yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] SharpIS03:
rageagainstthecage, further analysis and attempts

Since a couple of the 1-root apps use rageagainstthecage, I stumbled around and found information regarding the process. Here is the guy who came up with it, and here is an explanation of it.

From my understanding, RATC attempts to race the system in adding processes so the system can no longer knock down processes to user-level access. Once the system reaches its limit, adb will attain temporary root where other things can be done to get a permanent root (remounting the system, adding SuperUser and su).

In trying RATC via the command-line, I followed the step-by-step guide for the Galaxy Tab. Strange? Perhaps, except RATC is supposed to be an exploit via adb for all Droids. Is it?

I'll be putting the steps from the guide here as well. In part, just to make sure I'm following everything correctly.

Let it be noted I've got all the prerequisite files and programs that I need from the guide alraedy, so I'm not mentioning them here. I do believe my ADB drivers are just fine since I can run commands and stuff.

Step 1 (after resolving the prereqs) - Gaining temporary root via RATC

cd to whichever folder is holding your ratc exploit, then enter this command

adb push rageagainstthecage /data/local/tmp
351 KB/s <5392 bytes in 0.015s>

change the file permission of RATC in the tmp directory and execute

>adb shell
$ cd data/local/tmp
$ chmod 777 rageagainstthecage
$ ./rageagainsthecage
[*] CVE-2010-EASY Android local root exploit (C) 2010 by 743C

[*] checking NPROC limit ...
[+] RLIMIT_NPROC={3904, 3904}
[*] Searching for adb ...
[+] Found adb as PID 1309
[*] Spawning children. Don't type anything and wait for reset!
[*]
[*] <truncated>
[*]
[*] adb connection will be reset. restart adb server on desktop and re-login.
$
>

You'll hear the USB notification sound go off and on.

Step 2 - restart the adb server

>adb kill-server
>adb start-server
* daemon not running. starting it now on port 5037 *
* daemon started successfully *

After this, check to see if you have root

>adb shell

If you see the #, that means it worked. Unfortunately, I see $. No root. No need to move on from here at the moment.

An interesting thing did happen as I was recreating these steps and typing this at the same time. My first attempt ran RATC and I didn't kill the server like in Step 2. Somehow, my phone rebooted on its own. My second attempt at doing this, I killed the server and my phone just sat there.

Hmmm. Trying this method several times in succession, I can kill/start the adb server just fine, but it doesn't seem to detect my device anymore. That is, until I have to reboot the phone. By rebooting the phone, that means adb no longer has root...well, if my phone could get root this way anyways.

As the creator of the ratc exploit said,

What to try from here? O well, I guess it's time to rest up and get ready for Ageha. Think I'll stop here, at least for the remainder of the vacation.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Just some questions for my fellow IS03 users

pboos, razor950, and lundman

How are you guys liking the IS03 so far?

How are you handling the battery life? Do you use task killers or battery apps?

Have you found a way to enter Recovery or Bootloader mode successfully?

Just wondering!
[Android Software/Hacking General [Developers Only]] SharpIS03:
new ADB driver from Sharp Developers Square, r2

Get it here.
[Android Software/Hacking General [Developers Only]] lundman:
I know Unix, so maybe I can help here. Can you show the output from "mount" on the /system file system? It is likely that it is mounted read-only when you do a boot into single user root, so you can not write to it, or delete apps like you tried.

You will need to remount it rw before you can. Assuming that is the case...
[Android Software/Hacking General [Developers Only]] SharpIS03:
Thanks for your reply lundman! I've tried to remount it rw, as mentioned in the steps I took in my latest attempt. It does change to rw after doing the mount/remount command. However, something changes during this time.

Let's see if I can illustrate. Just for the hell of it, I'm powering off and rebooting my phone. Also, I'm going to run the commands via the Terminal Emulator. Starting fresh...

1. mount - verify ro or rw

/dev/block/mtdblock4 /system yaffs2 ro 0 0

2. df - to check /system space

/system: 354304K total, 326932K used, 27372K available (block size 4096)

3. run rageagainstthecage-arm5.bin in /data/local/tmp

[*] Forked 3880 childs

4. Restart Terminal Emulator, verify #

#

5. df - again to check space on /system

/system: 354304K total, 326932K used, 27372K available (block size 4096)

6. mount -o rw,remount -t yaffs2 /dev/block/mtdblock4 /system -> let's set system to rw, then check mount and df again

/dev/block/mtblock4 /system yaffs2 rw 0 0

/system: 354304K total, 326932K used, 27372K available (block size 4096)

So far, so good. /system is showing rw and there seems to be enough space as well. Next...let's try moving a file into /system

7. cat /data/local/tmp/su > /system/bin/su

cannot create /system/bin/su: not enough memory

8. df

/system: 354304K total, 354304K used, 0K available (block size 4096)

I apologize if this was messy, I am trying to go to sleep as soon as possible. As you can hopefully see through my haphazard attempt, everything seems fine right until we try to move a file into /system even after remounting the /system as rw.

Granted, I do not know Unix at all, so maybe my commands are structured weird or something. If I've input the incorrect command, or you have another suggestion, let me know!

On a similar note, Japanese Android enthusiasts had a hard time dealing with the IS01 as well, which is another Sharp Android device that was carried by au KDDI. They had some kind of workaround but I don't understand it. Here is the site again. I don't know how good your Japanese is, but you can probably follow the code.

Back on track, this rooting method could possibly work IF I could access the recovery mode and input the commands via adb. But alas...I believe Sharp/au blocked this root method as well as disabled the recovery and bootloader modes by normal means. Speaking of au, I still haven't heard their response to my question regarding the recovery mode for this phone. They answered my last two emails fairly quickly in comparison.

Well, that about does it for me at this point...looking forward to any feedback or suggestions. Thanks!
[Android Software/Hacking General [Developers Only]] lundman:
Hey,

Yeah, your commands are correct so the error is unexpected.

As for the Japanese pages, they appear to make a new yaffs image, and replace the existing one. That sound worrying, but I guess it implies you can't modify the existing yaffs image.

The guys over here:

http://xdaforums.com/showpost.php?p=9384974&postcount=18

Suggest you get the signed busybox, and create a new directory called "xbin", which would be interesting to know if you can create something new. Then they copy the busybox file over to the xbin directory.

But I am new to the whole android rooting so I don't know for sure either.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Nice find, and something to definitely take into consideration. However, Step 1 will lead to problems, especially these instructions

reboot into recovery

Our IS03's. as far as I know, cannot get into recovery mode. Whole different ballgame if we could get into recovery easily :)

There's this site which explains how to get into recovery mode. Have you tried yet?

You'll notice that a lot of the other rooting methods for other phones, or flashing new roms, involve rebooting into recovery at some step in the process. So, no easy recovery mode, probably no root or custom roms for the IS03 as it were. That's what it seems like to me after all these hours of poking around and testing...

Hopefully something will turn up soon. Thanks for your reply.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Gimped Japanese Android phones?

Just a little FYI post here. On Softbanksucks.com, the author wrote a post describing how Japanese Android smartphones would lose the ability to view One Seg, or use osaifu keitai, or even lose send/receive by Infrared if the au Card is not inserted or your contract finishes. He spoke to staff at an au shop. Details are here.

I wanted to try this, so I took out my au IC card. One Seg still works fine, as does send/receiving by IR. Not sure about the osaifu keitai function yet. I'll verify that later.

Interesting.
[Android Software/Hacking General [Developers Only]] chokonen888:
003SH user here....if you thought you got burned with 2.1, the Softbank version of 2.2 blocks Skype (though I already installed a US apk that works great) and the built-in tethering for Froyo has been conveniently removed by Softbank. Oh those silly Japs...

BTW, the 003SH has that same covered little oddity you noticed on your IS03 :confused: wonder what it is...
[Android Software/Hacking General [Developers Only]] lundman:
Yeah you said there is no recovery mode, but some of the output you are showing (the # prompt etc) lead me to believe you had a shell, on the hardware itself, which was of root privilege levels.

Since you could run command "mount" to remount, that would seem to be the case. So you need to find out a sequence of commands that would let you change/modify something on /system, to use later. I don't know if yaffs actually lets you run in rw mode, but at the very least, you should be able to "dd" in the mtd image (instead of mounting it) and copying it to SD card, and we can mount it on regular unix and see..

dd if=/dev/block/mtdblock4 of=/path/to/SDcard/image.dump bs=2048

(Make sure "if=" ie 'input-from' is on mtd, so you don't accidentally overwrite your flash)

But perhaps we already have a copy/dump of the system yaffs? I've not actually looked
[Android Software/Hacking General [Developers Only]] SharpIS03:
dumping images

Thanks for that information. I have just tried it and I guess I have an .img of system.

So, I ran ratc to get root privileges on my phone through Terminal Emulator, then I ran:

cat /proc/mtd

which spit out the information contained in the thumbnail image in this post. System is on mtd4, so I ran this command in Terminal Emulator:

dd if=/dev/mtd/mtd4 of=/sdcard/system-dump.img bs=2048

After a few minutes, I received confirmation that the process followed through. Admittedly, I felt a little scared because I never ran this command before, thought maybe I screwed something up with my command.

I also got an img of recovery just for fun. I've copied those img files onto my computer.

Hmmm, that was fun. Now what? Thanks again for that suggestion!
[Android Software/Hacking General [Developers Only]] SharpIS03:
Right on, and welcome! How's that 003SH working out for you?
[Android Software/Hacking General [Developers Only]] In Defiance:
IS03 owner since Day 0 over here. Would love to see the phone rooted. Would love to see it running 2.3 already (AU says 2.2 coming in the Spring -- most likely bundled with the launch of the newer IS handsets) but looks like we have to wait for now.
[Android Software/Hacking General [Developers Only]] chokonen888:
Thanks! Honestly, while I like the phone, seems like they rushed 2.2 onto it as it constantly errors, freezes, resets itself.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Welcome to, what seems to be like, the only English thread regarding the IS03 :) I too wish for the things that you do, which is why I've been working (foolishly, I dare say) to try all these different rooting methods with disregard to my own lack of knowledge about rooting...

You wouldn't happen to have any information regarding recovery mode or anything like, would you? :D
[Android Software/Hacking General [Developers Only]] lundman:
Well, I am in no way suggesting you should do any of the things I mention here.

But when I hack the embedded media players, and similar devices, I would take this image (actually, it'd be fun to receive a copy of your image) and mount it on a normal linux box, and have a look around.

Ultimately, i would rsync it over to a play area, make some small change, like adding busybox setuid root or similar, make a new image (changing as little as possible)

then dd this image back over mtd4 to enable you to have a root shell after restarting. But I'm sure you can see the risks here. It could be the image is "signed" and therefor you just bricked your phone. Or, the re-packaging is done wrong... or... ... or=>brick, or=>brick ... :)

with the media players, if I stuff up, then I can do recovery factory firmware flash, but I don't know about the phones as they are new to me.
[Android Software/Hacking General [Developers Only]] SamuraiD:
ISO3 USB Driver and Ashot Screencast

Hi all. Fellow IS03 user here. I got a couple quick questions I am not a developer but trying to get this program to work will be a useful tool on my android website about app reviews and such. I have tryed talking with the developers no success.

Here goes. Ashot screen capture software for android it claims it will screen cast your android screen without having to root your phone. If nobody knows about it just google android ashot screen capture or visit the mightypocket website.

Anyways I follow the instructions but for some reason I cannot get the USB driver to install I have the latest Google USB Folder download but when I try and find it comp says doesn't have the proper files to install driver. Was thinking maybe something being restricted by AU.

If anyone is up the challenge and might be able to get it to work and explain what I am missing would be appreciated greatly. I have tried running this program on XP, Vista, and Linux Ububtu 10.10 Meerkat with no success.

Thanks.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Yea, seems a little too dicey for me attempt. I'm probably going to try poking around the img, at least, just to see what's there. As soon as I properly set things up on Ubuntu or something. I have to read up on that kind of process though.

No recovery mode too, so I won't be doing anything that risky.

I'll see about uploading my image somewhere and sending you the link.

Have you tried the rage method on terminal on your phone yet? You could probably pull your own image. Considering I've done it twice now, I don't think you'd damage your phone at all.

There seems to be a lot of interesting progress surrounding the IS01 lately, but it's all over my head at the moment.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Ashot

It works perfectly for me. I'm running Win7 x86. Pretty nice program, this Ashot. Just curious, wouldn't ddms.bat work fine for the purposes of grabbing screenshots? No need for an extra program ;)

Only thing I can suggest is that you may want to use the ADB drivers that were provided by Sharp over here. You'll see usb_driver_SHARP_r2.zip that is clickable. You'll need to replace your current drivers with these.

After that, I think you're good to go. Good luck.
[Android Software/Hacking General [Developers Only]] SharpIS03:
questions about mounting imgs

I'm interested in trying this except that I'm running into a lot of hurdles just trying to get things set up.

Here is a list of the imgs that I've pulled.

mtd0 - boot

mtd2 - recovery

mtd4 - system

In Ubuntu, I run the file command to see what the image files are. I get:

boot - HIT archive data

recovery - HIT archive data

system - VMS Alpha executable

From what I understand, I need to get some kind of yaffs2 utility installed in Ubuntu or something?

Is there an easier way to browse these imgs in Ubuntu?

Sorry for the very, very noob questions in this area. Much more than that, THANKS for all of the ideas, every suggestion lets me learn a little something more.
[Android Software/Hacking General [Developers Only]] lundman:
Perhaps you could use http://uploaded.to, or one of those binfile places. I have not done any playing with my IS03, as it is actually the wife's. Eventually she'll leave it unguarded though...
[Android Software/Hacking General [Developers Only]] SharpIS03:
software update

Anyone else get the OTA software update?

Seems like it only updated the baseband, build number, and display version from 01.00.01 to 01.00.02.

Found a link, could this be what the update covered? If true, then the update also:

E-mail (~ @ ezweb.ne.jp) and group C to remove the address book for incoming mail sorting condition, unable to receive mail.

If there is no sound for incoming mail.

E-mail created (~ @ ezweb.ne.jp) trying to re-edit, E-screen and operations such as the destination list is displayed immediately after creation screen, Cc or Bcc address was given, To specifications may vary.

During charging, it may malfunction and the touch.

In addition, the update will change the screen layout of a voice call.

These were taken straight off of the google translation of the link.

The update took about 45 minutes to download and install, taking up a sizable chunk of the battery in the process.

I don't think anything else was really changed, though I haven't tried any rooting methods after the update or anything. Too lazy, busy with work, or playing Oblivion.
[Android Software/Hacking General [Developers Only]] pboos:
did not yet get the update. but my battery died today. so will have to wait. the battery is the worst on this device. or maybe its only me? and sometimes my phone seems to get pretty warm.

meet with two sharp developers who work on the is03 last week and they confirmed that there is a bug in WiFi. WiFi takes a lot of battery and they suggested not to turn on WiFi too often :D. but they didn't want to tell me how to root the device :D. but i was able to hold a is03 with 2.2 on it. seems a little faster. got one of the 2.2 devices at work now, but after playing around with it a little it did not seem that much faster than 2.1. but only played with the launcher. might be a little faster. hopefully the battery will increase. we will see.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Good to hear from you, pboos. The battery for me is also pretty terrible. I was using ADW launder with 4-5 screens full of widgets, making sure that the widgets updated at 4 or 6-hour intervals at best. Even on standby, the battery was running out at about 10% every hour. I've recently slimmed down to 2 screens with widgets that don't update at all, and my battery usage on standby was going down at 10% every 3 hours. Much better. I suppose this is all common sense stuff though with these phones.

That's too bad that they didn't want to divulge any rooting details for the device. If possible, ask them what happened to the recovery or bootloader modes via ADB. They probably won't give you an answer about that too, though.

Can't wait for the 2.2 update, I'm also hoping for a performance increase as well as better power management for the battery. If only there were more developers for the IS03 that could speak English and poke around, I just don't cut it haha. I heard we're supposed to get 2.2 this spring, any word on which month we'll be receiving it? :)
[Android Software/Hacking General [Developers Only]] pboos:
yeah spring is what i heard too. but sadly late spring :(. I thought what I heard was April/May. :(
[Android Software/Hacking General [Developers Only]] In Defiance:
My phone has been stuck on the update screen after rebooting for the past 5 minutes w/o any progress; the circle icon is spinning but it is stuck at 0%. Not good.

Edit: It's moving now; seems super slow for such a insignificant update.
[Android Software/Hacking General [Developers Only]] pboos:
update worked well. even though it took a very long time! 1st the download took forever, than the installation as well. Flashing whole CM7 takes less time on my NexusOne...

I am having strange problems with my device. Battery sometimes drains like crazy! And the device gets pretty warm. But I am not doing anything except trying to charge it over USB here at work. But it is not really charging. Doing a "adb shell top" shows me, that /system/bin/usbmgrd is taking 97% of the cpu! Why that? Anybody experiencing the same problem. Somehow this problem does not always occur here. Mostly here at work. Maybe charging through normal USB connected with a computer is not possible? Or is it because I use Mac OS X here at work?

If anybody is experiencing similar stuff, it would be interesting to hear.
[Android Software/Hacking General [Developers Only]] dccpikoro:
Ahh, nice to find another thread on the IS03. I've been doing my own investigation on rooting this phone over at my site (cannot post link since this is my first post): init.sh <- That is the site. Add a www in front if you like.

I'm receiving the over the air update right now. Sitting at 50% on the install screen. Since I have dd'd mtdblock0 through mdtblock8 off the phone, I'll perform a diff once I pull the updated image.

Computer here at work is pretty under powered so I can't do any debugging here but I've got the whole weekend ahead of me.

Same limitations that you have been reaching so far. Root shell in the local terminal, and ratc, busybox, and su copied into /data/local/tmp and chmodded 777.

I've remounted /system as rw but when I try to copy things over, I am getting out of memory errors, not filesystem errors. I'll update here with the exact prompt when I get the chance.

I'll try the jailbreak again when the phone is finished updating and let you know how it turns out.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Thanks for the post! I found your website this morning and commented. I look forward to anything you can find.

My skills with this kind of thing are severely limited, perhaps you'll have better luck.
[Android Software/Hacking General [Developers Only]] SharpIS03:
open source software from sh developers square

SH Developers Square released some open source software on their website. Not sure where this will take us though.

Take a look.

I wonder if there's anything useful.
[Android Software/Hacking General [Developers Only]] jubinell:
Hi

Have you looked the stuff here?

init.sh/?p=172

I followed the instructions and it looks like everything goes thru smoothly. But how to check if the phone has been successfully rooted?
[Android Software/Hacking General [Developers Only]] SharpIS03:
Hey there! Yes, his procedure is the same one I followed a few weeks ago, as detailed in my post here.

Both of us were able to get root temporarily as indicated by the # symbol in Terminal Emulator; however, there is a memory issue or error that occurs as soon as you try to move files into the /system directory. Only difference between our methods was that he used 777 for chmod and i did 755. Same results.

So we can get temporary root, but we can't keep it permanent.
[Android Software/Hacking General [Developers Only]] SharpIS03:
Interesting problem you have there. Unfortunately I can't provide any insight there.

I experience some warming issues myself, though, but nothing out of the ordinary.