Some problems with rooting EVO with unrEVOked - Android Software/Hacking General [Developers Only]

Hello,
First off, let me say, this is my first android device. I have some experience with linux and previously owned a rooted Palm Pre.
I have an HTC EVO, and have rooted it (at least I think it's rooted), with a program called unrEVOked. It flashed a NAND called ClockworkMod Recovery (2.5.0.1), and I can get to the shell using the adb shell command when it is in recovery mode.
However, even with the SuperUser app installed, I'm having trouble running sudo or any command at the terminal (on the phone), and the apps appear to also be having trouble executing any commands that are within /sbin/ (such as killall for the Shark capture packet sniffer). This is persistent while in USB Debugging Mode and running adb shell.
I didn't have to interact with the system at all during unrEVOked, including creating a user, which struck me as odd. Also, never set up an SSH server daemon, but that's okay. I'd be a happy guy if 1) I could actually use commands in /sbin/ and programs could also do this. Note that at a terminal, when I run aname, it tells me that I don't have permission. sudo su does the same.
Alright... I can get su root via the adb shell and terminal emulator.
androidpolice com/2010/05/24/that-was-quick-evo-4gs-already-been-rooted/
It still doesn't appear that apps like a file manager, and Shark packet sniffer can get root though; even with granting them SuperUser access. Any ideas?
Any help is appreciated.
Thanks,
Matt

Related

Android Telnet Client (so you can telnet into your phone after you start telnetd)

Whipped this up last night, because I wanted to be able get root commands on my phone, from my phone. This is a safe/benign way to get root access (ie, you don't have to have a suroot or su laying around, potentially opening a security hole).
I'll throw this up on the Market tonight too.
This is a raw telnet client, so don't expect any fancy!
Terminal Emulator and Busybox
Nice. That makes it even easier No adb or wifi required.
You can also download the Terminal Emulator program from the market, and then install the busybox binary, which has a telnet command.
If you don't have root on your phone yet, use adb to push busybox to /data/local, which is owned by the shell user, so you can chmod it from an adb shell and make it executable.
It still requires adb, but no wifi.

[Q] LG Optimus V: Stuck on "Waiting for device..." on SuperOneClick

Hey guys, this is my first post, and I just wanted to say first off that all of you who have figured out how to root phones are awesome! Because of xda-developers and androidforums, I helped a friend root and put cyanogenmod 6 on his HTC Hero (cdma).
Anyway, I'm trying to put Zefie's CM7 on my LG Optimus V, and I'm stuck. First off I'm trying to root my phone. I'm following this guide: [How-To] Root the LG Optimus V on Android Central (I'd post the link, but the system won't let me since I'm a new user.). Usually I'd follow the instructions step by step, but I had to make some changes. I see this guide is written for Windows, but I'm running Ubuntu 10.10. After doing a lot of searching I was able to figure out that I had to install the Linux version of the Android SDK and use mono to run SuperOneClick.exe. That part was easy since I have a good knowledge of Linux and how it runs. The part that I'm stuck at is performing a Shell Root. When I click on Shell Root, SuperOneClick is stuck at "Waiting for device..." It's been like this for a while. If I click on Root, it gets stuck at "chmod psneuter..." Either way it's stuck and I don't know what to do.
Just to let you guys know, I have USB Debugging turned on, and I'm running Android version 2.2.1.
When I rooted my friend's HTC Hero, all I had to do was run a downloaded apk onto his SD card and run it, and then it would instantly root it. Is there a similar apk for the Optimus V? If not, is there a way I can manually root it via the terminal? Anyway, I'm stuck and would appreciate any suggestions or comments. Don't forget, I'm running Ubuntu 10.10, so some issues may arise since the tutorial was meant to be run on Windows machines.
Later tonight I'm going to try to root my phone at my friend's house since he has a computer running Windows XP. Hopefully I can get some better progress on his computer instead of mine. Thanks in advance for all your help!
Okay, nevermind. I did a little more searching and found a way to root my phone without running SuperOneClick.exe. I'll post if I have any more problems.
Well I spoke too soon. Here are the steps I followed to get to a # prompt in adb:
./adb push psneuter /data/local/tmp
./adb shell chmod 777 /data/local/tmp/psneuter
./adb shell /data/local/tmp/psneuter
I then did the following commands:
adb shell
mount -o remount,rw -t yaffs2 /system /system
exit
adb push su /system/bin
adb push busybox /system/bin
adb shell
cd /system/bin
chmod 4755 su
chmod 555 busybox
exit
adb reboot
After rebooting the phone, I installed Superuser and TitaniumBackup. I opened TitaniumBackup and it gave me an error stating that it could not acquire root privileges. I know for a fact that my phone has su and Busybox installed on it and have the correct permissions.
What bugs me even more is that when I run su via the adb shell root prompt or a terminal emulator on my phone, it returns the following error:
link_image[1997]: failed to link su
CANNOT LINK EXECUTABLE
What's up with that? I did find out that some people have had issues with Android 2.2.1 on their phone, and unfortunately that's what my phone had when I bought it about a month ago.
Okay, I figured it out finally and have my phone rooted. I had to run SuperOneClick.exe on my buddy's Windows computer. Instead of doing a Shell Root, I just clicked Root and it rooted. Now I'm stuck at figuring out how to do a Nandroid backup. I backed up everything using Titanium Backup, but I know I want to make a backup rom in case something goes wrong during the flash. What are the steps to performing a Nandroid backup?
Lol nevermind. I got Zefie's CM7 up and running this morning.
Nandroid is made using recovery. Glad you got it working
Sent from my VM670 using XDA App
bhambalek said:
Okay, nevermind. I did a little more searching and found a way to root my phone without running SuperOneClick.exe. I'll post if I have any more problems.
Click to expand...
Click to collapse
I am having the same problem as you, can you link me the other method?
EDIT: I do see the instructions in the next post, however where did you find them and get the files?

[Q] Rooting ZTE Midnight - Cydia Impactor

Hello all, I'm a noob to android and cell phones in general but not to computers. Been in to computers for about 15 years so fairly tech savvy there and have some experience with linux.Don't laugh but despite having been in to electronics and computers for 15 years I have never owned a cell phone until now. I was given a ZTE Midnight and have tried quite a number of methods to root it with no success. I have tried poot, superoneclick, oneclickroot, SRSroot and now Cydia Impactor. Cydia Impactor did not work with it's default method but I tried a method with it found on here listed below. I followed those steps and was able to acquire a root shell via telnet on windows 7 ultimate. But that is where I began running in to issues. First I was having trouble remounting as RW but managed to get that worked out but adb would still not push su to system /xbin. So I copied su to my sdcard and navigated to the sdcard via telnet and did cp su /system/xbin and that worked. I set permissions with chown 0.0 /system/xbin/su & chmod 06755 /system/xbin/su and did rm /data/local.prop and then rebooted the phone and installed SuperSu. Started SuperSu and got 'su needs to be updated '. It would not update so I tried uninstalling SuperSu and installing Superuser. Started Superuser and got no errors and all seemed well until I tried installing an app that requires root. I installed busybox and got the 'there was a problem opening a shell with root access...' I got no notification from superuser to grant permissions to busybox and could not set them manually. I did some reading and decided I had the wrong su installed and needed the 22kb which I found on here coupled with SuperSu. So I went back in via telnet and removed su and followed the same procedure I had before with cydia impactor to gain a root shell via telnet but can not replicate it. So that is where I am at, stuck. This seems like my best chance of getting this phone rooted if I could manage to replicate what I had did to begin with. Any ideas? I can telnet in on port 2222 with user access but not on port 22 with root access. I'm not a linux pro or anything but I think maybe before I removed su I needed to remove it's permissions that I had set previously. I thought a factory reset would remove any of that but the problem persists after a reset. Well if I left out any important details let me know. Any help or advice would be much appreciated.
Thanks,
Duh
1. Menu -> System settings -> Developer options -> USB debugging ->Enabled.
2. Menu -> System settings -> Developer options -> Stay awake ->Enabled (to keep the telnet session from going to sleep).
3. telnet (I am running on Ubuntu, but some sort of telnet program is needed).
4. Cydia Impactor
5. phone is connected to your wifi.
Steps:
1. Run the "Cydia Impactor" to "# drop SuperSU to /system/xbin/su". See what happens.
2. It failed for me giving an error related to not being able to remount /system or not being able to create /system/xbin/su.
3. In Cydia Impactor, run "# start telnetd as system on port 2222". You don't need to bother to telnet in. Just let it finish and then proceed to the next step.
4. In Cydia Impactor, run "# start telnetd as root on port 22". Let it finish.
5. Telnet into your phone from a terminal on your computer: "telnet 192.168.1.117 -l root 22". Note that the ip address is likely different on your network, e.g., 192.168.1.xxx.
6. If everything worked OK, you should be presented with a root prompt ("~ #"). I have busybox (obtained from the Bin4ry exploit download) that I adb pushed to /data/local/tmp. The command "/data/local/tmp/busybox whoami" tells me I am indeed root.
Click to expand...
Click to collapse
Not to be impatient but I thought for sure I'd heard some sort of reply by now. Did I post in the wrong section?
testing
duhciphered said:
not to be impatient but i thought for sure i'd heard some sort of reply by now. Did i post in the wrong section?
Click to expand...
Click to collapse
testing 123 test test

How do I adb pull root directories (like "/system"?) to my Windows PC??

Hi there, I'm trying to pull root directories like /system and /data without any luck. My purpose it to have them on my PC as a backup, and be able to browse them to pull out apps and pieces of data as necessary if it ever becomes necessary.
Device: Nexus 6P (North American version)
ROM: Stock 6.0.1 Rooted, using Wugfresh Nexus Root Toolkit and SuperSU
PC OS: Windows 7 PC (64 bit)
Adb is working properly and I can easily pull non-root directories like "/sdcard" and so on. I'd like to be able to backup the entire root directory ("/") or at least the child directories (like "/system" and "/data", etc.) Unfortunately, when I try
Code:
adb pull -p "/system" "C:\somewhere"
it skips a bunch of files, so I need to come up with a better method.
I've tried
Code:
adb root
and it tells me it's already running in root mode.
I try
Code:
adb remount
and it does this properly, but doesn't change the effects of all the commands I've tried.
When I run
Code:
adb shell
it enters shell and gives me # by default, so seemingly it is giving me su permission by default?
*** Oddly, when I enter "su" while in shell, it tells me "/sbin/sh: su: not found" which seems odd to me. I think it's possibly that SuperSU is installed as systemless root, or there's something else screwy here, so I guess I'm not sure how to proceed. Still, if that were case, why would adb already be running as root, and why would shell automatically give me the #?
Any help is appreciated!!
Thanks!

[Vulnerability] Bluestacks root access via adb

On GitHub: https://github.com/KDVB/BlueStacks-ADB-root-access​​Disclaimer​For informational purposes only. The author does not call for further actions. Created to warn users who use this product
Background​ADB (Android Debug Brigde) - is a versatile command-line tool that lets you communicate with a device. The adb command facilitates a variety of device actions, such as installing and debugging apps. adb provides access to a Unix shell that you can use to run a variety of commands on a device.
Research Walkthrough​For default, in Bluestacks, ADB port is open, but we can't to use shell command (output "error: closed")
Searching for information in the emulator files found the following file ".adbcmd" in Root.vnhd image. Path to file "dataFS\downloads". In this file we can see adb commands that we can run without connection to shell
For example, "getprop" command, that gives us information about android propetries
As we can see, interaction with android shell is working. So, I think "if I can interact with unix shell, maybe tryed to use pipe operators" and pwn i can interact with file system, but with shell-user privilage.
As a result i continue my search to find su command to get root access. SU file is in "/boot/android/android/system/xbin/bstk/su". I tryed pipe operator to get root access, but get error and shell didn't open(
After that i tryed list terminator ";" and it works. I get root shell
Result​Bluestacks have this vulnerability and people involved in its development know about it and are engaged in its elimination.
The real test is to see if you can actually do anything. Sure, you've ID'd as root, but will it actually let you change anything?
V0latyle said:
The real test is to see if you can actually do anything. Sure, you've ID'd as root, but will it actually let you change anything?
Click to expand...
Click to collapse
Thanks for your reply. Actually you can change in current session, but when emulator reboot, all changes remove. If we speak about system folders. In sdcard folders changes save. Sorry, I didn't mention it in the post.
When i searched information on the virtual disk, i found some scripts that build a system. That takes information from .conf files, but that works only for local work. For example, when you using OpenVPN Connect that port still open and you can interact with it.

Categories

Resources