yashsingh1/xdaforums huggingface dataset:
[Droid Eris Android Development] zifnab06:
You can't. Simple enough. The USB Port only works as USB, or as serial if you feel like making a cable. To write a PRL, you put a .nb file with the PRL into a custom .nbh. But, it needs to be signed right now....and I don't think engineering or HardSPL are signed.
[Droid Eris Android Development] jmanley69:
Using something like CDMA Workshop

http://www.cdma-ware.com/workshop.html

you'll install a "virtual" serial port on your computer (I forget the program to do that). Then use CDMA Workshop to load PRL, change network stuff... all that kind of cool things.
[Droid Eris Android Development] zifnab06:
Maybe something we can use? I thought the USB was just data + charging. Whoops :D
[Droid Eris Android Development] ataranine:
Eris system dump

Could this be of some help to anyone?
[Droid Eris Android Development] zifnab06:
Nah, we have the RUU rom.zip file. And, it isn't too hard to to extract the .img files. I've been through it, and without being able to modify something on the device (boot.img, recovery.img, and system.img are all signed, and the directories they are flashed into all have ro access) it's not that useful. Root would be easy if that was all we'd need to do :(

BTW - 900+ posts! WOOT!!! Anyways, here's a brief summary of what we've done to date, and what we've tried, and why it failed:

All previous exploits for other android devices have been patched, so they are out.

Rom.zip and Update.zip are signed, so we can't modify them and try and flash modified one.

Every folder but /data is ro. Every folder but /system is mounted with nosuid. Meaning, no root access from any file running on them, and no modifying /system.

The init files could easily be modified to give us root, only problem is they are read only.

The phone tries to boot from a series of files from the sdcard when loaded into recovery. All of which need to be signed by HTC's privatekey.

Mostly, at this point, we need people looking for/compiling root access exploits. Milworm (the website) is out, it's too outdated. Anything running a DOS attack is out, becuase the phone just locks up.

Look for anything that has a root escalation exploit. That's what we need. And, at this point, I'm assuming without a serial cable that the phone's hardware is secure. The signing process beats us. Unless we have enough files that are signed we can reverse engineer the key, and its RSA so I'm assuming we can't unless someone is pretty good at cryptology.

Before I forget, MERRY CHRISTMAS! Have fun!
[Droid Eris Android Development] binny1007:
just foud this one not sure if it will work for us but can somone compile this for me, thanks.
[Droid Eris Android Development] zifnab06:
we don't have keberos or pam-krb5. Sadly :(
[Droid Eris Android Development] binny1007:
Crap..... we should be keeping a list somewhere of exploits that we have tried so we don't repost them.
[Droid Eris Android Development] zifnab06:
Psst if i hear one more person call this a motorola droid eris, i might have to attack them through my computer........if only that were possible.
[Droid Eris Android Development] tats_06:
I am sorry, that's how AndroidSPIN posted it as :mad: :o :D

At first I thought it was part of motorola OS that may work for Eris...my bad :o :)
[Droid Eris Android Development] binny1007:
Ok guys this is getting bad, I'm having dreams about rooting my phone.....
[Droid Eris Android Development] jmanley69:
Then as soon as you wake up... write down the procedure so you can share it with the class.
[Droid Eris Android Development] chuckz07:
Jman or binny (and whomever else), look at this xml. You guys know a little more than me about most of this. This files appears to tell the system what has certain privledges.
[Droid Eris Android Development] binny1007:
That's the thing though I go on xda to post how I did it and I can't remember.
[Droid Eris Android Development] jmanley69:
We looked into that on the Hero forum too when the Sprint Hero came out. I'm afraid that this file basically says what groups people are in and what privileges they get. The thing that caught our eye was the part about "be careful modifying this or you could give somebody privileges they don't deserve"... the only problem is, you have to be root to edit the file... we couldn't find any groups in that file, or any programs running under those uid's, that would give us what we needed.

I've been playing around (on my Hero) with the exploit that is supposed to let you write to protected files, but the only files that we could write to that would give you root are located under /system... and /system is locked down by the mount as ro. :(:(:( and this file is under /system :(
[Droid Eris Android Development] chuckz07:
Ok then. I am confused about something else, if someone could clarify more for me please. Here (XDA) and some other community sites has a DUMP of the ERIS, but some confusion about it being for the Motorola DROID and not the ERIS. Mot DROID has no HTC software in it but this dump contains numerous amount of HTC branded stuff in it. Also there is a 'desirec-keypad.kcm.bin' file in one of the folders. So I am asking if someone can clarify that the dump is not the ERIS please? Like I said, I am just confused. Thanks!
[Droid Eris Android Development] jmanley69:
People see "droid" and think of the Moto Droid... so... when they see "Droid Eris" they think "Moto Droid Eris" which is wrong. Your phone is made by HTC and has absolutely nothing to do with Motorola. Verizon did this to you by playing marketing tricks and releasing 2 anDROID phones around the same time.

Those "dumps", as far as I know, are just some files from within /system. All that is available to you through the RUU that Verizon gave you for MR1.

Here's what you've got to be careful about. There are people out there that will try to capitalize off of your misery and try to send you a virus, or spyware, or something even worse perhaps.... So... stick to what you get through official channels, or sanctioned posts on xda.
[Droid Eris Android Development] chuckz07:
Ok thanks. I did know the diff between the 2, but my confused part was this an ERIS dump or not. So I guess after your explanation, it is unsure if this is an actual real dump, or someone trying to sabotage an unknown user. Or something like that.
[Droid Eris Android Development] jmanley69:
possibly, but if it's safe, it's no different than what you already have in the RUU. There are posts about how to extract system.img... it's not too difficult... just one command I believe.
[Droid Eris Android Development] chuckz07:
There is another file in the dump that lists all rsa certs, if you believe that may be useful to look at it I'll find it again and upload it.

EDIT: Sorry, meant to say it ref's ras certs
[Droid Eris Android Development] binny1007:
Do we have pulseaudio on our devices, and if so Jman with that exploit you were playing with does it allow you to wright to /tmp/. Maybe we can use a combo of two expliots.
[Droid Eris Android Development] jmanley69:
Here's the problem with trying to "crack" the signing method.

Encryption needs 2 parts to work... a "public" key and a "private" key, and the cert that's included on your phone is the "public" key.

The way it works is... I take some value, and my private key. When I "hash" them together, I get an encrypted version of that value. Then, I give the encrypted version of the value to somebody and the public key. They take the public key, and it unlocks the value.... that's how they know that it really came from me.

So... Let's say you're a king in the middle ages. You want to tell your troops to stand down while they're in a war, but you've got too much going on to go to the front line yourself. You need to send your orders with a messenger. You write the orders "Stand Down", put them in an envelope, drop some wax on the envelope, press your ring in it and send it on its way. When the message gets to the general, he looks at the seal and knows that this came from the king, so he trusts the orders (but doesn't need to trust the messenger). That's what's going on here. HTC is the only one with the king's ring (private key), but the phone knows what the seal looks like (public key), so when the encrypted message (the OTA update) comes onto the phone, he says "Ohhhh... Ok... I'll go ahead and do that".

Without the private key... there is absolutely no human way to encrypt our own message so that it will decrypt with the public key.

SHA1 is rumored to have been "cracked" and by that they mean that in SOME cases, you can create collisions... In a nut shell, that means that you can encrypt the 5th Harry Potter book to get a value of 123456789. Then, you can take the same book... rip out page 6, replace it with "And Harry kissed Ron", then add certain seemingly nonsensical information... encrypt it up and get 12345689. However!!! Don't try to do this!!! it's only in theory, and it would take much more computing power than you have at your disposal. It would not be worth it... and you'd drive yourself crazy only to have a kernel bug show itself before you're done.
[Droid Eris Android Development] jmanley69:
There's no /tmp/ on the android phone. As for pulseaudio... I don't know if it exists in the Android OS or not.
[Droid Eris Android Development] binny1007:
Ok can you post that exploit your playing with.
[Droid Eris Android Development] chuckz07:
More specifically, I was looking in the direction of trying to 'tag along' or even finding a 'loop hole' by studying these files. Right now I am just opening via Notepad and looking at them. My binary editor freebie ran out a long time ago, so there is some info in there I cannot properly view. But someone else may be able to. Just throwing out more ideas but if you feel my ideas are a waste of time, I'll try to focus somewhere else.
[Droid Eris Android Development] jmanley69:
This is taken word for word from securityfocus.com If this violates terms and conditions, a moderator is free to remove this post without notifying me.
[Droid Eris Android Development] jmanley69:
If Windows...

http://www.chmaas.handshake.de/delphi/freeware/xvi32/xvi32.htm
[Droid Eris Android Development] chuckz07:
Ahhh, thank you kindly!
[Droid Eris Android Development] binny1007:
Ok more clarity needed can we use that to wright to /proc/sys/vm/ if so we can wright over mmap_min_addr with one that has a 0 in it and tada we can us asroot2.... just a thought
[Droid Eris Android Development] jmanley69:
I'm pretty sure the fix with mmap_min_addr was code in the kernel... not a file that was replaced.

Here's the contents of /proc/sys/vm

pwd
/proc/sys/vm
# ls
ls
-rw-r--r-- 1 0 0 0 Dec 26 19:43 block_dump
-rw-r--r-- 1 0 0 0 Dec 26 19:43 dirty_background_ratio
-rw-r--r-- 1 0 0 0 Dec 26 19:43 dirty_expire_centisecs
-rw-r--r-- 1 0 0 0 Dec 26 19:43 dirty_ratio
-rw-r--r-- 1 0 0 0 Dec 26 19:43 dirty_writeback_centisecs
-rw-r--r-- 1 0 0 0 Dec 26 19:43 drop_caches
-rw-r--r-- 1 0 0 0 Dec 26 19:43 laptop_mode
-rw-r--r-- 1 0 0 0 Dec 26 19:43 lowmem_reserve_ratio
-rw-r--r-- 1 0 0 0 Dec 26 19:43 max_map_count
-rw-r--r-- 1 0 0 0 Dec 26 19:43 min_free_kbytes
-rw-r--r-- 1 0 0 0 Dec 26 19:43 min_free_order_shift
-r--r--r-- 1 0 0 0 Dec 26 19:43 nr_pdflush_threads
-rw-r--r-- 1 0 0 0 Dec 26 19:43 oom_dump_tasks
-rw-r--r-- 1 0 0 0 Dec 26 19:43 oom_kill_allocating_task
-rw-r--r-- 1 10007 10007 0 Dec 26 19:43 overcommit_memory
-rw-r--r-- 1 0 0 0 Dec 26 19:43 overcommit_ratio
-rw-r--r-- 1 0 0 0 Dec 26 19:43 page-cluster
-rw-r--r-- 1 0 0 0 Dec 26 19:43 panic_on_oom
-rw-r--r-- 1 0 0 0 Dec 26 19:43 percpu_pagelist_fraction
-rw-r--r-- 1 0 0 0 Dec 26 19:43 swappiness
-rw-r--r-- 1 0 0 0 Dec 26 19:43 vfs_cache_pressure
[Droid Eris Android Development] redman213:
Can't you just download ccleaner and delete the files from your registry so you can keep using the trial over and over?
[Droid Eris Android Development] ataranine:
I just downloaded this. If there's anything specific codewise we need to find in any file I'll gladly sit here day and night looking through each individual file to find it.
[Droid Eris Android Development] binny1007:
That's wired couse in mine I have a mmap_min_addr and I belive the way they "fixed" the pipe.c hole was to give mmap_min_addr was to give it a non 0 number, me and video played with trying to replace this file back in the day when this thread first stared. The current asroot2 relies on mmap with a address of zero, so if we can replace the one on our devices with a zero'd one than we can use asroot.
[Droid Eris Android Development] crax0r:
Dumping...

Hey guys, I'm a tech savvy but I don't really know much about this subject. :(But when I dumped the /system/dumpstate command I saw a lot of security.android tags and boot.android tags. Do you want to upload me the dump file? I just want to help, it's very long by the way! :p
[Droid Eris Android Development] binny1007:
Here is what I have in mine.

C:\AndroidSDK\tools>adb pull /proc/sys/vm/ vm/
pull: building file list...
pull: /proc/sys/vm/mmap_min_addr -> vm/mmap_min_addr
pull: /proc/sys/vm/vfs_cache_pressure -> vm/vfs_cache_pressure
pull: /proc/sys/vm/block_dump -> vm/block_dump
pull: /proc/sys/vm/laptop_mode -> vm/laptop_mode
pull: /proc/sys/vm/max_map_count -> vm/max_map_count
pull: /proc/sys/vm/percpu_pagelist_fraction -> vm/percpu_pagelist_fraction
pull: /proc/sys/vm/min_free_order_shift -> vm/min_free_order_shift
pull: /proc/sys/vm/min_free_kbytes -> vm/min_free_kbytes
pull: /proc/sys/vm/drop_caches -> vm/drop_caches
pull: /proc/sys/vm/lowmem_reserve_ratio -> vm/lowmem_reserve_ratio
pull: /proc/sys/vm/swappiness -> vm/swappiness
pull: /proc/sys/vm/nr_pdflush_threads -> vm/nr_pdflush_threads
pull: /proc/sys/vm/dirty_expire_centisecs -> vm/dirty_expire_centisecs
pull: /proc/sys/vm/dirty_writeback_centisecs -> vm/dirty_writeback_centisecs
pull: /proc/sys/vm/dirty_ratio -> vm/dirty_ratio
pull: /proc/sys/vm/dirty_background_ratio -> vm/dirty_background_ratio
pull: /proc/sys/vm/page-cluster -> vm/page-cluster
pull: /proc/sys/vm/overcommit_ratio -> vm/overcommit_ratio
pull: /proc/sys/vm/oom_dump_tasks -> vm/oom_dump_tasks
pull: /proc/sys/vm/oom_kill_allocating_task -> vm/oom_kill_allocating_task
pull: /proc/sys/vm/panic_on_oom -> vm/panic_on_oom
pull: /proc/sys/vm/overcommit_memory -> vm/overcommit_memory
22 files pulled. 0 files skipped.
0 KB/s (70 bytes in 0.280s)

C:\AndroidSDK\tools>
[Droid Eris Android Development] jmanley69:
well.... post it up here silly.
[Droid Eris Android Development] binny1007:
Ok just give me a few and ill have. it posted.
[Droid Eris Android Development] jmanley69:
I tried with some other files in there...

It looks like /proc/self/fd/3 gets to be r-x------, so I can't echo anything into those files. Try this and see what happens

sh 3< /proc/sys/vm/mmap_min_addr
read A <&3
echo $A
echo 0 > /proc/self/fd/3

then... if you didn't get a permission denied... can't create file...

You should be able to cat /proc/sys/vm/mmap_min_addr and it should read 0.

If that works, you may be able to try asroot or asroot2.

If you get a permission denied, then I guess the file access hole has been patched.
[Droid Eris Android Development] binny1007:
here it is and do i do that from adb shell?
[Droid Eris Android Development] jmanley69:
yes, from adb shell
[Droid Eris Android Development] binny1007:
wooo this is what i got

C:\AndroidSDK\tools>adb shell

* daemon not running. starting it now *

* daemon started successfully *

$ sh 3< /proc/sys/vm/mmap_min_addr

read A <&3

echo $A

echo 0 > /proc/self/fd/3sh 3< /proc/sys/vm/mmap_min_addr

$ read A <&3

echo $A

$ 3

$

so now what do i do ?
[Droid Eris Android Development] jmanley69:
yes, but you didn't finish... silly... you've got to do all the commands. There's no doubt that you can read the file. the file is rw-r--r--, so you can read the file without playing any tricks. the question is... can you write to the file.
[Droid Eris Android Development] binny1007:
finish it how? Im still learning as i go..... so what do i do next?
[Droid Eris Android Development] binny1007:
did you mean this?

$ cat /proc/sys/vm/mmap_min_addr

echo 0 > /proc/self/fd/3cat /proc/sys/vm/mmap_min_addr

cannot create /proc/self/fd/3cat: directory nonexistent

$
[Droid Eris Android Development] jmanley69:
Follow every single line.
[Droid Eris Android Development] binny1007:
sorry thought i did that last line but looks like that is a no go

$ sh 3< /proc/sys/vm/mmap_min_addr

sh 3< /proc/sys/vm/mmap_min_addr

$ read A <&3

read A <&3

$ echo $A

echo $A

3

$ echo 0 > /proc/self/fd/3

echo 0 > /proc/self/fd/3

cannot create /proc/self/fd/3: permission denied
[Droid Eris Android Development] binny1007:
ok after i do

sh 3< /proc/sys/vm/mmap_min_addr

read A <&3

echo $A

should it return $ or #
[Droid Eris Android Development] jmanley69:
You did everything correctly. This vulnerability has been patched.
[Droid Eris Android Development] markachee:
after "echo $A" it should print the contents of the file, and return you back to a $ prompt

But after reading through that hack, it seems like it only lets you write to files that are writable by everyone, but within directories that aren't accessible by everyone.
[Droid Eris Android Development] ataranine:
So you guided him through it...only to tell him that the vulnerability has been patched? Awesome, that's nice making him waste his time.. :(
[Droid Eris Android Development] jmanley69:
Easy killer.... I guided him through it because he wanted to try it. Once it didn't work, it was obvious that the vulnerability had been patched on his phone. I don't have an Eris, and I'm trying to help you guys out of the kindness of my heart. However, if jerks like you insist on instant gratification, I will simply unsubscribe to this thread and you guys can figure it out on your own.
[Droid Eris Android Development] binny1007:
just found this expliot it was published on 2009-12-23 so i have my fingers crossed there are 4 in here all for local privlage escalation, here is the link

http://www.securityfocus.com/bid/36901

yes i know it is for pipe.c but like i said before pipe.c is still unpached the fix that vzw did was to give mmap_min_addr a non null value. so lets hope one of theas work.
[Droid Eris Android Development] binny1007:
Dude WTF I am more that happy to do this. I am sorry but please dont make one of the only people that are helping us mad, than we will be in a sinking ship, so please back off if you dont have anything good to say or helpful.
[Droid Eris Android Development] jmanley69:
I'm pretty sure we've seen these before. It was actually published November 3, and I've got the code on my ubuntu box already.

The first 2 require ps and grep that you don't have on your phone. The Busybox that you can load on the phone won't support those commadn line arguments. The second won't compile because you're missing personality.h.

The third looks like it might work, but like I said, I've got the code on my Ubuntu.

Sorry....
[Droid Eris Android Development] binny1007:
i also found this

http://www.securityfocus.com/bid/37068/info

but no proof of concept

and this

http://www.securityfocus.com/bid/37036/info

but no proof of concept

so if anyone wants to search for these and see if you can find a proof of concept than go for it.
[Droid Eris Android Development] binny1007:
yea i was looked at it a little better and relized that we may have tried them allready :(
[Droid Eris Android Development] ataranine:
You're more than happy to waste your time.

That's fine.

It's all better now.
[Droid Eris Android Development] jmanley69:
Not even close...
[Droid Eris Android Development] ataranine:
Look I didn't mean to piss you off or something I was just stating a fact.

I know you're busting your ass.

Sorry.

This phone's just been pissing me off so bad today, making me wish I had root more and more.
[Droid Eris Android Development] binny1007:
Ok what are your thoughts on this one. If you think it may work could someone compile this for me.

http://downloads.securityfocus.com/vulnerabilities/exploits/raptor_chown.c
[Droid Eris Android Development] chuckz07:
The only non-ERIS owner who has been spending quite a bit of time and energy helping us to try and get this thing rooted...and this is how you treat 'Help'. Dude, if the phone is pissing you off that bad that you cannot utilize it the way it is now, return it for another phone. Besides, it could be weeks or even months before this thing gets rooted.
[Droid Eris Android Development] ataranine:
I said sorry, leave it alone. Kthnx.
[Droid Eris Android Development] FireSokar:
Rooting this device would be useless if rumors are true of 2.1 on jan 22nd. I do not see a mainstream effort until it is updated past 1.5, dont get me wrong i want it rooted i just dont see alot of people caring much to help until its updated.
[Droid Eris Android Development] ataranine:
I don't want Sense, and I'm sure a few other people don't like it either. Being able to flash another rom without Sense on it would be awesome.
[Droid Eris Android Development] binny1007:
Not true once we do get root it will be nothing to apply our own updates, but I do agree that we will see more traffic once we get the update if we are not rooted by than.
[Droid Eris Android Development] jmanley69:
Doesn't work on the Hero.
[Droid Eris Android Development] jmanley69:
Once you're rooted, you can apply 2.1 on your own terms (i.e. still rooted).
[Droid Eris Android Development] binny1007:
One Change in the source I am getting bin/ls not found so can you change the source to system/bin/ls or will that mess things up?
[Droid Eris Android Development] binny1007:
two more..... not crossing my fingers
[Droid Eris Android Development] binny1007:
anyone have some spare time and want to start downloading some of these and give them a try http://leetupload.com/dbindex2/index.php?dir=Local Root Exploits/

*Edit*

I have no idea what these do and I take no responsability for what they do to your device
[Droid Eris Android Development] Videofolife13:
@jmanley69: I've been a member of different hacker communities for probably 5 years, and I've found that it's best not to ask developers for support and instead, let them gradually support the devices that come out. Someone, eventually, will get the Eris rooted using one method/exploit for another. There are some people working at it everyday. It'll happen, be patient, let the devs be devs. :)
[Droid Eris Android Development] jmanley69:
I'm not impatient for myself... I'm running a Hero and have had it rooted since the day I brought the exploit to this forum. I'm just offering suggestions to the Eris owners because I know that when I had issues with the Hero and flashrec, I contacted the devs of flashreac, helped them work it out and they released a patch (within a day) to fix the problem.

If I had an Eris, I'd be able to play around with some of the exploits being explored here, but since I don't all I can offer is my humble advice and general support.
[Droid Eris Android Development] Videofolife13:
Cool. It's always nice to get some advice from forum veterans. I wasn't trying to be mean, but I don't think flashrec can be rewritten easily to work on the Eris since it relies on mmap_min_addr being 0, and us Eris owners are stuck with a number in the 30,000's. So, until we find a work around for that, most exploits out there won't work for us.
[Droid Eris Android Development] jmanley69:
I tried the exploit you suggested, but it requires wc. Since the busybox that Google gives us (aka toolbox) doesn't support wc, I loaded the real busybox. However, all the exploit does is eat up resources until the phone finally kills the adbd service and you have to pull the battery.

Edit: I should mention that I did this on my Hero.. but android is android as far as supported tools (i.e. wc)
[Droid Eris Android Development] Videofolife13:
Would it be too much to ask for you to post the compiled exploit?