Hi All!
Let's say I would like ( or rather I'm forced to ) build a customized Android ROM. Among all related things that are well described there is a one "black hole" to me..
I need to replace Android Market with a custom market application and block unknown sources setting ( to always disabled ). Root access must also be disabled.
For me it seems that not having root access along with Unknown Sources disabled excludes writing a custom market application, because as far as i know custom market app will need to invoke Package Installer.
Did anyone came across such problem ?
For now i only need to estimate the complexity of this task so i would appreciate ANY clues on this one..
regards
Also interested in the solution, have a similar problem.
First, you should leave Unknown sources always on enabled. If you're worried that you might suck in a malware app, install an antivirus.
Second, I installed several custom ROMs so far, and the only problem I noticed with market is that it does not show the phone model (GT-i5800) anymore, but just "phone". Other than that, apps install fine, payed apps can be purchased and this is the stock Vending.apk, not modded.
Third, don't even consider not rooting your phone if you make a custom ROM (even this sentence is a contradicition...), coz if you don't have root, you can't dump the factoryfs.rfs, making it impossible to create a Custom ROM in layman's terms...
Got any questions, just ask!
Hi so i am new in the Android world i just recently obtained a new Asus Memo Pad 10 (ME103K) and i would like to root it to use some functions a friend showed on their Android device, but i sadly got scared that i might brick my device if i do not root correctly, so i searched up my device but i couldn't find anything that looked like a guide for this particular one ( i even read in a forum that it supposedly doesn't have a root yet because its new ) , so my question is : Is there any way to root this device yet? and if yes, can i ask for a guide or a link that has the guide? Thanks in advance .
*Bump*
I haven't been able to find a root working for Asus MemoPad 10 (ME103K) Could anyone provide any information if there is a root available? (I saw many fake sites and some claiming to work but didn't)
Thank you in advance
Framaroot?
Yoohei said:
Hi so i am new in the Android world i just recently obtained a new Asus Memo Pad 10 (ME103K) and i would like to root it to use some functions a friend showed on their Android device, but i sadly got scared that i might brick my device if i do not root correctly, so i searched up my device but i couldn't find anything that looked like a guide for this particular one ( i even read in a forum that it supposedly doesn't have a root yet because its new ) , so my question is : Is there any way to root this device yet? and if yes, can i ask for a guide or a link that has the guide? Thanks in advance .
Click to expand...
Click to collapse
have you tried framaroot?
http://forum.xda-developers.com/apps/framaroot/root-framaroot-one-click-apk-to-root-t2130276
Downlaod version 1.9.3
I rooted ME103K on my own, compiling a custom kernel
Executive summary: Go to youtube and watch video with ID "gqubgQjqfHw" (I can't post links yet, sorry! ) - or search Youtube for "Rooting MemoPAD10 (ME103K) with my custom compiled kernel"
Analysis:
I hated the fact that my recently purchased MemoPAD10 (ME103K) tablet had no open process to allow me to become root. I don't trust the closed-source one-click root apps that use various exploits, and require communicating with servers in.... China. Why would they need to do that? I wonder...
I therefore decided this was a good opportunity for me to study the relevant documentation and follow the steps necessary to build an Android kernel for my tablet. I then packaged my custom-compiled kernel into my custom boot image, and the video shows how I boot from it and become root in the process.
Note that I didn't burn anything in my tablet - it's a 'tethered' root, it has no side-effects.
If you are a developer, you can read in detail about the steps I had to take to modify the kernel (and su.c) and become root - by reading the questions (and answers!) that I posted in the Android StackExchange forum ( can't post links yet, see the video description in Youtube ).
If you are not a developer, you can download my custom boot image from the link below - but note that this means you are trusting me to not do evil things to your tablet as my kernel boots and my /sbin/su is run
Honestly, I haven't done anything - I just wanted to run a deboot-strapped Debian in my tablet. But I am also worried about the cavalier attitude I see on the web about rooting your devices - if you want to be truly safe, you must either do what I did (and recompile the kernel yourself) or absolutely trust the person that gives it to you. I do wish Google had forced a UI-accessible "become root" option in Android, just as Cyanogen does (sigh).
The image I created and used in the video to boot in rooted mode, is available from the link show in the Youtube video details.
Enjoy!
I've been banging my head about this one for a couple of years across several Windows installations including 7, 8, 8.1 and 10 at home on two PCs and Windows XP (I think) and 7 at work, on multiple laptops, and taking place in both Chrome and Internet Explorer 9, 10 and 11. I have Edge uninstalled in Windows 10 so I can't test that at the moment. I forget what result I had with Firefox, but I'll probably reinstall it to find out.
It's most annoying when editing an OP but whether with an OP or regular post, I've occasionally worked around the problem by keeping a "master" copy of the post in Notepad++ on Windows, editing that, then copying and pasting that to my post edit. This only works when I either already have a current master copy in Notepad++, or can manage to retrieve an uncorrupted copy which is sometimes difficult when the problem happens in all my currently installed programs.
The problem also occurs when editing a DevDB project in both Chrome and Internet Explorer.
The problem happens most frequently in Chrome so my most common solution was to temporarily switch to Internet Explorer, but right now even IE is giving the same result.
I'm very good at searching and I've tried searching both Google and XDA with different sets of search terms and I don't find anything even remotely similar.
For example, the following correct text:
Code:
First, the thanks:
[user=2645378]@AndroidFileHost[/user] for the Android File Host website and especially their changes allowing for the reorganization of already uploaded files.
[user=5418208]@KyPbP[/user] for [URL="http://forum.xda-developers.com/showpost.php?p=60851710&postcount=108"]letting us know it's availability and giving the link to download the VK810 35A_08 KDZ[/URL].
[user=5868929]@hsbadr[/user] for giving me permission to kang his [URL="http://forum.xda-developers.com/showpost.php?p=56005236&postcount=1"]Verizon G3 VS985 JasmineROM 7.0[/URL] update script for this use.
[user=229404]@rant[/user] for giving a [URL="http://forum.xda-developers.com/showpost.php?p=60857092&postcount=1"]link to the official Verizon PDF detailing this release[/URL].
[user=631273]@Chainfire[/user] for [URL="http://forum.xda-developers.com/showthread.php?t=1538053"]SuperSU[/URL]!
[user=5022682]@Hnk1[/user] for continued support, advise and ideas, and for experimenting to find out how to root 35A_08 without downgrading. His two updated guides:[INDENT][URL="http://forum.xda-developers.com/lg-g-pad-83/general/vk810-altev-complete-root-recovery-t3108260"][VK810][Altev][Guides][Information] Root Recovery Repair [4.4.2][5.02][/URL]
[URL="http://forum.xda-developers.com/lg-g-pad-83/general/vk810-downgrade-required-t3116336"][VK810][ROOT][Lollipop][5.02] No downgrade required[/URL][/INDENT]
[SIZE=5][COLOR=Red]Debloat scripts that you can flash in CWM (ClockworkMod Recovery) after flashing the ROM and SuperSU.zip are located in the [URL=http://forum.xda-developers.com/showpost.php?p=60861201&postcount=2]second post[/URL].[/COLOR][/SIZE]
after clicking the Edit button becomes:
Code:
First, the thanks:
[user=2645378]@AndroidFileHost[/user] for the Android File Host website and especially their changes allowing for the reorganization of already uploaded files.
[user=5418208]@KyPbP[/user] for [URL=" us know it's availability and giving the link to download the VK810 35A_08 KDZ[/URL].
[user=5868929]@hsbadr[/user] for giving me permission to kang his [URL=" G3 VS985 JasmineROM 7.0[/URL] update script for this use.
[user=229404]@rant[/user] for giving a [URL=" to the official Verizon PDF detailing this release[/URL].
[user=631273]@Chainfire[/user] for [URL="[/URL]!
[user=5022682]@Hnk1[/user] for continued support, advise and ideas, and for experimenting to find out how to root 35A_08 without downgrading. His two updated guides:[INDENT][URL="] Root Recovery Repair [4.4.2][5.02][/URL]
[URL="] No downgrade required[/URL][/INDENT]
[SIZE=5][COLOR=Red]Debloat scripts that you can flash in TWRP after flashing the ROM and SuperSU.zip are located in the [URL= post[/URL].[/COLOR][/SIZE]
Notice the URLs are missing, plus some other words after the URL such as specifically:
Code:
[user=5418208]@KyPbP[/user] for [URL="http://forum.xda-developers.com/showpost.php?p=60851710&postcount=108"]letting us know it's availability and giving the link to download the VK810 35A_08 KDZ[/URL]
becoming:
Code:
[user=5418208]@KyPbP[/user] for [URL=" us know it's availability and giving the link to download the VK810 35A_08 KDZ[/URL].
If this were only happening in Chrome, I would suspect an extension. I've had the problem happen on completely new and clean installations of Windows as well.
Thanks in advance for any advice.
FYI now really weird, even this post didn't come out right on the initial posting. The information attempts to be there when I edit it (additional CODE boxes, there are clearly four total CODE boxes with both beginning and ending CODE tags when I posted and when I edit the post), but as usual, URLs and other information is missing from my examples. I'll probably be forced to give screenshots when I have time later.
Am I allowed to provide a guide on how to do it, its an easy process and I've done it with the apk and installed it on my device.
The latest blackberry keyboard pre-patched apk before I managed to patch mine was 1.0, I managed to find and patch a 4.0 apk.
I have to go soon, but here's a quick non-in-depth tutorial
< I have some concerns a tutorial would get me in trouble >
Anyone know if I'll get hit with some DMCA legal stuff if I post a tutorial?
it SHOULDNT be a problem right?
Devices & Linux Versions I or other Testers have Successfully Gained Root on:
(Likely All) MTK CPU Based Android devices UP TO 11 (Maybe 12? I haven't tested) (I.e LG, Sony, Select Samsung devices)
Android Devices with LINUX KERNEL VERSIONS - 5.8 - 4.14 - Maybe More? (Needs Testing)
-THIS GUIDE IS NOT BEGINNER FRIENDLY - BASIC UNDERSTANDING OF PYTHON, UNIX/LINUX ETC WILL BE REQUIRED!-
If you have been holding off updating your device, well here's some good news, your device may still be vulnerable to a method to gain root access (and subsequently, possibly the ability to edit Build.prop and therefore allow the ability for OEM unlocking on USA based devices.) <- correct me if I'm wrong, but this should be possible, and once done, should persist across updates, correct?
As of the time of writing this, there is not currently a simplified APK method, but, still this process is relatively straight forward.
Alot of the methods used HAVE been patched from what I understand, but there have got to be plenty of devices out there still which are not updated. This project aims to compile all current, former and future Root methods into an APK that will do all the leg-work. If its able to find a working method, the GUI will pop a root shell for the end user. This SHOULD work, regardless of the setting of the "OEM UNLOCK" option in the dev options. A bypass, essentially.
Regardless, The project linked below uses a myriad of known exploits & vulnerabilities and looks to find one that will work.
Methods used are:
Nearly all of GTFOBins
Writeable docker.sock
CVE-2022-0847 (Dirty pipe)
CVE-2021-4034 (pwnkit)
CVE-2021-3560
It'll exploit most sudo privileges listed in GTFOBins to pop a root shell, as well as exploiting issues like a writable docker.sock, or the recent dirty pipe (CVE-2022-0847). More methods to root will be added over time too.
There is also an alternative (Dirty Pipe) injection method the uses @topjohnwu 's Magisk , this should be implemented into the apk. See this Github repo, Here.
I would imagine this could be implented in a way to target devices that have stopped being supported for updates, aswell, that do not have TWRP, such as the SM-T307U.
One big note - I am betting there are still ALOT of devices that are in inventory at retailers that remain on the vulnerable OS. So keeping that in mind, I'd say this is worth building.
What needs to be done:
TESTING!
Build APK - HELP NEEDED WITH THIS!
Deploy
Main Goals:
Get bootloader unlock ability for devices normally not unlockable (I.e North American Samsung Galaxy S22, Etc)
Above can be achieved by getting temp root via methods detailed here or otherwise, then editing build.prop, altering the below settings (The settings may be worded differently or simply not present at all, depending on device and Firmware version):
sys.oem_unlocking_allowed to 1
ro.oem_unlock_supported to 1 (most devices are set to 1 by default.)
ro.boot.flash.locked to 0
ro.secure to 0
ro.debuggable to 1
I think there may be one or two more that pretaint to Flash.locked. I.e flash.locked.other--or something very close.
Locally, gain temp root (System preferred, but any root will do.) on as many device types as possible.
Give device control back to end user.
Stay up-to-date on new exploits for root access & update apk accordingly.
STAY ETHICAL!!!! This is, in the end, a research project. Meaning all work preformed in the context of this project could result in a damaged or bricked device. By participating in this project you acknoledge these risks and accept them, and agree to not hold me, XDA, or anyone else responsible if you do some dumb ****. - k0mraid3
Github Project link: HERE for my fork & HERE for the original project.
My fork will incorporate the original project, as well as other found root access methods, such as the magisk injection method mentioned above - my repo is mainly used as a hub for the APK's dev - i don't have enough time to work on it at the moment but all are welcome to help.
July 15th 2022 (UPDATE) (SAMSUNG DEVICES ONLY): A new Escalation method has been found via the Galaxy app store (Versions BEFORE Galaxy Store 4.5.41.8). No details known yet, but it is said to be very easy. See CVE-2022-33708 (July132022). Unknown if downgrading the app to 4.5.0.0 will enable the method again or not.
Cred: liamg
One method to run Traitor on device - Thanks @DevinDking for sharing this.
Steps to get script on phone.
//
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
$adb push traitor ${dir} //This puts file on phone make sure to run the terminal where its located
$adb shell chmod 755 ${dir}/traitor"
//
Now to run script start a new terminal
//
adb shell
#!/bin/sh
set -e
dir=/data/local/tmp
adb=${adb:-"adb"}
${dir}/traitor //script opens
//
But I assume this wouldn't work right, and isn't right.
Idk trying my best here xD
Click to expand...
Click to collapse
Tools & References:
Linux (and Android, FTMP) Privilege Escalation Techniques
Dirty Pipe - Magisk Injection
Traitor - Main Repo
GTFOBins
CVE Database (Public Database for exploits, vulnerabilities, etc.)
Windows Subsystem For Linux (Great for Dev)
ADB App Control - Cred @Cyber.Cat
Leaked Samsung Source Code ***Mod Edit: Link Removed***
Crontab Root Template script (File Attached - you still must edit crontab with "crontab -e" and point it to this file, see comments for guide, I will add one to post later)
Android Image Kitchen Used to create custom image's etc.
MTK Client
MTK Meta Utility (Source-???)
Will add more as time goes on and more found.
Interesting Attack vectors -
GFX Componets of a system.
Issues with Linux itself (i.e Dirty Pipe)
Privilage escalation via any means (I.e GTFOBins)
unprotected system process - Hijack them if possible (i.e RILService Mode, and a wide range of other OEM apps left on devices after ship)
7/24/22 - Samsung, LG & Other OEM's obfuscating (Intentionally Hiding) Fastboot and ADB Bootloader interfaces on PC
So over the last week or so i dived head first into USB Dev - ill save you the time and sum it up.
Vendors and OEM's are actively obfuscating the USB connection between your smartphone and the PC to keep you from Rooting. As far as im aware, there is no Universal way to fix this as each OEM screws with the USB drivers differently. THIS needs to be a point of focus for the rooting community. However, i have found a few tools for Dev if you wish to screw with this. (I'll upload them tonight)
7/24/22 - MTK (MediaTek) based Exploits
I Will try to compile a few methods for FORCING Bootloader Unlock on MTK based Devices as well as a way for manipulating said devices. I will attach two tools to this thread, these tools are EXTREMELY POWERFUL and can completely **** up your device. When i say REALLY F*CK UP your device, I mean to the point you cant even access recovery, Download OR bootloader mode. I'm Talking a blank DEAD device. So use with caution.
With that said, lets talk about the tools. You will need a basic understanding of Python to make use of MTK Client
First up, we have MTK Meta Utility (Currently Version 44) (Download Below)
Next we have MTK Client (Github Link)
So what can you do? Well, you can crash the Preloader to Brom with MTK Meta Utility while at the same time using MTK Client to send any payload you like to the device via Fastboot.
I know, vague right now, but ill add detail over the coming days.
I will continue to update the below list as new methods are discovered.
If you find Guides, tutorials or new exploits, please link them in the comments so I can include them in future development!
Telegram Channel: Here.
Information on Vulnerabilities, exploits & methods - CVE-2022-0847 (Jfrog) - The Story Of "Dirty Pipe" - XDA - Dirty Pipe - PWNKIT (CVE--2021-4034) - CVE-2021-3560 - Docker Breakout / Privilege Escalation - CVE-2022-33708 (July132022) - CVE-2022-33701 (July122022) - CVE-2022-22268 (Unlock Knox Guard with DEX) (JAN2022) - MTK Client -
Dev Team & credit to -
@topjohnwu - LiamG - @wr3cckl3ss1 - bkerler -
UPDATED - 7/29/22
There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.
Don't update... destroyer of worlds
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Lol, everybody already updated the patch
blackhawk said:
Lol, everybody already updated the patch
Click to expand...
Click to collapse
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.
sierratango88 said:
There is also a new vulnerability exploit by Zhenpeng Lin that allows for privilege escalation on Pixel 6 and and Galaxy S22 devices running 5.10 kernel.
Click to expand...
Click to collapse
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.
olivehue512 said:
I feel like I'm missing something because wouldn't their normally be a million responses of hype, hope and nay-saying going on here? Has this been shot down already?
Click to expand...
Click to collapse
Well, because they are known and accepted vulnerabilities and exploits. A very few have even been marked as "WONTFIX" such as the TTY method.
olivehue512 said:
This is just sad panda. I'm gonna skip next update anyways unless it comes with an actual other phone that is BL unlocked. I feel like everyone wants this so bad it can't be that far out before it happens.
Does the Magisk injection method work after July patch? I was reading through the work they did to get it done. Props to those guys.
Click to expand...
Click to collapse
Honestly, it's worth a shot but I doubt it.
One of the goals behind building the APK compilation of all these different tactics is to enable the end user to "give it a shot" easily on different devices, without having to know how to run all of this manually. Basically imagine an apk that just tries all the above methods and if ones successful the gui will pop a root shell open. From there, the possibilities are endless. Edit Build.prop, SELinux, Verity, Etc.
FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.
K0mraid3 said:
Has it got a fancy number yet?! Eager to try this!!!! Maybe it can be put in with the others.
Click to expand...
Click to collapse
There hasn't been a CVE assigned to it yet that I am aware of.
xgerryx said:
FYI even you applied the July update, seems like the Kernel version is still from June 21st, is still 5.10xxxx so we could still benefit from this exploit. Very interested in how we can get root here in the US.
Click to expand...
Click to collapse
Go to the Github linked and try the different methods, see if you can pop a root and nano build.prop to allow OEM unlocking?
sierratango88 said:
There hasn't been a CVE assigned to it yet that I am aware of.
Click to expand...
Click to collapse
GREAT news for us! LEts get this temp root! lol
Looks like another new one! CVE-2022-33708
Another Samsung Exclusive - CVE-2022-33701
So, ive just spent my entire friday and friday night MANUALLY testing all the GTFOBins & reproducing some of the newer CVE's on Samsung Galaxy S7 Edge (Android 9) -Galaxy tab A 8.4, (Android 11), Galaxy S21 & S22 (Android 12) --- A little bit of progress made. Again, ill need someone with better working knowledge on APKs & Java to really move forward. All i can say so far, is this all must be awk for sammie, because cronie is looking promising
"crontab -e"
interesting find. not "New" but still new-ish enough some may be able to use. CVE-2022-22268 (Unlock Knox Guard with DEX)
New to this all but not rooting. Anyone recommend a way tutorial on how to try these methods on Win 11?
I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.
DevinDking said:
I don't have a deep understanding of Linux, I have tried, debian and unbuntu. I get traitor to run but it's detecting the Linux kernel and not my phones. How can I get the program to search for vulnerability on my phone not my Linux. I would love a more in depth guide and I'd love to give feedback on methods.
Click to expand...
Click to collapse
i had the same issue but cant remember how i worked that out. let me see if i can find out what i did on win11