yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] binny1007:
Here is a one more, and it looks good it was published yesterday, the only problem is it says it uses metasploit framwork? Not sure if we can use that or not.

http://packetstormsecurity.org/0912-exploits/cyrus_pop3d_popsubfolders.rb.txt
[Droid Eris Android Development] jmanley69:
I don't believe this is what you think it is. It looks to me like there's an IDE called Geany http://www.geany.org/ that helps you write scripts. Part of it's "build.c" program indiscriminately writes to a file in the working directory (without checking to see if it's a symlink or what).

The way it's exploitable is... Binny and I are on the same system. Binny is using Geany to write a shell script. Just before he saves the script, I go into his working directory and make a symlink to another file someplace else on the system (that he has permissions to but I don't), and put that symlink in his working directory and name it the same name as the shell script he's about to save. Then, when he saves the shell script, it actually dumps the contents into the target of the symlink. - make sense?
[Droid Eris Android Development] jmanley69:
this buffer overflow injects a shell into the pop3 daemon. A) the phone doesn't run a pop3 daemon. B) we don't have a "shellcode" to inject that will run on the ARM processor. If we had the shellcode for the phone, we could inject it in a number of other buffer overflows.

While it's a very good idea to try the buffer overflows, before we do, somebody needs to get the payload together first.
[Droid Eris Android Development] binny1007:
On the first one, yes that makes sence and on the shell code thing can't we reuse the shell code from asroot2? Forgive me if that is a silly question as I have said I'm more of a Windows guy.
[Droid Eris Android Development] binny1007:
Here is the source for asroot if it helps.

http://flashrec.googlecode.com/svn/trunk/android-root/
[Droid Eris Android Development] jmanley69:
No. the asroot isn't really shell code. It glitches the kernel to allow you to run anything you want As Root (hence asroot). Then, it just runs the command you put in after asroot "As Root"... sooooooo... asroot /system/bin/sh will run sh as root and you now have a rooted shell that lets you do whatever you want.

Shellcode for a buffer overrun is /x19 /x24 /x3a /xaa /xsomething /xsomethingelse /xmorehex /xabunchofotherhexthings ....

It's machine code that IS a shell.
[Droid Eris Android Development] FireSokar:
Bypass CRC Check, if crc checks are done when the file is first launched and we know the flashing from usb is read directly off the pc. Why not modify the MR1 update the way you want it IE Root on a file. Place this file on the last few MB of the rom. Launch the update with the original rom, and either A, make a process to overwrite the last few mb of the rom on your pc once flashing began, this way itll get to your program later on. Or B, Hijack the complete process and directly stream into it instead of overwriting files.
[Droid Eris Android Development] redman213:
I didn't know that other boot.img's were made for previous phones but I don't know if anyone asked for one from whoever knows how to make one either. I'm just hoping someone can.

Keyword: Hope
[Droid Eris Android Development] ataranine:
Hope don't make stuff happen.
[Droid Eris Android Development] crax0r:
I have the 1.6 boot.img, if anyone can crack the MD5 then we can get somewhere with this....
[Droid Eris Android Development] zifnab06:
http://twitter.com/Stericson/status/7214672595

For those of you too lazy to click the link:

Nexus root needs engineering SPL. If only we had on.

Homework for someone: Find out if the SPL from the Hero/Ion will work on our phones. I'm not going to give much help here, if you flash the Eng SPL for the Hero and get a brick, I'm not responsible. I would, but my phone has some water damage on the back, and can't get it replaced if I brick it.
[Droid Eris Android Development] binny1007:
jman- just a few more Questions....

Is the shell code specific to the type of expliot that you are trying to use?

and if not would this work..

\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52
\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52
\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52
\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52
\x38\x30\x41\x52\x38\x30\x41\x52\x38\x30\x41\x52\x30\x30\x4f\x42\x30\x30\x4f\x52\x30\x30\x53\x55
\x30\x30\x53\x45\x39\x50\x53\x42\x39\x50\x53\x52\x30\x70\x4d\x42\x38\x30\x53\x42\x63\x41\x43\x50
\x64\x61\x44\x50\x71\x41\x47\x59\x79\x50\x44\x52\x65\x61\x4f\x50\x65\x61\x46\x50\x65\x61\x46\x50
\x65\x61\x46\x50\x65\x61\x46\x50\x65\x61\x46\x50\x65\x61\x46\x50\x64\x30\x46\x55\x38\x30\x33\x52
\x39\x70\x43\x52\x50\x50\x37\x52\x30\x50\x35\x42\x63\x50\x46\x45\x36\x50\x43\x42\x65\x50\x46\x45
\x42\x50\x33\x42\x6c\x50\x35\x52\x59\x50\x46\x55\x56\x50\x33\x52\x41\x50\x35\x52\x57\x50\x46\x55
\x58\x70\x46\x55\x78\x30\x47\x52\x63\x61\x46\x50\x61\x50\x37\x52\x41\x50\x35\x42\x49\x50\x46\x45
\x38\x70\x34\x42\x30\x50\x4d\x52\x47\x41\x35\x58\x39\x70\x57\x52\x41\x41\x41\x4f\x38\x50\x34\x42
\x67\x61\x4f\x50\x30\x30\x30\x51\x78\x46\x64\x30\x69\x38\x51\x43\x61\x31\x32\x39\x41\x54\x51\x43
\x36\x31\x42\x54\x51\x43\x30\x31\x31\x39\x4f\x42\x51\x43\x41\x31\x36\x39\x4f\x43\x51\x43\x61\x30
\x32\x38\x30\x30\x32\x37\x31\x65\x78\x65\x63\x6d\x65\x32\x32\x37\x32\x37

wich i pulled from here

http://dragos.com/psj09/pacsec2009-arm-alpha.pdf

just trying to help out.....
[Droid Eris Android Development] binny1007:
also i just found this its a pretty good paper on arm shellcode

and

one more

http://gatheringofgray.com/docs/INS/shellcode/dev-string-arm-shellcode-into_my_arms_dsls.pdf
[Droid Eris Android Development] R-T-B:
I would but I can't get a replacement now that I opened mine... I took a risk already, it's someone elses turn. Whoever does so is a hero in my book!
[Droid Eris Android Development] binny1007:
ive tried and they wont load if you find me a signed engineering SPL just the spl not an entire rom i will try it again, but the problem is all the spl's come with a rom that in turn checks the device id and boom... device id failier. So like i said find me a spl that is just the spl that is siged and official from htc than i will flash it.
[Droid Eris Android Development] redman213:
Happy New Year guys!!
[Droid Eris Android Development] binny1007:
Also Jman back to the bypass file permission i was doing some more reading on the subject and im not sure we were doing it right, sorry i know i am bombarding you with stuff. but i have some free time and I am searching the net like crazy, and going over things we may have missed.

Pavel considered that in his original mail, where he checked there were
no links.

Pavel wrote his email in a convoluted way, so it's not clear what's going
on. Here's an attempt to rewrite:

User1 creates file with permissions 0644
User2 opens file for read access on file descriptor 4
User1 chmod's directory to 0700
User1 chmod's file to 0666
User1 verifies no hard links to file
User2 can not open the file for read or write access
User2 can not write to file descriptor 4
User2 _can_ write to /proc/$$/fd/4

Now user2 is expected to be able to have read-access to the file via
(he opened it in step 2). If he attempts to write with ">&4" then it
silently fails (on Linux, anyway). But access via /proc/$$/fd/4 allows
write access.

The real concern appears to be that user2 can write to a file descriptor
opened for read access.

A fix would be to have a mask against every procfs "fd" entry that matches
the open() mode of the file descriptor (or perhaps the mode of the file
when it was opened?). Thus a write to /proc/$$/fd/4 would fail because
the mask on fd4 would be "read".

I think this is of (very) small concern (no one in their right mind
would do this) but it is an unexpected result and breaks the principle
of least surprise.

FWIW, the same "issue" exists on Solaris 10. It's not Linux specific
[Droid Eris Android Development] binny1007:
also i just got this

$ echo 0 > /proc/self/fd/0
echo 0 > /proc/self/fd/0
0

but when i cat mmap i get

$ cat /proc/sys/vm/mmap_min_addr
cat /proc/sys/vm/mmap_min_addr
32768

so i am confused when i use 0 it is writing somthing as 0..... but what?
[Droid Eris Android Development] binny1007:
sorry i am babbling here but i just read somthing interesting it seems as though /proc has to be mounted in order to use this but there is a way around this i think here is what it says

Dear Pavel,

... can you see a way to write to that file when /proc is unmounted?

While there is legitimate access to do so (after file is created and
before pavel issues 'chmod 700 /tmp/my_priv'), guest to use commands:

ln /tmp/my_priv/unwritable_file /tmp/hardlink-to-object

and then use that instead of /proc/self/fd/3, should work same as
original "attack" (and am curious whether 'link counts' shown by
'ls -l /tmp/my_priv/unwritable_file' are 1 or 2 in each case).

Cheers, Paul
[Droid Eris Android Development] eroxb:
http://code.google.com/p/live-andro...=Filename+Summary+Uploaded+Size+DownloadCount

Dunno if this will help or not but there is a live cd of the android operating system
[Droid Eris Android Development] kuligokm:
Happy New Year

I've been following you guy's since page 6. Wish I could be of more help but you seem to know more than I do at this point. Trying to learn from everything you post. There is no such thing as a completely secure OS, there are always holes, just need to find the right one. Enough minds together can solve any problem.
[Droid Eris Android Development] FireSokar:
Where is sense UI stored? perhaps we could use a bug in sense ui to gain root.
[Droid Eris Android Development] ataranine:
God knows there's plenty of those.
[Droid Eris Android Development] punk.kaos:
SenseUI is in a bunch of files. Part of it is in the modified android framework in /system/framework the rest is in either /system/app/rosie.apk or /system/app/launcher.apk
[Droid Eris Android Development] binny1007:
Just found this 0-day local privilage escalation!!!!!!!

Please let this work could someone compile this and post it to try.

Thanks
[Droid Eris Android Development] jmanley69:
Again... No ext4 exploit. Your phone does not have an ext4 partition.
[Droid Eris Android Development] binny1007:
Crap sorry...
[Droid Eris Android Development] binny1007:
How about any of these.

http://www.securityfocus.com/bid/36038/exploit
[Droid Eris Android Development] jmanley69:
Doesn't look like it.

Some of them require personality.h, so won't compile. Some rely on the mmap_min_addr bug (this exploit was released at the same time as the mmap_min_addr exploit - back in August). One of them is pulseaudio...

As for the exploit you sent me a couple days ago. That one won't work. the CAP_SYS_ADMIN bug only affects those functions, and none of those functions let you access a file.
[Droid Eris Android Development] kuligokm:
What about flash?

There is the HTC flash player on the phone. Will any of the flash exploits work?
[Droid Eris Android Development] jmanley69:
any of what exploits?
[Droid Eris Android Development] redman213:
Are you saying the Flash Player is totally secure in the Eris? Or did you not know it had one?
[Droid Eris Android Development] R-T-B:
It's hard to actually use an exploit without actually having a reference. Yes, flash players have had exploits in the past. This doesn't neccesarily help us get root however. We need more information, otherwise it's useless.
[Droid Eris Android Development] jmanley69:
bugs in things like flash, adobe, browsers, etc... only allow the attacker to have the permissions of the end user. The reason that they get so much publicity is because on Windows machines, everybody ends up being the local admin.

The only way anything like that is going to get you root access is if you can get the root user to open a browser on your phone and go to a website where you've placed specially crafted code.

2 problems with that. 1) root isn't going to open a browser on your phone unless you have root and do it. 2) you don't have the specially crafted code.

Concentrate on these types of attacks... Kernel exploit to give escalation of privileges or get a SoftSPL or HardSPL.
[Droid Eris Android Development] binny1007:
I have a question if the new rom that was just posted turns out to be 2.0/2.1 will we be able to use the old MR1 update to use the verifier.c hole?
[Droid Eris Android Development] jmanley69:
I believe the verifier.c flaw requires the update patch to be of a newer version than what is on the phone. This is, of course, assuming HTC hadn't followed any of the threads and didn't patch that hole.

A new ROM was released for your phone?
[Droid Eris Android Development] binny1007:
It was posted last night(leaked)

http://rapidshare.com/files/3291345...WWE_1.17.605.1_release_signed_with_driver.exe

MR1 is 1.16.605.1..... so i have no idea what this would be but I am downloading it right now, i am going to re up it when it is done rapid share is bieng so slow right now i still have 40 min left.
[Droid Eris Android Development] aka_word:
I'll post a mirror as soon as I can.
[Droid Eris Android Development] jmanley69:
Wouldn't it be easiest to just post the original link from Verizon? Their servers are probably designed to give everybody the fastest experience.
[Droid Eris Android Development] ataranine:
That sounds either really sketchy, or just someone mislabeled it and meant 1.16.605.1 instead of 1.17.605.1.

I just think HTC is more careful than to let their stuff get leaked... and plus there wasn't SUPPOSED to be another update until later this month.
[Droid Eris Android Development] binny1007:
yea but this is a leak and has not been released from VZW yet. Im uploading it right now will post mirriors when done
[Droid Eris Android Development] ataranine:
Jesus, please do. I'm so sick of RapidShare.
[Droid Eris Android Development] aka_word:
RapidShare is the worst.
[Droid Eris Android Development] binny1007:
nope Its real see screen shot im updating now....
[Droid Eris Android Development] ataranine:
Yes, it is. They want people to pay to download mostly pirated stuff. XD
[Droid Eris Android Development] binny1007:
still got 18 min on the upload guys but it took me over a hour to dl from rapid-crap
[Droid Eris Android Development] ataranine:
Don't get your hopes up, also about the update, I'm sure it's just the leaked bugfix update they were talking about to release on 22nd.
[Droid Eris Android Development] binny1007:
bug Fix was MR1 the one on the 22nd was suppose to be 2.0/2.1
[Droid Eris Android Development] ataranine:
No no no, no way. There was another bugfix coming on the 22nd. HTC confirmed nothing but the 2.1 update coming sometime in Q1 2010. Could mean any time between Jan and April. I'm just saying, you know, don't get your hopes up. I'm not going to. That way we won't be disappointed. :)
[Droid Eris Android Development] binny1007:
well its booting now so we will see......
[Droid Eris Android Development] ataranine:
Lucky you. I'm still waiting for Rapid****. :(
[Droid Eris Android Development] binny1007:
yup just a bug fix update
[Droid Eris Android Development] ataranine:
Figured as much.. but it DOES say 1.17.605 instead of 1.16.605 right? In the settings?
[Droid Eris Android Development] jmanley69:
CAUTION CAUTION CAUTION!!!!!!

Before you apply this RUU... you MUST be cautious!!!

Once you install a new base RUU, you CANNOT run a previous one. So, you're stuck with the new version! period!

Also!!!!!!!! and most importantly!!!!!!!!!!!!!!!!!

If this is not an official release, then you may end up getting your phone stuck on this version until HTC releases an RUU for a NEWER version!

What I'm trying to say is that if you put this on your phone, and for whatever reason the next (or any future) OTA doesn't recognize this exact version number, you cannot download and apply the OTA. That means your phone will not be able to be upgraded without applying a new RUU (preferably an official release).

Let's say your phone has version 1.0 and MR1 was version 1.3. There is an official upgrade path from 1.0 -> 1.3 and that's supported by the OTA or the MR1 RUU.

Now, you've got 2.0. Let's say the official release is 2.2. Then there's an OTA released for 2.35. There would be an upgrade path from 2.2 -> 2.35 BUT NOT NECESSARILY FROM 2.0 -> 2.35.

I cannot guarantee that this would happen, but you must be aware of the risk before you run the RUU!
[Droid Eris Android Development] binny1007:
well its too late for me :) but that is good advice

here is the mirrior i used

http://www.gazup.com/NHwVU-ruu_desi...lease_signed_with_driver.exe-download-mirrors
[Droid Eris Android Development] aka_word:
F--- it, I'm getting a Motorola Droid.
[Droid Eris Android Development] binny1007:
also uploading to mediafire too
[Droid Eris Android Development] jmanley69:
Or switch to Sprint and get a Hero. Better network, cheaper total cost of ownership for a smartphone... (let the war begin muwhahahahahha)
[Droid Eris Android Development] ataranine:
I might be jumpin on that boat with ya soon.
[Droid Eris Android Development] binny1007:
But what would i do without my map following me around?
[Droid Eris Android Development] aka_word:
Sprint isn't even relevant.
[Droid Eris Android Development] jmanley69:
You use a better... faster one...

One that actually covers the entire U.S. because I have no roaming charges, and I can call and receive from any mobile on any network at any time for 100% free airtime.
[Droid Eris Android Development] jmanley69:
And all the time using a rooted Android phone that is basically the same as your Eris.
[Droid Eris Android Development] binny1007:
oh boy i am not getting into this one, I had sprint and thier network in madison kinda sucks so I went back to VZW.
[Droid Eris Android Development] aka_word:
Especially since my prediction that VZW would release the Passion is inaccurate.
[Droid Eris Android Development] ataranine:
Well I'd be happier with a phone that can be rooted. I think I could use the Moto for a couple years.
[Droid Eris Android Development] Gary13579:
Let's try to keep the arguing, especially about off topic subjects like networks, to elsewhere! Thanks :).

(besides, we all know T-Mobile has the most 3G coverage :p )
[Droid Eris Android Development] binny1007:
HAHAHAHAHA Ok...

One more mirror

http://www.mediafire.com/?q4tm2mnnatj
[Droid Eris Android Development] ataranine:
I just finished applying the RUU. Can't wait to see what bugs they fixed and what else they broke in the process.
[Droid Eris Android Development] aka_word:
I concur. The Eris just won't do.
[Droid Eris Android Development] binny1007:
well it seems to be a bit more snappier, but only time will tell
[Droid Eris Android Development] ataranine:
Perhaps, yes. I'll give it that, at least. Signal still fluctuates like hell.
[Droid Eris Android Development] rsawicki:
by some strange occurance... im connected to the HTC bootloader...

I went to apply the newest ruu and had to do some driver fiddling since its a new windows installation for me.

long story short.

im at the desktop without the RUU running... and i have a working HTC bootloader in my device manager... i rebooted and its still there.

anything we can do with this?
[Droid Eris Android Development] binny1007:
what do you mean a working bootloader?
[Droid Eris Android Development] rsawicki:
Bootloader access? maybe

well it ran the first part of the ruu got stuck at waiting for bootloader, but its in my device manager it survives a reboot, and it also survives being pulled from the usb connection and replugged.

so i dont know exactly what the hell i have here. i know i can pull the battery and reproduce this somehow... id need to play around to find out for sure. but this is the second time.

if i pull the usb cable it goes to the screen saying:

PB00100 XC SHIP S-ON

HBOOT-1.46.0000 (PB0010000)

MICROP-0111

TOUCH PANEL-MELFAS_45_17

RADIO-2.32.40.11.09

OCT 5 2009,19:21:56

RUU

instead of the normal fastboot etc. options...

any tips here?
[Droid Eris Android Development] binny1007:
yes that is the oem bootloader we have played with and did not find anything we could use. are you stuck on it?
[Droid Eris Android Development] rsawicki:
no i can pull the battery and get back to normal boot.

so you had it up in the device manager and all?

i didnt use any adb commands to get to this point. i simply wanted to try porking over the new RUU with that modded rom.zip to see if by chance someone over at htc made a big mistake...

guess i got kinda excited for a minute about nothing....

damnit.
[Droid Eris Android Development] binny1007:
yea i cant rember what page but if you go back to like page 50 of this thread we played with that
[Droid Eris Android Development] zifnab06:
Yay new RUU. I'll wait for OTA on this one I think though, too lazy to restore everything on my device again....
[Droid Eris Android Development] FireSokar:
Perhaps some of the old exploits that were tried will now work -_-
[Droid Eris Android Development] rsawicki:
yeah sorry i know we tried it.... just didnt know if a new ruu would bring some sort of flaw we could exploit the bejeezus out of....

cant blame a guy for having dreams.... lol
[Droid Eris Android Development] binny1007:
offtopic i saw this today and felt i had to share.....
[Droid Eris Android Development] zifnab06:
Why would they unpatch an exploit? I would assume any bugfixes by HTC do not modify the kernel, just the HTC applications stored on the device.
[Droid Eris Android Development] rsawicki:
Win.... lmfao... just.... win...

+10 for display of an antiquated Nutsack suspension device....

i needed that laugh...

thanks! lol
[Droid Eris Android Development] FireSokar:
If its unfinished It may be a beta build of a kernel. This may not be the final product and could be a testing kernel but if it does not have a eng spl it probally is final :/
[Droid Eris Android Development] zifnab06:
Its a bugfix. As noted by the 1.16.705.1...the last one was 1.16.605.1. If it was a beta, A) It wouldn't be signed (requiring engineering SPL) and B) Different version notation.
[Droid Eris Android Development] FireSokar:
So would this be safe/unsafe to flash then. Dont want to bork up any future updates..
[Droid Eris Android Development] binny1007:
Just my 2 cents it says release right in the ruu so I would have to imagine that this is final.
[Droid Eris Android Development] FireSokar:
Can you guys check your gps see if its working, some guy at androidforums is posting GPS has stopped working but he does not specify what update... it was posted today.
[Droid Eris Android Development] zifnab06:
i would for you, but i'm not flashing my phone until OTA. Unless someone knows how to back up /data and /system/app w/o root :(
[Droid Eris Android Development] FireSokar:
Yeah, im debating about flashing id seriously hate it to not be final and get screwed over... but then again i can get a replacment until the 19th... hehe just tell em "dunno wont update"
[Droid Eris Android Development] binny1007:
Gps is working fine I just checked it.
[Droid Eris Android Development] FireSokar:
Wish we could find a changelog for this. What was the time difference between the last full update leak and the OTA?
[Droid Eris Android Development] redman213:
Thats why we use FTP's:D
[Droid Eris Android Development] binny1007:
haha I just noticed this it appers the cell south guys rooted there phones using the gold card trick that we played with, at least somone is benifiting from our hard work. congrats cell south guys.
[Droid Eris Android Development] jmanley69:
What's the link to their thread?
[Droid Eris Android Development] binny1007:
Here it is,

http://xdaforums.com/showthread.php?t=581869
[Droid Eris Android Development] jmanley69:
You know... at this point... what would it hurt to try? You should always be able to put your MR1 RUU back on if it doesn't work. However, I take no responsibility should somebody mess up their phone.
[Droid Eris Android Development] binny1007:
To try the Sprint ruu, with the gold card? I tried that a while ago it will not pass the device id check.