yashsingh1/xdaforums huggingface dataset:
[Gen8 General] Inciner8Fire:
I used APK Manager to modify the apk a bit. I enabled debugging in the manifest and replaced the ls, su, and superuser file. This did not work.

I then put back the original ls file and installed it, this time it worked. So it would seem the exploit does need the custom ls. I noticed after the install this binary is placed in /data/rootbin and /system/bin

I did have adb connected and was running logcat while this was installed. Once I have a chance to verify that there isn't any network information in it I will upload the log.

When I installed wifi was connected, but not authenticated to a captive portal.

So I think we know that the exploit has something to do with WiFi and the ls binary.
[Gen8 General] Cthugha:
Well, it does say "Archos 101 - wlan local exploit - by Archaism .RU" in the app...

I'm still holding off installing this but unless someone find something incriminating I'll install it tomorrow.
[Gen8 General] jutley:
I love the way people are on a para trip about this exploit first people asking for a easy root now we have it we all go on a para trip I love it.We don't really have any other easy root method apart from sde so I say stop gettin para and enjoy it.
[Gen8 General] gottahavit:
That's because it was dropped here with very little info and the originator has since dissapeared.

Besides we all want to know HOW it was done! ;-)
[Gen8 General] daquad:
I have installed the root but the system is not writable !

Root explorer display rw but is not real ...

For me this application is useless.
[Gen8 General] gottahavit:
This is NOT a permanent root. it does not allow to alter the system partition. It does allow you to get su access to do things you could not do otherwise like update the data partition for adhoc, setting up wifi tether .... etc....
[Gen8 General] ExploreMN:
I think what is making people paranoid is a combination of things.

1. The "author" is an unknown in the community who basically vanished after posting it.

2. It requires access to WiFi which it shouldn't need. If there is a reason it needs WiFi, the author really needs to explain WHY it needs it. From what I understand, this is the only root exploit that needs Wifi access. Doesn't that make the hairs on the back of your neck stand up? Even a little?

I guess what I don't get is why after 10 pages of posts, no one thought to create a temp Google account, factory reset their Archos and tie it to that account, set up a packet sniffer and run the exploit and post the packet log here in the forums for people to check out.

As for me...I'm not running it. My Archos has all my crapola on it and I don't feel like doing my above plan because I don't want to back up all my data, reload all my apps, etc...
[Gen8 General] z06mike:
I just downloaded and installed this on the new firmware. It worked! As far as if it is fishy or not is yet to be determined. I download AVG for Android and used it to scan. It does say suspicious item was found, but does not specify what it is. FWIW, I also put this on my phone just to see and it also said the same.
[Gen8 General] z06mike:
When jailbreaking iPhones, some of the exploits require you to toggle Wifi on/off. For what purpose? I have no friggin idea!!, but this could be the same type of deal.
[Gen8 General] ExploreMN:
Dude... be careful when you say the "iWord" - it may get you a blanket party.

At any rate, I need to know what its doing with the WiFi...completely and totally. So I revert back to my previous post...someone inclined to test this really needs to set up a packet sniffer and capture everything this transmits using a dummy Gmail account that, if compromised, won't hurt them in any way.
[Gen8 General] z06mike:
LOL :D

I downloaded and installed a little while ago and have not seen anything suspicious on my Gmail account.
[Gen8 General] madsquabbles:
so you'd rather jump in blindly instead of finding out what and why??

sheesh some people are too trusting... btw my next response is going to need your credit card number. you don't really need to know why:rolleyes:
[Gen8 General] Inciner8Fire:
I attached the output of logcat from when I installed and ran this tool. Perhaps this will help someone figure out what this is doing.

I rebooted and ran the root tool again and I noticed that when it was running the ls command it ran as

/tmp/ls 0x62c7a315 0x260de680

I think I've researched this as much as I can and haven't found anything wrong. I didn't notice any unusual connections to my gmail since I originally installed this yesterday, but I changed my pass just in case.
[Gen8 General] toutiwai:
no!

i never link my credit card to nothing :D
[Gen8 General] Tesla74:
Did you run Market? It seems to be the trigger.. problem with Google password after running Market.
[Gen8 General] AllenPapapetrou:
Swap Size

This is incorrect according the the Firmware Change Log for 2.1.02:

And the Archos User Manual (for A70) section 5.12:

Allen
[Gen8 General] toutiwai:
i think it's a good guess :)
[Gen8 General] Bhaal42:
It worked perfectly, no sign of trouble on my Google account.

But since we still got no RW /system, I can't use adFree ou Root Explorer, so it's still a bit useless ...

Root will be usefull when we'll be able to make change to the system partition.

I've juste change my memory management with Autokiller, and hope the settings will stay!
[Gen8 General] ncuxxx:
Confirm. Newest FW got root :-)

Its not steel my passwords :-)
[Gen8 General] KOCTA:
Hacking a Nook Reader uses similar method -- there is something in Android that starts when WiFi goes off and it could be hacked. I don't know details but you can find it at nookdevs. I changed my Nook firmware this way pretty easy. No, I'm not a hacker, I just followed the instruction ;)
[Gen8 General] kalevs:
i can confirm also that it runs on new firmware - and i don't have any complications with my gmail account.
[Gen8 General] Inciner8Fire:
When I set this up before the firmware update I had the market v4 already installed and had no problems with my account. After updating firmware, but before running the exploit I changed my gmail pass to be on the safe side. I then ran the exploit, got root, then setup market v5 and signed in.

I have not had any password problems, and I recognise all the IPs connecting to my gmail.
[Gen8 General] ncuxxx:
On new FW 2.1.2 i have lost root :-(

SU not installed. I dont know how SU uninstalled.

It writes that SU not found
[Gen8 General] Inciner8Fire:
After getting root in Archangel did you click "Permanent Root" then re-click the "You have root" button.

I had to do this for it to persist after rebooting.

The su not found is probably just because you don't have root, if you don't have root access it can't be used.
[Gen8 General] ncuxxx:
I do it...

later i`ll try to repeat (there is no wi-fi ap around me :).
[Gen8 General] dfauvarq:
I confirm, in the java code, the "only" thing done apart from the GUI is a copy of its own ls and su on /tmp and then run /tmp/ls 0x62c7a315 0x260de680

Everything is in this "ls" program

As far as I can see there is nothing tricky in the java code itself.
[Gen8 General] 4qu4rius:
How can we confirm if it's harmless or not ?
[Gen8 General] toutiwai:
decompile / dissasemble / decrypt the "ls" ;)
[Gen8 General] bobsie41:
Sorry if i have missed something or i am being a noob but

Where is the download link??

:confused:
[Gen8 General] 4qu4rius:
It seems reading the first post of the topic is pretty often a good idea to know what the topic is about.
[Gen8 General] ske714:
In helpful terms, the links are in the first post. You have to add the http:// in front of what's there. The original poster, being a new guy, was unable to post a complete hyperlink due to forum restrictions.
[Gen8 General] bobsie41:
Thanks for YOUR help!
[Gen8 General] 4qu4rius:
I beg your forgiveness if my help seemed a little sarcastic. It wasn't intended to be.
[Gen8 General] ncuxxx:
Question for developers of explot.

I run exploit, get root. Set permanent root. Reboot...

if after reboot i will not have wifi connection - su command will not be found.

if i will hava wifi connection - su will exist, becouse after each reboot it must hack android again-and-again :-)
[Gen8 General] Inciner8Fire:
I decided to take this one step further. I connected to a WiFi Access Point. I installed the superuser app from XDA. I then copied the ls tool from the Archangel apk to the sdcard. I then connected to it via adb. From there I moved ls to /tmp and ran /tmp/ls 0x62c7a315 0x260de680

This got me root, although it is gone after reboot.
[Gen8 General] dfauvarq:
I tried to "strace" it to get the system call. I did it from an android emulator not the real archos.

It actually only worked once, so I can tell that it calls

sh -c "iwconfig 2>/dev/null tiwlan0 mod...

unfortunately I don't have the end of the string and when I tried again I always got an incorrect trap error from strace and no trace. I couldn't go any further.

Maybe one thing to try is move ls to /tmp/myls and see if you got root with that renamed binary.

If you don't get the root I guess the trick is that this /tmp/ls triggers a execution of /tmp/ls by another program that has root privileges (or /tmp/su as both files are put on /tmp)

The other thing I could see in the emulator if I run the ls with no arguments by hand:

pidof: not found

cp: not found

cp: not found

Unable to chmod /data/rootbin/su: No such file or directory

Bad mode

Bad mode

cp/pidof don't exist in the default emulator.

So far I've seen no evidence that it is trying to do something bad to the machine but as the code is well hidden you never know.
[Gen8 General] wdl1908:
Yep I tried that too.

It seems when you check the permanent root checkbox in the app it will start at boot and execute the exploit giving you root again. I can confirm that the script /sdcard/sdcard/extraroot.sh is executed with root permission after the exploit has done it's job.

For the moment i use it to turn off the swap in the new firmware

swapoff /dev/block/mmcblk0p3

I'v ran the exploit several times now even on a live wifi and i'm not seeing any google account problems.

I think the fun can begin now. What can we put in the /sdcard/sdcard/extraroot.sh
[Gen8 General] archaism1:
dump.ru/file/5041494

or

depositfiles.com/files/247x6gbwp

rar password: b223844a132

sha1sum of apk: 6a6cb89aa093a1d4671f5142fe156bcfc6535db4

Achaism Team bring you a quick update of Archangel, we added some extra info

about working devices and firmwares which have been reported.

We also added some more options for the extraroot feature (see readme.txt)

for advanced users.

This version has a few tweaks which may make it take a bit longer but should

make it a little more reliable.

It also patches the vulnerability which it exploits and seals the system after.
[Gen8 General] wdl1908:
What I found is that the /system/bin is copied to /data/rootbin and then the su is copied to /data/rootbin

so the two cp commands are the copy instruction to accomplish that.

the chmod /data/rootbin/su is for setting the SUID bits on the su binary.

the question is what is the "Bad mode" about.
[Gen8 General] wdl1908:
Thanks archaism1,

I hope you will become a regular member of the XDA Archos community and bring us more goodies.

The plot thickens.......
[Gen8 General] aznmode:
stay tuned...As The World Turns
[Gen8 General] Tesla74:
So are we sure this is safe now?
[Gen8 General] CarsnGadgets:
no,

and now there is a new version out, so we begin again...lol,

I really hope this is just a great rooting tool (and personally I think it probably is innocent.), and thank the OP for his work.

but, I still wont be trying it for a few days to see what other users discover. :D
[Gen8 General] dfauvarq:
Is this vulnerability patch temporary sealed until reboot or permanent ?

In other words if you seal the system and you don't want to have permanent root option would you be able to root the device again using your method ?
[Gen8 General] CarsnGadgets:
i would imagine that it only lasts until reboot, the same as the root does, and is reapplied at reboot if you have permanent root selected.

but I am probably wrong...lol ;)
[Gen8 General] ExploreMN:
So no one here has the ability to set up a packet sniffer on their network and see what this is really trying to send and to where? I mean you don't even have to destroy your PC to do it...there are plenty of bootable linux ISOs out there...

Ugh...my tablet has every app and piece of data I need on it right now...but it seems more and more like I'm going to have to be the one to truly look into what this rooting app actually does. *sigh*
[Gen8 General] wdl1908:
I suspect you are right because if they are able to close the exploit permanently it would not be possible to reacquire root after that.
[Gen8 General] wdl1908:
I would if i could but I don't have the infrastructure to setup something like that. My wifi router is directly connected to the internet so the packets would not show up on my network anyway.
[Gen8 General] archaism1:
There is not much time for Q&A but here are some answers for some questions:

Someone said that they couldn't use archangel to block ads... Here is an example extraroot.sh script to do that:

make an extraroot.sh in linux text format (not dos/windows) like so:

--- cut here ---

cat <<EOF >/tmp/hosts

127.0.0.1	localhost

127.0.0.1	pagead2.googlesyndication.com pagead.l.google.com googleads.g.doubleclick.net

127.0.0.1	api.admob.com mm.admob.com r.admob.com mob.adwhirl.com cus.adwhirl.com met.adwhirl.com

EOF

mount --bind /tmp/hosts /etc/hosts

--- cut here ---

There are many good mods which can safely be done in ways like this above. Nice forum people can post their recipes maybe?

Someone else asked about when they reboot their device and there is no wireless and they need root:

In this case perhaps use the deep sleep option instead of power off, if it is a huge problem for you to do this there are other more serious rooting methods like the SDE methods good people have worked on.

Someone else asked about the new patch/seal in archangel version 2:

This only applies until after reboot as archangel makes no changes which can not be reversed for the safety of your archos

A question from archaism:

Does this still work with firmware 2.1.03 ? Can anyone answer this? don't risk yourself to find the answer, but it would be nice to know.

There may be more updates in the future but do not get unhappy if there are not or questions remain not answered
[Gen8 General] ExploreMN:
All you need is a computer attached to the network your Archos will connect to. On the PC you run your packet sniffer and capture all network traffic. As the Archos will be the only thing "talking" on it, you should be able to get a clean capture of everything it does on the internet. So...tools needed:

1. PC running something like Kismet, Ethereal, etc

2. An Archos 101 running Archangel

3. A wireless router that both are connected to
[Gen8 General] ncuxxx:
Yes. It works fine. 2.1.02 and 2.1.03 accept rooting :-)

Thanks!

Why you dont have webpage of your team?
[Gen8 General] wdl1908:
Nope because the packets of the wifi will never reach the LAN side of the router. They will be directly routed to the WAN. The only packets that are visible on the LAN are arp packets and packets destined to the internal network and those are the packets we'r not interested in.
[Gen8 General] ExploreMN:
Kismet : A powerful wireless sniffer

Kismet is an console (ncurses) based 802.11 layer2 wireless network detector, sniffer, and intrusion detection system. It identifies networks by passively sniffing (as opposed to more active tools such as NetStumbler), and can even decloak hidden (non-beaconing) networks if they are in use. It can automatically detect network IP blocks by sniffing TCP, UDP, ARP, and DHCP packets, log traffic in Wireshark/TCPDump compatible format, and even plot detected networks and estimated ranges on downloaded maps. As you might expect, this tool is commonly used for wardriving. Oh, and also warwalking, warflying, and warskating, ..
[Gen8 General] wdl1908:
Thast just the problem I don't have a PC with wireless where I can install kismet on. I only have PC's that are wired to the router. The wireless is only used for non PC devices.
[Gen8 General] strongergravity:
1 box of brownie mix, 2 eggs, 1/4 cup of oil. Mix & put spoonfuls on cookiesheet. 350 degrees for 8-10 minutes. Brownie cookies, easy & quick! ;)

Seriously, I hope this checks out. I don't want the Russian Mafia, the Triads, or Justin Beiber to get my data...
[Gen8 General] willowave:
I just did it, it works perfect and it's easy. Had no probs. Very good instructions too.
[Gen8 General] ExploreMN:
Okay, lets talk sniffers 101 (pun intended).

When you set up a sniffer you can go about it a few ways. First, you can listen to everything and anything on the network.

The second way is to tell it to listen to just the outside address on your router.

So, if you have a wired PC, you set it up on your network...attached to your router, and have it listen to the outside address or WAN address.

Then it will record any traffic the Archos is trying to send to the outside world. After all, that is all we are interested in anyway, right? Making sure its not sending information to some foreign server...be it to request a package be installed without your knowledge on your device or to send your private information to some foreign entity.

I would love root, but I don't need it for anything bad enough to warrant a factory reset and go through this...but for anyone who is really truly worried, this is the best, safest way to make sure your shiznit isn't getting stolen by the Russian mafia or Colombian drug lords...
[Gen8 General] louis chan:
For some dd-wrt build (mega build I think) in wireless router, tcpdump is included. And that is a simple packet sniffer.

Or: enable jffs, and get tcpdump + libpcap installed. This is working for me.
[Gen8 General] wdl1908:
Listen to everything on the LAN is impossible when you have a switch in your network unless you configure the ports on the switch in replication mode.

So Switches 101 says no in the first case.

The second case Routers 101 says that is impossible.

WAN <-> Router <-> LAN <-> PC

<-> Wifi

All traffic that is coming into the Wifi and goes out to the WAN is NEVER seen on the LAN unless you configure your router as a bridge. And if that is the case it's Bridge 101 not Router 101 so Sniffers 101 is not working in my setup.
[Gen8 General] wdl1908:
Nice. A pitty my wifi router is just crap for this kind of thing.

So you have a setup that should be able to get the tcpdump we need to see if something fishy is going on.

Are you a brave person? Are you willing to test the archangel with a tcpdump running to see what it sends on the network?
[Gen8 General] sdmrichie:
Hi,

Just got my first archos yesterday, the archos 70 and trying to apply this root.

I have firmware 2.1.03 and i know it's not supported but am unable to get it to work, when I click the obtain root button it just sits on please wait forever.

The strange thing is if i rotate the screen while it is doing this the button becomes un greyed and i can click the obtain root again.

Any tips or suggestions?
[Gen8 General] ncuxxx:
Did you connected to wifi?
[Gen8 General] sdmrichie:
I am connected to wifi.
[Gen8 General] dfauvarq:
I did a tcpdump on my dd-wrt router and I actually found something suspicious if confirmed by another person.

The first time I rooted I saw a HTTP GET to

apache2-twiddle.camelopardalis.dreamhost.com

Unfortunately I didn't have the full dump of the request (it starts with GET /sto)

It may have nothing to do with this application.

I tried to uninstall and resinstall and root again but this time I didn't see any suspicious packets. I'm not really in the mood of reinstalling from scratch my Archos so maybe there is something left hidden in the machine.

BTW the rooting works when the connection to the Google account works due to invalid password.
[Gen8 General] wdl1908:
Can you clarify this a little bit?
[Gen8 General] dfauvarq:
In order to be a little bit more safe I changed my password on Google, changed in on the archos, then change again on Google but did not change it again on the archos.

So the archos had an incorrect password to connect to Google.

It was just for me a way to be a little bit more safe.

If I get some time I'll try a wipe of the archos, configure it with a new google account and snoop it when rooting.

It's a shame there is no fastboot on archos (AFAIK) to be able to do quick backup/restore of full partitions, it will be easier to setup such a test a go back to the previous state.
[Gen8 General] cajl:
the new APK is ok

on all Archos Gen 8 !
[Gen8 General] wdl1908:
And ok means what?
[Gen8 General] Bhaal42:
Only that's the V2 is working on his Gen8.

cajl don't really care about security.
[Gen8 General] 327ci:
edit.....found my answer
[Gen8 General] louis chan:
I upgrade my A70 to 2.1.02. And test the ver 1 root utility with tcpdump on those IP packets.

During root, there are lots of arp request & lots of ntpv4 update, but I didn't see suspicious IP addresses. And I reboot it and observe the permanent root activities. Still nothing odds that'd catch my eyes.

So my verdict is that it is safe.
[Gen8 General] wdl1908:
A buddy of mine has a linux PC that is configured as router. I asked him if we could test the setup and do a tcpdump of the traffic.

I can confirm there are no other packets being send/received than just ARP and NTPv4 packets.

So i agree with "louis chan".
[Gen8 General] Cthugha:
Do backup and restore with Titanium Backup work after getting root using this exploit?
[Gen8 General] wdl1908:
Yes they do but it seems the archos busybox has some problems so you have to use the Problems button in Titanium backup to install a proper busybox.
[Gen8 General] wdl1908:
So I think now the fun can begin I started a new thread for the custom scripts that can be used with Archangel.

So please post your scripts here http://xdaforums.com/showthread.php?p=10965161
[Gen8 General] dancnpete:
so at this point are we saying the root apk is a go? at least for back up purposes?
[Gen8 General] medmike:
Can we overclock with market app and setcpu, or does it need o/c script? Yes, linux noob here....
[Gen8 General] ExploreMN:
Honestly, I have no clue what you are talking about, but when I run Wireshark on my PC I can see the Archos broadcasting on my network and when I use it to surf the net I can see the requests and what-not. So...based on that, I am assuming whatever you are doing is incorrect. I can also filter out everything except the Archos as well.

It looks like I will have to be the one to test this since no one else seems able to do it...maybe this weekend I'll back up all my crap and factory reset my 101, set up the dummy e-mail account and see what this thing really wants with our wifi connections...
[Gen8 General] Tesla74:
I would wait until we see what ExploreMN finds out this weekend.

@ExploreMN

Thank you for taking the time to do this. I know it is a lot of work to reload everything. It will be interesting to see what you find.

Tesla
[Gen8 General] ExploreMN:
Okay, I did it and I didn't see anything nefarious going on. In fact, it never even tried to contact the outside world (all traffic coming from it was local and/or broadcast only). Now, I don't know if there is some kind of "trigger" event that would cause it to download something in the background or transmit something.

I can only say that installing it, running it, and setting it to permanent root does not do anything.

The root does work (first app I installed was Wireshark for root LOL) and it worked okay.

So, for what its worth! There you go!

Oh, and just to be safe, I checked my test e-mail account and there were no other IP addresses except my own.