yashsingh1/xdaforums huggingface dataset:
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Good Morning!!

Well I had a strange error with Ghidrah and was unable to find help on it, specifically in the bytes view, trying to use the edit feature.

It is telling me the address I want to edit has an instruction that exists... Well obviously it does!

So I read a few guides and they did show you could edit in the "listing" view of ghidra, by using the patch instructions option

I copied the information from the address you showed me and typed it into the mini_jail new address

Doing the modification that way, Ghidra was able to modify the hex for us. So it seems Ghidra is able to do a lot!

I saved it like this as an elf (i think that was right since you said elf many times?)

and it created this guy! I am going to test now! Maybe I made a mistake, I am not sure but gosh I never would have made it this far without your help!!

edit well i must have done something wrong but i'm getting closer!

edit--- i see where it made it not be a "d" and put an "f" so maybe that's the problem x.x
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
First of all, what I suggested as a patch is NOT the correct patch.

You were supposed to modify the copy of adbd, then VERIFY that the branch was to the correct place.

You never show that the instruction was modified correctly.

Of course it's not going to work and you need not bother showing me any details of it not working.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Just to recap...

Let's say you have a section of code with 5 instructions:

insn1
insn2
insn3
insn4
insn5

And you determine that the middle section (insn2, insn3, insn4) does something that you do not want to happen:

insn1
insn2 ; BAD!
insn3 ; BAD!
insn4 ; BAD!
insn5

You still want insn1 and insn5 to do their stuff. So you put in a branch instruction to branch around insn2, insn3, insn4.

On some planet you could stick in an instruction after insn1, but before insn2 to branch directly to insn5 (which you still want).

Unfortunately, we don't live on that 4th dimensional planet.

But, if we are (somehow) branching around insn2, insn3, insn4 then we don't need those instruction and that space could be used for something else. Like a branch.

insn1
xxxxx branch to insn5
insn3
insn4
insn5

So, of course we don't touch insn1 and insn5 (which we like).

But since we're branching around that middle place we actually have 3 spots to put in whatever instructions we like.

We could also do it this way using the "nop" instruction which does nothing.

insn1
xxxxx nop
xxxxx nop
xxxxx nop
insn5

It's just is that if we want to skip a big chunk, which is easier: writing 27 nops or 1 branch instruction?

Or we could even use that space to do something unrelated for something we want done elsewhere but we don't have the room:

insn1
xxxxx branch to insn5
xxxxx calculate pi
xxxxx return
insn5

TLDR: So you always want to change the instruction after the last instruction that you like.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Good Morning and Thank You for taking the time to explain all this.. I feel like you are a mind reader haha.

So I think I have a new problem?

And let me apologize in advance, I am not trying to detour what you are trying to teach me, I just want to show you what I tried already and how it failed.

I was trying to just learn how to even make edits in hxd, so I followed this guide we read before https://harrisonsand.com/posts/patching-adb-root/

I was able to locate these offsets in ghidrah:

then in hxd under these views i found the offsets:

I made the NOP edits as shown below and saved

However I get this error.

The reason I think there is something more going on here is because when I go to replace the modded binary with the original system binary, adb still rejects my attempts to connect with the same error message and code.

I tried to do some research and without outright saying it, stuff is pointing to SELINUX, but I am wayyy out of my element and seemingly just prodding in the dark at this point.

Lastly, I had been using the binary from the uninstalled firmware image at first. This time I adb pulled the binary from a preinstalled system image incase that made a difference, and as far as running the modded bin. it did not.

Do you know what could be causing the system to reject the modded binary? Thank you for your time as always
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
There are four steps here:

Determine what you want to remove

Modify the code to do that

Verify what you did is what you think you did

Actually try to run the modified code

I gave you a head start, I told you what you want to remove.

I told you how to remove an entire chunk.

You've gone and said, "Look, something says uid, I'll just remove that instead!"

You can't do that, it 's not going to work.

Moreover, removing a function call might be a lot more than replacing one instruction.

A function call needs arguments, that is, some registers or the stack set up with the correct values.

A function call is often checked afterwards to see if it succeeded.

When the function call itself is removed there will be no return code and this check will often fail.

minijail_new is the first instruction that we're calling "bad".

Since minijail_new takes no arguments we don't have to intervene with any earlier instructions.

access is the first function call that we're calling "good"

access requires two arguments so we have to include those arguments if we want access to work.

The first argument is set up with the two instruction adrp/add

The second argument is set up with the instruction mov.

So when we refer to the function call of access we mean all four instructions (including the bl).

In any case, we just want the address of the adrp.

We don't want to modify anything at all in this area.

The point of this whole exercise is to just change 32 bits of one instruction at one location.

That location is the location of the bl minijail_new instruction.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Thank You for helping me to understand by providing all this Context. Now I get why that example i shared was failing and wouldn't or couldn't work. I really had no idea how everything is so device specific up to and including the binaries. Again sorry for a tangent, it just helps me to learn. Now that I know how to edit, I will start working in the area as you have said many times and report back. Sorry it didn't register until just now. Thank you Miss Renate!!!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Hi there, Am I understanding correctly to replace this adrp

With the one shown here?

280800f0 to 800700d0?

Thank you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Nope.

minijail_new is something bad. It's the first bad instruction. You want to replace that with a branch.

The adrp 0x4f7000 (on the bottom) is where you want to branch to. It's innocent. You neither want to modify it or to copy it to somewhere else.

(Note: This would be easier if you didn't hide the addresses. They are important when you are dealing with things at this level. Also, your disassembler is not particularly being helpful when it says "param_1". Since this is aarch64 I presume that they mean x0, but it could just as well be w0 if I didn't know any better. Also, your disassembler printing out 32 bit instructions as bytes in byte order is pedantic, but not helpful. The instruction that you mentioned is 0xd0000780, that's little-endian.)

The point that I was trying to make is that if you had an assembler or knew how to build an instruction you could just replace it with the correct branch. If you didn't, you could just replace it with any branch, then verify that it landed at the right place and if it didn't you could adjust the instruction until it did.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Thank you Renate for telling me all this.. Sorry for hiding the addresses, was working on not showing too much in my posts and I hit the other extreme. x.x

"The point that I was trying to make is that if you had an assembler or knew how to build an instruction you could just replace it with the correct branch. If you didn't, you could just replace it with any branch"

I will find me an assembler now! Honestly, when you mentioned assembler in the past, I thought it was being used interchangeably with the disassembler which seems (and is) stupid now that I think about it. There are so many moving parts here... I had no clue. This is a very humbling exercise and I really thank you for taking me this far.

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
I don't know the disassembler you have, it probably does single instruction assembly.

Take your adbd, make a copy.

Find the actual address of the minijail_new call in the file.

You can do that by searching, you can do that by calculating offset, whatever.

Change that instruction to 0x14000077. That's a branch to some random place forward.

Stick that modified file in your disassembler and verify the effect that you made.

Is minijail_new gone? No: then you modified the wrong place.

Is the branch to the adrp in the setup for the access call? No: change the 77 part of the instruction to a higher value if you are short or a lower value if you went past.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Dan Walsh explains Selinux in the best way I have ever seen

It really helps to understand it as "a labeling system"

His website https://danwalsh.livejournal.com/

He says you can create a policy module towards the end of the video to allow your app the access you need without setting selinux to setenforce=0

Spoiler content hidden.

Spoiler content hidden.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Yes, of course.

SE policy is usually written in .te files by the OEM.

But there is also "CIL" Common Intermediate Language.

You'll find them on your device. (You won't find any .te files.)

When Android boots it checks the dates and signatures on the CIL files.

If there is a need it recompiles sepolicy using secilc (the compiler) and all the CIL files.

You can also write your own rules in CIL and compile them with all the original CIL files.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
@jenneh so, did you ever finishing patching that adbd?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
--edit

I was able to get caught back up to where we were. I got the minijail bl edited to access using ghidra's built in assembler and saved it as an elf program. Trying to install it now through twrp to see what happens

I hope I did this right. I went to patch the access bl so I could get the right offset and then I patched the minijail new using that offset and it changed its name to access. Ghidra said that it was using an assembler for that step.

But it results in this:

I get that error any time I try anything to the binary. Even if I don't change anything and try to reinstall the stock binary. Is there something I need to do with selinux? Or any ideas?

Thank you for your time as always!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Nope.

404fc8 was your bl minijail_new

You want to change that to b 405130 (branch) to the already existing adrp instruction which is 1/2 of the setup of the first argument to the bl access at 40513c
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Is this right Miss @Renate ?

I changed that to b to 405130 and it changed the name to this?

Do I need to add more or should I test at this point?

Thank you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Just scroll down. Does 405130 have a tag of "LAB_00020858"?

Moreover, do the little branch thingies on the left show a line from here to there?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
I did it wrong, I typed literally that 405130 and that shot me up top with the line. I should have type b then the LAB_00405130 and that got me shot down to that branch now with the arrows!! Thank you for mentioning these, that is helpful knowledge.

Spoiler content hidden.

So now that's good? Try?

Thank you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
That looks good.

The concept is the same doing it other ways. You're just dealing with the how Ghidra does things.

(I'm just now writing some macro assembler for AVR8.)
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Okay!!! So Progress! I realized that I needed to revoke the original adb authorization on the shield for my pc, that was what was giving the error I mentioned before. Now the modded adbd does work and I can connect to a server but still that pesky "adbd cannot run as root in production builds" message appears. Should I try to jump further or would you have another suggestion for tackling this problem?

THANK YOU :D
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Are you connecting over WiFi or USB? Try USB.

You're not trying to adb root are you?

Just adb shell
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate I was trying to adb root, I had thought I needed this when we first started working on this, but this project went full circle and showed me how to use TWRP terminal to install the stuff I couldn't do in the shell su. So I feel kinda silly but also I learned so much here. Sorry for all the trouble and thank you again :geek:
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
So, just to be clear, with the patched adbd you can:

C:\>adb shell
#
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate

Double checked, but yes with the patch the shell su still works.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
I think that you're missing the point of this.

Patching is to allow adbd to give you a root shell without Magisk or su.

Also, I've never been a fan of using ADB over WiFi.

I believe that this patch would only work for ADB over USB.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Thank you, yes I did miss the plot entirely here. This is an amazing thought! I know some people are leary to use magisk or random su binaries. I wish I could test via usb but my shield won't work for me via usb in adb mode. Idk why. The usb works for fastboot, but I could not get it to go just wired in adb. Do I Need to be usb connected in order for this to work? Sorry I didn't mean to dismiss the project prematurely. I didn't Understand, now I do!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
It's because you've got it configured for WiFi. Set it to USB:

C:\>adb usb

Also, why you want a rooted ADB over non-rooted ADB with su:

C:\>adb pull /data/data/com.example.com/files/whatever

This will work with a rooted ADB but not with a non-rooted ADB because you never get a chance to say su.

With a non-rooted ADB you must:

C:\>adb shell
$ su
# cp /data/data/com.example.com/files/whatever /sdcard/whatever
# ^D
C:\>adb pull /sdcard/whatever
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate Yes Thank You! I couldn't figure out how to explain it, but your rooted adb example is Exactly why I thought I needed to mod the adbd binary to let me run "adb root" haha, when in fact you were showing how to just make the shell root. Fantastic! I will reflash stock and reinstall the patched adbd and let you know how things go.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate I have a few questions so I can try to understand all of this better.

First question is, how did you know to go to the adb external storage? I understand you are realllly smart and experienced, but how could someone like me know that the external storage was a clue or a starting point?

Second question is:

When I use TWRP to remove the old adbd, and ls in the terminal, I am presented with a lot of directories that I don't see in the adb shell (even rooted). I see a lot of init scripts, and a root_system and sbin directory. Why does it present like this?

Last questions:

I tried replacing both the sbin adbd and the system/bin adbd with the patched one. I am able to adb connect but no root yet. Would the shell just open as root if it worked? Should I be replacing both adbds? Should I even have both?

Thank you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
1) Android is open source so all the C++ (used to be C) source code is available. It might take a lot of time to find the exact version but the structure changes slowly over time. Also, as noted before, the translation from source code to ARM instructions is not completely linear. Static or inline functions disappear as identifiable identities and get subsumed into their parent functions. Still, I've rooted a bunch of adbd so I have a good eye for this stuff now.

2) When you see more you're looking at the root directory /. Normal users only see /sdcard. Use the pwd to see where you are.

3) Look at init.rc to see which adbd executable is specified in the block service adbd. How are you replacing the file? Are you sure that you did?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Okay on the first part, my init.rc says this

For the second part, I am certianly not certain, I am only trying my best but here is what I did:

I copied the patched adbd to my sdcard/Download from adb. I rebooted to bootloader and booted into TWRP.

I opened Terminal in TWRP and cp sdcard/Download/adbd . (copy to root directory) I couldn't just copy from the directory to the sbin, I Had to use the root directory because it was complaining to me about "no home directory set" so I couldn't "~" like normal

Then I rm the sbin/adbd and I cp adbd to the sbin. I did the same for system/bin and I tried with both at the same time. I do not know if this is right, it's all I know how to do right now x.x

--edit As an addon. I am sorry I am not trying to make this difficult, but the adbd that I modified, I pulled from system/bin, do I need to reflash Stock and pull from sbin instead and re patch it? Thank you as always
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
If you change /sbin/adbd in the recovery ramdisk then adbd in recovery will be rooted.

It will not change anything in your normal system.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Okay, so That's good to know, I didn't realize that TWRP was for the recovery ramdisk and not the real system. So then I will test the patched adbd with a modded boot and terminal app to see if it works then maybe I can trouble you to learn how to install it without the modded boot if it works. (I would assume thats when I learn how to add it to the system.img? Idk) I will reach back out soon, thank you so much for helping me!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate

I repatched the adbd from scratch and did these steps (the sbin on the main file system does not contain a adbd) but the shell is still regular user. Did I do something wrong? Or is there something else I can try to patch?

Thank you!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
You can't just start up adbd by itself and expect anything useful to happen.

adbd is part of the USB "gadget" functionfs system.

Look at init.rc and see the triggers that say on property:sys.usb.config=adb.

It does a few thing before that line that says start adbd

(Why all this garbage exists is the subject of a separate discussion. I use my own stuff.)

Recovery: What are you using? Does it have adb running normally? Is it rooted?

System: Is it Magisk-ed?
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Okay thank you @Renate So my init.rc does not contain the line you mentioned, the only line with adb is this

But I have other init.rc files like:

The highlighted one contains the line you mentioned and the lines above it (the beginning lines are that code you asked me to look at):

Spoiler content hidden.

For your second question, Recovery, I am not. I just have the stock recovery installed. I am brand new in this regard, I do not have a clear understanding what the recovery is even for other than a way to install magisk with TWRP but still I just boot twrp and haven't installed it before. Any knowledge there is appreciated

Lastly the System is currently magisked? I think? I patched my boot img with magisk and installed the apk so I could install the patched adbd. I did not know any other way. I have access to full firmware I can go stock, stock with root (magisk), or debug "developer" rooted fw (nvidia provided su).
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
So, have you figured out Magisk modules yet?

Since you are doing a systemless root you need to replace adbd using a module.

It can be in a "grab-bag" module, just a module for yourself to put odds and ends.

Look at https://topjohnwu.github.io/Magisk/guides.html

Make yourself a module and find a way to inject a file like /system/etc/hello

Obviously, you don't put hello there, you put it in something like /data/adb/modules/MyModule/system/etc/hello

Once you figured this out you can go and replace /system/bin/adbd and you'll know how to do it.
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
@Renate I haven't yet but I Will! Thank you sososo much for the lead, will reach out whenever I figure that out!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] jenneh:
Hi @Renate !

I was able to learn how to make and install a module using this template

Spoiler content hidden.

The module installs successfully but adb does not work.

I think the trouble I am having is I do not understand how to set the permissions to execute the binary? When I try to adb connect, it auto refuses the connection.

I setup the customize.sh in the template like this:

# MMT Extended Config Script

# Config Flags

MINAPI=28
MAXAPI=28

# Replace list

REPLACE="
/system/bin/adbd
"

# Permissions

set_permissions() {
set_perm /system/bin/adbd 0 0 0644
}

The error I am getting is the same I had when I was trying to install it in the terminal and I chmod +x it.

I think my problem is with the permissions but I don't know how to proceed. Any advice would be appreciated.

Thank You!
[Nvidia Shield TV & Shield TV Pro (2019) Guides, Ne] Renate:
Well, you're close, but a bit side-tracked.

I should have given you some more hints. Sorry.

First of all, when you make Magisk modules for yourself you don't have to do the zip and install it.

That's if you want to give your module to 20 friends.

If you just want to get something done you just need to do the directories and stuff in your own device directly.

Next, chmod 644 means anyone can read it, but no one can execute.

You nead 755. Or at least 700, adbd is started by init (root) as a service from init.rc

Another thing to bear in mind, changes occur at the next reboot.

So, all you had to do was think of a module name and make a directory with a module.prop

Then you park the modified adbd in /data/adb/modules/MyFunnyName/system/bin/adbd

Reboot

If you have problems, install a terminal application since you won't have ADB if it's broken.

Then you can ls -l /system/bin/adbd to see if your version is there.

You can also do md5sum /system/bin/adbd to make sure that it's the modified one.