yashsingh1/xdaforums huggingface dataset:
[Click Android Development] alanchen75:
push data into tattoo bin/ fail

I have one problem.

After follow step by step set up my enviroment.

And then run

adb push m7 /data/local/bin/

ADB return message as below：:confused:

adb server is out of date. killing …….

* daemon started successfully *

failed to copy ‘m7′ to ‘/data/local/bin/’: Is a directory

But I can use adb push data into SDCARD of TATTOO.

Why can't I PUSH data into '/data/local/bin/'?

Could someone can help me？

PS. I can get device ID can also sdcard CID by adb.
[Click Android Development] chusen:
i get

[ Overwritten 0xb0000100

but i don´t get # ,i´ve try to restart the tattoo and the pc and same results, any idea?
[Click Android Development] zipredictive:
guys... is it dangerous? I know... full battery dont switch off computer and phone ecc ecc...
[Click Android Development] HTCDevil:
How long it takes to have # ?
[Click Android Development] -bm-:
I can't give you a guarantee but I think it is safe to try! I can't imagine a way how your tattoo could get unusable until you follow the howto but as I said and always in live: There is never 100% safety ;-)

-bm-
[Click Android Development] zipredictive:
sure... understood! thank u so much!
[Click Android Development] kiljacken:
i get to "[ Overwritten 0xb0000100" but the # does not come up...
[Click Android Development] HTCDevil:
Me too...

No # appears...
[Click Android Development] coolbits:
When i selected htcsync on phone when connected i got root on first try...

Be sure to select that.
[Click Android Development] ivendor:
I've successfully rooted my tattoo. One advice, do it immediately after the boot of the phone (when the word "tattoo" is on the screen), if it fails, reboot from adb and retry, after few tries, it succeds.

However, how can we make it permanent? If i try to write to /system partition, even if i remount it as rw, i get this error:

"cp: cannot create '/system/bin/su': Cannot allocate memory"
[Click Android Development] coolbits:
Hmm i wonder if it really is mounted r/w... i get:

# /data/local/busybox cp /data/local/bin/su /system/bin/

cp: cannot create '/system/bin/su': Read-only file system

#

How to mount /system r/w?

---

Ok remounted /system r/w... now i also get Cannot allocate memory
[Click Android Development] Framework43:
Congrats guys. You deserved it after the long wait :)

Hopefully us Eris users will get Root soon as well.
[Click Android Development] Bubisch:
Okay, i have cleaned up all the OT-Stuff to keep it nice and clean ;D
[Click Android Development] sheik_yerbouti:
Has any of you rooters tried the SetCPU app on your Tattoo's and been able to overclock it?
[Click Android Development] kiljacken:
any news on the missing #???
[Click Android Development] HTCDevil:
Nothing to do for me... i've tried so much times...damn.
[Click Android Development] zipredictive:
wich one are u guys trying?

I mean... the first works and the batch not?

or u have problems with both method?
[Click Android Development] kiljacken:
currently the batch...

But none of the methods worked so far...

I only get to "[ Overwritten 0xb0000100" but the # is missing...
[Click Android Development] coolbits:
Not working yet... i think it needs "SU" to be in /system/bin first
[Click Android Development] HTCDevil:
Both method...

First method: stop after typing the code in adb shell...it appears some >>_ but nothing happens.

Second method: Overwritten etc. but no # after that. :confused:
[Click Android Development] locoliso:
Nothing for me. I dont get #.

uname -a

Linux localhost 2.6.29-gf922713 #117 PREEMPT Tue Sep 29 18:11:07 CST 2009
[Click Android Development] dancer_69:
I tried first with method described in 1st post and after some tryings I successed to get the #

But when I tried the id command I get not found error.

I tried a lot afterwards with the batch file, but nothing. Tried a lot with tip to run immediatly after boot, but again no success.
[Click Android Development] marsdroid:
we need to use

adb shell chmod 755 /data/local/bin/m6

THX

Marsdroid
[Click Android Development] mainfram3:
I was finally able to open the system.img from the test RUU. It has some interesting binaries in there, but no flashing tools.

In anyone is interested, here's the only tool I found that would extract the contents from the system.img: http://code.google.com/p/unyaffs/ (Linux only).

To everyone having problems getting root: it takes time. It ___really___ takes time. The first time I got root I didn't realize it then, but it was a terrible lucky fluke. I could have been running the right exploit all night long and have completely missed it, because the race is really difficult to win.

Hopefully we'll be able to come up with a more permanent, reboot-resistant way, to setup a root shell.
[Click Android Development] sheik_yerbouti:
OK guys, I'm gonna dip my foot into the pool and see how it goes...
[Click Android Development] sheik_yerbouti:
On first try, after pushing the m6 binary, I ran adb shell chmod 755 /data/local/bin/m6 and got ./m6: permission denied. So I ran the batch file and the While loop, but did not get #.

EDIT: Correction. When I typed in the chmod command, i got the man files for adb. So I tried opening an adb shell and then typing chmod 755 /data/local/bin/m6, and it seemed to work. Then, when I ran the While loop, I got:

.
.
.
wrote shellcode 9bcc line 276
usage: reboot [-n] [-p] [rebootcommand]
[ Overwritten 0xb0000100
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]

yet, no #.

EDIT 2: I rebooted the phone, and tried the While loop again. This time, I got root. But I typed 'id', and nothing happened. It said 'id: not found'. :S
[Click Android Development] sushi1234:
After a few miserable hours i finally got to root, but when i type id, i get "not found"
[Click Android Development] -bm-:
For everyone having the id-not-found problem: That was my fault when writing the howto, sorry!

You first have to run the export-commands and then "id" will work. I corrected the howto already!

@Bubisch?! You're here and not deep down in the grassland? Thanks for cleaning up the thread! ;-)

-bm-
[Click Android Development] LordGiotto:
Thank You for your work -bm-

However I think there is an error in the guide:

# remount -o rw,remount /dev/block/mtdblock3 /data

doesn't work for me... I used:

# mount -o rw,remount /dev/block/mtdblock3 /data

I've got another question about this part: the mtdblock3 isn't system?

On my device, cat /proc/mtd returns:

dev: size erasesize name
mtd0: 000a0000 00020000 "misc"
mtd1: 00500000 00020000 "recovery"
mtd2: 00280000 00020000 "boot"
mtd3: 09600000 00020000 "system"
mtd4: 09600000 00020000 "cache"
mtd5: 0a520000 00020000 "userdata"

It's only a small doubt, it works perfectly :)
[Click Android Development] chusen:
any solution for [ Overwritten 0xb0000100 blocked guys please?
[Click Android Development] coolbits:
Try again and again... i got # when opened people (phonebook) when running...

Here is faster command from bftb0

while do ./m6 ; do: ; done

got root instantly
[Click Android Development] leon1984:
why "do:" I do not understand
[Click Android Development] coolbits:
i found it here and tryed, dont know why :)

http://xdaforums.com/showpost.php?p=5679260&postcount=140
[Click Android Development] -bm-:
You are a little bit impatiently, aren't you?

Did you read the howto completly line by line and not just hacked in the code? What did you tried to do while the exploit was running?

-bm-
[Click Android Development] chusen:
i read the how to step by step and try it several times, in first time i got # but i don´t get # never again, i try to do hard reset and new rom installed and same result

And sorry for my impatience :)
[Click Android Development] drakaz:
Works great here, Tattoo rooted. Great job, many thanks from my girldfriend ;)
[Click Android Development] sushi1234:
I finally managed to get root really quickly...

I opened almost all of the applications on the phone, then i used tattooroot installation batch and instead of using

while `true` ; do /data/local/bin/m6; done

i used

while do /data/local/bin/m6; done

But now i don't know how to copy files between folders, i get access denied even with root privileges.
[Click Android Development] -bm-:
Look at the end of the howto. You have to remount ALL partitions rw, did you do that?
[Click Android Development] -bm-:
You left one question open: what did you do while the exploit was running?
[Click Android Development] chusen:
open apps and close with taskiller, in other time nothing, in other time open phonebook, other open gmail.... and always same result (sorry for my english)
[Click Android Development] sushi1234:
Thank you -bm- it was a problem because of my unfamiliarity with linux commands, but now, as i have learned a few commands, everything is working great:)
[Click Android Development] sheik_yerbouti:
-bm-, why is opening and closing apps so important? What's the logic?
[Click Android Development] vorontsov_ilya:
Who can root

kernel: 2.6.29-gf922713 htc-kernel@and18-2 #117

version: 1.67.411.7 CL#74298 release-keys
[Click Android Development] -bm-:
I don't exactly know why this helps the exploit to win the race but it is proven that it does. I think you have to ask the devs in the other thread.

Ill be off for at least 12 hours now.

Have a lot of fun!

-bm-
[Click Android Development] jamezelle:
It bogs down the processor so the exploit wins the race
[Click Android Development] Coburn64:
Damn, every time it wins, it doesn't spawn a root shell. Here's something interesting:

WIN!

....

Overwrote 0xXXXXX (XXX is the address) (should stop here)

usage: reboot [-n] [-p] [rebootcommand]

usage: reboot [-n] [-p] [rebootcommand]

So it looks like keeps on going. Odd. :(
[Click Android Development] HTCDevil:
...same to me..:mad:
[Click Android Development] leon1984:
Try "while ./m6; do:; done" eliminates the verification of true

open and close programs, the telephone book, everything you can think of while running the script.

Reset the phone with adb shell reboot, and connect as soon as possible with adb shell

Test and test many times, the script is not perfect
[Click Android Development] sheik_yerbouti:
I've been trying the steps and I haven't gotten root again after my first success. I'm sleepy now, so I will do this again tomorrow.

@leon: Whenever I tried the while loop with m6 represented as ./m6, it always get the message that it was not found.
[Click Android Development] leon1984:
Depends on where you call, to do this one needs some knowledge of linux ... if calling from the HOME

"while /data/local/bin/m6; do : ; done"
[Click Android Development] engerim:
Succeeded here today (didn't work last night).

Exact Steps (after doing install of m6):

1) Power on + connect phone (use USB storage)

2) Launch m6 in a loop on adb shell:

while true;do /data/local/bin/m6;done

3) Launch GMail

4) Got '#'

5) export PATH=/data/local/bin:/sbin:/system/sbin:/system/bin:/system/xbin

6) id

uid=0(root) gid=2000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),300

2(net_bt),3003(inet)

Problems during running the exploit that you can consider normal:

Getting the "usage: reboot [-n] ... " messages, this normal as the exploit runs over the reboot command. Sometimes I also get a "terminal echo" instead of the root shell.

My Tattoo OS is this:

# uname -a

Linux localhost 2.6.29-gf922713 #117 PREEMPT Tue Sep 29 18:11:07 CST 2009 armv6l GNU/Linux

I installed busybox but its not in PATH when the exploit runs.

mount output:

rootfs on / type rootfs (ro)

tmpfs on /dev type tmpfs (rw,mode=755)

devpts on /dev/pts type devpts (rw,mode=600)

proc on /proc type proc (rw)

sysfs on /sys type sysfs (rw)

tmpfs on /sqlite_stmt_journals type tmpfs (rw,size=4096k)

/dev/block/mtdblock3 on /system type yaffs2 (ro)

/dev/block/mtdblock5 on /data type yaffs2 (rw,nosuid,nodev)

/dev/block/mtdblock4 on /cache type yaffs2 (rw,nosuid,nodev)

#

Question now is... How to make it persistant without needing to reboot?

The most logical thing would be to add something to the end of /init.rc

So I did this to test if its persistant (as root) with busybox installed:

export PATH=/data/local/bin:/sbin:/system/sbin:/system/bin:/system/xbin

mount -o remount,rw /

echo "# hello" > /testfile

sync

cp /init.rc /init.rc.bak

echo "#hello" >> /init.rc

sync

mount -o remount,readonly /

sync and remount should make sure the flash is updated/synced.

the echo adds a comment to the init.rc file.

ls -l /

shows:

-rwxr-x--- 1 0 0 11510 Feb 21 06:12 init.rc

-rwxr-x--- 1 0 2000 11502 Feb 21 06:11 init.rc.bak

You can see the init.rc is bigger.

Then I rebooted the phone (by using the phone UI).

And... sadly init.rc.bak was gone. init.rc back to its original size.

So suppose the only way to fix this for good without having to run m6 is to adjust the firmware flash images (wherever they are). ..

I also remounted /system rw and got the same error as reported here (No memory left) when trying to write something.

One last thing: During typing a couple of commands the root shell died and I ended up in the m6 loop again. Got root again instantly or after just restarting gmail. Maybe this happened cause the phone went to sleep.

Entering and exiting GMail was the fastest way for me to have success with the exploit more than once.
[Click Android Development] kevinbing:
I've really appreciated your work.

Nice work!
[Click Android Development] HTCDevil:
Ask for all of you:

which operative system do you use for that operation?
[Click Android Development] engerim:
You mean which operator? Mine is a original HTC, not operator looked one in Taiwan, supposedly made for Taiwan Mobile.
[Click Android Development] sheik_yerbouti:
Win 7 Ultimate 64-bit.
[Click Android Development] HTCDevil:
No. Operative System on your PC.

Thanks sheik, it's a problem for me...i have windows 7 ultimate 32 bit...so it's not fault of o.s. :confused:
[Click Android Development] kiljacken:
I use: Windows XP Professional SP3
[Click Android Development] svprm:
Failed:

...
Wrote shellcode 9bc8 line 272
Wrote shellcode 9bcc line 276
usage: reboot [-n] [-p] [rebootcommand]
[ Overwritten 0xb0000100

Stopped.

I stopped some application using Taskiller.

Any Help?
[Click Android Development] avimak:
I tried it about 30 times, no good :(

Any tips? thanks!

("Sometime the exploit stopps but no shell ('#') comes up. Just terminate it with ^C and try again." I did it for 30 times, always stops with no "#", tried to reboot several times - didn't help)
[Click Android Development] leon1984:
open gmail it works while you are in while loop?
[Click Android Development] sheik_yerbouti:
Question for the devs:

Is the pushing of m6 a one time process, or does it have to be done EVERYTIME we want to attempt get it rooted? Can we just resume from the WHILE loop when the attempt to root it?
[Click Android Development] sheik_yerbouti:
Persistance has paid off. I've finally got Root again, and this time I was able to finish all the steps. Phew!

What happens now?
[Click Android Development] engerim:
If you installed su after its working the first time you won't have to do it again unless you power down the phone.

The only way to make this work better would be to adjust the exploit to be more user friendly (i.e. better detection if it really succeeded) and loop in itself instead of being executed over and over again.

I use Vista + adb tools to access the phone (if it matters, I don't think it does).
[Click Android Development] sheik_yerbouti:
The first time I had root, I didn't install su due to -bm-'s flow of instructions. This time, I installed it.
[Click Android Development] engerim:
Remount data and install su so it can last until power down :-)
[Click Android Development] sheik_yerbouti:
Yes. I've installed SU. I tried to run an app(setCPU) on my phone which needs root, but while the shell with # was still open, the app reported that it did not have root. Disconnected the USB cable, and still won't run. I'm launching the app through the phone itself.

Am I doing something wrong, or is there still somework to be done?
[Click Android Development] shears:
I'd just like to say thank you all for your hard work. You've made an extraordinary job that many people will appreciate.
[Click Android Development] chusen:
please excuse me for my insistence, I tried it many times and many methods (original script, opening applications, gmail, phonebook, Taskill ..) and the result is always the same. it is possible that the exploit code can be improved to achieve success always?

PD: DEV thanks for you work
[Click Android Development] mkrle:
HTC Magic user here, i'm trying this exploit on Magic and i can only get to

[ Overwritten 0xb0000100

I've been trying for about an hour with about 30-40 halts at that message.
[Click Android Development] LeeGath:
Hi,

I'm a noob that bought a HTC Hero which was locked to Orange. I've been through various paths trying to unlock the phone, but to no avail. Then I found this post......

Anyway, I haven't yet managed to get root, but will persevere as that seems to be the only way (@mkrle I think you've just gotta keep trying bud). I think I read somewhere about battery status affecting whether or not we win the race condition? Did anyone that's rooted their phone take note of the battery?

A couple of strange things have happened and just wanted to see if anyone else has experienced the same thing?

- Most instances it follows a pattern of

/droc/23146/cmdlineusage: reboot [-n] [-p] [rebootcommand]

usage: reboot [-n] [-p] [rebootcommand]

usage: reboot [-n] [-p] [rebootcommand]

usage: reboot [-n] [-p] [rebootcommand]

until I get the shellcode lines and eventually the Overwritten message

However on one occasion I got a long non-carriage returned /droc statements, but then it seemed to stall so I ctl^c, but wondered if it was significant?

-On an odd occasion I've lost my adb connection?

Anyway, I'm going to keep trying and hopefully get some success later today, but wanted to ask the question. If I get root, then what? How do I remove Orange CID check?

Thanks
[Click Android Development] david_zbx:
I have waited this informationfor a long long time. Thank you very much. very great!

:D
[Click Android Development] leon1984:
had better not turn off your phone
[Click Android Development] svprm:
Failed,Tried many times

Tried open and closing the Gmail app.

C:\TatooRoot>adb shell
$ while `true` ; do /data/local/bin/m6; done
while `true` ; do /data/local/bin/m6; done
reroc/594/cmdline[ WIN! 594
Wrote shellcode 9ab8 line 0
Wrote shellcode 9abc line 4
Wrote shellcode 9ac0 line 8
....................................
Wrote shellcode 9bcc line 276
[ Overwritten 0xb0000100

Stoped.
[Click Android Development] dragoslav.nikolic:
Thanks a lot
[Click Android Development] avimak:
Same here, I tried all posted methods, nothing works :(

During the loop I'm getting many:

usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
/droc/19959/cmdlineusage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
/droc/19974/cmdlineusage: reboot [-n] [-p] [rebootcommand]
/droc/19977/cmdlineusage: reboot [-n] [-p] [rebootcommand]
/droc/19980/cmdlineusage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]
usage: reboot [-n] [-p] [rebootcommand]

Model number:

HTC Tattoo A3232

Software version:

1.67.729.8
[Click Android Development] Zecanilis:
It could be a ROM version problem (i think). It's better you to post your results with ROM version also.

Has for the rest. Keep up the good work people, an thank you for you effort.

Cheers
[Click Android Development] svprm:
@Zecanilis

Yeah,It nice idea.

Not working on:

Kernal Version:2.6.29-gf922713

Software Ver:1.67.720.8
[Click Android Development] avimak:
Version number added. thanks
[Click Android Development] dancer_69:
I tried a lot(more than 100) times and I succeed two times to get root. Some of the times I get stuck after five or ten minutes loop.

So it works on:

Kernel: 2.6.29-gf922713

Software Version" 1.67.405.6
[Click Android Development] sheik_yerbouti:
Kernel: 2.6.29-gf22713

SW version: 1.67.720.8

Result: ROOTED
[Click Android Development] svprm:
I'm also having the same.

Pls tell what you did?

step by step.

Thanks in advance.
[Click Android Development] chusen:
i think the problem is not the sw version, i think the problem is the process not work succesfully in all times because is a eris exploit and need to do fine to work in the tattoo. mainfram is work in fine the exploit, be pacient and cross you fingers :)
[Click Android Development] sheik_yerbouti:
All steps are in the first post of this thread. Just follow it, and dont stop until you get Root.
[Click Android Development] dusan7:
Same here. I tried several times

Kernel: 2.6.29-gf22713

SW version: 1.67.405.6
[Click Android Development] Netbuster:
I have the same version, once got # (rooted) I copied the su binary in /data/local/bin, change the permitions for executing by everyone, after reboot this binary gives me: permition denied

$ ./su

./su

su: permission denied

$

the expoit isnt work anymore :(
[Click Android Development] coolbits:
SU needs root privileges to run... so you need to exploit again and run with root...

It will not run on low privileges...

Read the first post - very important.
[Click Android Development] HTCDevil:
It doesn't work on every Htc Tattoo for now.

Mine gives to me always the same result (i've tried at least 100 times):
[Click Android Development] kiljacken:
When i run su i get:

su: uid 10072 not allowed to su

Btw:

You can use a terminal emulator to do the root loop without adb...
[Click Android Development] LordGiotto:
Worked for me.

Kernel: 2.6.29-gf922713

Build: 1.67.405.6

Is there any way to use system su to become root?

So we can use programs that requires root access :)
[Click Android Development] marsdroid:
are you running htc-kernel@and18-2 #117 ?

EDIT : ROOTED : M7 ONLY

gave up 16 hours after m6

THX

Marsdroid
[Click Android Development] dusan7:
Same kernel here = no success yet
[Click Android Development] svprm:
@Marsdroid

Same here.

htc-kernel@and18-2 #117

Not working.
[Click Android Development] -bm-:
su will only work from an adb shell, a local emulator will not work and you get the error you got :-)

-bm-
[Click Android Development] leon1984:
you have tried? I tried it in a terminal emulator install it in the tattoo and I got the root ...
[Click Android Development] -bm-:
God to know, for me it only worked in adb.
[Click Android Development] :
@leon1984 : What is your terminal emulator ?

I tried with connectBot, and I was'nt able to become root.
[Click Android Development] leon1984:
God has nothing to do with it.

It's more about luck jejeej

The effect is the same, you get the # but you have to export commands to operate and if you remove the console as you lose your root pass
[Click Android Development] BeerGood:
Only for 2.4.29 kernel

I think a lot of people (like myself) were hoping to use this vulnerability to root other android phone. Unfortunately, this issue only applies to the 2.4.29 kernel :(

Here's where it was reported:

http ://secunia.com/advisories/34977/

To see the 41 files that were patched:

http ://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d84f4f992cbd76e8f39c488cf0c5d123843923b1

HTC kernel source code for Eris,Tattoo, Hero, Magic:

http ://developer.htc.com/

To know if your kernel is vulnerable, download your kernel source and untar the file. Look in the file:

security/smack/smack_lsm.c

Search for "smack_key_permission". If you see this:

static int smack_key_permission(key_ref_t key_ref,	struct task_struct *context, key_perm_t perm)​

You're out of luck...

If you see this:

static int smack_key_permission(key_ref_t key_ref,const struct cred *cred, key_perm_t perm)​

Then you have hope! Unless HTC patched the code somewhere...