous methods. Many thanks for your efforts!

Interestingly, the folder /data/security/current was already present on my device, so all I had to do was overwrite the sepolicy file with the patched one. I wonder if this was left by a previous Kingroot attempt.
[E 2015 General] jcpowell:
Are you saying that you got permanent root without reboots or just temp root without reboots?
[E 2015 General] edjocute:
I was referring to his "Persistent selinux permissive method" which is also a temp root.

Unfortunately, permanent root does not work with or without reboots since we can't write to /system yet. I tried using both the dd method kryz posted, as well as Flashfire to no avail. You could still try it though, might work on your device. Who knows?
[E 2015 General] jcpowell:
How did you try it with FlashFire?
[E 2015 General] edjocute:
After temp root, use the Flash OTA option to flash the patched system.img to the system partition. Flashfire will do its thing and show the progress bar and all but no changes saved to system partition after reboot.
[E 2015 General] bibikalka:
It would be really good if the temporary root became fully stable! XT1528 is a hugely popular device, with a large following! :D Should it not be possible to run a simple dirty cow run-as replacement via something like Gscript, so then one could easily get the temp root again after a reboot without adb (after settting up /data/security/current once)? You could probably add such an option to your apk too.

It is interesting that Flashfire is behaving identically to other attempts to write to /system, which all have no impact.

So it seems that the only thing that can write to /system is stock recovery (that's how OTA updates are done). I wonder if there is something in the bootloader that disables any write access to /system if not booted from /recovery. Of course, recovery has to be signed, but in fact we could overwrite /recovery with /boot, and then after a reboot to recovery we will be running the regular OS again, but it was booted from /recovery instead of /boot.

It may also be that recovery sets special SE Linux permissions, and those enable writes to /system, but I thought, SE Linux is set to permissive with the new scheme, so anything goes ?

Update: [MENTION=1939077]edjocute[/MENTION] - if you are all set up for this, can you actually try /boot in /recovery ? It's a long shot, but what if this works ...

As root (double check the partition names, LOL):

dd if=/dev/block/bootdevice/by-name/boot of=/dev/block/bootdevice/by-name/recovery

Then immediately after, do "adb reboot recovery". You should end up straight back in Android after a reboot. Get root via the adb exploit, and attempt to run FlashFire again using the patched system image you already have. See if booting from recovery made any difference.

Update2 : I actually recall now that Moto phones apply updates via fastboot, so in other modes (boot,recovery) it won't be possible to write to /system (unless the bootloader is unlocked).