yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] jmanley69:
Put these in /data/local, chmod 0755 each of them. get busybox and put it in data/local and make a symlink for wc to point to busybox.

Then go to /data/local (and you have to run this FROM /data/local) and ./dura

When your phone stops responding, adb will kick you out in another couple of minutes... don't panic, nothing has been damaged on your phone, just pull the battery and reboot.
[Droid Eris Android Development] jmanley69:
forgot the file.
[Droid Eris Android Development] Videofolife13:
Thank you.

I couldn't even get the exploit to work. It said "cannot find wc" and I couldn't make the simlink work. So... Sorry, guys.
[Droid Eris Android Development] jmanley69:
Download busybox for android.

Push it to /data/local/

Adb shell

$cd /data/local

$chmod 0755 busybox

$ln -s wc busybox

$./dura

But I'm telling ya... all it'll do is lock up your device. Feel free to try.

Find another exploit and I'll be happy to compile it for you.
[Droid Eris Android Development] Videofolife13:
Yeah, I got it to lock up. Thank you for compiling it. We're always lookin around.
[Droid Eris Android Development] markachee:
The guys in #android-root on freenode said that not only are Cellular South's Hero, Droid Eris, and Droid now using a non zero mmap_min_addr, but that the way around it had also been patched. Not sure if that was referring to CAP_SYS_RAWIO or not.

The "enlightenment.tgz" from grsecurity comes with a script called "run_nonnull_exploits.sh". I assume that is for trying exploit methods that don't require a null pointer dereference. I think it's worth it to try to compile the exploit so that it runs the same as if it was run from that script.

How are you compiling it? Does it just need an ARM compiler?
[Droid Eris Android Development] Videofolife13:
Awesome find. If someone can compile, I, and I'm sure Binny, will test it out. I like the way it looks, let's see if it'll work.

p.s. Tell the guys at #android-root about this too. They know a lot more than I do.
[Droid Eris Android Development] binny1007:
Yes I will test it out!!!! Anyway great work guys I'm glad more people are joining in.
[Droid Eris Android Development] markachee:
I've been fooling with enlightenment for a while and just wasn't sure how to compile it so it would run on the phone. Just realized I neglected to mention it in our CS Hero root thread. Oops.

Never really messed with cross compiling. Am I headed in the right direction looking at getting an ARM Toolchain? Any tips and/or links for getting that set up? (Ubuntu Jaunty)
[Droid Eris Android Development] jmanley69:
Forgive me I can't give you links since i'm on my hero currently.

Go get the android source (not the sdk the source) and setup ubuntu (vmware machine is fine) and get all the packages to install - android source page tells you exactly how to do this on ubuntu (you have to get java 5 manually from sun and install it manually.... took me about 5 hours on Google to find out how). Then what I did was run the setenv.sh. (or something like that) in /build/ in the source that sets the Target env to ARM. Then I replaced ping.c (you can pick anything but I picked ping because it's one source file with no real dependencies) with the source and "make ping" ... your complied program is in the /out folder named ping (or whatever you compiled)rename it to whatever.

I'm really sorry I can't get you links or better instructions but I'm out of town on my phone right now.

I'm sure there is a better easier way but that's what I set up for myself and it works. When the holidays are over I will make a how to complete with a better build environment but until then if you are good at Google you now have enough buzz words to go on.

If I get a chance tomorrow I'll look at your suggestion and try to compile it remotely.
[Droid Eris Android Development] markachee:
This is perfect! I had previously pulled and built the Android source so I'm already setup for this. I don't remember having too much trouble with that, but I was dreading getting into gnuarm or something similar. I bet there isn't a much easier way than this for anyone unfamiliar with cross compiling. Great idea, thanks!

Unfortunately, I'm going to have to wait until tomorrow sometime to try this out, but will let everyone know if I manage to do anything interesting with it.
[Droid Eris Android Development] binny1007:
has anyone taken a look at this

http://securityreason.com/exploitalert/6652

I dont know if it will help or not but i came arcross this in my searching today.
[Droid Eris Android Development] jmanley69:
I think that anything that relies on gcc optimizations or compiling using cc a specific way is probably out... those would probably need to be compiled on the platform we're trying to exploit.
[Droid Eris Android Development] markachee:
Managed to get the "make ping" trick to work for a simple hello world program that ran on my phone, but it wouldn't build enlightenment's exploit.c.

Then I found agcc ( http://android-tricks.blogspot.com/2009/02/hello-world-c-program-on-using-android.html ). I modified run_null_exploits.sh to use agcc and managed to get all the exploit modules to compile and even pwnkernel.c, but exploit.c throws assembler errors:

exploit.c: In function 'add_exploit_modules':
exploit.c:244: warning: passing argument 4 of 'scandir' from incompatible pointer type
exploit.c: At top level:
exploit.c:417: warning: 'regparm' attribute directive ignored
exploit.c:418: warning: 'regparm' attribute directive ignored
exploit.c:627: warning: 'regparm' attribute directive ignored
/tmp/ccuefary.s: Assembler messages:
/tmp/ccuefary.s:1866: Error: ARM register expected -- `mov %cr0,r3'
/tmp/ccuefary.s:1892: Error: immediate expression requires a # prefix -- `mov r3,%cr0'
/tmp/ccuefary.s:1976: Error: bad instruction `movl #123,0x10(%esp)'
/tmp/ccuefary.s:1976: Error: bad instruction `movl r2,0x0c(%esp)'
/tmp/ccuefary.s:1976: Error: bad instruction `movl #582,0x08(%esp)'
/tmp/ccuefary.s:1976: Error: bad instruction `movl #115,0x04(%esp)'
/tmp/ccuefary.s:1976: Error: bad instruction `movl r3,0x00(%esp)'
/tmp/ccuefary.s:1976: Error: bad instruction `iret'

I don't really know exactly what I'm doing here but it seems like i'm close to at least being able to try this.
[Droid Eris Android Development] jmanley69:
looks like they're putting assembly code into the C source. When you do this, you must have assembly code for the target platform (ARM in this case) and this assembly code must be for intel. To get this one working, you'd need to reference ARM assembly instructions (or in this case, just the registers). Hope that helps you on the right path.
[Droid Eris Android Development] jmanley69:
If you get bin/ls not found... then I think it worked! do an ls -l and see if the group ownership of the target file changed.
[Droid Eris Android Development] binny1007:
No it did not I tried to change mmap_min_addr and it did not change. Than I was just trying random files and still no luck
[Droid Eris Android Development] jmanley69:
and you're looking at the group column right? not the owner column. On the Hero it says "Error: Not vulnerable!"
[Droid Eris Android Development] binny1007:
And I have to say it again jman thanks for all of your help, you have no idea how much it means.
[Droid Eris Android Development] binny1007:
Yes I got the error not vunerable a couple of times, and when I got the bin/ls error I was tying it on some files in /data/local/ soooo..... I don't think that would help much. I was just more or less experimenting at that point.
[Droid Eris Android Development] jmanley69:
aaahhhh... I see... you ran it on a file that you already owned, so it passed the "if" statement and tried to do the ls... but it didn't really change the ownership because you already owned it (I just replicated that behavior).
[Droid Eris Android Development] binny1007:
Ok so if this is to long of a question than feel free not to answer it, but how do you compile these expliots for us? I mean I would like to learn how but have no idea were to start. I have ubuntu installed on a spare partition but I am mainly a Windows user so if you could point me in the right direction, either Linux or Windows that would be great. And if not I understand.
[Droid Eris Android Development] jmanley69:
I think we covered it before... but I can go over it again.

Go here http://source.android.com/download and follow the instructions to download the Google Android source. It should take a few hours (and probably time out on you several times). You probably don't need to compile the whole source, but you need the /prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin directory mostly...

Go here http://android-dls.com/wiki/index.php?title=Compiling_for_Android and get agcc. This link also explains it all to you.

You set your path to the /prebuilt/linux-x86/toolchain/arm-eabi-4.4.0/bin directory under the Android source repository.... then run agcc as you would gcc.
[Droid Eris Android Development] crax0r:
Can someone help me?

i used the command 'adb pull /system system' and it skips the main system files. Is there a hack that can let you pull them out? :confused:
[Droid Eris Android Development] jmanley69:
It's much easier to extract the files from the RUU. You shouldn't be able to read any file that is not readable by "world"... even through adb.
[Droid Eris Android Development] crax0r:
huh

I'm new sorry, but can you give me an update. I am willing to give my phone to the good of rooting! :) I gotz a warranty! Anyone try looking for these files? And can someone help me with RUU... I'll do anything!
[Droid Eris Android Development] zifnab06:
The NDK should work as well. It was released a while ago, the Native Development Kit for android. It's on the http://developer.android.com site. At least, it should work :D
[Droid Eris Android Development] crax0r:
Ubuntu

thanks for the responce, I'll start it as soon as I get my Linux up and running again. I had to delete the partition because of a kernel panic in 9.10 when mounting the drive. I'm reinstalling it now, so I'll start the download when it's running! Thanks. But hey, do you want a Droid Dump? and see if you pick anything out of it. There are some bootloader.android and root.android commands in there.
[Droid Eris Android Development] ataranine:
So someone told me they talked to a Verizon rep and he had him dial some number and change something in SID number or something or other.. what was he talking about. .exactly?
[Droid Eris Android Development] crax0r:
I think what you are talking about is the reprogramming. That's unhackable concidering I believe it's encrypted. And it doesn't have anything to do with the root user. But I may be wrong. Can anyone clarify? :confused:
[Droid Eris Android Development] ataranine:
Well the dude said the verizon guy told him to "change" certain things about the SID. I was just wondering if this could be of one bit of help, since we seem to be sort of stopped in our tracks here. :(

If it were so encrypted I don't think a simple end user would be able to change that stuff.. but the dude said he was told to change some numbers in the SID.
[Droid Eris Android Development] ataranine:
Bah nevermind. Guess the SID doesn't really have anything to do with security type stuff.
[Droid Eris Android Development] crax0r:
hey wait! :) I pulled up this article found at: http://www.forum.nokia.com/document...UID-CD3B0924-3619-460A-91BA-8475DC792B58.html

Quote "SID stands for "Secure Identifier." It is a locally unique identifier that is used to determine which private directory a process can access. In client/server communication, it is also used to identify the caller applications. The SID can be defined in the Mobile Media Platform (MMP) file as follows." more at http://www.forum.nokia.com/document...UID-CD3B0924-3619-460A-91BA-8475DC792B58.html
[Droid Eris Android Development] crax0r:
I think we can do something about this... :D
[Droid Eris Android Development] crax0r:
I'm having a problem installing the repo for the download. Can someone help! :(
[Droid Eris Android Development] ataranine:
You actually found something from that? :D
[Droid Eris Android Development] tbaker077:
Could this help anyone? http://www.androidspin.com/forum/viewtopic.php?f=124&t=132
[Droid Eris Android Development] FireSokar:
I doubt that will have much ground to help anyone, besides the site classifies our phone as motorola which brings like 0 credit to most of the members for not even spotting it. I wonder how much HTC is pissed about everyone calling there phone the "Motorola Drois Eris" If anything I would assume this would have a better chance as it is rooting steps not a rom to flash. http://modmymoto.com/forums/showthread.php?t=526469 its for the cliq which is running 1.5 as well and recently rooted, so i would assume the eris might have a chance?
[Droid Eris Android Development] ataranine:
I think the guys already went over that though, the exploit or whatever can't be used for the Eris or something. I dunno. :confused:
[Droid Eris Android Development] jmanley69:
RSD-Lite is for Motorola phones. You are welcome to try it... but I doubt it will work for an HTC phone.
[Droid Eris Android Development] jmanley69:
There's nothing you can do through the "programming" of the phone on the dial pad that will unlock your ROM to be rootable. You can play around with that stuff yourself if you like... you just need the MSL. I think that it's 6 0's on Verizon, but if not, you can look into CDMA Workshop which will either get you the MSL, reprogram it, or both. On Sprint, the easiest way to get it is to go online and do an ESN swap from your phone and back to your phone. Sprint gives you everything you need but tries to downplay the importance of the numbers.

Basically, the only thing that the Verizon guy is able to do with your phone is to change the MSID (not SID) which looks a lot like a phone number. The MSID is a code that the network uses to push PRL's and other radio programming to your phone (in a very brief, very watered down explanation). The Verizon guy can also change things like Access Overload, Slot Cycles, blah blah blah... everything that has to do with your phone's radio communicating with Verizon's network. While changing these variables can give you a better phone experience, none of them will change the underlying linux programming. These programming variables existed before Android, and exist on every CDMA phone (Verizon, Sprint, Other), it's a cross-phone cross-network radio standard.

Sorry to disappoint.
[Droid Eris Android Development] binny1007:
Just a update for anyone joining the thread i relize that this is over a 100 pages but please if you have some time go back and read it, if nothing else you will get some usefull info. But here is were we are at, we are currently looking and or waiting for new exploits. Any thing from milworm is out, if you look back in the thread you will find some websites that were posted otherwise use google. We are looking for Privilage escalation expliots, anything that is DOS-denial of service will not work.

Also we are looking into Super CID'ing the instructions can be found here http://xdaforums.com/showthread.php?t=559806 but do not try this if you dont know what you are doing, as it will boink your phone real good. And the source needs to be modified to work on our phones.

Any current expliot for android does not work, so we must work together as a team to get this rooted.

And make sure you say thanks to those that help, without it we would not be as far as we are now.
[Droid Eris Android Development] binny1007:
also I was playing with task and rtask in the oem fastboot does anyone think that these will help or should i just give up on them?
[Droid Eris Android Development] ataranine:
Wasn't too much of a disappointment, but thanks for taking the time to explain.
[Droid Eris Android Development] jmanley69:
I think at this point... anything in fastboot could help. This is like a "secret programming mode" that HTC, Google, and Verizon don't expect the "normal" person to get into. So... it's probably not as locked down as the rest of the OS.

p.s. Sorry for the "quotes", but sometimes it helps me get my "point" across...lol
[Droid Eris Android Development] binny1007:
And i dont use the "quotes" because most of the time i am on my phone and it is just a pain in the but.... lol

but back to the pulseauidio I found a exploit for it but it may need to be modified.

"Put files in /tmp/pulseaudio-exp (or change config.h). Must be on

same fs as the pulseaudio binary."

So you know way more than me on this but can we somhow make this one workable?

also here is a few more variations of the same thing.

http://www.securityfocus.com/bid/35721/exploit
[Droid Eris Android Development] binny1007:
here is the config.h

// take a wild guess
#define VULNBIN "/usr/bin/pulseaudio"

// current dir must be on the same fs as VULNBIN. example /var/tmp/bull or /tmp/bull
// without a final slash
#define PATH "/tmp/pulseaudio-exp"

// where we will put shell axx
#define PATHSHELL "/sbin/axx"

i think we would need to change the "#define PATH "/tmp/pulseaudio-exp" to /data/local/ and also

// where we will put shell axx
#define PATHSHELL "/sbin/axx"

we dont have sbin so not sure where to change that one?

*Edit*

Also we need to change "define VULNBIN "/usr/bin/pulseaudio" to wereever pulseaudio is?
[Droid Eris Android Development] jmanley69:
ok... your homework... find out if pulseaudio is part of Android. If so, where are the executables. The exploit reads that the vulnerability must be in the same file system as pulse audio. If this can be executed from /proc, we could be OK, but if it must be in /system anywhere, it's a losing battle.

To find the executable, use "find -name {the name of the file you're looking for}" from the root (/) directory. If your phone doesn't have find already, go ahead and grab a copy of busybox for Android (I think I've posted the link here before, but I know you can find it in xda someplace), and put busybox in /data/local and make a symbolic link (ln) to it for "find". then /data/local/find -name {whatever}

I'm off to AfterChristmasShop with the love of my life... so I can look at it more later this evening or tomorrow at work.
[Droid Eris Android Development] binny1007:
cant get busybox working? can anyone else with busybox working do this.... i will keep trying for now.
[Droid Eris Android Development] crax0r:
Can anyone pull these files and we may get somewhere with this, the jackpot most likely is the ls file!! :)

\system\bin\ls

\system\bin\mkdir

\system\bin\rm

\system\bin\mount

\system\bin\kill

\system\bin\setconsole
[Droid Eris Android Development] crax0r:
I'm pretty sure pulseaudio is part of the Android system. I'll look for the info in the system dump I did. The weird thing is you don't need su to run \system\bin\dumpstate? Why??

*update*

pulseaudio is the audio control for the whole phone. I don't think there would be an exploit linking to the root user with this app, look somewhere else. Can anyone confirm if there is a shell window built in to the phone. Hidden or not, it would so help!
[Droid Eris Android Development] binny1007:
so were did you find pulseaudio in what directory?
[Droid Eris Android Development] tbaker077:
My bad, I posted a link to the wrong site. I meant this one. http://www.androidspin.com/forum/viewtopic.php?f=124&t=132
[Droid Eris Android Development] ataranine:
Hmm I tried pulling the ls file..nothing. Something I'm not doing right?
[Droid Eris Android Development] tbaker077:
Double post please delete.
[Droid Eris Android Development] apreichner:
One more good reason to get ROOT. We can't let our phones look like that!!!

BTW. tbaker077, that is a GSM System dump of Android 2.1 for the Hero. We are trying to root Android 1.5 on the Droid Eris... Different phone, different operating system. And as Jmanely said earlier, we already have a system dump.
[Droid Eris Android Development] ataranine:
Good god the more I look at that UI the more I hate it.
[Droid Eris Android Development] FireSokar:
i think tbaker is trying to spam that rom for the hero... seriously thats the same link i told him 3 pages ago was useless.
[Droid Eris Android Development] jmanley69:
Those files are not real files. They are symlinks to Toolbox which is Google's version of Busybox. That's what I keep trying to tell you guys about the pipe exploits... Your phone does not really run Linux. It uses the kernel, but all the commands are implemented using a watered down version of Busybox.
[Droid Eris Android Development] zifnab06:
just a note

DO NOT PUT A GSM SPL ON YOUR PHONE! IT WILL BE A NEW PAPERWEIGHT IF YOU TRY IT!!!!!

DO NOT FLASH A GSM ROM! YOU WILL ALSO HAVE A NEW PAPERWEIGHT!!!

I'm looking through some of the old root threads. We thought about that, just be warned DO NOT DO IT.

Thanks
[Droid Eris Android Development] crax0r:
Still working on that. I got a dump on init.rc, hold on and let me pull it up from my email.
[Droid Eris Android Development] punk.kaos:
Using the kernel makes it linux, toolbox is busybox, which is an integrated all-in-one linux toolset. Just because Google has done some non-standard things doesn't make it not Linux.
[Droid Eris Android Development] crax0r:
Ok here's the init.rc, it's a little messy with the Unicode and Hotmail :mad:. But it's got some important text.

It's in .zip because of the .txt file size limit! :(
[Droid Eris Android Development] crax0r:
Well, I know it's there. right now I'm using File Manager from Market and it's there. I'll try and get it...

Nah, just pull the entire folder with everything in it! There's your homework!
[Droid Eris Android Development] crax0r:
Well, when I tried adb pull /system/bin/ it said 'skipping special file: ls' like 500 times! Even if, we could try looking for exploits for BusyBox, unless they patched them... :rolleyes:
[Droid Eris Android Development] ataranine:
I pulled the entire folder...and guess what? LOL all those files you listed are "missing" from it.

I tried this in the DDMS from the SDK by the way.
[Droid Eris Android Development] jmanley69:
You could... but since it's google's own version of Busybox (much more watered down), that's something that you'd have to go through the code for toolbox yourself. However, I can't see how any of the commands in Toolbox can get you root access when you don't have it to start with (unless you can find a flaw in cp or something like that that lets you edit a file that you shouldn't be able to).
[Droid Eris Android Development] jmanley69:
Please follow the thread... They are not real files. They are symlinks to Toolbox. If you go to /system/bin and do ls -l, you'll see for yourself.
[Droid Eris Android Development] ataranine:
Okay then, sorry.
[Droid Eris Android Development] crax0r:
My bad, still looking for the pulseaudio folder... ;) Having some problems
[Droid Eris Android Development] jmanley69:
I'm sorry... I didn't mean to upset... I'm just trying to help you guys out.

Seriously though... Do adb shell, then cd /system/bin, then ls -l and you'll see that ls points to ls -> /system/bin/ToolBox

That means it's a symlink, you can't pull it off your phone, because it's not a real file... it would be like emailing a shortcut for Excel off your Windows desktop to somebody and expecting them to be able to run Excel when they open their email (even though they don't have Excel installed).
[Droid Eris Android Development] jmanley69:
You should be able to use find. See my post about adding Busybox to your phone (if find isn't already implemented). You'll need the name, but you should be able to find part of the name (like pulse or audio).
[Droid Eris Android Development] ataranine:
I know you are dude, and we appreciate it. I don't know a damn thing about hacking this stuff but I do what I can. :D
[Droid Eris Android Development] crax0r:
If we could get, like... Windows Command Prompt on the Droid ERIS I could find an exploit and write a code for it... :D

But I really think that won't happen. CMD is not easy to get on a Android phone. Unless we had Wine...? :wink:
[Droid Eris Android Development] ataranine:
Wine? On a phone? xD :P
[Droid Eris Android Development] crax0r:
That's what I was saying... that would be awesome though! :p