yashsingh1/xdaforums huggingface dataset:
[G1 Android Development] dirtyjunkie:
Here in Austria is the same and before i have checkt thats is a "ProblemVersion" i have testet so much things! With the Terminal Emulator, the ConnectBot adn Telnet and also the SDK Emulator! But nothing helps to be a root user or flash my G1! So please help my and find a way!

THX

DirtyJ
[G1 Android Development] davidmuc:
German [rooted] Image

I'd be happy to get a german image to put on my US-phone (RC30), as I am living in Germany and bought the phone a few weeks ago in the US. Rooted would be perfect, but the "regular" image would do for now.

Any ideas (or files or url's), anyone?
[G1 Android Development] raw235:
i want the german image too, because i've got already a german one. it would be a matter of time until a local root exploit is developed for the g1?

what iam a bit scared of is, that when such a exploit occures, google will give out a automated update and fix it as soon as it gets public. any idea how to prevent that?
[G1 Android Development] Gedomania:
Is there now a way to downgrade the original german Firmware from the RC33 so that we can get root on our german phones , can somebody please tell me?

I would like to have the latest Jesusfreke Mod on the phone as soon as it arrives to alter my wifi settings in order to have the possibility to access WPA2 enterprise networks in my university.
[G1 Android Development] PaWi:
So just a question

What can we European Users do to

help

getting root access. I would love to help. But I do not know how.
[G1 Android Development] mrhide50:
I wrote an pm to JF, maybe he can help...
[G1 Android Development] raw235:
iam willing to help too; ive got some programming knowledge which can be usefull, but i dont know where to start :)
[G1 Android Development] Gedomania:
Hey MrHide,

did JF answer you concerning our little problem of not having root on our phones?
[G1 Android Development] Hanneskitz:
Wait till cupcake

The next firmware update (cupcake) will bring multilanguage.

So we just have to wait.

Leider!
[G1 Android Development] Gedomania:
Yeah maybe it will bring us multilanguage, but i don´t care about multilanguage ,

i want root :) and i want to get WPA 2 Enterprise working on my phone :)
[G1 Android Development] dirty_:
i would be fine if i just had the possibility to become root or downgrade or anything :(

And openvpn of course;)
[G1 Android Development] pumuckl:
Maybe it would be possible to change the CID in a custom build of the US RC29, so that german devices can be downgraded?

I wouldn't mind having a US firmware.

Does anybody with a little more insight as me thinks something like this would work?
[G1 Android Development] hades00:
hi!

I've got some phone-information from the german/austrian phone, maybe it helps changing the CID:

cheerio, hades00
[G1 Android Development] pumuckl:
RC30 downgrade?

Would it maybe be possible to flash the US RC30 onto the german device and then downgrade to RC29?

Just found this thread, which contains a full dump of the RC30 release:

http://xdaforums.com/showthread.php?t=463779

I don't have my phone yet, but I think I will give it a try once it arrives.

Don't think it will work, though.
[G1 Android Development] Palava:
Nope

That does - indeed - not work. Cannot enter boot loader..
[G1 Android Development] Grunschlik:
Ive been really looking into this and also asked JF.

For the moment, there is definitely NO way to get root an those devices, JFs explanation was:

"The bootloader checks to make sure that the phone's cid matches the cid in the nbh, and it ensures that the nbh is signed, so it's not possible to flash the RC29 nbh on a non-US phone."

So the only way to get root on our phones is to find a new exploit.

Im absolutly sure there is one, the question is how long it takes till someone finds it.
[G1 Android Development] Palava:
Super CID

Now, I really don't know a lot about these systems. But I do know that I made my Artemis have a so called "Super cid".

well, I'll wait :) i can't really contribute....
[G1 Android Development] raw235:
what about the devphone-images?

i mean, when google releases a full image update for the devphone, could this image be used to make the european-nonrootphones to devphones?
[G1 Android Development] hetaldp:
The Following Android Page says that

SDK 1.1 Release 1 API 2 have German Localization Supports and String

@JF can we use this German Localization Stuff and Make a German Rooted RC33-1.42 from ADP 1.1 or RC33 English Image. so any German Developer can buy RC30 or RC8 UK Phone, Root it and come into the World of Developers with Little Cost !!!

:)
[G1 Android Development] pumuckl:
The way I understand it now is that even changing the CID wouldn't bring us any further! :(

The problem is that the flash images are signed with a RSA-like algorithm.

So even if we were able to change the CID in a US/UK flash file, we couldn't use it to flash it onto a G1 from another location, because we wouldn't be able to sign it.

We would need a signed image that has the telnet exploit, like the RC29, but this is not going to happen since there was no European firmware with this exploit (UK notwithstanding).

So it seems we really have to wait! :(

I think there will be an OTA update soon, to bring Latitude to European devices.

But as it seems, even capturing this wouldn't bring us much further, because we still wouldn't have the private keys that are needed to sign custom flashfiles...

I'm really curious as to how long this will take!
[G1 Android Development] hades00:
hi!

i have an idea! (tell me when i'm wrong)

i found a nice app here

this program runs native c compiled code.

now here's the idea:

maybe it's possible to compile a shellcode (bind /system/bin/sh to socket) via cross-compile for arm. then upload it to a server and run it.

a shellcode like this is out in the web (allready for arm (i don't post the link))

would that theoretical be possible?

cheerio, hades00
[G1 Android Development] rb2k:
Still wouldn't be run with root user privileges :)
[G1 Android Development] hades00:
ok, thats a problem ;)

but there is another local root exploit out on the web (for kernel <2.6.24) but g1 is running a 2.6.25 kernel and it is patched! we just have to wait until a new leak is found
[G1 Android Development] PaWi:
I think we are Xda-developers and we are the one that need to find the leak.

Only way is: How can we help Finding this link?
[G1 Android Development] smnnekho:
damn.... this is actually seriously holding me back from gettin the G1. At least the (without rooting not reachable) Internetsharing is really essential to me.

Can someone say if this is just a matter of time and will definately work someday or if it's hard to say? Because then i guess i have to think about the devphone....
[G1 Android Development] rogro82:
I am able to execute files ( and set the execute rights ). The place that allows this is the folder /sqlite_stmt_journals.

I pushed busybox, using adb, to this folder and i can run the commands after a chmod. Maybe some linux guru can use this knowledge to get root rights.
[G1 Android Development] Der_Psychater:
I tested this, but i can't do chmod...

how are you using the chmod command?
[G1 Android Development] rogro82:
./adb push busybox /sqlite_stmt_journals

./adb shell

cd /sqlite_stmt_journals

chmod 4777 busybox

Now you can execute ./busybox [command] or just ./busybox to get the list of supported commands
[G1 Android Development] Der_Psychater:
ah ok, i only tried chmod 777 .... lol

i pushed "telnetd" and execute it, but it is not in the "ps" list and i am unable to connect...

is there any option for telnetd?
[G1 Android Development] rogro82:
Also cant get telnetd to run... you could try the telnetd that comes with busybox, but i couldnt get it to work.

Also dont think it will work as the owner is still shell... chown isnt working for me.
[G1 Android Development] Der_Psychater:
i tried "./busybox telnetd"

but it looks like the other "telnetd"

i tried "./busybox su"

but "su: must be suid to work properly" what means this?

i tried "./busybox sulogin"

but "sulogin: no password entry for root"
[G1 Android Development] Tuxguevara:
i've tried it...

telnetd won't work because you don't have root uid.

./busybox telnetd -p 23 -F

telnetd: bind: Permission denied

So it can't bind listener port.

I've already tried a few other things...

But i think there will be no success without exploiting it somehow.
[G1 Android Development] rogro82:
I know... you can use chown to change the user/group, but it wont let you change it to root.. you can change the group to (inet/log/input), but i dont think this will be of any use.
[G1 Android Development] Tuxguevara:
Tried...

Start:

./busybox nc -l -e /system/bin/sh

46642 <---random port (bind to specific port not allowed ^^ )

connect wlan network

connect with nc (netcat)

...> nc 192.x.x.x 46642

EDIT://

Could only run one command. Then it crashed...

Typed in id .And it's logically only uid=2000 again.
[G1 Android Development] rogro82:
That way i indeed can connect.... dont think it will allow you to do anything though..

./busybox nc -l -l -e -f -p 888

I also got another port assigned, but i can connect into it ( set it up using double -l switch else it will close immediatly )
[G1 Android Development] McLin:
Where can I find the binary of G1's Telnetd?
[G1 Android Development] rogro82:
in the emulator (sdk) i guess... just use adb pull /system/bin/telnetd ./
[G1 Android Development] Tuxguevara:
As i said. It's possible to enter one command before it will crash. But it's also not a root shell.

I don't think it will be possibly to get root via Busybox..
[G1 Android Development] rogro82:
Nope it wont work... as long as everything is executed as uid 2000 you wont be able to do squat... and changing using chown to 0:0 is a no go...
[G1 Android Development] Tuxguevara:
Also tried:

./busybox tcpsvd -v -c 3 -b 3 -u 0:0 0 22 /system/bin/sh

tcpsvd: setgid: Operation not permitted

So starting any daemon as root is not possible.

With ./busybox tcpsvd -v -c 3 -b 3 0 22 /system/bin/sh i got a shell with uid=2000 as usual...

EDIT://

Maybe found something...

ls -l /proc

.

.lrwxrwxrwx root root 2009-02-17 00:53 mounts -> self/mounts

.

.lrwxrwxrwx root root 2009-02-16 22:02 self -> 724

.

dr-xr-xr-x shell shell 2009-02-17 00:53 724

Owner of 724 is shell (2000). But mysteriously everytime i type in "ls -l /proc" the value of "self -> " increases +1 .

So...

$ cat /proc/725/mounts

.

/dev/block/mtdblock3 /system yaffs2 ro 0 0

.

Maybe it's possible to write into /proc somehow.
[G1 Android Development] raw235:
/proc/self points to the active process itself. Its increasing because cat gets everytime a new pid

The easy way of running binaries inside /sql* dir is a step forward. If we have a local root exploit, we can deploy it there. Now only the exploit is needet :) kernelhackers huh?
[G1 Android Development] rogro82:
Ok... succesfully upgraded my dutch G1 to RC33, but still not able to get root in anyway and also not able to revert to an older RC.

Going to try some more.... There must be an opening somewhere...
[G1 Android Development] McLin:
Here too, we need like my WM XDA an HardSPL, that we can flash without root:mad:
[G1 Android Development] rogro82:
McLin did you try the following?

http://andblogs.net/2009/02/new-adp1-update-official-with-google-voice-and-more/

Its the adp image without device/bootloader check... maybe we will have more success running this one..
[G1 Android Development] McLin:
IS that rooted?

I have signed-kila-ota-126986.f6469a1e.zip that is RC33 but not rooted...
[G1 Android Development] rogro82:
Hmmm just tried it but it says files arent signed :S maybe its my linux box.... and yes it should have su as its an adp image ( if im correct about su on adp )
[G1 Android Development] McLin:
I will try it... wait.
[G1 Android Development] rogro82:
Theres also a bootloader in that thread ( 0.95 with fastboot )... if everything will fail, maybe we should give a try although im not too eager to try :D

Also tried the other one:

Still getting 338 ( or so ) files not signed... I wonder how it can be that we were able to update using the other RC33 update.zip, but arent able to use this one
[G1 Android Development] McLin:
You tried: ADP 1.1 Official Update.Zip (No Device Checks!) v1.0 (606 downloads) ???
[G1 Android Development] rogro82:
I tried them both... did you have any success?
[G1 Android Development] McLin:
I must little charge:o Wait 5 min.
[G1 Android Development] McLin:
Same hier no Signature... But Filename says signed?
[G1 Android Development] rogro82:
maybe its still checked against something else or are the adp devices signed with other keys?

I guess trying to flash the bootloader is a no go because of not having a modified recovery partition as stated in the hardspl thread...
[G1 Android Development] rogro82:
Tried the bootload... no signature ( 5 files ), but atleast it didnt **** up my device :D
[G1 Android Development] McLin:
Bootloader upgrade with camera and power?

Extract the update.zip:

android-info.txt
[G1 Android Development] McLin:
We can delete the Text from the txt file;)
[G1 Android Development] rogro82:
I say give it a shot :)

If we are able to flash the US RC33 will we also be able to flash a JF RC33? We will not have root, but atleast some other stuff? Did you try this?

Edit:

Nevermind just tried it but also no sig on 300+ files
[G1 Android Development] McLin:
we can mount, so we make an *.img suid the telnetd bin and copy it to the image and mount it on G1 and run it...
[G1 Android Development] rogro82:
we cant mount anything for as far as i know...
[G1 Android Development] McLin:
I can mount and remound loop device and SD Card
[G1 Android Development] rogro82:
Can you post up the commands? I always get permission denied... :-S must be doing something wrong

I could try to make an ext3 image with telnetd in it...
[G1 Android Development] McLin:
Just mount it gives a list what is mount

umount without parameter gives umount need bla

so look first with mount where is the sd card and umount it...
[G1 Android Development] fnordprefect:
How do you umount the sdcard without beeing root? Are you sure? Did you double-check, that the sdcard is REALLY umounted?

The umount-binary is clearly not suid (as it is only a link to toolbox), there are no suid-binaries on the system where a user (adb shell or terminal emulator) has access to...
[G1 Android Development] McLin:
you dont need be root to umount sd card
[G1 Android Development] fnordprefect:
Are you REALLY sure? Can you perhaps join the irc-channel (irc.freenode.net, #android), so we can discuss this live? this would be the the root-hole we need... (i'm from germany, too).
[G1 Android Development] McLin:
not now I go sleep cos I need at work tomorrow morning, but when I'm @ work I can chat with you...
[G1 Android Development] rogro82:
umount /dev/block/mmcblk0p1

umount /sdcard

both: failed
[G1 Android Development] fnordprefect:
i'll be there tomorrow at around 12h (CET), see you!
[G1 Android Development] McLin:
but not with permission denied, you cant unmount cos there are processes at the card...

you can watch the list with ps
[G1 Android Development] rogro82:
Mounting an ext3 image i always get:

ioctl LOOP_SET_FD failed: Bad file number

Anyone with a solution?
[G1 Android Development] McLin:
use ext2...
[G1 Android Development] rogro82:
Just did... same problem
[G1 Android Development] voixonline:
Just a quick note

For all german users wanting to update to RC33 from 123099 ie to 126986 "NO ROOT" SEEMS TO BE JUST ENGLISH

check out ..

http://electrobabe.at/2009/02/13/t-mobile-g1-update-rc33-ab-162/

and the update.zip at

https://android.clients.google.com/updates/signed-kila-ota-126986.f6469a1e.zip

copy the downloaded file as update.zip to the sd card..

unmount sdcard (unplug usb)

restart phone with home button pressed

press alt - L then alt - S

drink coffee

works fine by me.. Latitude is there and the the market shows "Update Available"

voice search is working said "cheesecake" google found lots of cheese cakes..
[G1 Android Development] McLin:
Can you write all steps you are using, what did you type and what did you get
[G1 Android Development] voixonline:
PS , just noticed that this seems to just have English Installed, but the keyboard layout is correct.. ie üöä y<->z is A OK...
[G1 Android Development] m.gri3s:
i have a problem... because when i will update to rc33 i am afraid of to getting nevermind root??!?? anyone a idea? how we can umount our sd card?
[G1 Android Development] voixonline:
With the update we should be on the same level as the American devices which MAY mean its easier to root them.. but it may also mean the JF & co already all have rooted devices and wont bother trying to root the RC33 release whatever CID they have, but I dont expect that..

for me the main reason for updating was to get latitude and voice search working, I hate it when there a new features out there which I cant use.. :mad:

PS if anyone doe use this update be warned that your contacts go missing, they can simply be sinked again so make sure you have the contacts synced to google mail
[G1 Android Development] m.gri3s:
eigentlich könnten wir ja deutsch schreiben oder, hab jetzt mal so einwenig die beiden datein rc33 verglichen also einmal die bei uns funkt. und einmal jf seine, bei unserer fehlt unter apps telnetd, hab das einfach mal eingefügt und werde das update jetzt mal installieren
[G1 Android Development] voixonline:
naja deutsch geht auch, bin aber Englander... sag bescheid ob es klappt..
[G1 Android Development] m.gri3s:
ach ja hab noch ein problem, hab jetzt cant open sdcard/update.zip? kennst du das?
[G1 Android Development] voixonline:
I had a problem that my USB cable was connected over a USB extension cable and sometimes it kept resetting the connection when I copied the update.zip I had to connect my cable directly to a usb port which provided better power and without the extension.

how did you copy the update.zip to the sdcard with a cable to the phone or by removing the card and inserting into a computer...

my update zip is 46.0 MB (48209617 bytes)

ps if your using windows :( then make sure it is called update.zip (not update.zip.zip)
[G1 Android Development] rogro82:
@mcLin:

I first created an ext2 image using:

dd if=/dev/zero of=test.img bs=1k count=8096

mke2fs test.img

mounted it and added telnetd and chmodded/chowned it and then unmounted it and copied it to the sdcard.

created a mnt folder in sqlite_stmt_journals

Then in adb:

mount -o loop -t ext2 /sdcard/test.img /sqlite_stmt_journals/mnt
[G1 Android Development] voixonline:
could you start telnetd as root then?
[G1 Android Development] m.gri3s:
so ich hab mal telnetd hinzugefügt, beim installieren schreibt er e: no digest for system/bin/telnetd

was könnte das bedeuten?
[G1 Android Development] voixonline:
it means it could not find a hash digest meaning telnetd is not signed
[G1 Android Development] m.gri3s:
können wir irgendetwas dagegen tun?
[G1 Android Development] rogro82:
Will never work because the update.zip is signed and as soon as you change it will halt.

You can however upload telnetd using adb, but it will get you nowhere as it will be run as shell/shell and not as root...

My only hope is to get an ext2 image mounted with telnetd / sh / busybox already suid in it and then run it from there. It doesnt really need to be telnetd as long as you can execute as root it should be ok.

McLin:

Using busybox mount i get:

cannot setup loop device: No such file or directory ( but they both are or is there something wrong with the actual loop folder )
[G1 Android Development] m.gri3s:
bei mir steht beim erstellen der ext2 read only?
[G1 Android Development] McLin:
bash-3.2# mount

rootfs on / type rootfs (rw)

/dev/pts on /dev/pts type devpts (rw)

/proc on /proc type proc (rw)

/sys on /sys type sysfs (rw)

/dev/block/mtdblock0 on /system type yaffs2 (rw,nodev,noatime,nodiratime)

/dev/block/mtdblock1 on /data type yaffs2 (rw,nodev,noatime,nodiratime)

system.img /dev/block/mtdblock0

// busybox.tar

bash-3.2# tar jcvf tmp/system.tar.bz2 system

pc

#adb pull tmp/system.tar.bz2 system.tar.bz2

system.img pc mkyaffs2 system.img

2. yaffs2 mkyaffs2image

http://www.aleph1.co.uk/cgi-bin/viewcvs.cgi/yaffs2/

// Download tarball tar

utils

mkyaffs2image mkyaffs

#./mkyaffs2image system/ system.img

Use this FS!!!

The commands are just samples...
[G1 Android Development] rogro82:
K will give it a shot thx
[G1 Android Development] m.gri3s:
i have problems with this please help me to get this...

how can i get ext2 and the followings steps?

does i net the rc33?
[G1 Android Development] rogro82:
@McLin:

Just created a yaffs2 image with telnetd in it:

mount -o loop -t yaffs2 yaffs2.img /sqlite_stmt_journals/temp

ioctl LOOP_SET_FD: Bad file number
[G1 Android Development] McLin:
Without Loop?
[G1 Android Development] McLin:
mknode /dev/loop and /dev/loop0 ??

or

losetup /dev/loop and /dev/loop0
[G1 Android Development] rogro82:
mknode doesnt exist

losetup /dev/loop ( no such file or dir )

losetup /dev/block/loop0 ( permission denied )
[G1 Android Development] McLin:
Ok then we can forget the idea with mount img...

I didnt check it, that we havent an /dev/loop0

We need the keys, that we can sign our own update image...
[G1 Android Development] McLin:
Mhmmm....

In the android-info.txt in signed-kila-ota-126986.f6469a1e stand the same:
[G1 Android Development] eldorado2705:
Hi there,

i'm also trying to gain root access with G1, with good knowledge in programming and a little knowledge in linux, but learning more and more..

I wanted to ask you guys, where the permission is blocked exactly? Is it build in the kernel or is there any other process running in the background blocking every command which might help us to gain root access?

kind regards

eldorado
[G1 Android Development] voixonline:
When an update.zip is run to update the firmware is it run from the update.zip or from the phone tools?

my idea is that updating the firmware has root access, ok so we cant add files willy nilly into the update.zip but maybe the files such as "check_prereq" in the update.zip are ran when an update is started, this then checks keys and if it can update. So you swap out this file with some other binary that modifies root permissions...

just an idea, dont have time to check.
[G1 Android Development] voixonline:
ok i just checked edited a byte in check_prereq then tried to update

and guess what... didnt work...

can someone tell me what happens if you simply remove the digest entries in the manifest file? that is if anyone has tried..
[G1 Android Development] rpodgorny:
english only, please

can you, please, keep this thread english only? this is not only about german image, it's what the entire continental europe gets...

thanks
[G1 Android Development] McLin:
Is the Zip files signed? So we can copy it with Hex Editor...
[G1 Android Development] Tuxguevara:
I heard about an attack against sha-1 to produce the same checksum as before by injecting kind of pseudo data into the file.

So we would be able to change things in update.zip.

EDIT://

Read about it...

http://www.h-online.com/security/Hash-cracked--/features/75686/0

So not achievable, too i guess...

Still waiting for exploits...

Can someone tell me the exact version of linux kernel src they use for Android ?
[G1 Android Development] Plastriq:
Current kernel version in the repo's seems to be 2.6.27...

On the phone it's 2.6.25, uname is not available :(

Too bad my knowledge of linux is kind of limited, I'd have gladly helped out cracking this thing :)
[G1 Android Development] kmetz:
some inspiration

There is a video from a talk/lecture the guys who hacked the iPhone gave on the 25C3(a hacker congress in Germany): http://chaosradio.ccc.de/25c3_m4v_2976.html

They had to deal with very similar issues, signed images, bootloader hacks etc.

A nice inspiration - where to poke for holes, also an insight in how hard this might be to do.

Keep up! My linux skills might not be good enough, but if i find something, I'll let you know.
[G1 Android Development] McLin:
I have an Idea...

You take your Image with yaffs2 format, and dump it with dd in you SD Card.

Then you have an supportet FileSystem and permissions...