Root Your Android - Code a World
Root Your Android
刚买了手机，自然首先是想获取Root 权限， 什么SuperOneClick，Z4root之类的网上一大堆，虽然发自XDA，也有大量用户测试过了，可是看不到代码，没有原理还是不甘心， 找了半天终于找到SuperOneClick的原始代码。 至于原理，包括源代码都在下面两篇文章讲的很清楚了，自己看吧～
==================================================
From : http://intrepidusgroup.com/insight/2010/09/android-root-source-code-looking-at-the-c-skills/
This is a bit of a follow up to our previous post, but we thought it would be interesting to dissect the source code of two of the recent Android root attacks: the udev exploit and the adb setuid exhaustion attack. The c-skillz site has posted the code for both exploits in the downloads available from their site. As they state, these attacks work basically against all Android phones released to date (and probably future ones if they run Android 2.1 or 2.2).
The udev exploit gained attention as one of the first attacks used against the Droid X, but was posted on the c-skillz site about a week before it made a great deal of noise on other blogs and forums. The download also included a README file which points out this attack mainly follows the exploit reported against udev and patched in 2009. Here’s a link to the CVE it points out: CVE-2009-1185.
Android does not have a separate udev executable and process link on standard Linux deployments. However, large portions of the udev code have been moved into the init daemon (init, like on a standard Linux system, is typically the first userland process and runs as root). In a simplistic and brief nutshell, udev offers dynamic management of devices; notably, it allows standard users to “hotplug” devices that may require root level access, such as a USB device. The kernel will pass a message to the userland udev demon, which will in turn act on the message. The issue is that versions of udev before 1.4.1 did not verify if these messages actually came from the kernel. Thus, a rogue application can submit a message to udev and have an action executed (which in the case of Android, is the init process running as root). While the kernel will need to be updated to send credentials with its messages to udev, the userland udev/init process is really where this vulnerability exists. I had originally referred to this as a kernel exploit, but that would technically be incorrect.
So here’s a quick overview of the exploid.c code: when the application runs, it copies itself to the sqlite_stmt_journals directory (remember, we’re not root yet, so we need a directory the “shell” user can write to). It will then send a NETLINK_KOBJECT_UEVENT message to run the copy of itself when the next hotplug event is triggered. The copied version of the executable then check if it is being run as root (this is our userland udev/init process) and if so, remounts the system partition (which is normally mounted as a read-only partition) and dumps a copy of /system/bin/sh as /system/bin/rootshell with the permissions of 04711 (executable with the user ID bit set so it always runs as root).
Now lets look at the adb setuid exhaustion attack. Compiled, this typically has the name “rageagainstthecage” and the code refers to it has “CVE-2010-EASY” in one comment, but whatever you call it, it’s a pretty smooth way of getting adbd (android’s debugging bridge daemon) to run as root. First the code will check that there is an NPROC setting. This is the maximum number of simultaneous processes which the system will allow. A quick “ulimit -a” once connected over adb should show you this setting for your device (this is set to 3301 processes on a Droid Incredible). The code will then try to find the process ID of the currently running adb daemon on the device. After that, the attack starts a loop to generated processes until it can no longer fork any more processes. Once the limit is hit, one process is killed off and the adb daemon process is restarted. As the code comment points out, this is a bit of a race at this point to make sure the adb can restart, but the number of processes stays maxed out. When the adb daemon starts up on an Android device, it is running as root. The code will later check if it should stay as root, or run in “secure” mode which drops its privileges to the “shell” account. This attack attemps to max out the process so that when the adb daemon attempts to call “setuid” in its code, the call will fail. The current adb code does not check if the setuid call was successful or not, so will happily keep running as root even if this fails.
===========================================================================================
Reference:
[1] http://intrepidusgroup.com/insight/2010/09/android-root-source-code-looking-at-the-c-skills/
[2] http://c-skills.blogspot.com/2008/01/evilness-of-setuidgetuid.html
2018年9月03日 08:05
Who not like jewelry?Absolutely every woman likes.I need some more posts like this.For now I am going to start working for proofreading services of young learners online.Thanks
2018年10月13日 00:43
Good to see a blog from you, you should make it regularly. I am going to follow you at instagram to see you work, thanks for sharing this post
2024年10月06日 14:19
Just admiring your work and wondering how you managed this blog so well. It’s so remarkable that I can't afford to not go through this valuable information whenever I surf the internet!
2024年10月06日 20:34
Aneurysms can be successfully treated if they're caught in time. If you're experiencing horrible, recurrent headaches or even one episode of the single most painful headache you've ever had, see a doctor and ask:
2024年10月06日 20:35
I think this is one of the most important information for me. And i’m glad reading your article. But want to remark on some general things, The website style is wonderful, the articles is really great : D. Good job, cheers
2024年10月06日 20:37
I\'m writing on this topic these days, but I have stopped writing because there is no reference material. Then I accidentally found your article. I can refer to a variety of materials, so I think the work I was preparing will work! Thank you for your efforts.
2024年10月06日 20:37
Are you wandering here and there in search of the right source of information about How To Get Money Off Cash App Without Card? Instead of going anywhere, you have to check out the Cash App help page where the process of getting your money off your Cash App account without even linking a debit card is discussed in a fine manner. In case of any issues you face regarding the same, Cash App customer care executives are there to assist you out.
2024年10月06日 20:38
I have been searching to find a comfort or effective procedure to complete this process and I think this is the most suitable way to do it effectively.
2024年10月06日 20:38
You must have heard of the benefits of fish oil on the brain or heart, but do you know that fish oil can prove to be very beneficial for your muscle building? Give this a read to know more about how fish oil can be the best thing for bodybuilding and which supplements you can take for the best results.
2024年10月06日 20:40
exceptional study, superb website, wherein did u provide you with the statistics in this posting? I have read many of the articles on your website now, and i virtually like your fashion. Thanks a million and please preserve up the effective paintings i trully appretiate your work and recommendations given with the aid of you is beneficial to me. I will proportion this facts with my family & pals. That is a outstanding internet site, hold the high quality critiques coming. That is a excellent inspiring . I am pretty an awful lot thrilled together with your correct work. You put virtually very helpful records. I'm seeking to analyzing your subsequent put up. !!!!
2024年10月06日 20:41
what i don't comprehended is in all actuality how you are not simply appreciably greater very a lot desired than you'll be at this moment. You're insightful. You notice along those strains essentially regarding the matter of this concern, delivered me as i would like to think accept as true with it is something however a fantastic deal of fluctuated factors. Its like women and men aren't blanketed besides if it is something to acquire with woman loopy! Your character stuffs wonderful. All of the time manage it up! What is taking spot i'm new to this, i coincidentally found this i've located it completely accommodating and it has assisted me with tour loads
2024年10月06日 20:42
notable put up i should say and thank you for the statistics. Schooling is absolutely a sticky situation. But, is still most of the leading subjects of our time. I recognize your post and look forward to more. I just observed this weblog and feature excessive hopes for it to keep. Hold up the exquisite paintings, its tough to locate proper ones. I have added to my favorites. Thanks. Its a wonderful delight studying your publish. Its full of facts i am searching out and i love to submit a remark that "the content of your post is exquisite" notable paintings. Best publish! That is a completely best weblog that i'm able to definitively come again to more instances this year! Thank you for informative post.
2024年10月06日 20:42
what i don't comprehended is in all actuality how you are not simply appreciably greater very a lot desired than you'll be at this moment. You're insightful. You notice along those strains essentially regarding the matter of this concern, delivered me as i would like to think accept as true with it is something however a fantastic deal of fluctuated factors. Its like women and men aren't blanketed besides if it is something to acquire with woman loopy! Your character stuffs wonderful. All of the time manage it up! What is taking spot i'm new to this, i coincidentally found this i've located it completely accommodating and it has assisted me with tour loads
2024年10月06日 20:43
Students pursuing higher studies in USA often feel overburdened with the assignment topics. It becomes tough for students to complete the paper work on time. The reason is that they are always running out of time because they
2024年10月06日 20:44
Thanks i assume this is an informative post and it is very useful and informed. Therefore, i would like to thank you for the endeavors which you have made in writing this article. All of the content material is actually well-researched. Thank you
2024年10月06日 20:47
Because of the innovative progression of internet gaming in the previous few years, the craving to have the best PC for second life and other virtual game has been radically expanded among game sweethearts
2024年10月06日 20:57
Discover the latest tunes with \'New DJ Song Download\'. Explore a vibrant collection of fresh beats and remixes, curated to keep the party going. From chart-topping hits to underground gems, find your groove and download the hottest tracks to elevate your playlist today.
2024年10月06日 20:58
Are You Looking for In the UK, there are umpteen companies that claim to offer top-quality assignment writing services in the UK?. The Native assignment expert is available 24X7 to help students.UK assignment help online is priced quite reasonably so most of the students can take the service and become better in academic writing.
2024年10月06日 20:59
Besides this attribute, this app can also fix errors like print jobs stuck in Queue and failure in printing or other related printing problems. If you are a Windows user then you can resolve the issue of the HP Printer Offline Fix by using the HP Print and Scan Doctor application by following a few troubleshooting steps. You are advised to download and install the HP Print and Scan Doctor application on your system Besides this attribute, this app can also fix errors like print jobs stuck in Queue and failure in printing or other related printing problems. If you are a Windows user then you can resolve the issue of the HP Printer Offline Fix by using the HP Print and Scan Doctor application by following a few troubleshooting steps. You are advised to download and install the HP Print and Scan Doctor application on your system. Now, you should run HPPSdr.exe from the download location on your computer. Once HP Print and Scan Doctor is open, you should click Start, and then choose your HP printer.
2024年10月06日 21:03
If you're interested in coding then you should make your career while learning web development courses in Delhi from one of the best web development training institute.
2024年10月06日 22:44
Nice post. I discover something very complicated on distinct blogs everyday. Most commonly it is stimulating to read content off their writers and use a specific thing from their store. I’d would rather apply certain with all the content on my own blog no matter whether you do not mind. Natually I’ll supply you with a link for your internet weblog. Many thanks sharing.
2024年10月06日 22:46
notable put up i should say and thank you for the statistics. Schooling is absolutely a sticky situation. But, is still most of the leading subjects of our time. I recognize your post and look forward to more. I just observed this weblog and feature excessive hopes for it to keep. Hold up the exquisite paintings, its tough to locate proper ones. I have added to my favorites. Thanks. Its a wonderful delight studying your publish. Its full of facts i am searching out and i love to submit a remark that "the content of your post is exquisite" notable paintings. Best publish! That is a completely best weblog that i'm able to definitively come again to more instances this year! Thank you for informative post.
2024年10月06日 23:49
Instant online payments and fund transfer can be done via perfect money to family and friends. You can use the perfect money payment service for various other online transactions, not only as a way of funding an account with online bookmakers with the help of perfect money, but you can also transfer money to other perfect money users. Users need to link perfect money accounts with their bank account for funding and, once done, they can use it for online betting, like debit/ credit card for depositing and withdrawing. Also, depositing your money at a perfect money betting site is very easy yet fast.
2024年10月06日 23:49
Excellent read. I just passed this onto a colleague who was doing some research on that. He actually bought me lunch as I found it for him! Therefore let me rephrase: Thanx for lunch!
2024年10月07日 00:12
Macular degeneration, which affects the center of your vision and can begin as early as age 50, is reaching crisis levels: It is the leading cause of blindness in America. More than ten million people have reduced vision due to the disease, with 200,000 new cases every year. If you've been diagnosed with macular degeneration, talk to an ophthalmologist and ask: