2.1 RUU root vectors - Hero CDMA Q&A, Help & Troubleshooting

So the way I see it, there are a couple vectors from which we can attempt to root the official 2.1 RUU:
1. SUID privilege escalation - this is /possible/ through many of the suid binaries in /system/bin (anyone know what skyagent is, and how to use it?)
2. TCP/IP ports 9734, 16650, 2479, 9000 - I don't know what these are for. If someone does, please let me know.
3. mkfs.ext2 the sdcard (except that noexec is set when card is mounted)
4. Some other way involving fastboot erase/restore???
If anyone else thinks of anything, I'm all ears - until then, I'll be playing with it

What I've been playing with so far
pppd, wifitools, reboot and ip are setuid root.
skyagent is setuid/setgid root (REALLY, if anyone knows ANYTHING about this, now is the time to speak up).
pppd can execute scripts through pppd connect...
so, I've done this so far...
to make /sqlite_stmt_journals/callit.sh:
Code:
echo "exec /system/bin/pppd -detach modem crtscts \\" > /sqlite_stmt_journals/callit.sh
echo "/dev/tty 460800 noipdefault defaultroute \\" >> /sqlite_stmt_journals/callit.sh
echo "noauth name fakeUsername connect \'/sqlite_stmt_journals/dialer\'" >> /sqlite_stmt_journals/callit.sh
to make /sqlite_stmt_journals/dialer:
Code:
echo "exec /sqlite_stmt_journals/su - /system/bin/sh" > /sqlite_stmt_journals/dialer
and then I drop su into /sqlite_stmt_journals.
After that, I chmod everything 0755 and chmod su 4755.
tried to have dialer chown root su, but that doesn't seem to work.
Any suggestions?

I don't know what your talking about but I know there is an official section in development for rooting the hero

ah thank you!

Related

[ROOTING] The M7 Exploit + Newbie Guide

To be honest, I'm a nice guy, but when threads get filled with utter "OMG, How do I root?" posts, I get pissed off. I don't mean to backseat moderate or anything, I just really get fed up sometimes. Hence, I've broken out the hardcore side of myself, and I present:
Coburn's (mostly) failproof rootmeplz kthxbai tutorial, featuring the awesome m7 exploit.
YOU CANNOT USE THIS ROOT GUIDE TO INSTALL ANDROID 2.0.x/2.1/2.x AT THIS MOMENT IN TIME. PLEASE DO NOT ASK IF YOU CAN INSTALL ANDROID 2.x USING ROOT, AT THIS STAGE IT'S A BIG FAT NO! THANK YOU FOR YOUR ATTENTION!!
Alright.
Easy to understand, plain english guide
Download the ZIP file attached to this post. Extract the files to a safe location - perhaps C:\Tattoo ?
Now, you'll need adb for windows. You can get it from my website's server here: ADB for windows.
Make sure your device is in USB Debug Mode (Settings > Applications > Development). This is ESSENTIAL!
Extract all the files in the adb4win zip file to your C:\Tattoo folder.
Now, go to Command Prompt. In XP, it's under System Tools in Accessories. In Vista/7, it'll be under accessories.
Do the following at the command line:
C:\Users\Coburn> cd C:\Tattoo
This will change your working directory from C:\Users\Coburn (or silimar) to C:\Tattoo .
Now, at the command line, do this:
C:\Tattoo> adb-windows shell "mkdir /data/local/bin" (with the quotes!).
This makes a directory on the Tattoo under /data/local, called bin. If you get a error (like mkdir failed, file/folder exists), this is fine! Don't sweat it.
Now, run this command:
C:\Tattoo> adb-windows push m7 /data/local/bin/m7
...and wait until finish.
Run this:
C:\Tattoo> adb-windows shell "cd /data/local/bin && chmod 755 ./m7" (with the quotes!)
This allows you to run the sucker.
Now, the fun part. Run this:
C:\Tattoo> adb-windows shell
This will dump you at a "$" shell. do the following:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
...lotsa text will flow down your screen. This is normal. Sometimes the exploit causes adb to freeze up, I don't know. I think it may be due to the exploit. It worked on my mac fine though...
Soon, you'll be greeted with this:
#
This is the root prompt! If you get stuff like this:
# usage: reboot ...
usage: reboot ....
usage: reboot ...
Just keep your cool, press enter and the # will say "Boo" again. This is due the exploit spawning reboots to gain the shell.
Then, do these commands from this thread's first post:
-bm- and the hax0rs crew said:
You did it, you should be root now!
Let's set some variables:
Code:
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
[...] check if ur root:
Code:
id
You should get something like this:
Code:
# id
uid=0(root) gid=1000(shell) groups=1003(graphics),1004(input),1007(log),1011(adb),1015(sdcard_rw),3001(net_bt_admin),3002(net_bt),3003(inet)
uid=0(root) is important.
Click to expand...
Click to collapse
When you get this:
C:\Tattoo> adb-windows shell
$ cd /data/local/bin
$ while ./m7 ; do : ; done
[... lotsa pasta ...]
#
You can do anything then! Look at /system, /data, etc etc. You're broken free, my friend, and you'll forever be free. Until you press that exit button. you didn't. You didn't press that exit button? lolwut u did? Grrrrrrr!!!
EDIT: Added Guide to remount partitions. It's below.
Now you need to install su. Exit your root shell (via CTRL+C) (NO, Coburn, are you serious? ME LOSE ROOT SHELL?! ) and download this su.zip and extract it to C:\Tattoo. DO NOT EXIT THE COMMAND PROMPT WINDOW.
Meanwhile, back at the ranch, in your command prompt window, do this:
C:\Tattoo> adb-windows push su /data/local/bin/su
Then break out a shell...
C:\Tattoo> adb-windows shell
at the $ prompt, enter:
$ chmod 755 /data/local/bin/su
$ cd /data/local/bin/
..run the exploit again via "while 'true' ; do ./m7 ; done" to get root again then enter ...
# chown root.root /data/local/bin/su
# chmod 4755 /data/local/bin/su
# mount -o rw,remount /dev/block/mtdblock5 /data
# mount -o rw,remount /dev/block/mtdblock3 /system (This line allows you to play around with files on the system partition!)
After that, you can exit out of the root shell, and try a normal shell and this:
$ /data/local/bin/su
...which should make you get a nice # prompt. (Sometimes it doesn't, for me it got su: permission denied, wtf?)
(End SU Part of guide)
Tested on Windows 7. Also works on a phone terminal emulator too!
Keep your cool peeps - I do this for fun, I'm not a fulltime android dev. I am an addict though.
Happy rootin my friends.
Cheers,
Tattoo Hacker Coburn.
Greets fly out to the geeks that hacked it originally - without you, I'd have got a nexus one.
Thanks for marsdroid for correcting an error. Kudos to you, bro!
"ANDROID - It's a virus. In a Good Way. Once it's in your system, you can't get rid of it."
You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #
You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.
mainfram3 said:
You could also add an explanation on how to remount the partitions without nosuid, so that a suid su can work.
Click to expand...
Click to collapse
Noted. Will do.
LordGiotto said:
You should also add the "su" part in order to get root easier after the first time. Otherwise you have to do the exploit every time you want #
Click to expand...
Click to collapse
Heh, yeah. Might add that up too.
Coburn64.
Thanks Man.
Nice Thread.
Thank you Coburn
svprm said:
Coburn64.
Thanks Man.
Nice Thread.
Click to expand...
Click to collapse
Thanks bro for your thanks.
I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
[ROOTING] The M7 Exploit + Newbie Guide
Easy to understand, plain english guide
Click to expand...
Click to collapse
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-
-bm- said:
I'm very glad you did that work, I'm kind of busy but I will update my statusposting and link to your HowTo!
Thats great community work.
I apologize for my english, it's not my native language and I tried my best. ;-)
Keep up your work!
-bm-
Click to expand...
Click to collapse
You're welcome. I actually wanted this thread to help your thread, I wanted to spawn a m7 exploit thread to keep the original thread (which is based on the classic m6 exploit) clean of "How do I root with m7" and such.
Keep up the good work too, bm!
Thanks Coburn, so m6 is useless..
adb shell rm /data/local/bin/m6?
thx for the work , and corrections ! deleted the ealyer post
?
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??
liderzre said:
When i get # , and type:
# chown root.root /data/local/bin/su
i get :
chown root.root /data/local/bin/su
chown: not found
#
What i'm doing wrong /??
Click to expand...
Click to collapse
type
export LD_LIBRARY_PATH=/system/lib
export PATH=/system/bin
rooted
Ty. Guide is not 100% for noobs. (ME).
Problem copying files to system partition after successfull rooting
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks
ronyrad said:
Hi
The device was rooted successfully (from the first time using m7)
But I have very strange problem.
I try to update some files in the /system (updating fonts in /system/fonts).
I successfully run following command to remount system with rw permissions
/system/bin/mount -o rw,remount /dev/block/mtdblock3 /system
But when I try to copy files to /system/fonts I get "not enough memory" error.
If I run "df" command it shows that /system has 14% free before write attempt
But if I run "df" command after the write attempt I see that there is no free space.
It looks like there is some protection mechanism that prevents copying files to /system partition.
Does any one has an idea how to solve it?
Thanks
Click to expand...
Click to collapse
The problem is well known an jet we have got no explanation. It looks like an additional security system build in by HTC. That is what also prevents us from flashing Custom ROMS at the moment. Development goes on here: http://forum.xda-developers.com/showthread.php?t=631540&page=18 but there is no solution or explanation until now.
-bm-
Could it be that it seems to be that the driver (yaffs) is possibly trying to copy /system into memory, and then reflash the partition all at once (to prevent NAND/NOR tear and wear)?
this guide is in error and will for sure not work ...
you should post probberly ...specially now when things is working....
there is no reason do do a NONSENCE guide .....
thx for the work thoe
Click to expand...
Click to collapse
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.
Coburn64 said:
Excuse me, but it was tested working. I do not post false or misleading information, so please don't accuse me of posting something that won't work. It does work. If you have troubles, you're not following it correctly. Start again and work one step at a time.
Click to expand...
Click to collapse
don't worry for such baseless allegations coburn.... u r doing a great job. keep up this good work bro.... thanks a lot for this wonderful presentation...
waiting for ur custom ROM.....
Coburn64 u are missing a ; in the 2. while
and i dont expect the newbies to sit back and wait for the "BUUH"..
but im sure someone will....
thx again
EDIT Coburn64 fixed it

[SCRIPT] Permissions Init Script

Hey guys,
I had a nasty issue with Bi-Winning a couple weeks ago where I pushed custom framework and totally forgot about permissions. Apparently when you don't set the proper permissions it can really slow things down.
So I figured this could easily be avoided. So because of that and our CWM "Fix Permissions" option doesn't really do anything, I wrote this script to fix it!
Upon every boot, it will scan /system/app, /system/framework/, and /data/app and set the proper permissions for all the files in there.
Users
note if you're on Trigger 2.9.1+ or Bi-Winning V1+ you do NOT have to do this. It's built into your ROM already.
Flash the attached zip named "CWM_Flash_Permissions_Script.zip"
Ironically, it may not have the correct permissions after you flash it, so then do either of the following
1) Do these commands in ADB to set the correct permissions
Code:
adb shell
mount -o rw,remount /dev/block/stl9 /system
busybox chmod 777 /system/etc/init.d/*
or
2) Open up Root Explorer (or something similar)
navigate to /system/etc/init.d/
in there find the new file S30edt_perms
long press, and set the permissions
make it look like this
Code:
x x x
x x x
x x x
Here's the init.d script, it's really simple, but also effective
Code:
#!/system/bin/sh
# Permission script
# Written by Einherjar Dev Team
# www.edtdev.com
logFile=/data/edt/logs/S30edt_perms.log
if [ -f $logFile ]; then
rm $logFile
fi
touch $logFile
mount -o rw,remount /dev/block/stl9 /system
echo "Setting permissions" >> $logFile
for file in /system/app/* /system/framework/* /data/app/*; do
echo " setting permissions (644) for $file" >> $logFile
chmod 644 $file
done
echo "chmodding init.d folder"
chmod 777 /system/etc/init.d
for file in /system/etc/init.d/*; do
echo " setting permissions (777) for $file" >> $logFile
chmod 777 $file
done
echo "Permissions set" >> $logFile
Very cool, thanks roman.
Very cool to post the code too... lets us linux newbs get our learn on!
Poser said:
Very cool, thanks roman.
Very cool to post the code too... lets us linux newbs get our learn on!
Click to expand...
Click to collapse
I'm a Linux noobie myself!
birgertime said:
I'm a Linux noobie myself!
Click to expand...
Click to collapse
[slight OT] Just getting wifi working on an old ideapad y510 in slackware was an epic struggle... (wicd my arse)
[back on topic] I wish more devs would post script contents (though we can easily download and look in vi or notepad)... it helps the learning curve immensely
grateful for all the work EDT and rest of dev community does. We all are.
Question: What does the fix permissions CWM do then?
Poser said:
[slight OT] Just getting wifi working on an old ideapad y510 in slackware was an epic struggle... (wicd my arse)
[back on topic] I wish more devs would post script contents (though we can easily download and look in vi or notepad)... it helps the learning curve immensely
grateful for all the work EDT and rest of dev community does. We all are.
Question: What does the fix permissions CWM do then?
Click to expand...
Click to collapse
I have no clue, lol. Never bothered looking at it
edit: I hate vi.
roman im gonna add S30edt_perms.zip to my rom ..ill add you to credits
birgertime said:
I have no clue, lol. Never bothered looking at it
edit: I hate vi.
Click to expand...
Click to collapse
lol.
Vi is about as stripped down as you can get when it comes to text based editors... (I know its blasphemous... but I dig notepad++, shhh... dont tell)
I get "Bad Mode"
gamefreakgcb said:
I get "Bad Mode"
Click to expand...
Click to collapse
Hmm, ok you might need super user permissions do this and let me knkow if it works:
1) type in "adb shell"
2) type in su (don't press enter yet)
3) turn your screen on & unlock it
4) press enter on the su prompt, then his yes on the screen
then try that chmod command again.
birgertime said:
Hmm, ok you might need super user permissions do this and let me knkow if it works:
1) type in "adb shell"
2) type in su (don't press enter yet)
3) turn your screen on & unlock it
4) press enter on the su prompt, then his yes on the screen
then try that chmod command again.
Click to expand...
Click to collapse
Gave permission, still "Bad Mode"
gamefreakgcb said:
Gave permission, still "Bad Mode"
Click to expand...
Click to collapse
bad mode in the command line? gotta give me something more here
if it' s when you run chmod +x try this one:
Code:
busybox chmod 777 /system/etc/init.d/*
birgertime said:
bad mode in the command line? gotta give me something more here
if it' s when you run chmod +x try this one:
Code:
busybox chmod 777 /system/etc/init.d/*
Click to expand...
Click to collapse
When I do that, I get
chmod: /system/etc/init.d/S01edt_systcl: Read-only file system
chmod: /system/etc/init.d/S20edt_gps: Read-only file system
chmod: /system/etc/init.d/S30edt_perms: Read-only file system
chmod: /system/etc/init.d/S50edt_zipalign: Read-only file system
chmod: /system/etc/init.d/S98edt_tweaks: Read-only file system
chmod: /system/etc/init.d/S99edt_complete: Read-only file system
gamefreakgcb said:
When I do that, I get
chmod: /system/etc/init.d/S01edt_systcl: Read-only file system
chmod: /system/etc/init.d/S20edt_gps: Read-only file system
chmod: /system/etc/init.d/S30edt_perms: Read-only file system
chmod: /system/etc/init.d/S50edt_zipalign: Read-only file system
chmod: /system/etc/init.d/S98edt_tweaks: Read-only file system
chmod: /system/etc/init.d/S99edt_complete: Read-only file system
Click to expand...
Click to collapse
Oh crap, thanks for pointing that out man. Easy fix
do this
Code:
mount -o rw,remount /dev/block/stl9 /system
busybox chmod 777 /system/etc/init.d/*
should work like a charm
by the way, next time you flash a newer edt rom, they already have this fix built in. since you overwrote the file, you'll need to run the above commands to set the correct permissions as they get messed up sometimes when modifying them.
That did the trick, thanks.
The script in the .zip says
Code:
# Permission script
# Written by Roman (birgertime)
# www.edtdev.com
logFile=/data/edt/logs/S30edt_perms.log
if [ -f $logFile ]; then
rm $logFile
fi
touch $logFile
echo "Setting permissions" >> $logFile
for file in /system/app/* /system/framework/* /data/app/*; do
echo "setting permissions for $file" >> $logFile
chmod 0644 $file
done
echo "Permissions set" >> $logFile
Which is different than the OP. I'm confused.
MikeyMike01 said:
The script in the .zip says
Code:
# Permission script
# Written by Roman (birgertime)
# www.edtdev.com
logFile=/data/edt/logs/S30edt_perms.log
if [ -f $logFile ]; then
rm $logFile
fi
touch $logFile
echo "Setting permissions" >> $logFile
for file in /system/app/* /system/framework/* /data/app/*; do
echo "setting permissions for $file" >> $logFile
chmod 0644 $file
done
echo "Permissions set" >> $logFile
Which is different than the OP. I'm confused.
Click to expand...
Click to collapse
I notice that before... but got side tracked and forgot to mention something... I just pulled the one from in Bi-Winning V2 and have been ADB Push'ing that.
EDIT: Also noticed that the one that's in Dan_Brutal "Metrik Part 1- Pepperkake" is the wrong one.
Does this works on hd2 android? i really need this..
haysnamrip said:
Does this works on hd2 android? i really need this..
Click to expand...
Click to collapse
Should work on any Android that can run scripts
i flashed and its working.. no more changing permission after run fix_permissins on terminal emulator..
Hey Roman, thanks for yet another improvement for this phone!
Simple question: can I just download and push the S30edt_perms.zip to etc/int.d? And is this any good for CM7 based ROMs? I just checked and that file isn't in my init.d folder on Trigger Redux.
Thanks!
Sent from my rough sketch of a Vibrant on a brick.

[MOD] v0.3.1 Working Full Ubuntu for 1.5.7 and 1.8.3 based on Sogarth's script

Sogarth's webtop2sd will be released soon, you really should wait and install that instead of this! Thanks -The Management
No longer breaks on 1.83, thanks to Romracer
Update: This script worked on my phone. Mind you I was installing it from a fresh SBF flash, but it should work on your phone too. Absolutely no guarantees as usual.
Update 11th April 2011, 06:59 PM: Won't be getting CWM package because it'd be huuuuuuuuuge.
Update 28th April 2011. 16:38 PM: Removing BETA tag since there have been no issues with the script for quite some time.
First off I would like to thank Sogarth for making this script in the first place as well as Romracer for fixing it for 1.83. Since he is busy doing more important work I decided to do this little hack for those of us that updated to 1.5.7 and dont feel like flashing back to earlier versions to get full Ubuntu working.
Again, this is only necessary if you're already running 1.5.7 or 1.8.3.
Secondly, I am still working on this script so it may not work for you. If you have a problem you may post in the thread or PM me showing exactly the error message, word for word, that you receive.
Updates will be included in the OP from time to time as I fix errors.
Instructions:
1) install.bat (from your computer)
2) adb shell (get a shell on your phone)
3) su (get root on your phone in that shell)
4) . /data/local/tmp/install.sh (run the install script *on your phone* don't forget the "." and the space after the dot, or you will have to chmod 755 the shell script manually)
5) ?????
6) profit\
Noob instructions, written by Viamonte (I take no credit or responsibility):
Thanks again for all your help. Now the noob instructions:
"1-Download "Terminal Emulator" from the market, on your phone (or any other terminal), and the file anexed in this thread to your computer.
2-Connect the Atrix to the computer via USB, configuring the connection mode to "None" and enabling USB Debugging mode (Settings>Applications>Development>USB debugging)
3-Unzip the file you downloaded on your pc, and run Install.bat. This will push the script to your phone.
4-Go back to your phone and open the emulator you downloaded. Then type "su" (without quotes) and press enter. Then type ". /data/local/tmp/install.sh" (without quotes) and press enter again.
The script should begin running now. It will stop in two moments where you'll be instructed to get a cup of coffee, and may take several minutes to continue form this point. When finished, the Atrix will reboot.
To check if this worked, use the Webtop either on your multimidia dock or your lapdock and verify if new itens appeared on your task bar and on the right upper side of the screen"
0.3.1 release
0.2 release
0.1 first release
Changelog
0.3.1 fix to gconf file's mdate so it does what its supposed to do =)
0.3 Small typo fixes and cpp package install fix by romracer, now works on 1.83 =)
0.2 Fixed some typos in uninstall.sh and make sure the %gconf file wound up in the right spot.
0.1 - first version. NOT CWM install but ready to be packaged for that more or less
Nice, I'll give this a shot later.
Ill give it a shot when I get home!
Sent from Motorola Atrix on TELUS.
My phone is working perfectly, so why not ruin it?
I'm giving this a try right now!
1.4.57 - Rooted and gingerblurred with HDMI Mirroring and Webtop hack.
I'll update as progress goes along:
Edit 1:
Initial try gave me this
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] y
Mounting the filesystem...
07.sh
--------------------------------------------
EXECUTION FAILED
Unable to mount the filesystem file. ERR 07
--------------------------------------------
Press any key to continue . . .
Edit 2:
Ok, it doesnt work with resetting it. How about removing?
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] n
A filesystem file already exists. Delete it? [n] y
Deleting the filesystem file...
--------------------------------------
EXECUTION FAILED
Unable to delete the filesystem file.
--------------------------------------
Press any key to continue . . .
Edit 3:
Ok, only one option left then.
Checking device state...
Obtaining temporary root access...pushing shell scripts
A filesystem file already exists. Reset it? [n] n
A filesystem file already exists. Delete it? [n] n
--------------------------------------------------------------------------
EXECUTION FAILED
The filesystem file already exists, but no operations have been selected.
--------------------------------------------------------------------------
Press any key to continue . . .
=====================================================================
Edit 4:
Since execution is failing I'm trying to find the problem. Using ADB Shell i tried to manually run the shell scripts and stumbled here:
(I tried chmod 777 @ 02.sh to see if that was the problem, no change is results)
# ls -l
...
...
-rwsr-sr-x shell shell 87 2011-04-06 12:13 03.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
-rwsr-sr-x shell shell 251 2011-04-06 12:04 01.sh
# pwd
pwd
/data/tmp/shell
# /data/tmp/shell/02.sh
/data/tmp/shell/02.sh
/data/tmp/shell/02.sh: not found
I had the same issue as flybob when I tried to run the script.
Sent from my MB860 using XDA Premium App
Good effort, but 1.57 changes how we have to run commands as root. On a normal linux box, I'm sure your methods would work fine, but we're not dealing with a normal su binary. You should look into doing this as CWM as opposed to .bat files. I had a hell of a time getting around the restrictions since the psneuter exploit was closed.
Ah, I did not think about that Ririal, thanks for the info. I am not familiar with CWM though.
Why is the /tmp directory in /data ? That would certainly cause every script to fail.
I'll look at this some more tonight.
Ririal said:
Good effort, but 1.57 changes how we have to run commands as root. On a normal linux box, I'm sure your methods would work fine, but we're not dealing with a normal su binary. You should look into doing this as CWM as opposed to .bat files. I had a hell of a time getting around the restrictions since the psneuter exploit was closed.
Click to expand...
Click to collapse
How about a shell script that we can run in terminal emulator ? and the output goes to screen and a log file for debug !
molotof said:
How about a shell script that we can run in terminal emulator ? and the output goes to screen and a log file for debug !
Click to expand...
Click to collapse
most of the script is now run by shell scripts, no reason you couldn't run them in the terminal emulator, just get the order right. There are also a few lines I didn't translate to shell so you'd have to enter them by hand.
In any case I'll keep working on this until Sogarth releases his version with union mounts =D
You might be interested to know this;
# cd /tmp
cd /tmp
# pwd
pwd
/data/tmp
# ls -l /tmp
lrwxrwxrwx root root 2011-04-09 14:47 tmp -> /data/tmp
I'll happily help with the script, i know tons of linux and got my Atrix ready to be bricked
flybob said:
You might be interested to know this;
# cd /tmp
cd /tmp
# pwd
pwd
/data/tmp
# ls -l /tmp
lrwxrwxrwx root root 2011-04-09 14:47 tmp -> /data/tmp
I'll happily help with the script, i know tons of linux and got my Atrix ready to be bricked
Click to expand...
Click to collapse
That's just a symlinked directory. I won't make a difference if you call either.
Yes, just replied to the previous question
Why is the /tmp directory in /data ? That would certainly cause every script to fail.
I'll look at this some more tonight.
Click to expand...
Click to collapse
However, why doesn't the scripts run as wanted...?
# cat /tmp/shell/02.sh
cat /tmp/shell/02.sh
#!/bin/sh
/system/bin/su
/bin/rm /data/ubuntu.disk > /dev/null 2>&1 && echo PASS#
# ls -l /tmp/shell/02.sh
ls -l /tmp/shell/02.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
# /tmp/shell/02.sh
/tmp/shell/02.sh
/tmp/shell/02.sh: not found
flybob said:
Yes, just replied to the previous question
However, why doesn't the scripts run as wanted...?
# cat /tmp/shell/02.sh
cat /tmp/shell/02.sh
#!/bin/sh
/system/bin/su
/bin/rm /data/ubuntu.disk > /dev/null 2>&1 && echo PASS#
# ls -l /tmp/shell/02.sh
ls -l /tmp/shell/02.sh
-rwxrwxrwx shell shell 82 2011-04-06 12:11 02.sh
# /tmp/shell/02.sh
/tmp/shell/02.sh
/tmp/shell/02.sh: not found
Click to expand...
Click to collapse
Ah ok my mistake, you didn't quote anything I didn't realize that's what you were responding too
Likely noexec flag causing that issue.
Also, you can't invoke su from inside a shell script. It just doesn't work with this su binary.
yeah, I guess not. I hadn't realized that it wasn't a real 'su' before making this... too bad.
If anyone figures out how to get around that we'll be in business Unfortunately that's way beyond my expertise.
Okay, after fiddling a little bit and talking to a friend I may have solved some of the problems, mainly with the scripts executing and su working.
I will have to rewrite a bunch of things but should report back tonight.
the2dcour said:
Okay, after fiddling a little bit and talking to a friend I may have solved some of the problems, mainly with the scripts executing and su working.
I will have to rewrite a bunch of things but should report back tonight.
Click to expand...
Click to collapse
su -c "command"
You'll have to allow superuser on the phone for every single command.
PM'd you my error. I tried manually editing the permissions, but that didn't work.
Running on GladAtrix2 v3
USB debugging on; USB set to none
Checking device state...
Obtaining temporary root access...pushing shell scripts
-------------------------
EXECUTION FAILED
Unable to chmod scripts.
-------------------------
Press any key to continue . . .
Changed /sdcard-ext to /sdcard in script. Got this error
Checking device state...
Obtaining temporary root access...pushing shell scripts
-------------------------
EXECUTION FAILED
Unable to chmod scripts.
-------------------------
* server not running *
Press any key to continue . . .
Running BETA_ubuntu-1.0.6.4.zip. File extracts to BETA_ubuntu-1.0.6.2 directory. Ran ubuntu-1.5.7.bat
Moved BETA_ubuntu-1.0.6.2 to C:\ Same error
The only easy workaround to that I can see at the moment is to
Code:
adb shell
su
chmod 777 /path-to-scripts/*
ls -l /path-to-scripts/*
make sure all the files are executable (should say rwxrwxrwx)
then remove the bit of code from 1.5.7.bat
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/bin/chmod 6755 /mnt/sdcard-ext/shell/* > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
If anyone can help me fix this problem I should be able to automate the chmod process using ririal's suggestion of su -c. The problem is that there are too many nested quotation marks in this section of the batch file, and I can't for the life of me figure out how to escape quotes so they pass through to adb:
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/system/bin/su -c [U]'/bin/chmod 6755 /mnt/sdcard-ext/shell/*'[/U] > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
The underlined bit is where I need to escape either single or double quotes.
the2dcour said:
The only easy workaround to that I can see at the moment is to
Code:
adb shell
su
chmod 777 /path-to-scripts/*
ls -l /path-to-scripts/*
make sure all the files are executable (should say rwxrwxrwx)
then remove the bit of code from 1.5.7.bat
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/bin/chmod 6755 /mnt/sdcard-ext/shell/* > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
If anyone can help me fix this problem I should be able to automate the chmod process using ririal's suggestion of su -c. The problem is that there are too many nested quotation marks in this section of the batch file, and I can't for the life of me figure out how to escape quotes so they pass through to adb:
Code:
set retval=
for /f "tokens=*" %%l in ('%~dps0adb.exe shell "/system/bin/su -c [U]'/bin/chmod 6755 /mnt/sdcard-ext/shell/*'[/U] > /dev/null 2>&1 && echo PASS"') do set retval=%%l
if "%retval%" neq "PASS" set message=Unable to chmod scripts. && goto abort
The underlined bit is where I need to escape either single or double quotes.
Click to expand...
Click to collapse
^ escapes batch, \ escapes shell. Hope this helps. If you zip up and send me the whole process in a single .sh file I can wrap it up in CWM for you.

[APP] DropBear Server II // ssh/scp (root only)

I wanted to enable SCP and SSH using DropBear II ... for some reason DropBear Server II doesn't install scp & ssh binaries, you can get them from github and symlink it into system. Here's what I did...
DropBear archive (1M): https://www.dropbox.com/s/h2guipuvdltiden/dropbearii.zip
Feel free to mirror that if you want.
These directions allow you to ssh into the system as root, be very careful. I recommend not leaving the service running if you are not using it.
I take no responsibility if you brick your unit while mucking around as root.
Back Up
Download dropbearii.zip and unzip on your local file system.
From your local filesystem install the APK and push scp & ssh to tmp.
Code:
adb install DropBearServer2.1.apk
adb push scp /data/local/tmp/scp
adb push ssh /data/local/tmp/ssh
From the OUYA GUI install the DropBearServerII service... Select Make -> Software -> DropBearServer II -> Install
Shell into your OUYA and make /system writable.
Code:
adb shell
su
mount -o rw,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
Move scp & ssh into DropBear II directory
Code:
mv /data/local/tmp/scp /data/data/me.shkschneider.dropbearserver2/app_data/
mv /data/local/tmp/ssh /data/data/me.shkschneider.dropbearserver2/app_data/
Change the permissions
Code:
chmod 6555 /data/data/me.shkschneider.dropbearserver2/app_data/scp
chmod 6555 /data/data/me.shkschneider.dropbearserver2/app_data/ssh
Create the symlinks
Code:
cd /system/bin/
ln -s /data/data/me.shkschneider.dropbearserver2/app_data/scp ./scp
ln -s /data/data/me.shkschneider.dropbearserver2/app_data/ssh ./ssh
Change /system back to read-only (optional) and exit.
Code:
mount -o ro,remount -t ext4 /dev/block/platform/sdhci-tegra.3/by-name/APP
exit
exit
Reboot the OUYA (optional)
Code:
adb reboot
Notes/testing
Windows users can use Putty to ssh & scp get them here.
To ssh into the system:
Code:
ssh [email protected]_ADDRESS
To scp a file to the sdcard:
Code:
scp ./some_file [email protected]_ADDRESS:/sdcard/
To get to settings push the U circle button one time.
If you turn on "Start on boot" in the settings menu and reboot, the service will be turned off. Though it will be left on in the standard standby mode.
I recommend using pubkey rather than password. Basically generate a public key and push it into /sdcard/ then install it from the DropBear II app.
Unix Hosts can do:
Code:
ssh-keygen -t rsa
Windows using PuttySSH follow these directions, I haven't tested them though.
If you don't want to be bothered with pubkey, please change the default password it is set to 42.
If you already know about pubkey, you can cat them into: /data/data/me.shkschneider.dropbearserver2/app_data/authorized_keys
Unchecking "Allow Password" doesn't work properly.
Why would I want to do this? I didn't really like the Wireless ADB disappearing after the OTA upgrade, this may be less annoying if the next OTA doesn't nuke it.
I'm getting an error that busybox is not installed when trying to start the service. Is there anything special you had to do with busybox to get this to run? I installed it via the apk.
Edit: Nevermind. I didn't realize the busybox apk was an installer and I didn't find the icon when I looked. Just checked again and found the busybox installer icon and did a smart install. Dropbear ssh is running now.
I ran it manually with
Code:
dropbear -E -s -P /data/dropbear/dropbear.pid -r /data/dropbear/dropbear_rsa_host_key -d /data/dropbear/dropbear_dss_host_key
and it looks ok when idling but when connection it gives me
Aiee, segfault! You should probably report this as a bug to the developer
Click to expand...
Click to collapse
This could be CM10.1 environment issues (libc). The built-in SSHd doesn't work properly as well. Some binaries give strange errors when executed with SSHd (like sqlite3).
I can't install the DropBearServer II from the Make option, comes up with "operation failed". Tried to make the system rw to see if that might have been the problem but still no luck. Anyone else had that problem?
andlid said:
I can't install the DropBearServer II from the Make option, comes up with "operation failed". Tried to make the system rw to see if that might have been the problem but still no luck. Anyone else had that problem?
Click to expand...
Click to collapse
I installed it via adb.
For others I was able to install using IncognitoMan's -=StockPlus=- ROM -- http://forum.xda-developers.com/showthread.php?t=2347214
You may need busybox installed, I'm not 100% sure, I haven't tried without busybox.
SSH command line on android
The link is broken
Could someone please reupload this? would be awesome
Thank you so much
BIade said:
Could someone please reupload this? would be awesome
Thank you so much
Click to expand...
Click to collapse
bump - upload again please
You can also get static binaries from dropbear or ssh server apks in playstore by simply unpacking the apk.

[SOLVED] Softbricked, Rooted Bionic.

TL;DR: can someone direct me to a custom recovery image for droid bionic that lets me turn on developer mode USB from recovery mode? does CWM or TWRP do this?
Long version: i thought i could run a game that wasnt running well by installing the chainfire 3D mod. nope. it softbricked, and my developer usb mode was off at the time. now im stuck at a black screen after the M logo.
the device is rooted, running stock. (4.1.2). i plan on switching to a modded rom when i solve this and back my stuff up.
i can boot into fastboot, and the stock recovery mode. through recovery i can get an adb sideload mode to enable, and it does connect properly to PC, but normal ADB commands do not work. i also have options for bp modes and stuff when trying to boot to recovery, but most of those fail to start.
i know that if i can acesss normal ADB mode, fixing this is a couple simple commands away. there's an uninstall.sh file already there i just need to run.
fastboot and the sideload adb mode both function properly. my PC drivers seem to be in order for now.
if there's a file i can sideload or a command that works in adb sideload mode that will uninstall this driver, im all for it. ive already located the code used in the uninstaller:
Code:
#!/system/bin/sh
mount -o rw -o remount /dev/block/mmcblk0p25 /system
stop
cat /system/lib/libGLESv1_CM_ORG_CF3D.so > /system/lib/libGLESv1_CM.so
chown 1000.1000 /system/lib/libGLESv1_CM.so
chown 1000:1000 /system/lib/libGLESv1_CM.so
chown system.system /system/lib/libGLESv1_CM.so
chown system:system /system/lib/libGLESv1_CM.so
chmod 644 /system/lib/libGLESv1_CM.so
cat /system/lib/libGLESv2_ORG_CF3D.so > /system/lib/libGLESv2.so
chown 1000.1000 /system/lib/libGLESv2.so
chown 1000:1000 /system/lib/libGLESv2.so
chown system.system /system/lib/libGLESv2.so
chown system:system /system/lib/libGLESv2.so
chmod 644 /system/lib/libGLESv2.so
#rm /system/lib/libGLESv1_CM_ORG_CF3D.so
#rm /system/lib/libGLESv2_ORG_CF3D.so
rm /system/lib/cf3d_uninstall.sh
rm /system/lib/cf3d_sh
reboot -f
reboot
reboot normal
toolbox reboot
busybox reboot -f
busybox reboot
busybox reboot normal
sadly, i know very little about android and not much about linux. kind of picking this up as i go. im not even sure how to turn that code into an uninstaller file, though im guessing its as easy as a text file with the correct filename extension. i feel like i'm missing something sort of simple that someone more linux/android knowledgeable would be able to share.
can someone suggest, if one exists, an alternate recovery image i could install that would let me browse and edit files on the system partition, or enable full adb mode?
edit: i've tricked the device into charging, so the 'low battery' issue so many bionic softbrickers end up with has been avoided. phew.
edit 2: i used fastboot to reflash only system.img (i knew thats where the bad file was,) from cdma_targa_9.8.2O-72_VZW-22_cfc.xml.zip. the result was what appears to be a proper fix. i just lost a few tweaks (like deleting that godawful startup sound), and root. but i've rooted it before. shouldnt be a problem. next will be a full backup, and adb install of better recovery tools.
marking as solved.

Categories

Resources