yashsingh1/xdaforums huggingface dataset:
[Gen8 General] ShadowZephyr:
I just tested it on my Archos 70 on 2.1.0.4 and it's working. I'm currently messing around with LCD Density, which is working and requires root access :D
[Gen8 General] jakkrith:
This app made me very happy with root access. Just install and run. I have test on my Archos 101 FW 2.1.04 all app that request root work fine.

MarketAccess, TitaniumBackup, RootExplorer, CacheMate, Screen Shot It

No need to install SDE or any extra method. At this time I can power off my device and when power on root access still work fine. (with Permanent Root option)

Thank you very much.
[Gen8 General] wdl1908:
Very good analysis and thank you for the confirmation.
[Gen8 General] wdl1908:
Would you like to share your root scripts?

http://xdaforums.com/showthread.php?t=932854
[Gen8 General] Bhaal42:
I was talking of the ones I found on your topic

So sorry no more scripts yet!
[Gen8 General] jakkrith:
Problem report: I have found some problem with this app. It could not replace system file.

I have use Root Exproler to replace file /system/lib/libwebcore.so but after reboot it still the old file.

With SDE/Temp Root I can replace this file and reboot with "Hot Reboot" widget.

I've understand that Archangel design for fw 2.0.71 only but I hope you will release new version of Archangel that support fw 2.1.04 soon.

Thank you in advance. :D
[Gen8 General] gbohm:
it is because of the ro filesystem nothing you can do about that on a non custom rom
[Gen8 General] Tesla74:
Was this Google Market problem with version 1 or 2? Maybe version 2 fixed this?
[Gen8 General] Draky50110:
Don't have any problem with Market and root/archangelv2 + 2.1.04
[Gen8 General] mscroggi:
+1

I have had no difficulties at all...
[Gen8 General] fuzzer:
Works - minor problem

Archos 70

Firmware 2.1.3 (checked for update before root...none available)

Market problems at first, nothing would install... The download starts and after about 1 - 1.5 seconds the download icon disappears from upper bar. Tried rebooting the 70. No luck...I reinstalled the market and did the "market fix" a couple time, and most apps are visible, but not everything that was before...
[Gen8 General] Snyperx:
So is Archangel confirmed to work and be legit or is the jury still out on this? I would really like to run Ti Backup if I can.
[Gen8 General] loginatnine:
http://www.engadget.com/2011/02/01/android-market-acting-weird-is-it-a-precursor-to-tomorrows-e/
[Gen8 General] wdl1908:
I'm running the v1 did a few firmware upgrades and one downgrade no problems so far.
[Gen8 General] blazingwolf:
Works great on my 101 running 2.1.4. Also, this uses the WiFi exploit which is why it requires WiFi. Kind of makes sense don't you think? ;)
[Gen8 General] nam265:
link to v2?

Hi can someone send me the link to v2?

I dont know which post it's located...

and can someone update the first page???

Thanks
[Gen8 General] Draky50110:
The 1st page download is v2.
[Gen8 General] nam265:
I tried the first page and the file was "archaism-archangel-1.rar"

so i thought it was version 1...

I went to arctablet.com/assets/root for v2 instead.. is this one correct?
[Gen8 General] Tesla74:
Here is version 2 attached.. no password required.
[Gen8 General] glowco:
Can you explain what WiFi exploit this uses?

Thanks
[Gen8 General] Draky50110:
A lot of people would like to know the exact exploit LOL but nobody knows...
[Gen8 General] glowco:
Maybe blazingwolf knows?? He sounded kind of confident.

:)
[Gen8 General] ExploreMN:
Ah well...I use my Archos for business and I can't risk running a root app from an unknown who shows up on every forum one day and vanishes the next leaving a post of "trust me" as my only verification its not malicious or contains a hidden bomb.

Last time someone said "trust me" I woke up handcuffed to the bed with a sore butt and a missing wallet...
[Gen8 General] Draky50110:
Hope you d'ont use Market from g5-apps stable because this version is from someone coming, posting, vanishing ;)
[Gen8 General] liqn7:
So are the problems with downloading from the market universal or just an isolated problem with Archangel?
[Gen8 General] ExploreMN:
Using Arctools in the Appslib market under the assumption there needed to be a few checks and balances in place to get it published there...probably not the best protection in the world...but much better than "trust me" LOL
[Gen8 General] wdl1908:
I have not seen any problems with the market in relation to the Archangel root.
[Gen8 General] Marco.Montana:
Thank YOU A Million.... Definitely a decent sized donation coming from me!!!!!

Ok, downloaded and installed archangel ran app. Checked the box permanent root....

Waited a minute or 2, BAM rooted....

Worked like frosting a cake, I'm super pleased and happier than happy!

Archos 70 froyo 2.071 now rooted!

=========================================

Side note of even more awesomeness!!!!!!!!!!! My Archos would not connect to my Droid Incredibles Wifi hot spot. I got apps like WiFinder that would see my Droids Wifi but it wouldn't connect .

Just for giggle I went to costco to buy some crapola.... Started Droid tether found network using WiFinder as before.... BAM connected to my Droid!

I was like noway let me try again so I rebooted both devices, started Wifi hotspot on my Droid thats also rooted using Wifi Tether, found network using WiFinder.... BAM Connected again!

All i can say is whatever your exploit was it worked on BOTH my problems, I'm wicked happy !

Thank You!!!!!!
[Gen8 General] rokkywoof:
Kinda sounds like Archangel altered wifi-supplicant settings to connect to ad-hoc network?? Another aspect of "known wifi exploit", Blazingwolf?

That would be cool ...
[Gen8 General] tric3ur:
one quick question. Does anybody know the potetial dangers of using this on my archos 70 IT (the 8gb one) running archos firmwar 2.1.4?
[Gen8 General] Draky50110:
No danger exepected !
[Gen8 General] aengelpxl:
Been trying this a couple fo times on my 101 at 2.1.4 but nothing happens. It just sits there, telling me to wait. The device doesn't lock up, but it does nothing, even for 15-20 minutes. What gives?
[Gen8 General] Draky50110:
Had same problem.

Just force close and re-launch it.

Then reboot and then was root (used with titanium backu free version to test and root check also in the market.

No problem now.
[Gen8 General] aengelpxl:
I've rebooted several times, even done an android reset once, but to no avail. It feels as if I'm doing something horribly wrong. Somehow.
[Gen8 General] liutszho:
Weird,

I went to Files -> Networks -> SMB and I see Archangel as one of the SMB networks, clicked that, and I see a folder called "T". Tried clicking that and it asks for username and password. Can't get in.

Waah?!
[Gen8 General] ske714:
I had the same problem when I tried V2 on my 70it. I went back to the version in the first post and it works fine.
[Gen8 General] rokkywoof:
Overall, This Shows Android Security's Weakness

and the weakest part is human. Many of us have this tendency to tap through that screen with the required permissions without really understanding the implications, or thinking them through if we do understand, and just get that cool app installed.

Then the keys to our Google kingdom are up for grabs if the "app" is not quite what it seems.

I am coming to believe that Google is just as guilty as Microsoft (historically - they do seem to trying to pay it more attention now, but an uphill battle for them) in not putting enough emphasis on securing Android in favor of maximizing their ad revenue priorities.

I think I will be just using a "dummy" gmail account on any Android device I set up, and backtrack to applying that to my current ones, an A70 and A5IT. I do not need to access my "real" Google account through them, when my PC's (mostly Linux) provide a richer interface with more control and options anyway.

I only got interested in Android for many of the cool entertainment, utility and info apps that do not seem to be so readily available or as nimble on x86 Linux (not interested in depending on Windoze except for my job-related PC, and that is mostly my employer's responsibility for maintaining security as long as I execute my due diligence in following their security requirements). I consider my Android devices to be more suitable for these non-PIM functions, and not for the PIM type functions they do not secure very well at all. Actually, I am thinking a cheap color ereader like the Ematic (WalMart, $79) will take care of one main function I want to use Android for - just loving those cabbages to make some "special" ebooks readable ;)

I found after 2 Android phones, which I returned, that it is not the phone platform for me - sticking with WinMob 6.x for more maturity, and less cloud dependency/exposure. And no, I am not letting my employer take it over for Exchange access. I will manually put in the few calendar entries I need to keep "organized", and avoid the internal email "spam" that is broadcast inside our organization way too much. Also, I find I prefer the resistive screens more - the twitchiness of capacitive drives me crazy - must be my Palm background ;)

My thanks to the (contributing) participants on this thread for the "object lesson".
[Gen8 General] ExploreMN:
Come again? You do realize that "rooting" a phone is the same as "jailbreaking" a phone and that iPhone's iOS and Windows phones (from WP7 back to WinMo-all versions) can have similar things done, right?

While I do agree that the weakest part of security on any device is the human behind the device, that doesn't mean the device itself isn't secure. Even the most secure OS on the planet can get a virus if the end-user says "doh, go ahead and do what you want to do."

So really you are talking about two different things as if they are the same...which they are not.
[Gen8 General] Draky50110:
Troll spotted :)
[Gen8 General] rokkywoof:
Why then all the concern expressed in this thread about the mysterious ls executable, and efforts to find out what it was doing? The extended discussion about the equally mysterious Archaist highlighted red flags that occurred to me when I read both of his/their (that "we" bit is also unsettling) posts.

Does this sound familiar?

Your attitude is exactly what I am trying to express in my own way. I've done plenty of Android rooting and WinMo ROM replacement (no exposure to iOS, nor interested), but this episode made me think about the particular Google exposure/connection more, and I don't like where it leads.

Google itself holds too much of my info in their gCloud, and now I see that Android can be a gateway to it. My WinMo phone (I am no WinMo fanboy - it just seems the least worst smartphone option at the moment, and 6.x, not 7) is not depending on storing anything it retains anywhere else unless I deliberately copy it there, and it is not much of an explicit gateway to anything in particular. Most software I have added to it has been around quite a while now, and is pretty well vetted by a large community.

The security concerns being expressed about Android are not something to ignore. See this article about how

apps can load themselves

from the new Android Market web store:

(insert the http header - I am not allowed yet to include URL's in my posts) nakedsecurity.sophos.com/2011/02/04/android-market-web-store-backdoor-phone-hackers/

Do you see why this whole Android app mechanism and its security tie-in might make me leery now?

I just returned my A70 today, but I intend to keep enjoying fun stuff on the A5IT, although I intend to make it less of an exposure of my gCloud stuff (changed my primary Google account password today, and will re-init my Google access from the A5IT to a secondary "throwaway sandbox" account).

Pax
[Gen8 General] ExploreMN:
Sorry Troll, I'm not biting the bait. If you don't know the difference between operating system security and purposely running code that bypasses that security, perhaps your comment above is for the best.
[Gen8 General] rokkywoof:
Troll, eh? At least I am not starting an Android-haters blog ala the linuxhaters.blogspot.com. That is someone who knows Linux all too well, and truly seems to hate it with a foul-mouthed passion - dunno why he keeps immersing himself in it. Google's own search results could give me a lot of grist for that kind of troll-mill, but I'm not interested in that sort of crusade.

I like Android, but I want to keep it under control when I use it, and not keep wondering what is slipping in/out from every contact with the Internet due to the way it is structured, not just from a lack of due diligence about installing a random app or 3. We should all be working together to improve that situation, but that requires acknowledging its existence in the first place.
[Gen8 General] aengelpxl:
So, you're saying v1 works fine for 2.1.4?
[Gen8 General] bthoven:
I second that.
[Gen8 General] laurent2o1o:
Annotated logcat (originally posted by Inciner8Fire)

Hello,

back to the original concern of this thread (is this application dangerous or not).

logcat analysis

I analyzed and annotated the logcat posted by Inciner8Fire here. The pdf enclosed below highlights the visible steps of the 'rootification' process along with annotations of what I understood of the system events and user actions.

Just a few strange things :

- A french message 'Je suis dans le service' (I am in the service) issued by appslib just after the WiFi connection was established

- Some messages from Tethering daemon (might be legit even though Tethering is disabled on this tablet)

- Some uncomfortable messages issued by Daos (Archos updater daemon) that downloads an html page and warns that signature verification is disabled (potentially dangerous ?)

Please someone, take the time to double check my observation.

Although Inciner8Fire, could you confirm that your WiFi accesspoint really is AP-SSID and that it was connected to internet during your rootification ?

package analysis

I unziped archangel v1 apk and disassembled it.

The 'rootification' process takes place in rootification.ddx class. It seems that after necessary file preparation (gunzip of su, installation, ...) the final step is to prepare the string "/tmp/ls 0x62c7a315 0x260de680" and launch it...

(see lines 351-352 of "rootification.ddx" in the archive below).

Then, the app seems to just 'wait for root'.

As mentionned by others, the ls binary seems to be contain the exploit.

The ls binary

One odd thing about this binary is that it has two entry points

arm-linux-androideabi-readelf -l ls

Elf file type is EXEC (Executable file)

Entry point 0x11314

There are 2 program headers, starting at offset 52

Program Headers:

Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align

LOAD 0x000000 0x00008000 0x00008000 0x09ad4 0x09ad4 R E 0x1000

LOAD 0x000230 0x0005d230 0x0005d230 0x00000 0x00000 RW 0x1000

I couldn't disassemble the ls binary. Neither with objdump, nor gdb disassemble... Maybe because of this odd conformation.

As an illustration, the entry point 0x11314 determined above is beyond the end of file...

After some digging, I think that the binary has been obfuscated in order to prevent its reverse engineering (the string command and hexeditor inspection reveals odd string constructions, for example a '/system/bin' path appears as '/system/ûbin', many other strings are almost recognizable but are mixed with binary chars... )

maybe the strange "0x62c7a315 0x260de680" argument of ls is the key to decrypt the obfuscated binary ?

I'll keep on analyzing...
[Gen8 General] loginatnine:
Got the same problem as you... Where can I d/l the v1?
[Gen8 General] ske714:
Right here...

edit:Oh yeah, I'm not responsible and all that blah blah blah
[Gen8 General] loginatnine:
I can't seem to get it to work... I've tried archangel-1 and archangel-2 apk and it always freezes at "Please Wait" after I push the obtain root button... Any clues?

edit : I have a connected wifi connection of course.
[Gen8 General] wdl1908:
Do you have a wifi connection that is active?
[Gen8 General] ske714:
Try uninstalling both the archangel app and the superuser app and let them both reinstall from v1.
[Gen8 General] loginatnine:
I've rebooted a couple of times (it even gave me an "error" under wifi in the settings once) but I've managed to get it working now. Thanks for your help ske714 and wdl1908!
[Gen8 General] ExploreMN:
Nice work Lauren. Seems this little hack does a lot of things behind the scenes.

I guess I will officially place this in the "too risky to use" category. I don't need root bad enough to look past these and other questionable things (creating an SMB share...how is that not a screaming obvious?)
[Gen8 General] wdl1908:
I can confirm this is probably a debug message in appslib.

I downloaded a fresh copy of appslib and the text is there in the dex file. So this is harmless.
[Gen8 General] laurent2o1o:
Thanks for your confirmation :)

I'm not a binary object wizard, but I don't have a good feeling about the 'ls' binary. As I mentionned, I think it's somewhat obfuscated. It should definitely have more hardcoded strings (the Archangel share name that appears sometimes is an example) but a careful inspection reveals only junk strings...

What is it trying to hide ?
[Gen8 General] wdl1908:
IAI7 - Nomral debug message in appslib the text is found in the dex file of appslib.

IAI10 - see http://en.androidwiki.com/wiki/Using_the_Android_SDK_tools#Problems

+ Woops I thought the Access Point was not connected to internet : shouldn’t return HTTP_OK. Strange.

I'v seen a google page appear even when there was no wifi connection. It seems the http stack does a lot of caching. So if DaosCheckUpdate uses the same http stack as the browser it coudl be that the request is returned from cache.

The " - DAOS signature verification disabled (DAOS_SKIP_SIGN)" could be a problem except that just before the aos file is used in the recovery process it is checked again. That may explain why some people having problems upgrading via OTA The file seems to download ok but then when the flash process starts in when the recovery is booted it fails to validate the aos file.

Very good analysis but I don't see anything that can not be explained.
[Gen8 General] wdl1908:
I also wondered about that and the binary is probably Encrypted/Compressed and uncompressed when it's executed.

The reason for this is probably to make it harder to identify the exploit that is used to get root so it does not get patched. I suspect with the next firmware update from archos the hole will be patched and we'll be without a simple root solution. And they will make sure you can't install a previous firmware to get around it.
[Gen8 General] laurent2o1o:
Thanks for your insight on those.

On that one, I just fear that daos_daemon has some sort of administrative privilege over our tablets (i.e. it's not just checking for updates but has the ability to adapt its behaviour based on what it downloads from archos there).

This could open some kind of backdoor if an app gets the ability to spoof archos server address (I thought maybe archangel did monitor this behaviour using sniffer during his last update) hence the risk to process some unsigned data.

Okay this is Sci-Fi :D
[Gen8 General] wdl1908:
Yep that is Sci-Fi and very good thriller kind of Sci-Fi but it fizzles in the end. (Just kidding)

I've analyzed the binaries on the stock firmware and the stock boot loader and they lack the ability to flash new or updated kernels. It's all in the recovery and before that boots it's signature is verified so even tampering with the recovery is a big no no as it would take away the ability to flash new version.

Archos did a very good job in protecting the system against such events well they did a too good of a job that we need soft like Archangel to get around it.

I've seen phones that get rooted by a sneeze. or where there is no protection to even overwrite the bootloader but the archos.......it's very difficult without the SDE.
[Gen8 General] chrulri:
Thus we got the SDE ;)

Don't worry, you will lose warranty by rooting on purpose anyway, SDE or Archangel, doesn't matter. There's no difference to jailbreaking on iOS.

But of course you can lie to Archos when they ask if you had used Archangel ;)
[Gen8 General] ske714:
Assuming you're able to uninstall it from your broken tablet before you send it back :)
[Gen8 General] franketto10:
Is it possible to use the wifi ad-hoc with this Archangel root?
[Gen8 General] louis chan:
Yes. That's what I am doing. And I use this to access 3G network via another 2.1 android phone with tethering thru ad-hoc wifi.

1. refer to http://xdaforums.com/showthread.php?t=904291

2. here is what the change in “wpa_supplicant.conf” with basic wep encryption

ctrl_interface=tiwlan0

update_config=0

ap_scan=2

network={

ssid="yr_ssid"

key_mgmt=NONE

wep_key0="wepkey_ifany"

priority=1

mode=1

}

3. remember to backup files like wpa_supplicant.conf and tiwlan.ini

4. use of gscript to switch configs.
[Gen8 General] blazingwolf:
Sorry to those that asked if I knew what exploit was used. I'm not sure and have not really looked in to it.

I do know that I have been using it on my 101 with no issues what so ever. No unknown charges or funky emails or anything of the like. So, I'm not worried about this app.

So far, there has been no concrete facts shown to think anything ill of this root program.
[Gen8 General] ske714:
I switch back and forth between 3 wifi configurations-home, work, and tethered to my cell phone. At first, it worked without a hitch. 2.1.3, 2.1.4 and Archangel all came within a short period of time, after which my wifi didn't work so good. I would have to turn it off and on, and sometimes reboot to switch from one to the other. Sometimes it wouldn't connect at all, or just drop and not come back. I would have to forget and re-add a connection. Also, about the same time my battery consumption while on wifi went through the roof. I got the battery working better by wiping and reloading 2.1.3, but the wifi still gave me fits. I switched to the other root method and uninstalled Archangel, but flashed everything without wiping. Still the wifi troubles. This morning I did a hard wipe and reloaded everything, being careful not to restore wifi access points with TB, and everything is ticking like clockwork. I've been switching back and forth just to admire how fast it switches networks. Now, I'm not saying my troubles had anything to do with the archangel WIFI EXPLOIT root method, but I'm glad to have had another option.
[Gen8 General] agp64:
When I tried to root with Archangel it screwed my wifi connection. I had to Fully reinitialize my 70 to get it working again.

Then I tried to re root several times using Archangel but have had no luck. I tried version one and two on 2.1.4 and it still dose not work, So I think I will go down the SDE path and not worry about the warranty.
[Gen8 General] kamilzierke:
Ok. I've just rooted my 70 IT 8GB with newest firmware 2.1.4 (Android 2.2.1) using Archangel. Everything seems to be working perfectly, no unusual behavior.

The thing is - I don't know what are you people scare of? When installing this app it was asking only for this permissions:

Memory

-modyfing/deleting content on SD card

System tools

-changing Wi-Fi state

-automaticly running up at device booting

Net connections

-displaying(showing) Wi-Fi state

(I'm using other language than english, so translation may be inacurate.) I mean - what harm can be done with displaying or changing state of wi-fi? And other permissions are resonable (I guess)? It's not sending/geting feedback from internet, just changing state of signal transmiter.

Or I'm missing something?
[Gen8 General] fatboypup:
Will this let me flash a kernel or do I have to do sde?
[Gen8 General] macemoneta:
Yes; once root access is obtained, the software can do anything. It no longer needs authorization from you. You can run it for months with no harmful effect. Then one day it decides to download a file from a remote site and execute it. As simple as that, you've given complete unlimited access to any information on your device to a third party. It can infect you with a virus that waits until you are on a corporate LAN, and jumps. Anything, really.