yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] jmanley69:
It needs to be in /data/local and then you need to /data/local/3615 to run it (after setting 755 permissions)
[Droid Eris Android Development] Videofolife13:
If you run it, it comes up with this:

Usage: /data/local/3615 <host> <target>

So, what are we throwing at it?
[Droid Eris Android Development] jmanley69:
upon inspection of the code (sorry... I was just compiling what you guys threw at me)...

it would be...

/data/local/3615 127.0.0.1 0

and if that doesn't work

/data/local/3615 127.0.0.1 1

This attacks the dproxy service. It doesn't work on my MoDaCo ROM, but it may work on a stock rom. If it does... let me know which one worked, and I'll make it run without any command line arguments.

I don't think it'll run though... because I doubt dproxy is loaded on the Android phones.
[Droid Eris Android Development] Videofolife13:
+Attacking to 127.0.0.1...
fp: 0x8048cf8
buf len: 512
+Building buffer with shellcode... done
+Sending Payload... done
+Waiting for the shellcode to be executed...
connect(): Connection refused

Both returned this. It happens. I'm still waiting for the OTA update to come out. I think that would shed some light. We could try to craft our own update.zip when we do get a hold of it.
[Droid Eris Android Development] jmanley69:
post a ps if you can please.
[Droid Eris Android Development] jmanley69:
Yup... that'll do.

Check your exploit sources (websites) for any dmagent buffer overflow or overrun exploit.

If you can't find anything, I can try to probe it and see if there's a hole there, but since I'm not too skilled in that (yet), it will take me some time.
[Droid Eris Android Development] Videofolife13:
I couldn't find a lot out there.

The first exploit is a pipe.c exploit. Not sure if all pipe.c exploits are patched, but here is the source code for two exploits:

http://downloads.securityfocus.com/vulnerabilities/exploits/36901-1.c

http://downloads.securityfocus.com/vulnerabilities/exploits/36901-2.c

The second, well, I have no idea how to implement it. Here's a link if you want to look at it.

http://www.securityfocus.com/bid/36953/info
[Droid Eris Android Development] jmanley69:
The first 2 won't compile without personality.h (and I can't find it).

The third one is really a DoS... if you run that one, you'll just lock up your device and likely have to pull the battery (no bricking, just freezing), but won't give you root access.
[Droid Eris Android Development] binny1007:
Well if we can get the update we can try this alldroid.org/viewtopic.php?f=96&t=626
[Droid Eris Android Development] binny1007:
Here is one I don't think we tried yet.

http://www.milw0rm.com/exploits/9575
[Droid Eris Android Development] Videofolife13:
"LOCAL LINUX KERNEL ROOT EXPLOIT (< 2.6.19) - CVE-2009-2698"

Will it work even though we have 2.6.27?

And how come none of us have gotten the system update? I'm dying to get a hold of that OTA update
[Droid Eris Android Development] ksuviper:
OTA Update

i got my update a couple of nights ago. if there is anything i can do let me know.
[Droid Eris Android Development] rigamrts:
we had the ruu that works for the eris and tried to shove our rom through. the eris just spit it right back at us, smiled and waved. i think i saw a middle finger there too LOL. but no the phones sig check is a whore.
[Droid Eris Android Development] Videofolife13:
Try running this:

adb -d logcat UpdateReceiver:I CheckinService:I *:S

And post your output
[Droid Eris Android Development] ksuviper:
i'm not getting anything. it just sits there like its executing but never returns anything or returns back to the command prompt. does it matter if i have already installed the update?
[Droid Eris Android Development] rigamrts:
won't we be running into the same brick wall we did with the ruu. the sig check will just kick us back out.
[Droid Eris Android Development] rigamrts:
no it won't help once it updates and reboots the url wipes out of the log
[Droid Eris Android Development] ksuviper:
radio version

can someone tell me what version the radio is on a non updated phone? thanks.
[Droid Eris Android Development] weiln12:
Radio/Logcat

I have the update waiting, but haven't installed it. My current info is:

Radio: 2.32.00.09.26

Kernel: 2.6.27-e850bbao htc-kernel@and18-2 #926

Build: 1.12.605.1 CL76938 release-keys

Software: 1.12.605.1

Hardware: 0002

I've tried the logcat statement above, but mine just sits there as well. I went into the shell, and ran logcat, and copied that into a text editor, but I'm not sure what to look for. I did a search for "CheckinService" but didn't find anything.

What else can I do?
[Droid Eris Android Development] Videofolife13:
adb -d logcat > log.txt

From a shell on your computer with the phone connected. Look for ".zip" and see if you can find the google sever.
[Droid Eris Android Development] weiln12:
The only thing I found was the actual .zip on the phone, which is in /cache. I can't access it though, I don't have enough permissions to even read the directory.

Nothing else in the logcat at all.

Any other suggestions? I guess, I could do a reinstall from scratch, and have it download the file again, and check to see if there was something in the logcat. Do you think this may work?
[Droid Eris Android Development] Videofolife13:
Yeah. Try getting it to push it to you again, and when the notification pops up, run to your computer to try it. Haha.
[Droid Eris Android Development] Videofolife13:
Could I get someone's opinion on this?

adb logcat
- waiting for device -
I/DEBUG ( 41): debuggerd: Oct 15 2009 16:17:42
I/vold ( 40): Android Volume Daemon version 2.0
E/flash_image( 48): error opening /system/recovery.img: No such file or directory

This is the logcat output for the Eris's start up. Does this imply that the way it flashes a recovery image is on the first boot up? Like, it puts the .img in System, does a soft reset, and then loads it? I may just be optimistically off base here. Let me know what you think
[Droid Eris Android Development] weiln12:
OK, is this it?

http://android.clients.google.com/updates/desirec/desirec-ota-88486.7f0a2c6c.zip
[Droid Eris Android Development] Videofolife13:
I literally just screamed "Mutha****a! WOOO!!!" Haha. Awesome. Thank you so much for getting a hold of it.
[Droid Eris Android Development] weiln12:
Here is the most I could get from logcat. Maybe there is something in here to help?

I hope I'm attaching this correctly. Let me know if I can be of more assistance.
[Droid Eris Android Development] zifnab06:
I"ll put the recovery.img that jmanely modded and see what happens. Post back in a few.

Edit - I can't get it to work. Booting to recovery doesn't load the update.zip for some reason. I don't know why. Any help is appreciated.
[Droid Eris Android Development] Videofolife13:
Yeah. Then throw it onto your sdcard as update.zip or PB00IMG.ZIP and see if you can get your phone to update with the new recovery menu.
[Droid Eris Android Development] zifnab06:
update.zip didn't work so i'll try PB00IMG again.

Edit - Nada. Won't load recovery, and checking image fails (although it did with the original rom.zip and update.zip as well).

One more update. I'm going to try http://alldroid.org/viewtopic.php?f=96&t=626 and see if this method works or not. Post back in a few.
[Droid Eris Android Development] Videofolife13:
Not going to work. It's only for 2.0. You can give it a try, but it has a 99% chance of failing.

One thing you may want to try is falshing the recovery.zip that jmanly posted and using flashrec to flash it. (Can't guarantee that wouldn't have disastrous consequences).
[Droid Eris Android Development] zifnab06:
I got my Eris becuase of a warrenty issue through verizion with my env2. I'd rather not brick it if i can help it :(

edit But I tried anyways. Our copy of cupcake is patched against it. Boo :(
[Droid Eris Android Development] Videofolife13:
Good call. Looking at it more, flashrec uses asroot2 which doesn't work on the Eris, so it might be useless to try anyway.
[Droid Eris Android Development] zifnab06:
Can I get this compiled (unless we've tried it already?)

http://www.securityfocus.com/data/vulnerabilities/exploits/36038-android.tar.gz

I'm having problems getting a working arm-toolchain. boo :(
[Droid Eris Android Development] ataranine:
I'm seriously rooting for you guys... oh god..no pun intended.

Keep it up guys, you'll get it eventually, I know you're working hard!

Hopefully someone can make it happen. I hate HTC's version of Cupcake.
[Droid Eris Android Development] Videofolife13:
That's asroot. It's the original hero exploit. It's been patched.
[Droid Eris Android Development] zifnab06:
Sad. I didn't realize that. :( Well I'm running out of ideas.

I'm going to start posting exploits I can find.

http://www.milw0rm.com/exploits/911

This is an exploit with the AIO. Currently, its just a local DoS. Could we modify it?

As far as personality.h

Can we use it?

Then we can try http://www.milw0rm.com/exploits/9542.

This one also needs personality.h.

http://www.milw0rm.com/exploits/9479

Can I get an sshd ported for arm somewhere as well, and run it from /sdcard? If worse comes to worse, we might be able to get sshd/telnetd running, and possibly run a bruteforce script for the root password? That way, we could use a root ssh term or telnet term and mod what needs to be modded to get permanant su access.

Just a thought, tell me what you think.

Edit - as far as ssh. If we could get the root password.....it would be fairly easy to chmod login, so instead of using su to get root, we'd just "login root" and it would ask us for the password. Another thought.
[Droid Eris Android Development] ataranine:
I've been wondering...

Let's say WHEN the Eris is rooted, not if, WHEN..

Would one be able to install a custom ROM onto it, say maybe one without SenseUI?

Sometimes I prefer not to have it on my Eris, and disabling it doesn't REALLY disable it. I want the stock android OS on mine.

So, WHEN it gets rooted, we'll be able to load stock ROMs without SenseUI on it, right?
[Droid Eris Android Development] rsawicki:
Found something might be useful.

i was extracting all of the images, and came across a file zip file called OTAcerts.zip with a file called releasekey.x509.pem

i dont know if this is of any use but it is contained within the system image. there may be others like it in the other images.

im going to have a look around as im finding some rsa stuff in the hex editors too... i cant make out too much yet though... so ill include the zip file in the post since you can view the pem file in hex edit.

also im going to be looking into where to find an rsa key generator and i want to see if the md5 of this system.img will generate a key that matches the one in the pem file, as inside one of the files if i open it in a hex editor, theres a string that is making it appear as if the KEYS are being generated maybe based on the MD5... i dont really know for sure...

anyway... just trying to help.
[Droid Eris Android Development] ataranine:
bump.

Any progress guys? :D
[Droid Eris Android Development] JTF2007:
I just got the OTA update notification. Is there any reason why I should keep denying this install in case the exploit that is found only works on the current OS without this update?

Thanks.
[Droid Eris Android Development] Spencer_Moore:
I'm not positive but from following what they're trying to do it seems like there looking for an exploit in the new update. Don't take my word for it though idk ****
[Droid Eris Android Development] jmanley69:
as far as I know, piggybacking on the OTA update with your own payload is only confirmed to be a hole in the verify procedure included in 2.0.
[Droid Eris Android Development] Videofolife13:
True. The Verifier.c got rewritten for 2.0. We're still looking for a kernel exploit.
[Droid Eris Android Development] zifnab06:
Exactly. If we can find a kernel exploit, then we'd be golden.

Can someone do me a favor and do this for me on either a rooted hero, or on a rooted G1: (and upload them and send me a link)

adb pull / dump

I have a few ideas on how to get in (noted above with the sshd/telnetd idea), but I need some files out of the original rom (mostly sshd and telnetd, and the config files.

Thanks, and you rock!
[Droid Eris Android Development] thedudejdog:
yes i did that, what files do you need? it pulled my /sdcard and all my nandroid backups and everything.. lol

also, i'm running FRESH rom 1.0 does that make a difference?
[Droid Eris Android Development] jmanley69:
sshd and telnetd can't do a setuid to root unless they belong to root first (I believe), but regardless, programs can't change their uid unless they're in /system/bin, and you can't write to that without mounting rw, and having root privileges. Also, telnetd doesn't exist on the cdma hero.
[Droid Eris Android Development] jmanley69:
Just having the header is not everything. Header files tell C programs how to use functions in the library. If you have a header file that says a function exists, you can compile the program... but if the function doesn't exist at runtime, the program will not work. So, if the toolchain will not compile the program because of a missing header, that means the program will not work.
[Droid Eris Android Development] binny1007:
I did some searching tonight let's hope some of these will work

http://www.astalavista.com/index.php?app=exploits&do=view&id=9358

http://www.astalavista.com/index.php?app=exploits&do=view&id=9354
[Droid Eris Android Development] binny1007:
One more

http://packetstorm.linuxsecurity.com/0911-exploits/cve-2009-0692.c
[Droid Eris Android Development] jmanley69:
The first is a denial of service attack... that's not what you want.

The second relies on ps with parameters, which isn't allowed on the existing platform and grep which has permission denied on the current platform.
[Droid Eris Android Development] zifnab06:
Does ps need root? How about grep? Same idea as above, just with those if they don't require root. Just, grab a version of ps that will use the -eml options. and compile it.'

(just a note- i have finals at school this week so i won't be around to help :( good luck though. i'll be back when i get everything done)
[Droid Eris Android Development] obelisk79:
This sounds too easy to be true, but has anyone tried this yet?

http://www.androlib.com/android.application.uk-co-neilandtheresa-instantroot2-qAmj.aspx
[Droid Eris Android Development] jmanley69:
while they don't necessarily need root to run... the problem is that the version of linux on your phone is not a traditional version. All the commands (like ps and grep) are really part of a program called busybox. On the Android platform, the busybox has been even more crippled and is called "toolbox". Google has made commands like grep restricted to root only, and ps does not have options (it is what it is... no -anything command line arguments).

Now, while you can put your own busybox on there, and map ps and grep to it, it's not guaranteed to work like "normal" linux (since it's not real linux... it's more like linux-lite).

We've tried the pipe exploits, and they don't work. Not to discourage you guys from looking for more possibilities, but the same 4 or 5 keep showing up as "let's try this one".

Just like the NULL derefrence pointer exploit that came out in September (the ASROOT that the older kerneled phones could use)... another will come out. People are always trying to find these exploits, it just takes patience. Also, the problem is that there isn't somebody super skilled in the art of jedi hacking that owns an Eris.

The Samsung Moment was compromised by somebody playing around with all the "modes" and found out that when you put the Moment in Test Mode, you can write to system.

The Droid was compromised by somebody figuring out that you could append your own payload to the OTA update.

Newer GSM Hero's were compromised by somebody figuring out that you could force the phone to go back a version of firmware to your liking.

Things like goldcards, and all that were discovered by people just plugging away at it.

My suggestion is... read up on this stuff. Learn the Android platform... Learn programming enough to look through source code... Get the kernel and android source... play around with the phone trying to place it in different "modes" (by turning it on certain ways, by using fastboot, etc) - BE CAREFUL BECAUSE YOU MAY END UP WIPING ALL YOUR USER DATA - you will not brick your phone by turning it on a certain way, but there are secret keypress combinations that clear your phone without asking for confirmation.
[Droid Eris Android Development] jmanley69:
Yes, too easy to be true. This relies on the exploits that have already been patched (things that flashrec relies on). However, you are free to try....
[Droid Eris Android Development] jmanley69:
won't compile. needs dnet and pcap

That could have been a good one though.
[Droid Eris Android Development] binny1007:
Man I had high hopes for that one, its a buffer overflow attack is there anyway to exclude those?
[Droid Eris Android Development] nubslash:
Did you rip these from the "/data/app-private/"? Accessing that folder requires root.
[Droid Eris Android Development] rigamrts:
not really going to say how i did it cause it will allow pirating. buy yes the private folder is very ripable. but it probably won't help with rooting tho. i took a second look on how the app worked and did some testing found out we probably won't get this to work for root.
[Droid Eris Android Development] Spencer_Moore:
bump de bump :)
[Droid Eris Android Development] adelaney:
Why is this not for Eris posters? Last time I checked, it was a cdma hero. There should only be subtle differences in its rom compared to Sprint. The hardware is practically the same. Have you tried the cdma method? Flashrec? InstantRoot? I would try them see what happens.
[Droid Eris Android Development] jmanley69:
No need to bump, it's only been 10 hours since the last post. Doing so is a good way to upset the Hero people that graciously host this thread.

People are working as best they can, and when they find something, it'll be posted.

If you'd like to contribute, feel free to find possible kernel exploits for root escalation, and post them here for somebody to compile/try.
[Droid Eris Android Development] nubslash:
All current root methods have been patched on the eris.

Also, I was looking over how the moment was rooted and pressed the answer call button, trackball, and end key while I turned the phone on and I was presented with a menu with options for recovery and something else labeled 'fastboot' while I havent had the phone long or had the time to look into anything on the technical side of rooting, I just wanted to see if this was already known or if there is anything that can be done with this.
[Droid Eris Android Development] Videofolife13:
It's called fastboot mode. It's well known about and documented. (Use google if you want to know more) It can be accessed by holding call when you turn on the phone. The Eris fastboot does not run the commands that, say, the Dream does, so you can't really do much with it.
[Droid Eris Android Development] Zargle:
Why can't it be?

The new update fixed a lot of problems with the droid eris... I would say if anyone is rooting the droid eris... PLEASE make sure it works with the new update...

Hurry up with the root :D I want to save my apps to my SD card... I hate the limited memory... :rolleyes:

And come on HTC and Google! you should want us to root our phones voids the warranties which makes us cost less for you :p:D

------------------------------

http://www.elitenerds.com
[Droid Eris Android Development] TaurusBullba R.I.P.:
Both Droid Eris "root" threads have been merged to help tidy up the forum.
[Droid Eris Android Development] chuckz07:
Dumb question...While I was gathering some of the software for Linux, I came across this. Someone posted awhile back about the source code for 1.5 being released, is this what they may have been referring to?

http://source.android.com/release-features
[Droid Eris Android Development] binny1007:
Well guys I think we hit a brick wall for now :( every current exploit I find we have tried. I will keep looking but I'm not holding my breath
[Droid Eris Android Development] zifnab06:
If exploits don't work, take jmanely's idea from earlier. Grab anycut, start loading apps you don't know what they are, start messing around with things. Eventually, we might find something that allows rw access through adb (i'm not sure but test mode did for one of the older phones).

One more thing. Could someone extract their system.img out of rom.zip and post it somewhere, and give me the link? There might be some stuff we can use in there. Thanks!!
[Droid Eris Android Development] SirScott:
The link posted earlier for the OTA update does not contain a system.img, only a boot.img and recovery.img.

Or is that not the rom.zip you're referring to? If not, if you let me know where / how to get rom.zip, I'll upload the system.img file for you.
[Droid Eris Android Development] zifnab06:
I guess a better question would be....

How does one go about mounting yaffs2 in linux? I can't find anything but unyaffs, which fails with the system.img file. I want to get an accurate dump of the /system partition, which is contained in the system.img. I'm working on an idea kind of.

Thanks!
[Droid Eris Android Development] SirScott:
Do you have a kernel with yaffs2 support?
[Droid Eris Android Development] zifnab06:
i was wrong. I sent a message out to the google dev group, and unyaffs is doing its job. I was just slightly wrong. I need the boot.img file, which is slightly different than a normal filesystem. If anyone can open it, extract the initramfs file, and post init.rc it would be awesome. I'll keep trying.

edit - Read next post
[Droid Eris Android Development] zifnab06:
So, earlier we wanted init.rc, and those files contained in / (adb pull / dump)

Here they are!

http://www.mediafire.com/?yiw1yuuffld

I grabbed them out of the boot.img file, using a script found on android-dls.com. if these help, YAY!

Edit from here to bottom:

What I can tell from init.rc, during the boot process /system is open for writing. In init.rc, there are two commands directly in a row:

mount yaffs2 mtd@system /system

mount yaffs2 mtd@system /system ro remount

so, /system is first mounted as rw, then is remounted as ro. If we can find a way to mod init.rc, or force the bootloader to load our copy of the same file, then we could possibly get it to skip the second line of this command (making /system mount as rw).

In theory, could this work?

Another finding: in sbin on the recovery image, there is a file named "adbd". I'm assuming it is the adb daemon. I can't seem to connect to it via usb (maybe the usb daemon isn't running?). It would be run as root for the recovery boot. So, if we could somehow connect to it, we'd have root access, be able to mount /system, and drop su on there.

And one more thing (edit again)

http://android.git.kernel.org/?p=pl...2;hb=d105f8f84f25db7861775e07a808855334207d95

Thats the source code for the recovery file in /sbin (in recovery.img). What I'm thinking. And I'll see if it will work in a few. When you press the "Factory Restore" button, it writes something into the /cache folder. If we can modify the app that causes the factory restore to (under root access) get our own update.zip thrown into /system, we should be able to get root. If I understand how it works, we could easily modify this to flash our own update to the phone. All using the source from the android project :D