yashsingh1/xdaforums huggingface dataset:
[Gen8 General] marioluigi123:
1). Some to the top forum devs have already done a binary diff on the app and those sorts of checks.

2). That sort of thing is actually pretty rare and since this app was never on the Marketplace, it has the possibility of reaching how many people exactly?

3). Personally, I don't have too much stored info. on my Archos. If it was a phone maybe, but Archos devices are more for entertainment type purposes.

4). Android has sandboxing to some extent for apps (though root may nullify this somewhat).
[Gen8 General] ms07.guf:
HI

you are suggesting to change HOT SPOT ?

WHat is teh reason ? Before update I got root with my home hot spot

Is there a logical reason in this ?

Is some developer resolving ARchangel problem ?

thanks
[Gen8 General] thiazzi:
About the hot spot: Was just letting you know what works for me.
[Gen8 General] ms07.guf:
OK

i will try different hot spot.

thnaks
[Gen8 General] k4ever:
Open Question to the developer

Are you currently working on getting this to work with the latest firmware update? Is this taking long because of a technical issue or are you short on time? I don't mean to sound facetious its just that your application is the only application that works on rooting gen8 tablets without voiding the warranty. I will gladly donate money to your project if it will help to move things along faster.
[Gen8 General] ms07.guf:
I will donate too if Archangel will work with new FW. Thanks
[Gen8 General] Tesla74:
No viruses.. but could it download one?
[Gen8 General] jutley:
Can someone confirm it works on 43 Internet tablet please
[Gen8 General] boywonder_x:
Hi guys, I've just tested this on my archos 101 and it does seem to work. Pretty good timing as I was seriously considering swapping it for the advent vega. I've installed as instructed, installed titanium backup and it seems to be working fine for freezing apps (archos widget etc), though uninstalling some of the crap that comes with it (news and weather, system monitor) works, but after a reboot it's back again - I assume this is due to the read only nature of the android partition (just guessing here!). I'm going to try root explorer shortly and see what effect deleting things has - if it works at all.

There doesn't seem to be any malicious effects so far, although I doubt I'd notice so early on anyway ;)

I've taken a screenshot with my x10 as taking a system screenshot wouldn't really prove anything.

s4.photobucket.com/albums/y103/knightblade_1/?action=view&current=archosroot.jpg
[Gen8 General] Passe28:
works great on my 101!

installed Swaper2 now it's much faster :)
[Gen8 General] boywonder_x:
Tested Root explorer and it works, though after deleting one of the built in apps it just appears back in the system/app directory.
[Gen8 General] jerry101:
Thank you for hard work,we need it so much:D
[Gen8 General] Inciner8Fire:
Screenshots

wdl1908 I've got to have my first post sometime. I know that some screen shots have been posted since by jsperri, but I do not want someone to think I was lying. I have attached a photo of the installed app on my Archos 101 and several screen shots showing the firmware and the Superuser prompt.

I would have posted the screen shots earlier, but I was at work. I had run the root tool on my lunch break.
[Gen8 General] aznmode:
Still a bit weary to try this. This member looks to be new here as well as on Modaco forums.
[Gen8 General] gottahavit:
Not to mention completely dissapeared after posting. It does look promising apparently at least temp root is still possible even if this is carrying an extra package(not saying it is).
[Gen8 General] Reditus2:
just tried it on my archos with standard firmware and I managed to overclock to 1Ghz and changed the LCD density successfully on temporary root. I did try the permanent root but when I reset I lost root :(

EDIT: PERMANENT ROOT AND TEMPORARY ROOT DOES WORK, I messed up, just root the device and then click the permanent root option and just exit the application, when you reboot it should still be rooted :)
[Gen8 General] Inciner8Fire:
I noticed when I checked the Permanent Root it didn't seem to stick until I clicked the "You've got root!" button again.

It does seem to work for me after a reboot.
[Gen8 General] ice0901:
works for me as well
[Gen8 General] Inciner8Fire:
So far I haven't found anything malicious with this. I have run netstat several times and there don't appear to be any weird addresses there. I also didn't see any processes that jump out as being wrong.

Another interesting thing I noticed was that under Network/SMB Archangel was listed.
[Gen8 General] gottahavit:
That's very scary. What do you see if you click on it? I would be a little concerned what they are sending there, or perhaps this is part of the exploit to download something.
[Gen8 General] Inciner8Fire:
When I clicked on it it asked for a username and password, but has since disappeared.

I don't think they are sending anything, but I could be wrong. I did use APK Manager to rip apart and decompile the APK before installing. When I looked through all the resulting .smali files nothing seemed to be obviously malicious. I wonder if they found a bug in the SMB which allows this exploit, it might explain why WiFi needs to be on to gain root.

It sure would be nice if the developer would give us some additional information.
[Gen8 General] jutley:
Anyone tried on archos 43 Internet tablet.
[Gen8 General] cajl:
It is OK on

101

70

and 43 IT

http://www.jbmm.fr/2011/01/26/archos-gen-8-en-mode-root-sans-le-sde/
[Gen8 General] wdl1908:
Sorry I'm a little paranoid to install something that is posted by someone that has no history on the forum.
[Gen8 General] toutiwai:
hi again...

i must say that I have problem with my google account now...

it seems someone conected from elsewhere with my password :(

not sure, but it's strange!
[Gen8 General] ice0901:
How did you discover this?
[Gen8 General] Zobat:
archangel is death?
[Gen8 General] ms07.guf:
sadly YES ............ too long time Archangel developer group is in silence !!

I suppose Archangel is dead :(:(:(
[Gen8 General] remmargorp:
@marioluigi123 - What rexdog1888 mentioned is a very legitimate threat and is common in malicious software, you are correct that there is little exposure, but some exposure is still exposure and that logic is not very secure

After reading through all the pages I decided I would dig a little (especially since I just ordered an Archos 101 IT and was interested)

Below is my first pass at getting some source, I'm sure it's not complete but I didn't have time to validate my results

Package: com.archaism.rt

Code: pastebin.com/BxqzNvsv

Notes: Shows exploit method but not contents of su or ls

Package: com.noshufou.android.su

Code: pastebin.com/aE71NM66

Notes: Contents of su?

I figured I would use a service like pastebin instead of pasting the >5000 lines of code

Update: Confirming what others have posted in this thread, ls is clearly obfuscated, will look at it more later

Obfuscating code (in this application) is typically used to hide malicious activity or to delay the manufacture from patching
[Gen8 General] nimafire:
is it work on 2.4.19 with android 2.2.1: Generation 8 ?
[Gen8 General] Lenn:
No;)

I am the one who chulri redirected your thread to:)

So can we write there?

Greets,

Lenn
[Gen8 General] nimafire:
how are you Lenn

yes can you help me on that topic?
[Gen8 General] rimstar:
archangel

if it helps, as soon as i get my new archos 70 gen8, I'll be happy to try out this. unless off course it may do some permanent damage to my device
[Gen8 General] Draky50110:
No damage, but does NOT work with latest firmwares ;)
[Gen8 General] bobybc:
actually it works after upgrade to recent FWs , 2.4.65 at least

i found that putting Archos connected to PC via USB, or just plugged to the charger, then restart device - it somehow manage to root the device

Currently i cannot show this anymore, because i wiped my device , but i think that it was possible because i have installed Archangel on 2.1.08 and after that i only applied upgrades

I even suspect that Archangel was somehow "guilty" and didn't allow me to upgrade to latest 2.4.80 (it always fail on "checking update file validity" with msg :

Sorry, an unexpected error occured (code 112))
[Gen8 General] DSH:
Does it work on arnova 10 G2?
[Gen8 General] Draky50110:
Long time from working...

No root on Archos / Arnova except with SDE install...
[Gen8 General] Boonjour666:
Archos 70 IT2 sous froyo

Moi j'ai l'archos 70 it2 sous froyo. As tu essayeé avec celle-ci et sinon peut on la rooter d'une autre manière ? J'ai acheter le cable USB host pour 16 euros :( avec une puissance délivrée de 0mA (j'ai vérifié dans sys/bus/USb/devices/...) donc j'aimerais bien changer ça :eek:
[Gen8 General] wdl1908:
When you go to gmail.google.com on the bottom you can see the history of the connections and the IP addresses.
[Gen8 General] toutiwai:
no, i'm wrong, nobody was able to connect to my gmail account, BUT google disabled my account (all google services, not only gmail) because of "suspect activities". Now i received a new password and it's ok.... but didn't tried to root my archos again...

i'll keep you informed

i'm not sure it's linked, but... it's the first time I get a problem with my gmail account in +-5 years... just a few hours after the root :-)
[Gen8 General] wdl1908:
This probably needs more investigation. It could be coincidence but better safe than sorry. toutiwai could you ask google what suspect activities?
[Gen8 General] neoseer77:
Yes, tried it and also in conjuction with set CPU so device runs faster in non demanding task. Works great
[Gen8 General] airv44:
No success for me on a 70 IT I have only the message please wait :(
[Gen8 General] toutiwai:
make sure your wifi is on AND connected
[Gen8 General] airv44:
Thanks for your answer, but yes I'm connected on a guest network (at work) because I can't connect to the hidden network (peap).
[Gen8 General] toutiwai:
does anyone have the same problem with his/her google account?

I uninstalled archangel, and it seems really well uninstalled, i saw nothing "not uninstalled" (sorry for english); and no strange startup proc in memory after reboot
[Gen8 General] ZappBrannigan:
Thank you VERY MUCH! Works great on my Archos 101! Now I finaly was able to update my not working YouTube app! Works very well now!
[Gen8 General] jerry101:
New Firmware 2.1.02 is released. hope someone can test it.
[Gen8 General] toutiwai:
How did you fix Youtube app? I have the same problem...
[Gen8 General] toutiwai:
They made improvements in the wifi "driver" -> they maybe broke archangel hack :confused:
[Gen8 General] hurrpancakes:
I hope this eventually works with 2.1.02. They finally put in wifi n connectivity with the newest firmware, and I would love to have root on that firmware
[Gen8 General] jsperri:
You'll probably be happy to hear that this method still works (well, at least for me) on 2.1.2 ;)

Tested on Archos 70 IT.
[Gen8 General] ZappBrannigan:
@toutiwai

for fixing YouTube I used "Android Terminal Emulator" from the market.

Put in the following commands:

"cd /data/test/froyo/system/app"

"rm YouTube.apk"

after a reboot I was able to install the YouTube app from the market, which workes fine now!
[Gen8 General] jsperri:
This can also be done with ArcTools by point and click in the Remove Apps tab.
[Gen8 General] CarsnGadgets:
thanks for that, thats good to know.
[Gen8 General] wdl1908:
Any side effects like google account being blocked or other nasty stuff happening after the archangel root?
[Gen8 General] Inciner8Fire:
I just checked mine and I recognise all of the IP addresses. I am using a google apps address, not a standard one, althouogh I doubt that makes a difference.
[Gen8 General] hurrpancakes:
Well I've gone ahead and used this root method on 2.1.02, and everything seems to be working fine so far, so major issues that I've seen.
[Gen8 General] toutiwai:
good news if i'm the only one to have had a problem... maybe it's not a trojan :)

other subject: how can i see how much virtual memory (23/64 mo) i have after instal/reset the new firmware?
[Gen8 General] jutley:
why is erveyone on a para that this is a virus it works dont it ?
[Gen8 General] toutiwai:
first viruses in '80 where included in very good free games :-)

it can be a virus AND a working "rooter"
[Gen8 General] CarsnGadgets:
It could be legit, (I hope it is, and its looking promising.)

but at the same time, it could be malicious, and with root priveliges and wifi access it could do pretty much whatever the devs want, grab your google passwords, etc etc.

no harm in being cautious. :D
[Gen8 General] jerry101:
the author has blog.

c-skills blog

c-sk ills.blog spot.co m:D
[Gen8 General] liqn7:
Install terminal emulator and type in "free" and look at the swap file size.
[Gen8 General] carbonize:
It definitely seems fishy to me. This Arhcaism1 has joined several forums and this is the only post they have made on them. I first saw them on MoDaCo but there is no mention of this anywhere on the archosfans forums except the thread I started about it.

Since some have claimed it does give root and if this does turn out to be dodgy and I wonder if someone couldn't separate the wheat from the chaff and give us a good version.
[Gen8 General] toutiwai:
thank you!

but it stills says "32mb" :( it's better than 0, but i wanted 64 :p
[Gen8 General] CarsnGadgets:
it will only be 64 if you did a fresh install after a wipe, if you just upgraded then it will be 32.
[Gen8 General] loginatnine:
Will this give the ability to have custom roms??!?
[Gen8 General] archaism1:
Some people said they were worried about the application being a trojan etc.

We hope you can see that it does exactly what we said it would and is no fake!

Think about it, if we wanted to release something malicious, we would not tell

you that it could get root and would push it out, not to modders, but to general

consumers!

Like so many other people in the community, we develop tools and give them as

gifts to you. We encourage you to support them, we want nothing in return for

our gift.

The longer the mystery of how this works remains, the longer it will continue

to work.

Our next project calls... party hard people!
[Gen8 General] 4qu4rius:
This is the scarriest comment I've ever seen. NOTHING here makes me more confident in you. If you know how to root an Archos, then you know that what you delivered here is very suspicious. You can do pretty much everything here without our knowledge.

"you can see that it does exactly what we said it would and is no fake"

NO, we cannot see what your tool does behind our back. We see it can get us root, that's great, but not what else it does.
[Gen8 General] Inciner8Fire:
Well I have done some more investigating of this. Previously extracted and decompiled the apk using APK Manager and did not see anything obviously wrong with the resulting .smali files

Today I looked a little closer at this. In the res\raw folder of the extracted apk there are three files; ls, su, and superuser. Using some guess work I tried renaming some of these files to tar. As it turns out the su and superuser files are actually tar files. Inside these files are the su binary and superuser.apk respectively. I downloaded the newer superuser app from http://xdaforums.com/showthread.php?t=682828 and did a hex compare from the su binary and superuser.apk. They are identical. So if there is something fishy going on, at least we know it's not those files.

Perhaps someone else can try this as well, just to verify that I didn't miss something with those two files.

I'm going to keep checking though.
[Gen8 General] toutiwai:
i did a full reset, format hard disk to ext3, and reset android...

i'll try again later... :)
[Gen8 General] wdl1908:
I did the same last night and found nothing wrong with su and superuser btw they are gzipped files

$ file su
su: gzip compressed data, was "su", from Unix, last modified: Wed Nov 10 18:05:45 2010
$ file superuser
superuser: gzip compressed data, was "superuser.apk", from Unix, last modified: Wed Nov 10 18:05:56 2010

It's the ls that has me worried.

$ file ls
ls: ELF 32-bit LSB executable, ARM, version 1, statically linked, stripped

Ok they probably need a ELF binary to work the exploit but when looking into the file there is no real visible text. It says in the description that this script "/sdcard/sdcard/extraroot.sh" would be executed at every reboot so you could do some stuff automatically.

The text is not found anywhere in the package or the ls binary. So I suspect the ls binary is somehow compressed or encrypted.

I'v connected my A101 to a non internet connected wifi and installed the package. The root seems to work and the dir /system/bin is copied to /data/rootbin the su is copied there too then that dir is remounted over /system/bin

i'v done a visual compare of the file sizes of the files in /system/bin before and after the remount and that seems to check out.

I'v had a tcpdump running on that router and nothing spectacular jumped out mind you that i'v only seen dns queries come out of the archos nothing else which is normal since there is no way the archos could connect to the internet.

So for the moment still investigating.
[Gen8 General] dancnpete:
I'm going to applaud the effort of archaism1, but dude seriously the community can only benefit from the info on how you accomplished the feet. Sure there aren't enough devices available in the wild to make it that worthwhile for you to gather information, but the entire reason root access isn't available by default is to make sure peoples info is secure. Again we applaud your work, but fill us in, if the exploit is easy to fix in a firmware release, that's okay some people will choose to update some won't some will just go back to using the SDE's. Our options are substantial enough to give many of us pause to implement the total unknown. So for pete's sake enlighten us of grand master.
[Gen8 General] Tesla74:
Sounds to me you just want everyone to use so you can get their passwords. I won't use until it is proven safe.
[Gen8 General] cagra:
Well, Unrevok3d also keep their rooting techniques secret to prevent a fix. They also had a lot of quarrel with people yelling "Opensource!".

They have never shared their method and yet their solution is the default way of gaining Su on a lot of devices.

Of course I can see the problem of a new user appearing here and on modaco, with a magical solution and no explanation. It though sounds like a couple of you skilled guys have ripped it apart without finding any incriminating, so why so skeptical?
[Gen8 General] wdl1908:
I'm going to give up for now. I'v un-installled the package and rebooted the A101 and reconnected to my usual wifi. For the moment everything looks clean.

Root-Check said I had root.

Titanium backup was working but the tar.gz file that was created of a backed-up app was 0 bytes but I suspect that that is related to the busybox that is installed on the archos will test later when I can safely install a good busybox.

Some notes for the dev on this board. the ls binary is probably the exploit to get root. The ELF binary is some sort of selfextracting/decrypting binary because i see clearly 2 ELF identifiers in the file. I'v tried several elf compressors/decompressors without any luck.

Someone needs to run it trough a debugger on an ARM platform to see what it does.

Maybe some of the devs that work on the urkdroid project can look into this.
[Gen8 General] wdl1908:
1. I would not be so sceptical if the message was from a member that was on the board for a little longer than one day with no other post than a post to a russian file share site for a program that everybody knows that is wated on the archos.

2. Then there is the file dates that seems odd.

3. Then there is the ls binary that is encrypted or compressed so not even the strings can be check to see if there is anything suspicious about them.

4. One of the users of the apk reported that his google account was blocked hours after he used the apk. Coincidence? Maybe?

Let me ask you a question did you link a Credit-Card on your google account?
[Gen8 General] cajl:
no problem

on all Archos Gen 8 - I have these 5 Archos gen 8

if you have more projects for Archos, send me a MP
[Gen8 General] Tesla74:
This sounds safer to me:

http://xdaforums.com/showthread.php?t=930197

What do you all think?
[Gen8 General] sweetypie:
Yep, me too.

Inexplicably for me I just installed it and it worked ok on my A101. When I then clicked on the Market I got a Force Close. I just couldn't open the Market without it Force Closing on me.

So I found an Archosfans thread which pointed me here, where I read your post, and your Google password problem.

So I immediately logged into my Google account on my PC, and reset my password.

I've had to setup my Google account sign in details all over again on all my Archos devices (4), but I'm not taking any chances.

I never did like the Wifi thing, but familiarity breeds contempt and I've become lax recently.

At least now I have a strong Google password.

Thanks for posting about your Google problem, just in time.
[Gen8 General] wdl1908:
If you want to void your warranty yes.

Installing SDE voids your warranty.
[Gen8 General] Tesla74:
@sweetiepie

Thanks for confirming that this does steal your Google password.
[Gen8 General] sweetypie:
No No, I can't state that. But it's a co-incidence that we both had exactly the same problem.

For me it's just not worth the risk. Far too fishy - I can't believe I was so stupid - I ignored all my instincts.
[Gen8 General] wdl1908:
Sorry to hear that.

It was

This was something different than market FC'ing.

My archos is working perfectly after the uninstall and no account problems either BUT I was never connected to the internet when I did my tests. So it is still not clear what is happening. I read on some french forum that some people have problems getting root so it could be that it only works in certain conditions.
[Gen8 General] hurrpancakes:
I don't know about you guys, but in the past 18 hours, my IP is the only one that is accessing my email. I've had no issues with my Google account whatsoever.
[Gen8 General] ben.daccache:
I've just installed it on my archos 101 with new firmware. It took 20 second to Root.

Now i have root. I'm continually checking on my gmail account for unknown IP's. there's nothing for the moment... Still checking..
[Gen8 General] sweetypie:
Yes, that was something different to Market FC'ing. Sorry, I should have given the full story. I said I changed my password by going to my Google account on my PC. When I did that it wouldn't let me log in.

It asked me "Can't log in?". Then it took me to a dialogue where I HAD TO reset my password. Google forced me to do it. So, just like toutiwai really.
[Gen8 General] ske714:
I'm going to block my ip address with a firewall rule, and log any hits on the rule to my syslog. If anything tries to get out after I get root, I will know. I'll report back later.
[Gen8 General] jsperri:
Seeing is Believing ;)

There's a video here showing the rooting procedure using Archangel.
[Gen8 General] bufflehead:
I have not tried this yet, not sure if I will, but I have a question that really bothers me.

Could this root exploit be buried inside another app?

If it really is one-click, no adb or anything else, then what is to prevent this exploit being used silently inside an otherwise innocent looking ordinary app?

If this is the case then I want this loophole closed asap!

If I am feeling really cynical then maybe this thread is all about a test run of an exploit that will show up later inside an ordinary app.

Please tell me I am wrong about this.
[Gen8 General] CarsnGadgets:
The root exploit to gain root, is obviously using the wifi as part of the process.

It may not be malicious in any way, but it may appear 'suspicious' to the automated Google security checks even if it's inocent, perhaps that is resulting in the account locks that are being described?

Just a guess...