Idea for a root exploit - Xperia Z5 General

Hi everybody,
I'm asking myself why can't we exploit the stagefright bug to earn root and then install supersu and recovery on the smartphone?! If you agree with this, just tag some developers, I know that it's very dangerous but if we get root then make a pre-rooted 32.0.a.6.152 which correct stagefright bug then we'll be OK..
http://www.xda-developers.com/stagefright-explained-the-exploit-that-changed-android/

Stagefright itself isn't able to exploit to gain root. AFAIR it only gains system user, so another exploit would have to be used to root.

Tag devs!!

New root exploit using Chrome discovered!!!
http://gadgets.ndtv.com/mobiles/new...access-to-virtually-any-android-device-764811

Related

[Q] Moto making DX unrootable with new gingerbread update?

http://www.gottabemobile.com/2011/0...oid-x-gingerbread-upgrade-to-prevent-rooting/
Is this article true? Has anybody installed the latest official update and not been able to gain root access? If so, then I had better root my phone already before this gets rolled out.
not true. it's already been rooted. it's called GingerBreak.
^ what he said
It would be near impossible to prevent root access.
Sent from my Xoom the way it should be, rooted and with SD card.
There are so many bits of untrue information in that article it's not even funny.
1. It is rootable.
2. It is not a silent update.
3. The bootloader doesn't affect superuser access (root).
Amongst other things... I won't be looking to that site for any real info in the future.
Sent from my DROIDX using Tapatalk

[WARNING] OTA2 will fix root exploit!

As writen by the Lenovo Staff in the lenovo Forum:
1. OTA2 will fix the root exploit of OTA1. It is unacceptable to our enterprise customers deploying a business tool like ThinkPad Tablet to have a known root exploit - so we have no choice but to fix the exploit. My advice to anyone who wants to keep root, is to stay on OTA1. Fixing the root exploit took less than a day - it is not (and never has been) the reason for OTA2 delays. Nobody within Lenovo will have anything more to say about rooting the ThinkPad Tablet, so please don't ask any follow-up questions about this - or at least don't expect any answers. Thank you in advance for understanding this.
2. OTA2 delays are being caused by various issues found during testing. We are trying hard to get OTA2 done right and everyone within Lenovo understands how many important fixes are in it. Bsnf will probably have more to say about this tomorrow - whether OTA2 will release this week, or if there will be another delay while we fix a last-minute issue found during testing. We apologize for the delay.
Click to expand...
Click to collapse
The full thread can be found here:
http://forum.lenovo.com/t5/ThinkPad-slate-tablets/OTA2-fix-list/td-p/658231/page/17
So no ota2 for me!
Prefer bugs than not be able to root my tablet.
quyTam said:
So no ota2 for me!
Prefer bugs than not be able to root my tablet.
Click to expand...
Click to collapse
Well if you have cwr and can flash unsigned zips, then both should be possible after some modifying
Remember, the stock ROM overwrites the recovery ROM at every boot!! The new OTA will re-enable that feature...
Logxen said:
Remember, the stock ROM overwrites the recovery ROM at every boot!! The new OTA will re-enable that feature...
Click to expand...
Click to collapse
I meant modifying before flashing. But thanks for making it clear for everyone.
This is extremely lousy. I am regretting buying one of these now. What are the chances it gets rooted again? Unfortunately I updated to the OTA2 before seeing this.
FearTheCron said:
This is extremely lousy. I am regretting buying one of these now. What are the chances it gets rooted again? Unfortunately I updated to the OTA2 before seeing this.
Click to expand...
Click to collapse
Hu? Where did you get OTA2? I can't find it on the lenovo servers.
I didn't realize that the OTA2 wasn't out yet. I just hit the auto update and assumed that it was the ota 2 update. I am on build "ThinkPadTablet_A310_02_0037_0075_US". I will try the root exploit and see if it works. Hopefully someone can modify the ota update to maintain root.
According to a post over in the Lenovo forums it is, but those on root will not get the update OTA naturally.
TS
That was released in Nov 2011:
see http://download.lenovo.com/slates/think/tablet1/
You are still on OTA1 - relax and root away!
FearTheCron said:
I didn't realize that the OTA2 wasn't out yet. I just hit the auto update and assumed that it was the ota 2 update. I am on build "ThinkPadTablet_A310_02_0037_0075_US". I will try the root exploit and see if it works. Hopefully someone can modify the ota update to maintain root.
Click to expand...
Click to collapse
Seems they have pulled OTA2. I downloaded it ten minutes ago and now it is not there anymore.
ThinkPadTablet_A310_02_0039_0086_UK.zip
For some reason it does not list but can still be downloaded
http://download.lenovo.com/slates/think/tablet1/ThinkPadTablet_A310_02_0039_0086_UK.zip
http://download.lenovo.com/slates/think/tablet1/ThinkPadTablet_A310_02_0039_0086_WE.zip
ok, 0086_we is available via ota.
i just downloaded it automatically.
the update.zip is stored in /cache, just in case someone wants to delete it and prevent the update on next restart.
might it be possible to manipulate the update.zip and include su (maybe a silly question, but i'm far away from being a dev or android-expert).
greetings
danjac said:
ok, 0086_we is available via ota.
i just downloaded it automatically.
the update.zip is stored in /cache, just in case someone wants to delete it and prevent the update on next restart.
might it be possible to manipulate the update.zip and include su (maybe a silly question, but i'm far away from being a dev or android-expert).
greetings
Click to expand...
Click to collapse
Should be possible. You have at least to edit the update.script in the zipfile and to look for parts like this (from the orignal script):
Code:
ui_print("Removing unneeded files...");
delete("/system/app/LenovoBookmarkWidget-1.0.023.apk",
"/system/app/LenovoConfigFileHandler-1.2.001.apk",
"/system/app/LenovoSetupWizard-1.2.001.apk",
"/system/app/MobiHandAppStore_b1.0.4.538.apk",
"/system/app/dxtg-lenovo-usa_3.003.1049.apk", "/system/bin/aescrypt",
"/system/bin/redsocks", "/system/bin/redsocksctls",
"/system/app/LenovoAppShop_K1_b219.apk",
"/system/app/LenovoBookmarkWidget-1.0.022.apk",
"/system/app/LenovoConfigFileHandler-1.0.007.apk",
"/system/app/LenovoSetupWizard-1.1.001.apk",
"/system/app/dxtg-lnv-u1_3.003.999.apk",
[B]"/system/app/Superuser.apk", "/system/bin/su", "/system/xbin/su",[/B]
"/system/recovery.img");
"Removing unneeded files..." ... no comment...
You may also want to remove the recovery and stay wit CWM. Will look into it when i find some free time. But can't test it myself right now, because I'm playing around with a custom rom and the firmware updates in the update could make things more complicated.
What kind of custom rom do you use? Aosp? Ics?
Updated with temporary unroot and OTA Rootkeeper to .......086_WE
So the rootkeeper works on my tablet.
Sporty883 said:
Updated with temporary unroot and OTA Rootkeeper to .......086_WE
So the rootkeeper works on my tablet.
Click to expand...
Click to collapse
Hi
I got root keeper but did you do a temp unroot to do the update? What steps did you do? Really want to update and keep root.
Sent from my ThinkPad Tablet using Tapatalk
paperclip69 said:
Hi
I got root keeper but did you do a temp unroot to do the update? What steps did you do? Really want to update and keep root.
Sent from my ThinkPad Tablet using Tapatalk
Click to expand...
Click to collapse
I believe he is writing specifically about OTA Root Keeper which purports to have a temp-unroot procedure before running an OTA update.
https://market.android.com/details?id=org.projectvoodoo.otarootkeeper
Its ok I had rootkeeper and forgot it had a temp unroot, just did a temp unroot, updated tpt and restored root, all working fine and root access is confirmed.
Cheers
Tom
Sent from my ThinkPad Tablet using Tapatalk
before I even knew it, I had updated the ota2 after rooting. had root for about 3 minutes. LOL. does anyone know how to restore this thing back to ota1 or even the original firmware? I have the ota update kit stored locally, so if I had any kind of pointer to the original rom, I could probably downgrade it. Hopefully.
Anyone knows when will be available this update to ROW version?

Question on stock root

I got my S4 on release day and I have been really reluctant to root because I am happy with the way the phone is. But now I am tempted to root for 2 reasons. I want to be able to use every app in the multi window view and to be able to move stuff to the SD card.
So my question is....If i just root my phone but dont put and rom or recovery on it what would I need to do if Android or Samsung released an update? The update would not work if I was rooted correct? Can someone link me on the process I would need to do to be able to install such an update?
I believe there are root method which allows OTAs but you ll loose the root and you might need to re root again. If the root doesnt support OTAs then you will have to flahs stock firmware then update then root again.
Sent from the state where marijuana is not illegal !
chris_marsh said:
I believe there are root method which allows OTAs but you ll loose the root and you might need to re root again. If the root doesnt support OTAs then you will have to flahs stock firmware then update then root again.
Sent from the state where marijuana is not illegal !
Click to expand...
Click to collapse
Ok so for example if I followed QB Kings video in the Android Development Forum on rooting my S4 do you know if that root would allow for OTA's? I going back in forth in my head on if I should root or not. On one hand I would want these extra features I mentioned but on the other hand is it worth the hassle of dealing with the OTA update process.
Based on my limited knowledge, it is possible that if you take OTA, you may not be able to root again (if the OTA patches that root exploit). Hopefully the awesome Devs on here will be able to find another exploit, but it is possible that you may not be able to re-root.
jbarresi19 said:
Ok so for example if I followed QB Kings video in the Android Development Forum on rooting my S4 do you know if that root would allow for OTA's? I going back in forth in my head on if I should root or not. On one hand I would want these extra features I mentioned but on the other hand is it worth the hassle of dealing with the OTA update process.
Click to expand...
Click to collapse
Sorry no idea about that method. You should ask in that thread you might will get proper info. And BTW OTA for now are provided fast but as everybody knows it takes a while for Samsung to roll out important OTAs so you might as well root than sit hoping for OTA while missing all the modding action.
Sent from the state where marijuana is not illegal !
chris_marsh said:
Sorry no idea about that method. You should ask in that thread you might will get proper info. And BTW OTA for now are provided fast but as everybody knows it takes a while for Samsung to roll out important OTAs so you might as well root than sit hoping for OTA while missing all the modding action.
Sent from the state where marijuana is not illegal !
Click to expand...
Click to collapse
Very good point in not waiting around for an OTA...they do take long as hell to push out....and I will ask in the QB King thread to see how OTAs work with that root process...Thanks so much

Potential exploit to gain root?

Just read about this kernel vulnerability, which got me curious whether this can be exploited to gain root on the Z2.
http://linux.slashdot.org/story/14/...utm_source=rss1.0mainlinkanon&utm_medium=feed
That's the first thing I thought of when I read about it, too

Simpler Root Method

I just got my Z3c over the weekend, and since it was working perfectly on AT&T with LP 5.0.2 I was reluctant to do the whole downgrade/unock/relock/root/flash/upgrade/etc. root method.
Fortunately the latest version of Kingroot will root the phone with OTA Lollipop upgrade working and unlocked bootloader. I have 23.1.A.1.28 rooted without even having to enable ADB or do anything but install and run the Kingroot app.
EDIT: Editing here by request on this thread. There is another thread on this forum dealing with Kingroot in detail. Some suggest that the Kinguser app transmits the phone's IMEI and this introduces some risk. For me, I managed to get rid of the Kinguser app and install SuperSU instead. My phone works fine, rooted, with SuperSU (which was installed via recovery/flash method). I have no comment about how risky Kinguser app is, whether anyone is trying to steal something from you, or what your risk level might be with Kingroot method. Buyer beware.
I would say, if Kingroot can do this without the downgrade/unlock/relock/upgrade method then so can non-KR devs.
Does it work with a locked bootloader?
We already have a thread about Kingroot: http://forum.xda-developers.com/z3-compact/general/kingroot-4-0-t3105593
It's not being stickied because it's a very shade rooting method, very little is known about how it works and what more it does behind the scenes except for rooting. And Kinguser cannot be replaced by SuperSU by any normal, conventional means.
Yes, it worked on my phone with a locked bootloader.
Sorry for the confusion. I didn't realize Kingroot was such a bad thing. It's also very difficult to remove.
FWIW what I did to get rid of Kingroot and the Kinguser app (which is the real beast to remove) is after rooting with KR, I installed the dual recovery and then flashed the pre-rooted LP from TWRP. That totally eliminated the KR and etc. so if anyone has taken my potentially bad advice and rooted with KR, that's how to undo and retain root with SuperSU. I still think it is easier/simpler than the "tried and true" method of rooting for those who have already upgraded to LP/5.0.2.
mr72 said:
Sorry for the confusion. I didn't realize Kingroot was such a bad thing. It's also very difficult to remove.
FWIW what I did to get rid of Kingroot and the Kinguser app (which is the real beast to remove) is after rooting with KR, I installed the dual recovery and then flashed the pre-rooted LP from TWRP. That totally eliminated the KR and etc. so if anyone has taken my potentially bad advice and rooted with KR, that's how to undo and retain root with SuperSU. I still think it is easier/simpler than the "tried and true" method of rooting for those who have already upgraded to LP/5.0.2.
Click to expand...
Click to collapse
Thank you so much for information. I'm ready to do and i saw your post. Thank you so much again.
mr72 said:
I just got my Z3c over the weekend, and since it was working perfectly on AT&T with LP 5.0.2 I was reluctant to do the whole crazy downgrade/unock/relock/root/flash/upgrade/etc. root method.
Fortunately the latest version of Kingroot works great to root the phone with OTA Lollipop upgrade working and unlocked bootloader. I have 23.1.A.1.28 rooted without even having to enable ADB or do anything but install and run the Kingroot app.
IMHO someone should update the sticky threads. This is a much simpler method to get rooted LP on your Z3c. Just upgrade as usual and then root with Kingroot. Couldn't be easier.
Click to expand...
Click to collapse
Its not so tricky to root with giefroot. Just downgrade, root install dualrecovery and flash pre rooted lollipop. Thats all. Personal i dont trust kingroot. Nobody know how they do the root and there are always discussion about some data sending to servers. But its everyone choice
mr72 said:
Sorry for the confusion. I didn't realize Kingroot was such a bad thing. It's also very difficult to remove.
Click to expand...
Click to collapse
https://www.google.pl/search?q=repl...-8&oe=utf-8&gws_rd=cr&ei=BSaPVbTJNszbU-L2g8AG
followed the method in the first link, worked perfectly.
Super-sume on the play store does that with one click to remove kingroot
1) I suggest you change the title or just close this thread
2) I suggest you install a clean new stock firmware through Flashtool and root it via Giefroot ONLY (I know downgrading is boring and a bit harder, but that is still the safest method)
Kingroot is the simplest method, maybe not the most safe.
Giefroot is the longest, maybe the most safe.
Both of them have the same effect, root the phone.
No need to close the thread, I don't care Chinese developers need my IMEI to root my phone..
So if you agree with this idea, where is the problem? We are free to choose if we are informed to that.
fabjazz said:
No need to close the thread, I don't care Chinese developers need my IMEI to root my phone..
Click to expand...
Click to collapse
The right thread with the right title and the right OP is already here:
http://forum.xda-developers.com/z3-compact/general/kingroot-4-0-t3105593
That's why I suggested they close this one.
fabjazz said:
So if you agree with this idea, where is the problem? We are free to choose if we are informed to that.
Click to expand...
Click to collapse
I can't see any information about risks inside the OP of this thread and that's the only post a noob usually reads!
Please search the meaning of the verb "to suggest": it's not imperative and gives freedom of choice.
In this case, this one already exists :
http://forum.xda-developers.com/showthread.php?t=3107461
[ROOT ANDROID][2.x-5.0] KINGROOT: The One-Click Root Tool for Almost All Devices
Maybe, I suggest to close all double threads(or seems to be)... I suggest to all noob peoples to keep all questions for themselves... Great for a forum ! ?
Don't feel assaulted, just I think to ask a same question differently gives another answers, it depends who is asking and the point of view.
But you are right for the risks with IMEI.
We don't know if there is a risk or not, but it's just my opinion. ?
I think to help and share experiences are the good way.
✌
Rooted with kingroot, installed dual recovery and removed kingroot/kinguser with super-sume app (on play store).
All these steps with locked bootloader and last LP firmware

Categories

Resources