Hey there,
I did post about the issue I'd been having with all recent ROM's in the CyanogenMod thread, but am posting my own thread as I've seen no one else bring up the issue.
Essentially, on all ROM's I've tried since but not including nk02's 4.0, including CyanogenMod 3.9.x and nk02's 4.1.x, I cannot run the browser or anything dependant on it, like Market, opening email, completing the initial wizard.
This is the output of logcat while starting Browser:-
Code:
I/ActivityManager( 127): Starting activity: Intent { action=android.intent.acti
on.MAIN categories={android.intent.category.LAUNCHER} flags=0x10200000 comp={com
.android.browser/com.android.browser.BrowserActivity} }
I/ActivityManager( 127): Start proc com.android.browser for activity com.androi
d.browser/.BrowserActivity: pid=404 uid=10034 gids={3003}
I/ActivityThread( 404): Publishing provider browser: com.android.browser.Browse
rProvider
I/DEBUG ( 108): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *
**
I/DEBUG ( 108): Build fingerprint: 'tmobile/kila/dream/trout:1.5/CRC1/150275:
user/ota-rel-keys,release-keys'
I/DEBUG ( 108): pid: 404, tid: 416 >>> com.android.browser <<<
I/DEBUG ( 108): signal 11 (SIGSEGV), fault addr 010867e8
I/DEBUG ( 108): r0 45017a34 r1 001bfd9c r2 001cec24 r3 00000000
I/DEBUG ( 108): r4 001bfd9c r5 00000007 r6 00217e00 r7 aa073e55
I/DEBUG ( 108): r8 45017d9c r9 423afed8 10 423afec4 fp 00000001
I/DEBUG ( 108): ip 7fe00000 sp 45017a34 lr aa1c4739 pc 010867e8 cpsr 000
00010
D/dalvikvm( 404): GC freed 1976 objects / 148848 bytes in 134ms
I/DEBUG ( 108): #00 pc 010867e8
I/DEBUG ( 108): #01 pc 001c4736 /system/lib/libwebcore.so
I/DEBUG ( 108): stack:
I/DEBUG ( 108): 450179f4 00000001
I/DEBUG ( 108): 450179f8 00000000
I/DEBUG ( 108): 450179fc afe2defc /system/lib/libc.so
I/DEBUG ( 108): 45017a00 aa16fed3 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a04 aa16fec1 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a08 00000000
I/DEBUG ( 108): 45017a0c 001ceb28 [heap]
I/DEBUG ( 108): 45017a10 00000000
I/DEBUG ( 108): 45017a14 001cf4c8 [heap]
I/DEBUG ( 108): 45017a18 00000984
I/DEBUG ( 108): 45017a1c aa170389 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a20 00000000
I/DEBUG ( 108): 45017a24 001c0a08 [heap]
I/DEBUG ( 108): 45017a28 df002777
I/DEBUG ( 108): 45017a2c e3a070ad
I/DEBUG ( 108): 45017a30 00000000
I/DEBUG ( 108): #01 45017a34 001c0a08 [heap]
I/DEBUG ( 108): 45017a38 aa073e55 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a3c aa14bf1b /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a40 001c0a08 [heap]
I/DEBUG ( 108): 45017a44 001bfd08 [heap]
I/DEBUG ( 108): 45017a48 001c0a08 [heap]
I/DEBUG ( 108): 45017a4c aa1aa761 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a50 001c0a08 [heap]
I/DEBUG ( 108): 45017a54 aa183c9b /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a58 0000000a
I/DEBUG ( 108): 45017a5c 45017aa8
I/DEBUG ( 108): 45017a60 aa3db598 /system/lib/libwebcore.so
I/DEBUG ( 108): 45017a64 00000000
I/DEBUG ( 108): 45017a68 00000000
I/DEBUG ( 108): 45017a6c 00000000
I/DEBUG ( 108): 45017a70 00000000
I/DEBUG ( 108): 45017a74 00000000
I/DEBUG ( 108): 45017a78 00000000
I/ActivityManager( 127): Process com.android.browser (pid 404) has died.
I/WindowManager( 127): WIN DEATH: Window{438c7088 com.android.browser/com.andro
id.browser.BrowserActivity paused=false}
I/DEBUG ( 108): debuggerd committing suicide to free the zombie!
D/Zygote ( 110): Process 404 terminated by signal (11)
I/DEBUG ( 417): debuggerd: May 13 2009 19:02:52
W/InputManagerService( 127): Window already focused, ignoring focus gain of: co
[email protected]
D/dalvikvm( 208): GC freed 196 objects / 8496 bytes in 128ms
Any idea what could be causing this? My phone is running the 32B engineering SPL and RAv1.1.2 recovery. I have tried mounting over usb, adb, and putting the card in a reader to upload the update.zip to the card. I have tried wiping several times before flashing. I have tried different mSD cards, and using different computers to push the files. I am really stumped as to why I cannot run Browser yet seemingly everyone else with a 32B phone can.
I'm willing to test updates in an attempt to fix the problem. Any help really appreciated!
Using nk02's rom, this is the logcat output of the wizard after pressing next on the screen where it asks if google can collect location data. If I've not skipped giving it the google login details, the phone will get stuck on a screen saying 'Signed in!', with a dimmed next button. If I skip giving it the google login details, and attempt to pass the collect location data screen, it'll show 'Date & Time settings' briefly at the top before looping back to the sign in screen with the same output to logcat
Code:
I/ServiceStateTracker( 119): Auto time state changed
I/ActivityManager( 56): Starting activity: Intent { comp={com.android.settings
/com.android.settings.DateTimeSettingsSetupWizard} }
I/ActivityManager( 56): Start proc com.android.settings for activity com.andro
id.settings/.DateTimeSettingsSetupWizard: pid=445 uid=1000 gids={3002, 3001, 300
3}
D/dalvikvm( 34): GC freed 277 objects / 10448 bytes in 342ms
D/dalvikvm( 34): GC freed 42 objects / 1864 bytes in 164ms
D/dalvikvm( 34): GC freed 2 objects / 56 bytes in 187ms
I/DEBUG ( 325): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** *
**
I/DEBUG ( 325): Build fingerprint: 'google_ion/google_ion/sapphire/sapphire:1
.5/CRB43/148830:user/adp,test-keys'
I/DEBUG ( 325): pid: 445, tid: 445 >>> com.android.settings <<<
I/DEBUG ( 325): signal 4 (SIGILL), fault addr ad494ce8
I/DEBUG ( 325): r0 bef87f00 r1 bef87ee0 r2 00000000 r3 00000002
I/DEBUG ( 325): r4 001a78c4 r5 fff8df51 r6 ad4abbf8 r7 bef87778
I/DEBUG ( 325): r8 bef88124 r9 bef88124 10 ad4abdd0 fp ad4abdd0
I/DEBUG ( 325): ip ad4abf20 sp bef87698 lr ad496e3d pc ad494ce8 cpsr 800
00030
I/DEBUG ( 325): #00 pc 00094ce8 /system/lib/libicui18n.so
I/DEBUG ( 325): #01 lr ad496e3d /system/lib/libicui18n.so
I/DEBUG ( 325): stack:
I/DEBUG ( 325): bef87658 afe39dd0
I/DEBUG ( 325): bef8765c bef88124 [stack]
I/DEBUG ( 325): bef87660 ad4abdd0
I/DEBUG ( 325): bef87664 00000000
I/DEBUG ( 325): bef87668 bef87f00 [stack]
I/DEBUG ( 325): bef8766c 00000003
I/DEBUG ( 325): bef87670 001a78c4 [heap]
I/DEBUG ( 325): bef87674 ad533619 /system/lib/libicuuc.so
I/DEBUG ( 325): bef87678 00000000
I/DEBUG ( 325): bef8767c 00000000
I/DEBUG ( 325): bef87680 001a78a0 [heap]
I/DEBUG ( 325): bef87684 001a78c4 [heap]
I/DEBUG ( 325): bef87688 ad53a4a5 /system/lib/libicuuc.so
I/DEBUG ( 325): bef8768c 001a78c4 [heap]
I/DEBUG ( 325): bef87690 df002777
I/DEBUG ( 325): bef87694 e3a070ad
I/DEBUG ( 325): #00 bef87698 bef88124 [stack]
I/DEBUG ( 325): bef8769c 00000000
I/DEBUG ( 325): bef876a0 00000000
I/DEBUG ( 325): bef876a4 00000000
I/DEBUG ( 325): bef876a8 ffffffff
I/DEBUG ( 325): bef876ac 00000000
I/DEBUG ( 325): bef876b0 00000000
I/DEBUG ( 325): bef876b4 00000000
I/DEBUG ( 325): bef876b8 00000000
I/DEBUG ( 325): bef876bc 00000000
I/DEBUG ( 325): bef876c0 00000000
I/DEBUG ( 325): bef876c4 00000000
I/DEBUG ( 325): bef876c8 00000000
I/DEBUG ( 325): bef876cc 00000000
I/DEBUG ( 325): bef876d0 00000000
I/DEBUG ( 325): bef876d4 bef87c78 [stack]
I/DEBUG ( 325): bef876d8 000005b8
I/DEBUG ( 325): bef876dc 00000000
I/ActivityManager( 56): Process com.android.settings (pid 445) has died.
D/Zygote ( 34): Process 445 terminated by signal (4)
W/InputManagerService( 56): Window already focused, ignoring focus gain of: co
[email protected]
I/ActivityManager( 56): Displayed activity com.android.setupwizard/.CloseAndLa
unchActivity: 117600 ms
If anyone has any idea what I'm doing wrong can they please inform me. Is my phone faulty? Everything else appears to be working fine. The flash completes without errors and the phone boots into a usable state with all hardware functioning fine.
nk02's ROM is unusable as I cannot get past the setup wizard. It just respawns if I kill it.
I'd love to get this sorted as my phone is useless at the moment
Just had a similar issue with SuperD v1.8. Browser and market would crash on startup. Library file /system/lib/libwebcore.so was causing it due to corruption during rom flashing. Not sure why this suddenly started to happen but if you check the file size it is correct, but the md5sum will differ from one extracted from the rom zip file. I pushed the extracted library to /system/lib and it fixed the issue. Of course you have to do this with /system mounted r/w.
The only thing I can think of is the recovery image is causing it since unzipping this file on my linux box produces a working library. Unzipping from recovery produces a corrupt file.
Just had a similar issue with SuperD v1.8. Browser and market would crash on startup. Library file /system/lib/libwebcore.so was causing it due to corruption during rom flashing. Not sure why this suddenly started to happen but if you check the file size it is correct, but the md5sum will differ from one extracted from the rom zip file. I pushed the extracted library to /system/lib and it fixed the issue. Of course you have to do this with /system mounted r/w.
The only thing I can think of is the recovery image is causing it since unzipping this file on my linux box produces a working library. Unzipping from recovery produces a corrupt file.
tmusall said:
Just had a similar issue with SuperD v1.8. Browser and market would crash on startup. Library file /system/lib/libwebcore.so was causing it due to corruption during rom flashing. Not sure why this suddenly started to happen but if you check the file size it is correct, but the md5sum will differ from one extracted from the rom zip file. I pushed the extracted library to /system/lib and it fixed the issue. Of course you have to do this with /system mounted r/w.
The only thing I can think of is the recovery image is causing it since unzipping this file on my linux box produces a working library. Unzipping from recovery produces a corrupt file.
Click to expand...
Click to collapse
Here's what I tried:
Using fastboot erase the recovery partition. Again from fastboot flash recovery-RA-sapphire-v1.5.2G.img. This is for a myTouch 3G, so if you've got a G1 use the proper recovery image. Reboot.
Reboot into recovery and flashed rom NexusSuperD18.zip.
From adb shell:
md5sum of /system/lib/libwebcore.so - 96a7cef79de087111c84c76f50353b18 (Correct checksum)
Reboot and let rom initialize. Fire up Browser and is still crashes!
Reboot back to recovery and check md5sum again:
/system/lib # md5sum libwebcore.so
03e1950b02dd5fb1f00750065aea66d1 libwebcore.so (WRONG!)
Something during first boot initialization has corrupted this library. I've got no idea what is causing this, but for now the only way to get it working is to push a good library in its place.
I have got problem while porting JB rom for Gtab P7320.
I cant boot into JB beacuse the error is looping
Code:
I/SystemServer( 291): LockSettingsService
I/SystemServer( 291): Device Policy
I/SystemServer( 291): Status Bar
I/SystemServer( 291): Clipboard Service
I/SystemServer( 291): NetworkManagement Service
E/NetdConnector( 291): Communications error: java.io.IOException: Connection refused
E/NetdConnector( 291): Error in NativeDaemonConnector: java.io.IOException: Connection refused
I have tried with plenty of JB/CM10 netd binaries from similar devices, but the same.
I have tried also orginal netd binary from orginal P7320 ICS, netdconnector error get away, but im getting another one..
Code:
E/mDnsConnector( 293): Communications error: java.io.IOException: Connection refused
E/mDnsConnector( 293): Error in NativeDaemonConnector: java.io.IOException: Connection refused
I have read the error is related with netd binary, so i think its nearly of the same...
Im using 3.0.8 ICS stock kernel for P7320 and i have modified init.rc and init.trace.rc in boot.img comparing them to gtab I957 CM10 source
libsysutils.so is the key...
If have replace it with JB's libsysutils.so library netd start normaly
but i have got next one bug related with the file...
Code:
W/MountService( 454): Thread android.server.ServerThread still waiting for MountService ready...
F/libc ( 626): Fatal signal 11 (SIGSEGV) at 0x00000000 (code=1), thread 626 (vold)
I/Vold ( 626): Vold 2.1 (the revenge) firing up
E/Vold ( 626): created DirEncryptionManager
D/Vold ( 626): Volume SdCard state changing -1 (Initializing) -> 0 (No-Media)
I/DEBUG ( 161): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 161): Build fingerprint: 'samsung/GT-P7320/GT-P7320:4.0.4/IMM76D/XXLPC:user/release-keys'
I/DEBUG ( 161): pid: 626, tid: 626, name: vold >>> /system/bin/vold <<<
I/DEBUG ( 161): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000000
I/DEBUG ( 161): r0 0135f7a0 r1 00000000 r2 beeed81c r3 00000000
I/DEBUG ( 161): r4 00000000 r5 400ef898 r6 0135f770 r7 0135f784
I/DEBUG ( 161): r8 0000025d r9 beeed81c sl 00000000 fp 0000171a
I/DEBUG ( 161): ip 400f1f64 sp beeed7d0 lr 400ee1a3 pc 400ee1ba cpsr 400f0030
I/DEBUG ( 161): d0 732f6d726f667461 d1 69636864732d6333
I/DEBUG ( 161): d2 685f636d6d2f322e d3 31636d6d2f74736f
I/DEBUG ( 161): d4 0000000000000000 d5 0000000000000000
I/DEBUG ( 161): d6 0000000000000000 d7 0000000000000000
I/DEBUG ( 161): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 161): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 161): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 161): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 161): d16 6320657461747320 d17 66206465676e6168
I/DEBUG ( 161): d18 0000000000000000 d19 0000000000000000
I/DEBUG ( 161): d20 0000000000000000 d21 0000000000000000
I/DEBUG ( 161): d22 0000000000000000 d23 0000000000000000
I/DEBUG ( 161): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 161): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 161): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 161): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 161): scr 00000010
I/DEBUG ( 161):
I/DEBUG ( 161): backtrace:
I/DEBUG ( 161): #00 pc 000021ba /system/lib/libsysutils.so (SocketListener::sendBroadcast(int, char const*, bool)+45)
I/DEBUG ( 161): #01 pc 00006c11 /system/bin/vold
I/DEBUG ( 161):
I/DEBUG ( 161): stack:
I/DEBUG ( 161): beeed790 00000000
I/DEBUG ( 161): beeed794 00000000
I/DEBUG ( 161): beeed798 00004000
I/DEBUG ( 161): beeed79c beeed87d [stack]
I/DEBUG ( 161): beeed7a0 00000000
I/DEBUG ( 161): beeed7a4 0000009d
I/DEBUG ( 161): beeed7a8 ffff0208 [vectors]
I/DEBUG ( 161): beeed7ac beeed81c [stack]
I/DEBUG ( 161): beeed7b0 000000fe
I/DEBUG ( 161): beeed7b4 00000000
I/DEBUG ( 161): beeed7b8 01360930 [heap]
I/DEBUG ( 161): beeed7bc ffffffff
I/DEBUG ( 161): beeed7c0 0135f770 [heap]
I/DEBUG ( 161): beeed7c4 0135f784 [heap]
I/DEBUG ( 161): beeed7c8 df0027ad
I/DEBUG ( 161): beeed7cc 00000000
I/DEBUG ( 161): #00 beeed7d0 00000000
I/DEBUG ( 161): beeed7d4 0000025d
I/DEBUG ( 161): beeed7d8 beeed81c [stack]
I/DEBUG ( 161): beeed7dc 01360930 [heap]
I/DEBUG ( 161): beeed7e0 ffffffff
I/DEBUG ( 161): beeed7e4 beeed81c [stack]
I/DEBUG ( 161): beeed7e8 0001990d /system/bin/vold
I/DEBUG ( 161): beeed7ec 00000000
I/DEBUG ( 161): beeed7f0 beeedaed [stack]
I/DEBUG ( 161): beeed7f4 beeedadc [stack]
I/DEBUG ( 161): beeed7f8 4013cd00
I/DEBUG ( 161): beeed7fc 0000ec15 /system/bin/vold
I/DEBUG ( 161): #01 beeed800 01360d30 [heap]
I/DEBUG ( 161): beeed804 ffffffff
I/DEBUG ( 161): beeed808 0001990d /system/bin/vold
I/DEBUG ( 161): beeed80c 00000000
I/DEBUG ( 161): beeed810 0001991a /system/bin/vold
I/DEBUG ( 161): beeed814 00000000
I/DEBUG ( 161): beeed818 0001e260 /system/bin/vold
I/DEBUG ( 161): beeed81c 756c6f56
I/DEBUG ( 161): beeed820 5320656d
I/DEBUG ( 161): beeed824 72614364
I/DEBUG ( 161): beeed828 6d2f2064
I/DEBUG ( 161): beeed82c 732f746e
I/DEBUG ( 161): beeed830 72616364
I/DEBUG ( 161): beeed834 78652f64
I/DEBUG ( 161): beeed838 6f745374
I/DEBUG ( 161): beeed83c 65676172
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r0:
I/DEBUG ( 161): 0135f780 0135f7a0 00000001 00000000 00000000 ..5.............
I/DEBUG ( 161): 0135f790 00000000 00000000 00000000 00000000 ................
I/DEBUG ( 161): 0135f7a0 400f1d00 0135f7c0 00000000 00000013 [email protected]
I/DEBUG ( 161): 0135f7b0 00000000 0135f7b0 0135f7b0 00000013 ......5...5.....
I/DEBUG ( 161): 0135f7c0 400f1d68 0135f7d0 00000000 00000013 [email protected]
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r2:
I/DEBUG ( 161): beeed7fc 0000ec15 01360d30 ffffffff 0001990d ....0.6.........
I/DEBUG ( 161): beeed80c 00000000 0001991a 00000000 0001e260 ............`...
I/DEBUG ( 161): beeed81c 756c6f56 5320656d 72614364 6d2f2064 Volume SdCard /m
I/DEBUG ( 161): beeed82c 732f746e 72616364 78652f64 6f745374 nt/sdcard/extSto
I/DEBUG ( 161): beeed83c 65676172 64532f73 64726143 61747320 rages/SdCard sta
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r5:
I/DEBUG ( 161): 400ef878 00000000 00000000 00000000 00000000 ................
I/DEBUG ( 161): 400ef888 00000000 00000000 00000000 00000000 ................
I/DEBUG ( 161): 400ef898 6b636f53 694c7465 6e657473 45007265 SocketListener.E
I/DEBUG ( 161): 400ef8a8 726f7272 69727720 676e6974 206f7420 rror writing to
I/DEBUG ( 161): 400ef8b8 746e6f63 206c6f72 65706970 73252820 control pipe (%s
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r6:
I/DEBUG ( 161): 0135f750 00000273 00000000 00000000 00000000 s...............
I/DEBUG ( 161): 0135f760 00000001 00000000 40c29f00 00000033 [email protected]
I/DEBUG ( 161): 0135f770 0001e090 00000001 000197ec ffffffff ................
I/DEBUG ( 161): 0135f780 0135f7a0 00000001 00000000 00000000 ..5.............
I/DEBUG ( 161): 0135f790 00000000 00000000 00000000 00000000 ................
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r7:
I/DEBUG ( 161): 0135f764 00000000 40c29f00 00000033 0001e090 [email protected]
I/DEBUG ( 161): 0135f774 00000001 000197ec ffffffff 0135f7a0 ..............5.
I/DEBUG ( 161): 0135f784 00000001 00000000 00000000 00000000 ................
I/DEBUG ( 161): 0135f794 00000000 00000000 00000000 400f1d00 [email protected]
I/DEBUG ( 161): 0135f7a4 0135f7c0 00000000 00000013 00000000 ..5.............
I/DEBUG ( 161):
I/DEBUG ( 161): memory near r9:
I/DEBUG ( 161): beeed7fc 0000ec15 01360d30 ffffffff 0001990d ....0.6.........
I/DEBUG ( 161): beeed80c 00000000 0001991a 00000000 0001e260 ............`...
I/DEBUG ( 161): beeed81c 756c6f56 5320656d 72614364 6d2f2064 Volume SdCard /m
I/DEBUG ( 161): beeed82c 732f746e 72616364 78652f64 6f745374 nt/sdcard/extSto
I/DEBUG ( 161): beeed83c 65676172 64532f73 64726143 61747320 rages/SdCard sta
I/DEBUG ( 161):
I/DEBUG ( 161): memory near fp:
I/DEBUG ( 161): 000016f8 ffffffff ffffffff ffffffff ffffffff ................
I/DEBUG ( 161): 00001708 ffffffff ffffffff ffffffff ffffffff ................
I/DEBUG ( 161): 00001718 ffffffff ffffffff ffffffff ffffffff ................
I/DEBUG ( 161): 00001728 ffffffff ffffffff ffffffff ffffffff ................
I/DEBUG ( 161): 00001738 ffffffff ffffffff ffffffff ffffffff ................
I/DEBUG ( 161):
I/DEBUG ( 161): memory near ip:
I/DEBUG ( 161): 400f1f44 40105414 40022901 40022901 400ffaac [email protected])[email protected])[email protected]@
I/DEBUG ( 161): 400f1f54 40106cd5 40115ce1 401062d0 400e34e1 [email protected]\[email protected]@[email protected]
I/DEBUG ( 161): 400f1f64 40105628 40105728 40101300 40101508 ([email protected]([email protected]@[email protected]
I/DEBUG ( 161): 400f1f74 40115dfd 40112821 40115131 4010073c .][email protected]!([email protected]@<[email protected]
I/DEBUG ( 161): 400f1f84 400ffd8c 40105cec 4010a4e5 4002290f [email protected]\[email protected]@.)[email protected]
I/DEBUG ( 161):
I/DEBUG ( 161): memory near sp:
I/DEBUG ( 161): beeed7b0 000000fe 00000000 01360930 ffffffff ........0.6.....
I/DEBUG ( 161): beeed7c0 0135f770 0135f784 df0027ad 00000000 p.5...5..'......
I/DEBUG ( 161): beeed7d0 00000000 0000025d beeed81c 01360930 ....].......0.6.
I/DEBUG ( 161): beeed7e0 ffffffff beeed81c 0001990d 00000000 ................
I/DEBUG ( 161): beeed7f0 beeedaed beeedadc 4013cd00 0000ec15 [email protected]
I/DEBUG ( 161):
I/DEBUG ( 161): code around pc:
I/DEBUG ( 161): 400ee198 46884638 f7ff4691 6930ee00 f8df4d13 8F.F.F....0i.M..
I/DEBUG ( 161): 400ee1a8 6843b050 689c447d 2100e016 9100464a P.Ch}D.h...!JF..
I/DEBUG ( 161): 400ee1b8 68204653 f0014641 b160f829 edd4f7ff SF hAF..).`.....
I/DEBUG ( 161): 400ee1c8 f7ff6800 465bedd8 447b2105 9000462a .h....[F.!{D*F..
I/DEBUG ( 161): 400ee1d8 f7ff2003 68a4eddc 685a6933 d1e44294 . .....h3iZh.B..
I/DEBUG ( 161):
I/DEBUG ( 161): code around lr:
I/DEBUG ( 161): 400ee180 000017a7 0000177c 000017ac 4ff7e92d ....|.......-..O
I/DEBUG ( 161): 400ee190 0714f100 469a4606 46884638 f7ff4691 .....F.F8F.F.F..
I/DEBUG ( 161): 400ee1a0 6930ee00 f8df4d13 6843b050 689c447d ..0i.M..P.Ch}D.h
I/DEBUG ( 161): 400ee1b0 2100e016 9100464a 68204653 f0014641 ...!JF..SF hAF..
I/DEBUG ( 161): 400ee1c0 b160f829 edd4f7ff f7ff6800 465bedd8 ).`......h....[F
E/VoldConnector( 454): Communications error: java.io.IOException: No such file or directory
E/VoldConnector( 454): Error in NativeDaemonConnector: java.io.IOException: No such file or directory
Hello!
I recently got a Galaxy R and flashed it with CM 10.1 (cm-10.1-20140216-NIGHTLY-i9103 at first, then experimental: cm-10.1-20130806-EXPERIMENTAL-i9103). When typing in chats/texts, the keyboard will crash after every letter. It disappears and takes 3-4 seconds to reappear, only to crash again. Also, I never see word suggestions, the bar above the keyboard simply stays empty.
Here is a logcat of what's happening:
Code:
F/libc ( 3185): Fatal signal 4 (SIGILL) at 0x4ff1c3a8 (code=1), thread 3185 (putmethod.latin)
I/DEBUG ( 114): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 114): Build fingerprint: 'Samsung/cm_i9103/i9103:4.2.2/JDQ39E/eng.jenkins.20130806.042300:userdebug/test-keys'
I/DEBUG ( 114): Revision: '13'
I/DEBUG ( 114): pid: 3185, tid: 3185, name: putmethod.latin >>> com.android.inputmethod.latin <<<
I/DEBUG ( 114): signal 4 (SIGILL), code 1 (ILL_ILLOPC), fault addr 4ff1c3ac
I/DEBUG ( 114): r0 3e0de338 r1 40000000 r2 00000000 r3 00000003
I/DEBUG ( 114): r4 00000001 r5 beaadcec r6 beaae4e8 r7 fffffffe
I/DEBUG ( 114): r8 00000000 r9 52ed7d88 sl 515e2d50 fp beaadc80
I/DEBUG ( 114): ip 3f800000 sp beaadbe0 lr 4ff1878d pc 4ff1c3ac cpsr 800f0030
I/DEBUG ( 114): d0 3ed4d4d53f800000 d1 400000003f2aaaab
I/DEBUG ( 114): d2 0000000200000003 d3 0000005a000001a8
I/DEBUG ( 114): d4 440e946e44077368 d5 00000000439a0000
I/DEBUG ( 114): d6 3f80000000000001 d7 3e0de33840000000
I/DEBUG ( 114): d8 0000000000000000 d9 41a000003f000000
I/DEBUG ( 114): d10 0000000041e80000 d11 0000000000000000
I/DEBUG ( 114): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 114): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 114): scr 20000013
I/DEBUG ( 114):
I/DEBUG ( 114): backtrace:
I/DEBUG ( 114): #00 pc 000123ac /system/lib/libjni_latinime.so (latinime::UnigramDictionary::getWordSuggestions(latinime::ProximityInfo*, int const*, int const*, int const*, int, std::map<int, int, std::less<int>, std::allocator<std::pair<int const, int> > > const*, unsigned char const*, bool, latinime::Correction*, latinime::WordsPriorityQueuePool*) const+107)
I/DEBUG ( 114): #01 pc 000129af /system/lib/libjni_latinime.so (latinime::UnigramDictionary::getSuggestions(latinime::ProximityInfo*, int const*, int const*, int const*, int, std::map<int, int, std::less<int>, std::allocator<std::pair<int const, int> > > const*, unsigned char const*, bool, unsigned short*, int*, int*) const+1002)
I/DEBUG ( 114): #02 pc 0000eb3d /system/lib/libjni_latinime.so (latinime::Dictionary::getSuggestions(latinime::ProximityInfo*, void*, int*, int*, int*, int*, int*, int, int*, int, int, bool, bool, unsigned short*, int*, int*, int*) const+244)
I/DEBUG ( 114): #03 pc 0000c56b /system/lib/libjni_latinime.so
I/DEBUG ( 114): #04 pc 0001e490 /system/lib/libdvm.so (dvmPlatformInvoke+112)
I/DEBUG ( 114): #05 pc 0004d255 /system/lib/libdvm.so (dvmCallJNIMethod(unsigned int const*, JValue*, Method const*, Thread*)+396)
I/DEBUG ( 114): #06 pc 000278a0 /system/lib/libdvm.so
I/DEBUG ( 114): #07 pc 0002b7cc /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*)+176)
I/DEBUG ( 114): #08 pc 0005fd4b /system/lib/libdvm.so (dvmInvokeMethod(Object*, Method const*, ArrayObject*, ArrayObject*, ClassObject*, bool)+374)
I/DEBUG ( 114): #09 pc 000677a1 /system/lib/libdvm.so
I/DEBUG ( 114): #10 pc 000278a0 /system/lib/libdvm.so
I/DEBUG ( 114): #11 pc 0002b7cc /system/lib/libdvm.so (dvmInterpret(Thread*, Method const*, JValue*)+176)
I/DEBUG ( 114): #12 pc 0005fa75 /system/lib/libdvm.so (dvmCallMethodV(Thread*, Method const*, Object*, bool, JValue*, std::__va_list)+272)
I/DEBUG ( 114): #13 pc 0004983f /system/lib/libdvm.so
I/DEBUG ( 114): #14 pc 0004773d /system/lib/libandroid_runtime.so
I/DEBUG ( 114): #15 pc 000483e7 /system/lib/libandroid_runtime.so (android::AndroidRuntime::start(char const*, char const*)+390)
I/DEBUG ( 114): #16 pc 00000db7 /system/bin/app_process
I/DEBUG ( 114): #17 pc 0001272b /system/lib/libc.so (__libc_init+38)
I/DEBUG ( 114): #18 pc 00000ae8 /system/bin/app_process
I/DEBUG ( 114):
I/DEBUG ( 114): stack:
I/DEBUG ( 114): beaadba0 3f000000
I/DEBUG ( 114): beaadba4 41a00000 /dev/ashmem/dalvik-heap (deleted)
I/DEBUG ( 114): beaadba8 00000003
I/DEBUG ( 114): beaadbac 00000003
I/DEBUG ( 114): beaadbb0 00000001
I/DEBUG ( 114): beaadbb4 00000003
I/DEBUG ( 114): beaadbb8 516522b2
I/DEBUG ( 114): beaadbbc 4ff1878d /system/lib/libjni_latinime.so (latinime::Correction::RankingAlgorithm::calcNormalizedScore(unsigned short const*, int, unsigned short const*, int, int)+100)
I/DEBUG ( 114): beaadbc0 00000003
I/DEBUG ( 114): beaadbc4 00000001
I/DEBUG ( 114): beaadbc8 beaadcec [stack]
I/DEBUG ( 114): beaadbcc beaae4e8 [stack]
I/DEBUG ( 114): beaadbd0 beaadc90 [stack]
I/DEBUG ( 114): beaadbd4 00000000
I/DEBUG ( 114): beaadbd8 df0027ad
I/DEBUG ( 114): beaadbdc 00000000
I/DEBUG ( 114): #00 beaadbe0 000001a8
I/DEBUG ( 114): beaadbe4 beaae4e8 [stack]
I/DEBUG ( 114): beaadbe8 beaadcec [stack]
I/DEBUG ( 114): beaadbec 00000001
I/DEBUG ( 114): beaadbf0 00000002
I/DEBUG ( 114): beaadbf4 00000000
I/DEBUG ( 114): beaadbf8 beaadcec [stack]
I/DEBUG ( 114): beaadbfc beaadc80 [stack]
I/DEBUG ( 114): beaadc00 beab4580 [stack]
I/DEBUG ( 114): beaadc04 beaadc70 [stack]
I/DEBUG ( 114): beaadc08 00002000
I/DEBUG ( 114): beaadc0c 00000001
I/DEBUG ( 114): beaadc10 beaadcec [stack]
I/DEBUG ( 114): beaadc14 52ed7d88
I/DEBUG ( 114): beaadc18 beaadca8 [stack]
I/DEBUG ( 114): beaadc1c 00000000
I/DEBUG ( 114): ........ ........
I/DEBUG ( 114): #01 beaadc30 beaadc90 [stack]
I/DEBUG ( 114): beaadc34 00000001
I/DEBUG ( 114): beaadc38 beab2ad4 [stack]
I/DEBUG ( 114): beaadc3c beab2aec [stack]
I/DEBUG ( 114): beaadc40 00000000
I/DEBUG ( 114): beaadc44 beaae4e8 [stack]
I/DEBUG ( 114): beaadc48 beaadcec [stack]
I/DEBUG ( 114): beaadc4c beab4498 [stack]
I/DEBUG ( 114): beaadc50 00000001
I/DEBUG ( 114): beaadc54 00000000
I/DEBUG ( 114): beaadc58 beaadc90 [stack]
I/DEBUG ( 114): beaadc5c beaae4e8 [stack]
I/DEBUG ( 114): beaadc60 beaadcec [stack]
I/DEBUG ( 114): beaadc64 4ff26f30 /system/lib/libjni_latinime.so (latinime::UnigramDictionary::GERMAN_UMLAUT_DIGRAPHS)
I/DEBUG ( 114): beaadc68 00000003
I/DEBUG ( 114): beaadc6c 00000000
I/DEBUG ( 114): ........ ........
I/DEBUG ( 114): #02 beab2a68 beab4498 [stack]
I/DEBUG ( 114): beab2a6c 00000001
I/DEBUG ( 114): beab2a70 beab2ad4 [stack]
I/DEBUG ( 114): beab2a74 beab2aec [stack]
I/DEBUG ( 114): beab2a78 00000000
I/DEBUG ( 114): beab2a7c beab2e08 [stack]
I/DEBUG ( 114): beab2a80 beab2d10 [stack]
I/DEBUG ( 114): beab2a84 beab2bd0 [stack]
I/DEBUG ( 114): beab2a88 00000007
I/DEBUG ( 114): beab2a8c 4ff3b9e0
I/DEBUG ( 114): beab2a90 00000003
I/DEBUG ( 114): beab2a94 515e2d50
I/DEBUG ( 114): beab2a98 beab4590 [stack]
I/DEBUG ( 114): beab2a9c beab4580 [stack]
I/DEBUG ( 114): beab2aa0 beab4570 [stack]
I/DEBUG ( 114): beab2aa4 beab4560 [stack]
I/DEBUG ( 114): ........ ........
I/DEBUG ( 114):
I/DEBUG ( 114): memory near r0:
I/DEBUG ( 114): 3e0de318 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de328 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de338 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de348 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de358 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de368 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de378 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de388 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de398 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3a8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3b8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3c8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3d8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3e8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de3f8 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3e0de408 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114):
I/DEBUG ( 114): memory near r1:
I/DEBUG ( 114): 3fffffe0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3ffffff0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 40000000 00000000 0000200b 00007fff 00000000
I/DEBUG ( 114): 40000010 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000020 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000030 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000040 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000050 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000060 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000070 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000080 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 40000090 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 400000a0 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 400000b0 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 400000c0 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 400000d0 00000000 00000000 00000000 00000000
I/DEBUG ( 114):
I/DEBUG ( 114): memory near r5:
I/DEBUG ( 114): beaadccc 00001500 00000000 beab2aec beab2ad4
I/DEBUG ( 114): beaadcdc beab4580 beab4590 515e2d50 00000000
I/DEBUG ( 114): beaadcec 4ff28940 4ff28950 51709a20 51709a68
I/DEBUG ( 114): beaadcfc 51709aa0 00000000 00000012 00000030
I/DEBUG ( 114): beaadd0c 51652008 516522a8 4ff28950 00000000
I/DEBUG ( 114): beaadd1c 00000000 00000000 00000000 00000001
I/DEBUG ( 114): beaadd2c 00000030 51584b78 00000000 4ff28950
I/DEBUG ( 114): beaadd3c 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaadd4c 00000001 00000030 5165f008 00000000
I/DEBUG ( 114): beaadd5c 4ff28950 00000000 00000000 00000000
I/DEBUG ( 114): beaadd6c 00000000 00000001 00000030 515e78a8
I/DEBUG ( 114): beaadd7c 00000000 4ff28950 00000000 00000000
I/DEBUG ( 114): beaadd8c 00000000 00000000 00000001 00000030
I/DEBUG ( 114): beaadd9c 516c3798 00000000 4ff28950 00000000
I/DEBUG ( 114): beaaddac 00000000 00000000 00000000 00000001
I/DEBUG ( 114): beaaddbc 00000030 515f9b60 00000000 4ff28950
I/DEBUG ( 114):
I/DEBUG ( 114): memory near r6:
I/DEBUG ( 114): beaae4c8 beaae2fc beaae320 beaae344 beaae368
I/DEBUG ( 114): beaae4d8 beaae38c beaae3b0 beaae3d4 beaae3f8
I/DEBUG ( 114): beaae4e8 4ff28960 515e2d50 00000100 00000002
I/DEBUG ( 114): beaae4f8 00000003 00000001 ffffffff ffffffff
I/DEBUG ( 114): beaae508 00000001 00000003 00000002 00fc0001
I/DEBUG ( 114): beaae518 00720062 00000069 00000000 00000000
I/DEBUG ( 114): beaae528 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae538 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae548 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae558 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae568 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae578 ffffffff 000017fa ffffffff ffffffff
I/DEBUG ( 114): beaae588 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae598 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae5a8 00000000 00000000 00000000 00000000
I/DEBUG ( 114): beaae5b8 00000000 00000000 00000000 00000000
I/DEBUG ( 114):
I/DEBUG ( 114): memory near r9:
I/DEBUG ( 114): 52ed7d68 538495c0 00188056 00000026 00000568
I/DEBUG ( 114): 52ed7d78 52ed7d88 527de350 52d4caa0 0000003b
I/DEBUG ( 114): 52ed7d88 4ff28980 538495c0 00000030 00000012
I/DEBUG ( 114): 52ed7d98 00000002 00000002 00000000 00000004
I/DEBUG ( 114): 52ed7da8 00000005 00000001 00000000 00000000
I/DEBUG ( 114): 52ed7db8 00000038 00000023 00750045 006f0072
I/DEBUG ( 114): 52ed7dc8 00650070 0052002f 006d006f 00000065
I/DEBUG ( 114): 52ed7dd8 4e8e6650 0000003b 40695a68 40695af4
I/DEBUG ( 114): 52ed7de8 00000005 00000011 5313b328 00000000
I/DEBUG ( 114): 52ed7df8 5313b370 00000015 00000000 00000000
I/DEBUG ( 114): 52ed7e08 5313b2f8 00000000 00000000 00000023
I/DEBUG ( 114): 52ed7e18 40695d20 00000001 00000008 52fc56c0
I/DEBUG ( 114): 52ed7e28 40776e45 00000000 00000000 0000001b
I/DEBUG ( 114): 52ed7e38 407b7378 52736150 012bb300 00000000
I/DEBUG ( 114): 52ed7e48 00000018 00000023 40695d20 00000001
I/DEBUG ( 114): 52ed7e58 00000008 52ed7e70 40776e45 00000000
I/DEBUG ( 114):
I/DEBUG ( 114): memory near sl:
I/DEBUG ( 114): 515e2d30 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 515e2d40 00000000 00000000 03030303 00004b5b
I/DEBUG ( 114): 515e2d50 00000010 00000020 00000010 00000030
I/DEBUG ( 114): 515e2d60 00000900 0000000f 00000014 00000021
I/DEBUG ( 114): 515e2d70 000001e0 00000134 00656401 00000000
I/DEBUG ( 114): 515e2d80 ff000000 514f3008 000000dc 000000ac
I/DEBUG ( 114): 515e2d90 0000004c 00000184 00000124 0000016c
I/DEBUG ( 114): 515e2da0 0000019c 00000094 0000013c 0000001c
I/DEBUG ( 114): 515e2db0 000000dc 0000007c 0000010c 000000c4
I/DEBUG ( 114): 515e2dc0 0000019c 000000f4 00000064 0000004c
I/DEBUG ( 114): 515e2dd0 00000004 0000019c 0000016c 0000013c
I/DEBUG ( 114): 515e2de0 0000007c 0000010c 0000004c 0000016c
I/DEBUG ( 114): 515e2df0 00000004 00000004 000000ac 00000034
I/DEBUG ( 114): 515e2e00 00000154 0000007c 000001b4 00000000
I/DEBUG ( 114): 515e2e10 00000000 00000000 00000000 00000000
I/DEBUG ( 114): 515e2e20 ffffffff 002e0064 006e0069 00750070
I/DEBUG ( 114):
I/DEBUG ( 114): memory near fp:
I/DEBUG ( 114): beaadc60 beaadcec 4ff26f30 00000003 00000000
I/DEBUG ( 114): beaadc70 000000ac 00000000 00000000 00000000
I/DEBUG ( 114): beaadc80 00000115 00000000 00000000 00000000
I/DEBUG ( 114): beaadc90 00000062 00000000 00000000 00000000
I/DEBUG ( 114): beaadca0 00000000 00000000 00000000 00000001
I/DEBUG ( 114): beaadcb0 4ff28f54 52ed7d88 4ff28950 401c0228
I/DEBUG ( 114): beaadcc0 beab2bd0 beab2d10 beab2e08 00001500
I/DEBUG ( 114): beaadcd0 00000000 beab2aec beab2ad4 beab4580
I/DEBUG ( 114): beaadce0 beab4590 515e2d50 00000000 4ff28940
I/DEBUG ( 114): beaadcf0 4ff28950 51709a20 51709a68 51709aa0
I/DEBUG ( 114): beaadd00 00000000 00000012 00000030 51652008
I/DEBUG ( 114): beaadd10 516522a8 4ff28950 00000000 00000000
I/DEBUG ( 114): beaadd20 00000000 00000000 00000001 00000030
I/DEBUG ( 114): beaadd30 51584b78 00000000 4ff28950 00000000
I/DEBUG ( 114): beaadd40 00000000 00000000 00000000 00000001
I/DEBUG ( 114): beaadd50 00000030 5165f008 00000000 4ff28950
I/DEBUG ( 114):
I/DEBUG ( 114): memory near ip:
I/DEBUG ( 114): 3f7fffe0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f7ffff0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800000 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800010 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800020 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800030 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800040 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800050 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800060 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800070 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800080 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f800090 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f8000a0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f8000b0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f8000c0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114): 3f8000d0 ffffffff ffffffff ffffffff ffffffff
I/DEBUG ( 114):
I/DEBUG ( 114): memory near sp:
I/DEBUG ( 114): beaadbc0 00000003 00000001 beaadcec beaae4e8
I/DEBUG ( 114): beaadbd0 beaadc90 00000000 df0027ad 00000000
I/DEBUG ( 114): beaadbe0 000001a8 beaae4e8 beaadcec 00000001
I/DEBUG ( 114): beaadbf0 00000002 00000000 beaadcec beaadc80
I/DEBUG ( 114): beaadc00 beab4580 beaadc70 00002000 00000001
I/DEBUG ( 114): beaadc10 beaadcec 52ed7d88 beaadca8 00000000
I/DEBUG ( 114): beaadc20 beab4498 beaadc68 beab10e8 4ff1c9b3
I/DEBUG ( 114): beaadc30 beaadc90 00000001 beab2ad4 beab2aec
I/DEBUG ( 114): beaadc40 00000000 beaae4e8 beaadcec beab4498
I/DEBUG ( 114): beaadc50 00000001 00000000 beaadc90 beaae4e8
I/DEBUG ( 114): beaadc60 beaadcec 4ff26f30 00000003 00000000
I/DEBUG ( 114): beaadc70 000000ac 00000000 00000000 00000000
I/DEBUG ( 114): beaadc80 00000115 00000000 00000000 00000000
I/DEBUG ( 114): beaadc90 00000062 00000000 00000000 00000000
I/DEBUG ( 114): beaadca0 00000000 00000000 00000000 00000001
I/DEBUG ( 114): beaadcb0 4ff28f54 52ed7d88 4ff28950 401c0228
I/DEBUG ( 114):
I/DEBUG ( 114): code around pc:
I/DEBUG ( 114): 4ff1c38c 1d1a4088 910030f4 6e5b4621 f9c6f7fc
I/DEBUG ( 114): 4ff1c39c 0a90ee07 eddfe001 eef77a15 eddf1ae7
I/DEBUG ( 114): 4ff1c3ac eef40b11 eef11be0 bfd4fa10 23012300
I/DEBUG ( 114): 4ff1c3bc 2300e000 dd0f2c02 46489319 46519714
I/DEBUG ( 114): 4ff1c3cc 8054f8cd 9416465a 95189617 b00b9b09
I/DEBUG ( 114): 4ff1c3dc 4ff0e8bd bf64f7ff e8bdb00b bf008ff0
I/DEBUG ( 114): 4ff1c3ec 8000f3af 7ae147ae 3fc7ae14 00000000
I/DEBUG ( 114): 4ff1c3fc 8000f3af 4ff0e92d 4605b0a5 982e9c33
I/DEBUG ( 114): 4ff1c40c 91199e37 99319214 93159a32 f89d9b30
I/DEBUG ( 114): 4ff1c41c 941b70d0 90169c36 91179312 9618921a
I/DEBUG ( 114): 4ff1c42c 9b3a9839 9a3c993b b0bcf8dd 80d4f8dd
I/DEBUG ( 114): 4ff1c43c 971c9e38 901d4627 911f931e 98169220
I/DEBUG ( 114): 4ff1c44c 1a336a2a 10999c18 91134294 463cdb63
I/DEBUG ( 114): 4ff1c45c 5928e07d 9a229921 98235108 991f5913
I/DEBUG ( 114): 4ff1c46c 51039a20 9100463b 92014630 46524641
I/DEBUG ( 114): 4ff1c47c f7fe3404 f10afecb 46030201 d0482800
I/DEBUG ( 114):
I/DEBUG ( 114): code around lr:
I/DEBUG ( 114): 4ff1876c d0164580 f04f1ae3 42ab4080 461dbfb8
I/DEBUG ( 114): 4ff1877c 5a10ee06 0ac6eeb8 1a10ee10 eaa8f7fd
I/DEBUG ( 114): 4ff1878c 7a13eddf 0a10ee07 7a27ee67 7aa7ee77
I/DEBUG ( 114): 4ff1879c eddfe001 ee027a10 ee029a90 eef84a10
I/DEBUG ( 114): 4ff187ac ee031ae2 eeb88a10 ee811ac2 eef81a81
I/DEBUG ( 114): 4ff187bc eec00ac3 eef70aa7 ee766a00 ee607ac1
I/DEBUG ( 114): 4ff187cc e0017aa7 7a04eddf 0a90ee17 83f8e8bd
I/DEBUG ( 114): 4ff187dc 437f0000 4f000000 00000000 447b4b02
I/DEBUG ( 114): 4ff187ec 3308681b 47706003 000105d6 b5104b09
I/DEBUG ( 114): 4ff187fc 681b447b 33084604 68406003 6802b110
I/DEBUG ( 114): 4ff1880c 47886891 44784804 30086800 46206020
I/DEBUG ( 114): 4ff1881c bf00bd10 000105c8 000105ae b08bb530
I/DEBUG ( 114): 4ff1882c b1b06840 68049d0e 9d0f9500 9d109501
I/DEBUG ( 114): 4ff1883c 9d119502 9d129503 9d139504 9d149505
I/DEBUG ( 114): 4ff1884c 9d159506 9d169507 9d179508 68249509
I/DEBUG ( 114): 4ff1885c b00b47a0 b510bd30 f7ff4604 4620ffc7
I/DEBUG ( 114):
I/DEBUG ( 114): memory map around fault addr 4ff1c3ac:
I/DEBUG ( 114): 4fe95000-4ff0a000 /system/app/LatinIME.apk
I/DEBUG ( 114): 4ff0a000-4ff28000 /system/lib/libjni_latinime.so
I/DEBUG ( 114): 4ff28000-4ff29000 /system/lib/libjni_latinime.so
I/BootReceiver( 420): Copying /data/tombstones/tombstone_01 to DropBox (SYSTEM_TOMBSTONE)
W/InputDispatcher( 420): channel '4161ecc0 InputMethod (server)' ~ Consumer closed input channel or an error occurred. events=0x9
E/InputDispatcher( 420): channel '4161ecc0 InputMethod (server)' ~ Channel is unrecoverably broken and will be disposed!
Disabling auto correction (Settings > Language & input > AOSP Settings > Auto-correction > Off, Show correction suggestions > Always hide) works, the keyboard no longer crashes.
I've tried the following gapps versions:
20130812
20130301
20121212
None of them solved the problem.
Any ideas?
Its a long story buddy.
Destitution of Neon support for tegra 2 is causing problems. However it is fixed in Android 4.4.2. I highly recommend you to flash 4.4.2 (Omni recommended).
I hope that with this thread we are able to gain system privileges with the help of CVE-2015-1474.
To begin with I try to write down what I have found. This is just a compilation of information so they might look mixed up.
The class GraphicBuffer is utilized by the system service SurfaceFlinger. My current understanding is that the vulnerable method "unflatten" is used to create a GraphicBuffer object from raw data that is sent to the service by IPC using Binder. A forged message might be easiest supplied via adb shell using this commando
Code:
[email protected]:/ $ service call SurfaceFlinger ...
I am not sure yet how the parcel get's eventually to the GraphicBuffer. It is a lot of code and I do not understand the low level graphics system of Android yet. The IGraphicBufferConsumer interface has a sub class BufferItem which has also an unflatten method which will call unflatten on GraphicBuffer. My gut tells me that the Parcel class is also involved in that process, but I'm not sure how yet.
One important piece of information that I'm still missing is how the unflattened data is used in the further processing of SurfaceFlinger. I don't think it is possible to freely write in the memory of SurfaceFlinger with this bug. There are still a lot of sanity checks to come by.
This could also effect on how we have to implement the communication with SurfaceFlinger. Maybe it's also possible with some forged objects and a SurfaceView.
Maybe together we are able to bring some light into this. A little bump in the right direction might help.
Phate123 said:
I hope that with this thread we are able to gain system privileges with the help of CVE-2015-1474.
Click to expand...
Click to collapse
Take a look at the thread below, It looks like there is already some research begin done but I can't quite get my head around whether they are on the right track. This might help us get going in the right direction though.
http://forum.xda-developers.com/not.../rd-rooting-n910a-n910v-models-t3042045/page6
awinston said:
Take a look at the thread below, It looks like there is already some research begin done but I can't quite get my head around whether they are on the right track. This might help us get going in the right direction though.
http://forum.xda-developers.com/not.../rd-rooting-n910a-n910v-models-t3042045/page6
Click to expand...
Click to collapse
Good news ( @Phate123, @awinston )! I have managed to crash the surfaceflinger on 4.5.2 (should also work on 4.5.3).
I'll upload the code on github, but first I want to briefly explain how I did it.
In Android everything that is a graphical element is represented by an GraphicBuffer.
GraphicBuffers are wrapped in BufferItems and managed by BufferQueues.
Each Queue has two sites, a producer side (IGraphicBufferProducer) and a consumer side (IGraphicBufferConsumer). In the basic scenario an app is the producer and the surfaceflinger is the consumer. These are obviously two different processes, but both must use the same BufferQueue.
BufferQueues are always created and owned by the consumers and consequently live in the same address space as the consumer. Producers must go through Binder to access their side of the queue.
As with everything in Android, the BufferQueue provides the same interface for both native (in the same process) and remote usage. The remote interface is implemented by a proxy that communicates through Binder with the other side.
In android KK BufferQueue implements the native side of the interface for both the producer (BnGraphicBufferProducer) and the consumer (BnGraphicBufferConsumer). These native implementations must provide a handler (onTransact) for requests that come from the remote proxies.
You can read more at https://source.android.com/devices/graphics/architecture.html.
Naturally, the first idea that comes into mind is to attack the native implementations of the BufferQueue that reside in the surfaceflinger. As the bug is in the unflatten routine of GraphicBuffer, we would like to craft a rogue parcel that represents a GraphicBuffer and then wait for the surfaceflinger to choke with it.
Unfortunately, from my findings, the bugged unflatten method is not called from the onTransact handler in the native implementations.
Only the proxy implementations seem to be a valid target, through BpGraphicBufferProducer::requestBuffer and BpGraphicBufferConsumer::aquireBuffer. Now we have a problem: as the BufferQueue resides in the surfaceflinger, there is no proxy implementation to attack.
Our only hope is to somehow create the BufferQueue in our process, so that we are the consumers, and use the surfaceflinger as the producer. This way the surfaceflinger would be accessing the BufferQueue through the bugged proxy (BpGraphicBufferProducer::requestBuffer). One way to use the surfaceflinger as a producer is to make screen captures.
I found the screencap command to be a very nice starting point to tinker with the idea as it does exactly what we wanted - it uses the surfaceflinger as a producer and pulls screen captures from it. Next I only had to hook the vtable entry of BpGraphicBufferProducer:: onTransact.
Now we have to control the overflow in GraphicsBuffer::unflatten.
p1gl3t said:
Good news ( @Phate123, @awinston )! I have managed to crash the surfaceflinger on 4.5.2 (should also work on 4.5.3).
Click to expand...
Click to collapse
Wow you are really good! I had started to piece some of this together and wanted to document it for good measure even though you are going to clearly beat the rest of us to this exploit. Arguably I could never figure it out, but never hurts to try. At least I am learning.
https://charleszblog.wordpress.com/2014/02/20/understanding-android-internals-graphics-basics-i/
http://translate.google.com/transla...dyhuabing/article/details/7489776&prev=search
http://4.bp.blogspot.com/-qQxyvr2Vc8w/VFYLxdacwpI/AAAAAAAAAes/HMMrUIwC9OY/s1600/Selection_043.png
https://android.googlesource.com/platform/frameworks/native/+/master/libs/gui/tests/Surface_test.cpp
The screenshot test is where I was focusing but wasn't really getting very far.
Crashed unflatten as well
Okay so I crashed unflatten as well. Trying to figure out where to go from here. I am a little confused though because I did it natively by calling unflatten directly from a cpp program I wrote with a few lines of code. When you crash it like this how do I know it was the buffer overflow? Sorry, still trying to learn as I go.
03-05 17:06:47.380 2652-2652/? A/libc﹕ Fatal signal 11 (SIGSEGV) at 0x52464247 (code=1), thread 2652 (screenshot)
03-05 17:06:47.490 258-258/? I/DEBUG﹕ *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-05 17:06:47.490 258-258/? I/DEBUG﹕ AM write failure (32 / Broken pipe)
03-05 17:06:47.490 258-258/? I/DEBUG﹕ Build fingerprint: 'Amazon/thor/thor:4.4.3/KTU84M/13.4.5.2_user_452004220:user/release-keys'
03-05 17:06:47.490 258-258/? I/DEBUG﹕ Revision: '0'
03-05 17:06:47.490 258-258/? I/DEBUG﹕ pid: 2652, tid: 2652, name: screenshot >>> ./screenshot <<<
03-05 17:06:47.490 258-258/? I/DEBUG﹕ signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 52464247
03-05 17:06:47.490 955-1055/? W/NativeCrashListener﹕ Couldn't find ProcessRecord for pid 2652
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r0 b723dfb8 r1 47424652 r2 be94a600 r3 00000020
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r4 b723dfb8 r5 be94a618 r6 52464247 r7 be94a604
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r8 be94a600 r9 00000000 sl be94a618 fp be94a6ec
03-05 17:06:47.500 258-258/? I/DEBUG﹕ ip b6f08f44 sp be94a590 lr b6f04f4b pc b6e34b94 cpsr 200b0030
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d0 0000000000000000 d1 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d2 0000000000000000 d3 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d4 0000000000000000 d5 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d6 0000000000000000 d7 55ab5f0000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d8 0000000000000000 d9 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d10 0000000000000000 d11 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d12 0000000000000000 d13 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d14 0000000000000000 d15 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d16 0000002000000001 d17 0000000000000020
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d18 b723a630b723a618 d19 b723a658b723a648
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d20 b723a678b723a668 d21 b723a698b723a688
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d22 b723aaf8b723a6a8 d23 b723af58b723af48
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d24 0000000000000000 d25 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d26 0000000000000000 d27 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d28 0000000000000000 d29 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d30 0000000000000000 d31 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ scr 00000010
03-05 17:06:47.510 258-258/? I/DEBUG﹕ backtrace:
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #00 pc 00005b94 /system/lib/libui.so (android::GraphicBuffer::unflatten(void const*&, unsigned int&, int const*&, unsigned int&)+23)
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #01 pc 00002f47 /data/local/tmp/screenshot
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #02 pc 0000e4db /system/lib/libc.so (__libc_init+50)
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #03 pc 0000308c /data/local/tmp/screenshot
03-05 17:06:47.510 258-258/? I/DEBUG﹕ stack:
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a550 00000000
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a554 b6010001
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a558 00000000
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a55c b6e0d44b /system/lib/libgui.so
---------- Post added at 12:26 AM ---------- Previous post was at 12:12 AM ----------
awinston said:
Okay so I crashed unflatten as well.
Click to expand...
Click to collapse
Is the trick to do it through the surfaceflinger process because it is running with escalated privileges?
awinston said:
Okay so I crashed unflatten as well. Trying to figure out where to go from here. I am a little confused though because I did it natively by calling unflatten directly from a cpp program I wrote with a few lines of code. When you crash it like this how do I know it was the buffer overflow? Sorry, still trying to learn as I go.
03-05 17:06:47.380 2652-2652/? A/libc﹕ Fatal signal 11 (SIGSEGV) at 0x52464247 (code=1), thread 2652 (screenshot)
03-05 17:06:47.490 258-258/? I/DEBUG﹕ *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
03-05 17:06:47.490 258-258/? I/DEBUG﹕ AM write failure (32 / Broken pipe)
03-05 17:06:47.490 258-258/? I/DEBUG﹕ Build fingerprint: 'Amazon/thor/thor:4.4.3/KTU84M/13.4.5.2_user_452004220:user/release-keys'
03-05 17:06:47.490 258-258/? I/DEBUG﹕ Revision: '0'
03-05 17:06:47.490 258-258/? I/DEBUG﹕ pid: 2652, tid: 2652, name: screenshot >>> ./screenshot <<<
03-05 17:06:47.490 258-258/? I/DEBUG﹕ signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 52464247
03-05 17:06:47.490 955-1055/? W/NativeCrashListener﹕ Couldn't find ProcessRecord for pid 2652
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r0 b723dfb8 r1 47424652 r2 be94a600 r3 00000020
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r4 b723dfb8 r5 be94a618 r6 52464247 r7 be94a604
03-05 17:06:47.500 258-258/? I/DEBUG﹕ r8 be94a600 r9 00000000 sl be94a618 fp be94a6ec
03-05 17:06:47.500 258-258/? I/DEBUG﹕ ip b6f08f44 sp be94a590 lr b6f04f4b pc b6e34b94 cpsr 200b0030
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d0 0000000000000000 d1 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d2 0000000000000000 d3 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d4 0000000000000000 d5 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d6 0000000000000000 d7 55ab5f0000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d8 0000000000000000 d9 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d10 0000000000000000 d11 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d12 0000000000000000 d13 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d14 0000000000000000 d15 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d16 0000002000000001 d17 0000000000000020
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d18 b723a630b723a618 d19 b723a658b723a648
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d20 b723a678b723a668 d21 b723a698b723a688
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d22 b723aaf8b723a6a8 d23 b723af58b723af48
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d24 0000000000000000 d25 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d26 0000000000000000 d27 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d28 0000000000000000 d29 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ d30 0000000000000000 d31 0000000000000000
03-05 17:06:47.500 258-258/? I/DEBUG﹕ scr 00000010
03-05 17:06:47.510 258-258/? I/DEBUG﹕ backtrace:
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #00 pc 00005b94 /system/lib/libui.so (android::GraphicBuffer::unflatten(void const*&, unsigned int&, int const*&, unsigned int&)+23)
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #01 pc 00002f47 /data/local/tmp/screenshot
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #02 pc 0000e4db /system/lib/libc.so (__libc_init+50)
03-05 17:06:47.510 258-258/? I/DEBUG﹕ #03 pc 0000308c /data/local/tmp/screenshot
03-05 17:06:47.510 258-258/? I/DEBUG﹕ stack:
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a550 00000000
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a554 b6010001
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a558 00000000
03-05 17:06:47.510 258-258/? I/DEBUG﹕ be94a55c b6e0d44b /system/lib/libgui.so
---------- Post added at 12:26 AM ---------- Previous post was at 12:12 AM ----------
Is the trick to do it through the surfaceflinger process because it is running with escalated privileges?
Click to expand...
Click to collapse
Surfaceflinger runs under the system user (+drmrpc group) and should have access to /dev/qseecom, through which we can get root using CVE-2014-4322.
The problem is that the heap buffer overflow triggered by unflatten seems very difficult to exploit.
We must consider the following to achieve a controlled memory write:
sizeof(native_handle_t) + sizeof(int)*(numFds+numInts) must overflow 32 bits and remain small enough that the malloc succeeds and returns a valid heap address in h->data. If the malloc were to fail, we would memcpy to address 0 and get a seg fault.
as even after the malloc, numInts and numFds are used only after being multiplied by 4 (sizeof(int)), we can ignore the 2 most significant bits from both of them. This means that the only way to get any kind of bof is to generate transport from bit 29 to bit 30 on the sum numFds+numInts. Consequently, at least one of numInts or numFds must have bit 29 set. This doesn't sound very good because next we will do a memcpy of numFds * 4 bytes and next a memcpy of numInts * 4 bytes, meaning that at least one of the two memcpy calls will try to copy at least (1<<31) bytes. This will certainly lead to a segfault before we can trigger something from another thread...
the executable code is position independent so we would need to leak an address to be able to use rop.
Things don't look good at all... I really hope that I have made a mistake or that there is another approach to the problem.
I'm afraid that the pros would have already implemented an exploit by now, if it could have been done.
p1gl3t said:
We must consider the following to obtain a controlled memory write:
sizeof(native_handle_t) + sizeof(int)*(numFds+numInts) must overflow 32 bits and remain small enough that the malloc succeeds and returns a valid heap address in h->data. If the malloc were to fail, we would memcpy to address 0 and get a seg fault.
as even after the malloc, numInts and numFds are used only after being multiplied by 4 (sizeof(int)), we can ignore the 2 most significant bits from both of them. This means that the only way to get any kind of bof is to generate transport from bit 29 to bit 30 on the sum numFds+numInts. Consequently, at least one of numInts or numFds must have bit 29 set. This doesn't sound very good because next we will do a memcpy of numFds * 4 bytes and next a memcpy of numInts * 4 bytes, meaning that at least one of the two memcpy calls will try to copy at least (1<<31) bytes. This will certainly lead to a segfault before we can trigger something from another thread...
the executable code is position independent so we would need to leak an address to be able to use rop.
Things don't look good at all... I really hope that I have made a mistake or that there is another approach to the problem.
I'm afraid that the exploit pros would have already implemented an exploit if it could have been done.
Click to expand...
Click to collapse
That have been my thoughts too. There is a memory corruption but it is difficult to use and it is not on areas that could be used to manipulate the return stack or a vtable entry. Or I just can't see the way. I have experience in this area,but it is kinda limited.
BTW: These drivers are not used by the Fire HDX by chance? https://www.codeaurora.org/projects...le-camera-drivers-cve-2014-4321-cve-2014-4324
Sadly I cannot find enough time to spend hours on digging. I hope there are some to be find this weekend though.
Phate123 said:
That have been my thoughts too. There is a memory corruption but it is difficult to use and it is not on areas that could be used to manipulate the return stack or a vtable entry. Or I just can't see the way. I have experience in this area,but it is kinda limited.
BTW: These drivers are not used by the Fire HDX by chance? https://www.codeaurora.org/projects...le-camera-drivers-cve-2014-4321-cve-2014-4324
Sadly I cannot find enough time to spend hours on digging. I hope there are some to be find this weekend though.
Click to expand...
Click to collapse
I don't think a stack attack would have been feasible at all as the code should be compiled with stack protector on and we can't do a brute force on the canary value. Hijacking a vtable pointer or a got entry would have been the way to go, but we still wouldn't know what to write as everything is aslr'd.
Regarding those camera drivers, I think someone over at the Samsung section also mentioned them. I'll look into them and report back.
p1gl3t said:
I don't think a stack attack would have been feasible at all as the code should be compiled with stack protector on and we can't do a brute force on the canary value. Hijacking a vtable pointer or a got entry would have been the way to go, but we still wouldn't know what to write as everything is aslr'd.
Click to expand...
Click to collapse
Would you mind sharing your code even though it doesn't look like you will be able to exploit this overflow? I am still trying to get my head around the basic attack through surface flinger and it would help me greatly to better understand how at least in theory this works. No worries if you don't want to.
awinston said:
Would you mind sharing your code even though it doesn't look like you will be able to exploit this overflow? I am still trying to get my head around the basic attack through surface flinger and it would help me greatly to better understand how at least in theory this works. No worries if you don't want to.
Click to expand...
Click to collapse
Here you go: https://github.com/p1gl3t/CVE-2015-1474_poc.
p1gl3t, great job on creating a poc of the exploit :good:
p1gl3t said:
Regarding those camera drivers, I think someone over at the Samsung section also mentioned them. I'll look into them and report back.
Click to expand...
Click to collapse
@jcase Says no on those camera group holes. http://forum.xda-developers.com/showpost.php?p=58945240&postcount=18
It's good to see other's working on 2015-1474 also :good:
ZPaul2Fresh8 said:
@jcase Says no on those camera group holes. http://forum.xda-developers.com/showpost.php?p=58945240&postcount=18
It's good to see other's working on 2015-1474 also :good:
Click to expand...
Click to collapse
@jcase is right, only mediaserver is executed under group camera so that it can access /dev/video*. You can see that in init.base.rc and ueventd.qcom.rc.
Now returning to the original topic... I fiddled around with unflatten, giving some input that should have made it crash.
What I did is I left numInts untouched and set numFds = -numInts. I was expecting surfaceflinger to crash every single time when it did the first memcpy. Somehow it didn't. I was baffled and had to gdb the process to see where my assumptions were wrong.
I breaked just before the first memcpy and printed the params:
Code:
(gdb) p $r0
$19 = 3074255348
(gdb) p $r1
$20 = 3074340312
(gdb) p $r2
$21 = 4294967248
r0 is the destination, r1 the source and r2 the number of bytes to copy. r2 is the unsigned representation of 4 * (-12) = 4 * numFds = -4 * numInts.
How did the program NOT crash???!! It even worked a second time, but crashed with SIGABRT in a free() because of heap corruption (I suppose). So even the second memcpy passed without segfault.
Here you have the memory map of surfaceflinger.
LE I have traced the memcpy. It looks like this on my Apollo 14.4.5.2
Code:
.text:0002218C __memcpy_base
.text:0002218C CMP R2, #4
.text:0002218E BLT.W loc_222DC
.text:00022192 CMP R2, #0x10
.text:00022194 BLT.W loc_222BE
.text:00022198 CMP R2, #0x20
.text:0002219A BLT.W loc_222AE
.text:0002219E CMP R2, #0x40
.text:000221A0 BLT loc_222A2
It seems like R2 (number of bytes) is treated like a signed int and the first branch is taken and the following instructions are executed
Code:
.text:000222DC loc_222DC ; CODE XREF: __memcpy_base+2
.text:000222DC LSLS R2, R2, #0x1F
.text:000222DE ITT CS
.text:000222E0 LDRCSH.W R3, [R1],#2
.text:000222E4 STRCSH.W R3, [R0],#2
.text:000222E8 ITT MI
.text:000222EA LDRMIB R3, [R1]
.text:000222EC STRMIB R3, [R0]
This ends up copying only n & 3 bytes, which is < 4. Basically, only the 2 least significant bits from n matter).
So... I guess we are able to write to h->data + numFds*4 as long as numFds*4 is negative. But having numFds as an offset may hurt us on the malloc side.
Now we have to defeat aslr somehow.
Any chance
I hope you are still working on this, we really need to get ride of the crappy Amazon OS and unlock the full potential of these amazing tablet specs.
I have an open tablet that I should repair, if there is need to take some photos of components please let me know, I am not into software hacking yet and it will takes me some time to get into it... but I want to contribute to make this possible, I hope more smart guys from around here join their effort to do it.
I wish if there is another tablet on the market who is as good as this one right now at an affordable price, to just see how CM12.1 behave on it, I tried it on a KFHD before I get it bricked it was fine but little bit laggy due to limited specs and low ram.
Hi, p1gl3t!
I'm interesting in your PoC and have to ask... Is your work on this done? And how might I use that for my specific device?
dadreamer said:
Hi, p1gl3t!
I'm interesting in your PoC and have to ask... Is your work on this done? And how might I use that for my specific device?
Click to expand...
Click to collapse
Not sure what this thread was all about (didn't look back) but the last post was over 2 years ago. A lot has happened since then; every 3rd gen HDX can be bootloader unlocked opening the door to custom ROMS ranging from Android 4.4.4 to 7.1.1.
https://forum.xda-developers.com/kindle-fire-hdx/general/thor-unlocking-bootloader-firmware-t3463982
https://forum.xda-developers.com/kindle-fire-hdx/general/thor-4-5-5-2-easy-to-root-unlock-t3571240
Davey126 said:
every 3rd gen HDX can be bootloader unlocked opening the door to custom ROMS ranging from Android 4.4.4 to 7.1.1.
Click to expand...
Click to collapse
Well, that's true but not for my device I still have a slightly outdated smartphone. It is Docomo Fujitsu Arrows NX F-01F [ Android 4.4.2, build # V10R22A (kernel version 3.4.0), ARMv7 arch (armv7l, armeabi-v7a) ]. And it's got no public firmwares at all, no bootloader unlock and no root in easy ways. Besides of that, there's one "pleasant" addition - PXN (Privilege Execute-Never), which doesn't let me to root the phone with simple ways or common tools.
To bypass PXN I have to use some JOP approach but for it I need to get boot.img or kernel memory dump somehow. Because I have no factory ROMs I'm trying to pull out boot.img through known vulnerabilities of my dev. One of them is CVE-2015-1474 (GraphicBuffer integer overflow), which potentially might give me system privilegies to copy boot.img from that phone.
So I wonder if p1gl3t's code is ready to use and is able to give the system privilegies. It seems it should be compiled together with AOSP codebase. But I'm unsure if it would work well when I get it compiled.
Checked your links. There I see that the presence of root is required. But I can't gain root so can't use those tools.
dadreamer said:
Well, that's true but not for my device I still have a slightly outdated smartphone. It is Docomo Fujitsu Arrows NX F-01F [ Android 4.4.2, build # V10R22A (kernel version 3.4.0), ARMv7 arch (armv7l, armeabi-v7a) ]. And it's got no public firmwares at all, no bootloader unlock and no root in easy ways. Besides of that, there's one "pleasant" addition - PXN (Privilege Execute-Never), which doesn't let me to root the phone with simple ways or common tools.
To bypass PXN I have to use some JOP approach but for it I need to get boot.img or kernel memory dump somehow. Because I have no factory ROMs I'm trying to pull out boot.img through known vulnerabilities of my dev. One of them is CVE-2015-1474 (GraphicBuffer integer overflow), which potentially might give me system privilegies to copy boot.img from that phone.
So I wonder if p1gl3t's code is ready to use and is able to give the system privilegies. It seems it should be compiled together with AOSP codebase. But I'm unsure if it would work well when I get it compiled.
Checked your links. There I see that the presence of root is required. But I can't gain root so can't use those tools.
Click to expand...
Click to collapse
Have not seen @p1gl3t on this thread/forum in awhile; not sure if s/he is still active on XDA. Might try a PM. Given the age and, err, uniqueness of device in question I suspect you're in for quite a ride. Good luck.
Well, I have compiled that badscreencap by p1gl3t along with android 4.4.2 codebase and then pushed it to my dev. But whenever I run it I receive segfault:
Code:
[email protected]:/data/local/tmp $ ./badscreencap
pid 24824
display.update ret 0
IGraphicBufferConsumer::consumerDisconnect 0x18
BBinder::onTransact 0x40
BnGraphicBufferProducer::onTransact 0x34
BBinder::onTransact 0x40
BnGraphicBufferProducer::onTransact 0x34
BBinder::onTransact 0xb6889759
BnGraphicBufferProducer::onTransact 0xb6889391
BBinder::onTransact = 0xb6899048
*BBinder::onTransact = 0xb6889759
BBinder::onTransact = 0xb7b912b0
*BBinder::onTransact = 0xb6889759
--------
f1 04 00 ff f7 18 be 38 b5 04 46 0d 46 11 b1 08 46 f6 f7 50
--------
[1] + Stopped (signal) ./badscreencap
When I issue any one command after that I get
Code:
[email protected]:/data/local/tmp $
[1] + Segmentation fault ./badscreencap (core dumped)
Of course, no any signs of system privileges for my id. Checked this with logcat and it has got the following trace:
F/libc (24824): Fatal signal 11 (SIGSEGV) at 0x00000004 (code=1), thread 24824 (badscreencap)
D/wpa_supplicant(10784): wlan0: Control interface command 'SIGNAL_POLL'
D/wpa_supplicant(10784): signal_poll nl80211_signal_poll:10508 rssi:[-47]
D/wpa_supplicant(10784): nl80211: survey data missing!
D/wpa_supplicant(10784): wlan0: Control interface command 'PKTCNT_POLL'
I/DEBUG ( 266): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG ( 266): Build fingerprint: 'DOCOMO/F01F/F01F:4.4.2/V10R22A/F01F.20150107.043237:user/release-keys'
I/DEBUG ( 266): Revision: '37'
I/DEBUG ( 266): pid: 24824, tid: 24824, name: badscreencap >>> ./badscreencap <<<
I/DEBUG ( 266): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 00000004
W/NativeCrashListener( 1119): Couldn't find ProcessRecord for pid 24824
I/DEBUG ( 266): r0 00000004 r1 beca97ac r2 b6f6f82c r3 00000004
I/DEBUG ( 266): AM write failure (32 / Broken pipe)
I/DEBUG ( 266): r4 00000000 r5 b7b8eee8 r6 b688b285 r7 00000000
I/DEBUG ( 266): r8 beca97e4 r9 00000000 sl beca99d8 fp beca98ac
I/DEBUG ( 266): ip b6ec1f38 sp beca9780 lr b6eba0d5 pc b6ee9b5c cpsr 000b0010
I/DEBUG ( 266): d0 0000000000000000 d1 0000000000000000
I/DEBUG ( 266): d2 0000000000000000 d3 0000000000000000
I/DEBUG ( 266): d4 0000000000000000 d5 0000000000000000
I/DEBUG ( 266): d6 0000000000000000 d7 3849498000000000
I/DEBUG ( 266): d8 0000000000000000 d9 0000000000000000
I/DEBUG ( 266): d10 0000000000000000 d11 0000000000000000
I/DEBUG ( 266): d12 0000000000000000 d13 0000000000000000
I/DEBUG ( 266): d14 0000000000000000 d15 0000000000000000
I/DEBUG ( 266): d16 7265646e6942422a d17 6e6172546e6f3a3a
I/DEBUG ( 266): d18 b6e8d399b6e8d4af d19 b6e8d07fb6e8d377
I/DEBUG ( 266): d20 b68827d1b6e8d071 d21 b6889759b68827f3
I/DEBUG ( 266): d22 0000000000000000 d23 0000000000000000
I/DEBUG ( 266): d24 0000000000000000 d25 0000000000000000
I/DEBUG ( 266): d26 0000000000000000 d27 0000000000000000
I/DEBUG ( 266): d28 0000000000000000 d29 0000000000000000
I/DEBUG ( 266): d30 0000000000000000 d31 0000000000000000
I/DEBUG ( 266): scr 00000010
I/DEBUG ( 266):
I/DEBUG ( 266): backtrace:
I/DEBUG ( 266): #00 pc 00003b5c /system/lib/libcutils.so (android_atomic_inc+8)
I/DEBUG ( 266): #01 pc 0000d0d1 /system/lib/libutils.so (android::RefBase::incStrong(void const*) const+6)
I/DEBUG ( 266): #02 pc 0002a3b5 /system/lib/libgui.so (android::sp<android::IBinder>::sp(android::sp<android::IBinder> const&)+20)
I/DEBUG ( 266): #03 pc 0003494f /system/lib/libgui.so (android::ScreenshotClient::update(android::sp<android::IBinder> const&, unsigned int, unsigned int, unsigned int, unsigned int)+78)
I/DEBUG ( 266): #04 pc 000349c1 /system/lib/libgui.so (android::ScreenshotClient::update(android::sp<android::IBinder> const&)+14)
I/DEBUG ( 266): #05 pc 00005de1 /data/local/tmp/badscreencap
I/DEBUG ( 266): #06 pc 0000e5a3 /system/lib/libc.so (__libc_init+50)
I/DEBUG ( 266): #07 pc 00005590 /data/local/tmp/badscreencap
I/DEBUG ( 266):
I/DEBUG ( 266): stack:
I/DEBUG ( 266): beca9740 00000000
I/DEBUG ( 266): beca9744 b6885b8b /system/lib/libgui.so (android::CpuConsumer::releaseAcquiredBufferLocked(int)+150)
I/DEBUG ( 266): beca9748 00000000
I/DEBUG ( 266): beca974c b68a0154 /system/lib/libgui.so
I/DEBUG ( 266): beca9750 b6f6e268 /data/local/tmp/badscreencap
I/DEBUG ( 266): beca9754 b7b900f0 [heap]
I/DEBUG ( 266): beca9758 b7b8fc40 [heap]
I/DEBUG ( 266): beca975c b7b8fc40 [heap]
I/DEBUG ( 266): beca9760 0000000c
I/DEBUG ( 266): beca9764 b6f6e268 /data/local/tmp/badscreencap
I/DEBUG ( 266): beca9768 b7b8fc40 [heap]
I/DEBUG ( 266): beca976c 00000000
I/DEBUG ( 266): beca9770 b6f6e268 /data/local/tmp/badscreencap
I/DEBUG ( 266): beca9774 b6885c09 /system/lib/libgui.so (android::CpuConsumer::unlockBuffer(android::CpuConsumer::LockedBuffer const&)+92)
I/DEBUG ( 266): beca9778 b7b8fc40 [heap]
I/DEBUG ( 266): beca977c beca9808 [stack]
I/DEBUG ( 266): #00 beca9780 beca97ac [stack]
I/DEBUG ( 266): ........ ........
I/DEBUG ( 266): #01 beca9780 beca97ac [stack]
I/DEBUG ( 266): beca9784 b68853b9 /system/lib/libgui.so (android::sp<android::IBinder>::sp(android::sp<android::IBinder> const&)+24)
I/DEBUG ( 266): #02 beca9788 beca9800 [stack]
I/DEBUG ( 266): beca978c b688f953 /system/lib/libgui.so (android::ScreenshotClient::update(android::sp<android::IBinder> const&, unsigned int, unsigned int, unsigned int, unsigned int)+82)
I/DEBUG ( 266):
I/DEBUG ( 266): memory near r1:
I/DEBUG ( 266): beca978c b688f953 b6f4b334 00000002 b7b8f0e0
I/DEBUG ( 266): beca979c 00000000 b6f3d1d8 b7b8eee8 b7b8fc40
I/DEBUG ( 266): beca97ac b7b8f0e0 b6f6e08f 00000000 b7b91270
I/DEBUG ( 266): beca97bc b6f6e268 b7b8f0e0 b6f6e24e b6899008
I/DEBUG ( 266): beca97cc b688f9c5 00000000 ffffffff 00000000
I/DEBUG ( 266): beca97dc b6f6dde5 00000000 b7b8f0a0 00000018
I/DEBUG ( 266): beca97ec 00000001 00000040 00000001 00000034
I/DEBUG ( 266): beca97fc 00000001 b7b8fc40 b7b8f0e0 00000000
I/DEBUG ( 266): beca980c 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca981c 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca982c 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca983c 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca984c 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca985c beca98b4 beca98b4 beca98bc 00000001
I/DEBUG ( 266): beca986c b6f3cfd8 b6f6db95 00000000 00000000
I/DEBUG ( 266): beca987c b6f015a5 00000000 00000000 00000000
I/DEBUG ( 266):
I/DEBUG ( 266): memory near r2:
I/DEBUG ( 266): b6f6f80c b6f6f9d0 b6f6f8ac b6f6f8fc b6f6f958
I/DEBUG ( 266): b6f6f81c b6f6f9a8 0000058c 00000000 00000000
I/DEBUG ( 266): b6f6f82c b6f6d769 b6f6d7e1 b6f6d5eb b6f6d5f9
I/DEBUG ( 266): b6f6f83c b6f6d899 b6883bd5 b6883ce9 b68843d1
I/DEBUG ( 266): b6f6f84c b6882dd5 b68828f1 b68829e9 b6883a59
I/DEBUG ( 266): b6f6f85c b6f6d8f5 b6889391 b6881f99 b6884cf1
I/DEBUG ( 266): b6f6f86c b6884ac9 b688372d b68839b9 b6884fb9
I/DEBUG ( 266): b6f6f87c b68822a9 b6882889 b68826f5 b6882679
I/DEBUG ( 266): b6f6f88c b6882383 b6882359 b688232f b6882305
I/DEBUG ( 266): b6f6f89c b688241d 00000588 fffffffc 00000000
I/DEBUG ( 266): b6f6f8ac b6f6d92d b6f6d5fd b6e8d075 b6e8d071
I/DEBUG ( 266): b6f6f8bc b6e8d071 b6e8d1e9 b6e8d079 b6e8d079
I/DEBUG ( 266): b6f6f8cc b6e8d071 b6e8d4af b6e8d399 b6e8d377
I/DEBUG ( 266): b6f6f8dc b6e8d07f b6e8d071 b6f6d7cf b6f6d805
I/DEBUG ( 266): b6f6f8ec b6889759 0000057c fffffff0 00000000
I/DEBUG ( 266): b6f6f8fc b6f6d7c9 b6f6d7ff b6f6d5eb b6884fb1
I/DEBUG ( 266):
I/DEBUG ( 266): memory near r5:
I/DEBUG ( 266): b7b8eec8 b7b8eed0 0000001b 00000001 00000001
I/DEBUG ( 266): b7b8eed8 b7b8eec4 00000001 00000000 00000023
I/DEBUG ( 266): b7b8eee8 b689d17c b689d1d0 b7b8ef88 b7b8efc8
I/DEBUG ( 266): b7b8eef8 00000001 b689d200 b7b8ef08 0000001b
I/DEBUG ( 266): b7b8ef08 00000002 00000002 b7b8eefc 00000001
I/DEBUG ( 266): b7b8ef18 006e0061 0000001b b689e97c b7b8e408
I/DEBUG ( 266): b7b8ef28 b689e9a4 b7b8ef38 00660072 0000001b
I/DEBUG ( 266): b7b8ef38 00000001 00000002 b7b8ef28 00000000
I/DEBUG ( 266): b7b8ef48 00000000 0000001b b6e9a888 b7b8eff0
I/DEBUG ( 266): b7b8ef58 00000001 00000000 00000010 00000023
I/DEBUG ( 266): b7b8ef68 00000001 00000001 b7b8f0d4 00000001
I/DEBUG ( 266): b7b8ef78 00000000 00000000 00000020 00000043
I/DEBUG ( 266): b7b8ef88 b6e9a944 00000001 00000000 00000001
I/DEBUG ( 266): b7b8ef98 00000000 b7b8ef50 b6e9a858 00000000
I/DEBUG ( 266): b7b8efa8 00000000 00000000 00000010 00000000
I/DEBUG ( 266): b7b8efb8 b7b8a048 b6e9a9ac b7b8efc8 0000001b
I/DEBUG ( 266):
I/DEBUG ( 266): memory near r6:
I/DEBUG ( 266): b688b264 a81047a0 ea4cf7f4 a8104604 ea4ef7f4
I/DEBUG ( 266): b688b274 f7f4a804 4620ea4c bdf0b01d 00014f3c
I/DEBUG ( 266): b688b284 b09db5f0 a8044604 461f4615 f7f4460e
I/DEBUG ( 266): b688b294 a810ea26 ea22f7f4 a804491c f7f44479
I/DEBUG ( 266): b688b2a4 4631ea24 f7f4a804 a803eada f7f46829
I/DEBUG ( 266): b688b2b4 a903ead0 f7f4a804 a803ead2 fe31f7f5
I/DEBUG ( 266): b688b2c4 a8044639 ea16f7f4 a8049922 ea12f7f4
I/DEBUG ( 266): b688b2d4 a8049923 ea0ef7f4 a8049924 ea0af7f4
I/DEBUG ( 266): b688b2e4 210e68a0 68032200 aa049200 ab10695c
D/wpa_supplicant(10784): wlan0: Control interface command 'SIGNAL_POLL'
I/DEBUG ( 266): b688b2f4 a81047a0 ea04f7f4 a8104604 ea06f7f4
I/DEBUG ( 266): b688b304 f7f4a804 4620ea04 bdf0b01d 00014e94
I/DEBUG ( 266): b688b314 1d05b538 f1004604 f7f4004c 4628ee1e
I/DEBUG ( 266): b688b324 fdfff7f5 f7f54620 4620fdfc b538bd38
I/DEBUG ( 266): b688b334 4615460c 4620e004 f7ff3d01 3460ffe9
I/DEBUG ( 266): b688b344 d1f82d00 0000bd38 b09db530 a8044604
I/DEBUG ( 266): b688b354 f7f4460d a810e9c4 e9c0f7f4 23004925
I/DEBUG ( 266):
I/DEBUG ( 266): memory near r8:
I/DEBUG ( 266): beca97c4 b6f6e24e b6899008 b688f9c5 00000000
I/DEBUG ( 266): beca97d4 ffffffff 00000000 b6f6dde5 00000000
I/DEBUG ( 266): beca97e4 b7b8f0a0 00000018 00000001 00000040
I/DEBUG ( 266): beca97f4 00000001 00000034 00000001 b7b8fc40
I/DEBUG ( 266): beca9804 b7b8f0e0 00000000 00000000 00000000
I/DEBUG ( 266): beca9814 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9824 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9834 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9844 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9854 00000000 00000000 beca98b4 beca98b4
I/DEBUG ( 266): beca9864 beca98bc 00000001 b6f3cfd8 b6f6db95
I/DEBUG ( 266): beca9874 00000000 00000000 b6f015a5 00000000
I/DEBUG ( 266): beca9884 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9894 b6f6d594 b6f6f668 b6f6f670 b6f6f678
I/DEBUG ( 266): beca98a4 beca98b0 00000000 b6f57881 00000001
I/DEBUG ( 266): beca98b4 beca99d8 00000000 beca99e7 beca99f8
I/DEBUG ( 266):
I/DEBUG ( 266): memory near sl:
I/DEBUG ( 266): beca99b8 beca99d4 00000000 00000000 5c2cbe0e
I/DEBUG ( 266): beca99c8 6dbb4e08 7c900b9b 76a8a152 006c3776
I/DEBUG ( 266): beca99d8 61622f2e 72637364 636e6565 5f007061
I/DEBUG ( 266): beca99e8 622f2e3d 63736461 6e656572 00706163
I/DEBUG ( 266): beca99f8 48544150 62732f3d 2f3a6e69 646e6576
I/DEBUG ( 266): beca9a08 622f726f 2f3a6e69 74737973 732f6d65
D/wpa_supplicant(10784): signal_poll nl80211_signal_poll:10508 rssi:[-47]
D/wpa_supplicant(10784): nl80211: survey data missing!
I/DEBUG ( 266): beca9a18 3a6e6962 7379732f 2f6d6574 3a6e6962
I/DEBUG ( 266): beca9a28 7379732f 2f6d6574 6e696278 4f4f4c00
I/DEBUG ( 266): beca9a38 4f4d5f50 50544e55 544e494f 6e6d2f3d
I/DEBUG ( 266): beca9a48 626f2f74 4e410062 494f5244 4f525f44
I/DEBUG ( 266): beca9a58 2f3d544f 74737973 56006d65 5f454249
I/DEBUG ( 266): beca9a68 45504950 5441505f 642f3d48 702f7665
I/DEBUG ( 266): beca9a78 73657069 45485300 2f3d4c4c 74737973
I/DEBUG ( 266): beca9a88 622f6d65 732f6e69 4e410068 494f5244
I/DEBUG ( 266): beca9a98 41445f44 2f3d4154 61746164 444e4100
I/DEBUG ( 266): beca9aa8 44494f52 5353415f 3d535445 7379732f
I/DEBUG ( 266):
I/DEBUG ( 266): memory near fp:
I/DEBUG ( 266): beca988c 00000000 00000000 b6f6d594 b6f6f668
I/DEBUG ( 266): beca989c b6f6f670 b6f6f678 beca98b0 00000000
I/DEBUG ( 266): beca98ac b6f57881 00000001 beca99d8 00000000
I/DEBUG ( 266): beca98bc beca99e7 beca99f8 beca9a35 beca9a4e
I/DEBUG ( 266): beca98cc beca9a63 beca9a7d beca9a92 beca9aa5
I/DEBUG ( 266): beca98dc beca9ac0 beca9acb beca9af4 beca9b13
I/DEBUG ( 266): beca98ec beca9b26 beca9b34 beca9b5c beca9e57
I/DEBUG ( 266): beca98fc beca9e83 beca9e9a beca9ebf beca9ee9
I/DEBUG ( 266): beca990c beca9f02 beca9f16 beca9f3d beca9f67
I/DEBUG ( 266): beca991c beca9f8d beca9f9a beca9fb4 beca9fd7
I/DEBUG ( 266): beca992c beca9fe2 00000000 00000010 0007b0d7
I/DEBUG ( 266): beca993c 00000006 00001000 00000011 00000064
I/DEBUG ( 266): beca994c 00000003 b6f68034 00000004 00000020
I/DEBUG ( 266): beca995c 00000005 00000008 00000007 b6f56000
I/DEBUG ( 266): beca996c 00000008 00000000 00000009 b6f6d530
I/DEBUG ( 266): beca997c 0000000b 000007d0 0000000c 000007d0
I/DEBUG ( 266):
I/DEBUG ( 266): memory near ip:
I/DEBUG ( 266): b6ec1f18 b6f1e845 b6f052ef b6f05357 b6f196c1
I/DEBUG ( 266): b6ec1f28 b6f15749 b6f1542c b6f1cb11 b6f1e239
I/DEBUG ( 266): b6ec1f38 b6ee9b54 b6ee9b34 b6ee9b74 b6ee9b0c
I/DEBUG ( 266): b6ec1f48 b6ee9bb8 b6f00de1 b6f2d62f b6f164dd
I/DEBUG ( 266): b6ec1f58 b6f1ba3d b6f1e7b9 b6f2d3bb b6f167db
I/DEBUG ( 266): b6ec1f68 b6f20c55 b6f135e4 b6f20035 b6f05f01
I/DEBUG ( 266): b6ec1f78 b6f05f29 b6f05f71 b6f003d0 b6f05f1b
I/DEBUG ( 266): b6ec1f88 b6f01b38 b6f01a34 b6f13468 b6f13348
I/DEBUG ( 266): b6ec1f98 b6eeb151 b6f06279 b6f13180 b6f1fec3
I/DEBUG ( 266): b6ec1fa8 b6f01810 b6f01f44 b6f02190 b6f0227c
I/DEBUG ( 266): b6ec1fb8 b6f01f84 b6f01ec0 b6f01fa0 b6f140ec
I/DEBUG ( 266): b6ec1fc8 b6ede927 b6f13d10 b6ede919 b6f13510
I/DEBUG ( 266): b6ec1fd8 b6f0086c b6f021ec b6f00ab8 b6f00ad8
I/DEBUG ( 266): b6ec1fe8 b6f13530 b6f14964 b6f14984 b6f138b4
I/DEBUG ( 266): b6ec1ff8 b6f1f0f9 b6f14944 b6ec2000 ffffffff
I/DEBUG ( 266): b6ec2008 00000001 ffffffff b6ebb42d 00000000
I/DEBUG ( 266):
I/DEBUG ( 266): memory near sp:
I/DEBUG ( 266): beca9760 0000000c b6f6e268 b7b8fc40 00000000
I/DEBUG ( 266): beca9770 b6f6e268 b6885c09 b7b8fc40 beca9808
I/DEBUG ( 266): beca9780 beca97ac b68853b9 beca9800 b688f953
I/DEBUG ( 266): beca9790 b6f4b334 00000002 b7b8f0e0 00000000
I/DEBUG ( 266): beca97a0 b6f3d1d8 b7b8eee8 b7b8fc40 b7b8f0e0
I/DEBUG ( 266): beca97b0 b6f6e08f 00000000 b7b91270 b6f6e268
I/DEBUG ( 266): beca97c0 b7b8f0e0 b6f6e24e b6899008 b688f9c5
I/DEBUG ( 266): beca97d0 00000000 ffffffff 00000000 b6f6dde5
I/DEBUG ( 266): beca97e0 00000000 b7b8f0a0 00000018 00000001
I/DEBUG ( 266): beca97f0 00000040 00000001 00000034 00000001
I/DEBUG ( 266): beca9800 b7b8fc40 b7b8f0e0 00000000 00000000
I/DEBUG ( 266): beca9810 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9820 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9830 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9840 00000000 00000000 00000000 00000000
I/DEBUG ( 266): beca9850 00000000 00000000 00000000 beca98b4
I/DEBUG ( 266):
I/DEBUG ( 266): code around pc:
I/DEBUG ( 266): b6ee9b3c e1910f9f e080c003 e1812f9c e3520000
I/DEBUG ( 266): b6ee9b4c 1afffffa e12fff1e e1a03000 f57ff05f
I/DEBUG ( 266): b6ee9b5c e1930f9f e2801001 e1832f91 e3520000
I/DEBUG ( 266): b6ee9b6c 1afffffa e12fff1e e1a03000 f57ff05f
I/DEBUG ( 266): b6ee9b7c e3e02000 e1930f9f e080c002 e1831f9c
I/DEBUG ( 266): b6ee9b8c e3510000 1afffffa e12fff1e e1a03000
I/DEBUG ( 266): b6ee9b9c f57ff05f e1910f9f e000c003 e1812f9c
I/DEBUG ( 266): b6ee9bac e3520000 1afffffa e12fff1e e1a03000
I/DEBUG ( 266): b6ee9bbc f57ff05f e1910f9f e180c003 e1812f9c
I/DEBUG ( 266): b6ee9bcc e3520000 1afffffa e12fff1e 6883b508
I/DEBUG ( 266): b6ee9bdc 47984608 2140ea6f ea801840 eb023290
I/DEBUG ( 266): b6ee9bec ea831302 bd082093 2203b5f8 46046943
I/DEBUG ( 266): b6ee9bfc 43726846 0f92ebb3 0076d923 46302104
I/DEBUG ( 266): b6ee9c0c ebe4f7ff b1e04605 1e772200 6821e011
I/DEBUG ( 266): b6ee9c1c 3022f851 6858e00a e00cf8d3 0c00ea07
I/DEBUG ( 266): b6ee9c2c 102cf855 f84560d9 4673302c d1f22b00
I/DEBUG ( 266):
I/DEBUG ( 266): code around lr:
I/DEBUG ( 266): b6eba0b4 000078c4 4604b510 ffe2f7ff f7fd4620
I/DEBUG ( 266): b6eba0c4 4620e918 b510bd10 1d206844 ea2af7fd
I/DEBUG ( 266): b6eba0d4 f7fd4620 f1b0ea28 d1085f80 f04f4621
I/DEBUG ( 266): b6eba0e4 f7fd4070 68a0ea26 68996803 bd104788
I/DEBUG ( 266): b6eba0f4 6844b510 f7fd1d20 4620ea16 ea12f7fd
I/DEBUG ( 266): b6eba104 f1b0b138 d1085f80 4070f04f f7fd4621
I/DEBUG ( 266): b6eba114 68a0ea10 68996803 bd104788 68186843
I/DEBUG ( 266): b6eba124 30044770 beb4f003 4604b538 460d3004
I/DEBUG ( 266): b6eba134 ea04f7fd d1192801 07d968e3 6823d409
I/DEBUG ( 266): b6eba144 5f80f1b3 e00cd100 e8bd4620 f0034038
I/DEBUG ( 266): b6eba154 68a0bea7 694a6801 47904629 07c268e0
I/DEBUG ( 266): b6eba164 68a0d504 6801b110 4790684a b570bd38
I/DEBUG ( 266): b6eba174 68444605 4620460e e9e0f7fd d10b2801
I/DEBUG ( 266): b6eba184 463168a0 68da6803 68e04790 d40307c0
I/DEBUG ( 266): b6eba194 46286829 4798684b 46314620 4070e8bd
I/DEBUG ( 266): b6eba1a4 bfc2f7ff 4604b570 460e3004 e9baf7fd
Click to expand...
Click to collapse
Besides of the crash it seems to be incomplete because the code lacks any final ways of gaining elevated privileges (payload w/ reverse shell or something like that).
I assume it all makes no sense due to the loss of relevance for others. So I'll turn my attention to another CVE's out there. This could be the most elegant and shortest way of getting system though.
dadreamer said:
Well, I have compiled that badscreencap by p1gl3t along with android 4.4.2 codebase and then pushed it to my dev. But whenever I run it I receive segfault:
When I issue any one command after that I get
Of course, no any signs of system privileges for my id. Checked this with logcat and it has got the following trace:
Besides of the crash it seems to be incomplete because the code lacks any final ways of gaining elevated privileges (payload w/ reverse shell or something like that).
I assume it all makes no sense due to the loss of relevance for others. So I'll turn my attention to another CVE's out there. This could be the most elegant and shortest way of getting system though.
Click to expand...
Click to collapse
Is your goal to gain root on FireOS v3/v4/5 or are you experimenting with this for other reasons? If the former there are far easier methods (FireOS version dependent) of achieving this; even a theoretical way to unlock the bootloader sans root.