| |
|
|
 |
|
|
|
|
 |
Rank: Android
Joined: 5/19/2010(UTC)
Posts: 1
Points: 3
Location: United States
Groups: Registered Users, Subscribers
|
I'm bored so I figured I would ask:
"Is anyone working on rooting the droid 2?"
|
|
|
|
|
|
|
|
|
|
Rank: Android
Joined: 6/3/2010(UTC)
Posts: 32
Points: 99
Location: United States
Groups: Registered Users, Subscribers
|
I'd like to know this as well.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
Rootzwiki tweeted earlier that Birdman will check it out next if they can get enough donations to buy him a D2. Already sent my $20 to Alldroid
|
|
|
|
|
|
Rank: Android
Joined: 8/13/2010(UTC)
Posts: 9
Points: 27
Location: United States
Groups: Registered Users, Subscribers
|
Has anyone looked at the exploid.c source. It looks like the biggest change the birdman had to do was change where the /system directory was mounted to. I am wondering if we can leverage his work and possibly just be required to change the system mount point.
I am new to droid, but not to the concept. I may try and see what I can figure out tonight, however its my wife's phone so I got to be careful not to brick it. I am stuck with a BB Storm 2 till either the D2WE or Droid Pro get released.
Anyone with any experience and has any suggestions would be welcome and appreciated.
|
|
|
|
|
|
Rank: Android
Joined: 6/28/2010(UTC)
Posts: 13
Points: 39
Location: US
Groups: Registered Users, Subscribers
|
seriously...i mean im very happy that I got my X rooted and Birdman & Koush-Cyanogen got a recovery working on the X but dizamn...does anyone know that the Droid 2 is out? Feels like the Droid 2 doesn't even exist. Well hopefully someone can root the Droid 2 and thank you again to all the dev's out there working on all these sweet android devices!
|
|
|
|
|
|
Rank: Android
Joined: 8/16/2010(UTC)
Posts: 6
Points: 18
Location: United States
Groups: Registered Users, Subscribers
|
I just got my droid 2 this last Saturday and so far I am loving it. Coming from a winmo samsung i760 even the default verizon/moto stuff feels super slick.
However, the bloat is really getting on my nerves. If I can do nothing other than get rid of that stupid blockbuster app I'll be satisfied.
So even though I have no experience other than general linux software dev and some hardware hacking in college, I'll do everything I can to help the droid 2 rooting effort. I don't really want to brick my phone, but if something goes wrong I can probably get a replacement easily enough. So if someone wants to try something out post here and I'll see what I can do.
I've been trying to come up to speed on the exploid via birdman et al, and it sounds like it has promise, but froyo appears to be new territory for these hacks.
My first step is to get adb working and then I'll start digging into what I can see figure out of the system. Since I'm new to android this will probably take me a while.
Happy hacking.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
Nice to see some new faces willing to work on this. I'm very new to Linux, so I probably won't be of much help in finding exploits but I'm comfortable with ADB and would be willing to help test any hacks. Hopefully we get an sbf leak eventually too.
|
|
|
|
|
|
Rank: Android
Joined: 8/16/2010(UTC)
Posts: 6
Points: 18
Location: United States
Groups: Registered Users, Subscribers
|
So I've got adb working and took a look around. I was able to create a file in /tmp and make it executable, so the only parts left (assuming the same vulnerability still exists) is to find the mount points that will work and go from there.
I'm still trying to find info on the vulnerability, so if anyone has detailed notes on it please post a link to them. Hopefully that explains the importance of the block devices because I'm unclear what's going on there.
In the droid x exploit, birdman mounted /dev/block/mtdblock7 and got it to work (again I'm not clear on exaclty what is going on here with the block devices and mounting points).
I checked on the droid 2 and found no such device, but I did find a bunch of /dev/block/mmcblk1p9 kind of devices. If I find more documentation as to what is needed and why I'll try and see if these devices will suffice or if this is a dead end.
I also need to find an original copy of the exploid.c source (preferably the latest droid x version) as that will need to be modified if we find something that works.
The next thing I'm going to try is to pull down the ndk and see if I can crosscompile some code and run it on my droid 2. If that works I should be able to compile whatever modifications needed for exploid.c and test them out.
Last note, this is my first foray into this kind of work and so I'm just doing a brain dump here as it's the best place I could find in terms of relevance, but if there is a better way to communicate about my efforts going forward please let me know.
|
|
|
|
|
|
Rank: Android
Joined: 8/16/2010(UTC)
Posts: 6
Points: 18
Location: United States
Groups: Registered Users, Subscribers
|
I found the source for the exploit (should have realized it was included with the droid x exploit just a few forums over [http://alldroid.org/default.aspx?g=posts&t=493].
Anyway after looking through there and comparing what I saw on the droid 2 it looked very similar. The same file system (ext3), and mount points (/dev/block/mmcblk1p21 and /etc/firmware) are all there. The only thing missing is the /sqlite_stmt_journals dir. However it seems that this isn't strictly required, so I just followed the steps for the droid x root (in the post I linked to above), except I changed the directory to /tmp for the exploid location.
It ran and output successfully, but I got nothing. I tried both the wifi and bluetooth in varying configurations and also trying the exploid file in /data/local/tmp, but although it looks like it should work nothing happens. At least it isn't breaking or crashing my phone :)
In the meantime I was working on recompiling and I think I have that finally working. I was able to insert a few print statements into the code and it otherwise appears to work as the original (and still doesn't work). I'm going to be adding a lot more debug statements so I can try to make sense of the exploid because it's all still black magic to me.
From what I understand it uses something about hotplugging (which is triggered with wifi and or bluetooth activation) to get the init proces (which is running as root) to copy it's self to the system/bin directory as rootshell and run from there. It sounds like it should work, and from what I can tell not too much in this area has changed for froyo, but I'm still not sure what I'm looking for. If anyone has suggestions for what to look for in the code and or add to it I can readily change it now.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
Thanks for getting to work on this. I can't be of much help, but I did notice Birdman tweeted this last night: " 2.2 for the droidx is rootable using exploid...with a few little tweaks of course :)" http://twitter.com/_mrbirdman_/status/21554548948Assuming the 2 and the X are nearly identical, maybe you just need to get a tip from him to get started over here.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
..and I would assume you already looked at this but in case you didn't: http://c-skills.blogspot...07/android-trickery.htmlThere's seems to be quite a bit of info in the readme's.
|
|
|
|
|
|
Rank: Android
Joined: 8/16/2010(UTC)
Posts: 6
Points: 18
Location: United States
Groups: Registered Users, Subscribers
|
Thanks, yea I had looked there, but after you mentioned it again I went back and realized I had missed the link to the original vulnerability. I was able to find some references about how the msg being sent to the hotplug isn't verified to make sure it comes from root etc, but everything I saw still seemed to imply it should work on the droid 2 from all I saw. I still don't understand the importance of the sqlite_stmt_journals vs other directories. I fired off a message to birdman, but I don't know how well he responds to random emails. If someone has better connections with him and can find out what he did differently for 2.2 I can give it a try.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
Well it looks like we at least have proof it can be done: " never say i never did anything for you guys, 2.2 leak from @ is rooted by yours truely ;)" https://twitter.com/_mrbirdman_/status/21649457649Anyone ballsy enough to give this a try? http://www.droid-life.co...using-universal-androot/I would, but I'm terrified to risk it without a backup method.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
And the exploid file for Droid X: http://alldroid.org/Defa...0&g=posts&m=7512Comparing to the original exploid, the only differences I see are the mount locations and the chmod commands... but I'm no Linux expert.
|
|
|
|
|
|
Rank: Android
Joined: 8/16/2010(UTC)
Posts: 6
Points: 18
Location: United States
Groups: Registered Users, Subscribers
|
The latest droid x instructions seems to imply you have to start from 2.1 and go from there. Bad news for us if that is the case, but I may be missing something.
I'm not sure about the universal android exploit. I'm looking through the code now. It cleans up after itself better and uses some tricks to figure out the mount point for various phones, but it doesn't look like it's doing anything significantly different from the previous exploid. I'll see if I can pull out some of the changes and try them directly, I'm not quite willing to just run an app and hope it works
|
|
|
|
|
|
Rank: Android
Joined: 6/5/2010(UTC)
Posts: 3
Points: 9
Location: United States
Groups: Registered Users, Subscribers
|
I just got my Droid 2 yesterday. I have had the original Droid since it was released and have had it rooted with custom roms since they were first available. I've paid very close attention to the community since and have a fairly high working knowledge of linux. If I can be of any help lemme know, I'd love to get something working on this device.
|
|
|
|
|
|
Rank: Android
Joined: 6/3/2010(UTC)
Posts: 3
Points: 9
Location: United States
Groups: Registered Users, Subscribers
|
From what ive read sqlite is just a logging software but it is odd its not its in every other phone
|
|
|
|
|
|
Rank: Android
Joined: 7/23/2010(UTC)
Posts: 2
Points: 6
Location: United States
Groups: Registered Users, Subscribers
|
Prior to 2.2.19 on the D2 you could root the device (the sqlite directory does not need to exist). Once the exploit became public the next release from Motorola (2.2.19) fixed the exploit. So it's not necessarily something between the DX and D2, Motorola specifically went after the exploit in 2.2.19.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
The man who found the original exploid vulnerability is taking a look at the Droid 2: http://c-skills.blogspot.com/2010/08/droid2.htmlI donated to alldroid hoping for some D2 love, but maybe we'll have to look elsewhere.
|
|
|
|
|
|
Rank: Android
Joined: 8/24/2010(UTC)
Posts: 2
Points: 6
Location: United States
Groups: Registered Users, Subscribers
|
There is an update to the blog post. Looks like he released a version for the Droid 2.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
bigcox wrote:
There is an update to the blog post. Looks like he released a version for the Droid 2.
Yeah this is great news. I'd like to test, but not quite sure of the process. It seems that we would follow the Droid X instructions with a few modifications, but I'll let someone more experienced take a look first.
|
|
|
|
|
|
Rank: Android
Joined: 8/13/2010(UTC)
Posts: 9
Points: 27
Location: United States
Groups: Registered Users, Subscribers
|
karnovaran wrote:
Yeah this is great news. I'd like to test, but not quite sure of the process. It seems that we would follow the Droid X instructions with a few modifications, but I'll let someone more experienced take a look first.
There is a readme file in the tar ball. It explains what to do. I will try it on my wife's phone when I get home. If it hasn't already been tried.
|
|
|
|
|
|
Rank: Android
Joined: 7/24/2010(UTC)
Posts: 23
Points: 69
Location: United States
Groups: AllDroid Sponsor, Registered Users, Subscribers
|
bmtbandit wrote:
There is a readme file in the tar ball. It explains what to do. I will try it on my wife's phone when I get home. If it hasn't already been tried.
Right, I've been looking at it and it seems straightforward. I just wouldn't know what to do if I mess something up. Eh, maybe I'll just give it a shot and hope for the best.
|
|
|
|
|
|
Rank: Android
Joined: 8/13/2010(UTC)
Posts: 9
Points: 27
Location: United States
Groups: Registered Users, Subscribers
|
karnovaran wrote:
Right, I've been looking at it and it seems straightforward. I just wouldn't know what to do if I mess something up. Eh, maybe I'll just give it a shot and hope for the best.
It does not look that invasive, my guess is if you mess up it just doesn't work. No harm no foul, but I could be wrong. If I had access to the phone I would already of tried it.
|
|
|
|
|
|
Rank: Android
Joined: 8/24/2010(UTC)
Posts: 2
Points: 6
Location: United States
Groups: Registered Users, Subscribers
|
karnovaran wrote:
Yeah this is great news. I'd like to test, but not quite sure of the process. It seems that we would follow the Droid X instructions with a few modifications, but I'll let someone more experienced take a look first.
I'll take a look when I get home, if I can. I am new to this stuff as well.
|
|
|
|
|
|
Forum Jump
You cannot post new topics in this forum.
You cannot reply to topics in this forum.
You cannot delete your posts in this forum.
You cannot edit your posts in this forum.
You cannot create polls in this forum.
You cannot vote in polls in this forum.
|
|
|
|
|
|
|
|
| |
|
|
|