Develop Bugs

APK root exploit

I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit

Do you have a link to their research or are their findings private?
Regards,

Mr_Bartek said:
Do you have a link to their research or are their findings private?
Regards,
Click to expand...
Click to collapse
saurik - his analysis of the "second master key vuln"
giantpune for his symlnink attack vuln in property space:
Code:
/system/bin/mv /data/property /data/backupprop
/system/bin/mkdir /data/property
/system/bin/ln -s /sys/kernel/uevent_helper /data/property/.temp
/system/bin/setprop persist.sys.fail /data/pwn.sh

jcase said:
I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit
Click to expand...
Click to collapse
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.

coolrevi said:
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.
Click to expand...
Click to collapse
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from

jcase said:
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from
Click to expand...
Click to collapse
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!

ricky310711 said:
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!
Click to expand...
Click to collapse
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely

pulser_g2 said:
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely
Click to expand...
Click to collapse
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...

ricky310711 said:
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...
Click to expand...
Click to collapse
It depends on if OEMs backported it, depends on which build OEMs used and depends on the bug. Four or five different zip parser bugs with similar results. This one I used was patched in 4.3, but other exist.

Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.

trickraca said:
Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.
Click to expand...
Click to collapse
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two

jcase said:
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two
Click to expand...
Click to collapse
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
It should not come rooted, if it comes rooted then no way did it pass CTS. I'm guessing unlocking the bootloader and flashing a recovery? I don't know, I dont have one

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk

noobish doubts..
Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
Please i ne ed a walthrough..
1) download twrp
2) put it in root of the telephone robot
3) flash it in recovery?
4) reboot recovery wipe cache and dalvik flash omnirom..
Please correct me..
Thank you

giuliano rigon said:
1) download twrp Yes
2) put it in root of the telephone Yes
Make sure to copy Omnirom to your phone at some point
3) flash it in recovery? No - Flash TWRP in Fastboot if you haven't flashed the recovery already. Use the official Teamwin site for guidance
4) reboot recovery wipe cache and dalvik flash omnirom.. Wipe Cache, Dalvik, System, and Data
Click to expand...
Click to collapse
Updates in Red
This is off-topic for this thread though. Questions/Info for flashing Omnirom should be addressed in the Omnirom thread.

Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks

nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.

not rooted.. confirm i can flash
nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
I nave tried my damnedest to root .. Fastboot flashing supersu flashing from recovery Direct install from google play complete unroots and reflash letting recovery do it .. No way..
So now i need a last confirmation.. Can i flash omnirom after wipes even if i am unrooted.. And has anyone rooted omnirom or does it come unrooted.. Thanks for the info .. Another idea.. Flashing color OS footing and then flashing omni.. Or is this a late night bad Dream..
---------- Post added at 01:17 AM ---------- Previous post was at 01:05 AM ----------
Harfainx said:
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.
Click to expand...
Click to collapse
Sorry now i got it.. It was in the forums.. Just unchecking the respect cyanogen settings in the super su menu got me roooted and happy.. Sorry for your time.. I flashed super su zip from recovery rebooted and unchecked .. Now i am set..

I were rooted myN1 in yesterday, its really good . thankss
Sent from my N1 using XDA Premium 4 mobile app

[Q] which recovery after root?

Howdy, I plan on rooting my tablet in a few days. The instructions say to root, then, flash stock recovery. Is flashing the stock recovery necessary if i plan on using goo to install twrp recovery prior to flashing cleanrom on my device?
Also, the cleanrom thread says to flash the appropriate version of twrp. Am I to assume the latest version on goo is the ticket for that?
Also, while the dev has indicated there will be further versions after 1.2, can I expect to simply download updates, or expect to flash new versions every time? I guess this particular question doesn't really matter I'm just interested.
And finally, has anybody used heimdall with any success with the p600? Google says no...
I would have posted this on the clean rom thread but was not allowed since I have not had enough posts yet. moving this to there would not hurt my feelings.
I appreciate any and all help and of course feel appreciation and give thanks to the developers who have put in such great effort. Thank you.

sleekmason said:
Howdy, I plan on rooting my tablet in a few days. The instructions say to root, then, flash stock recovery. Is flashing the stock recovery necessary if i plan on using goo to install twrp recovery prior to flashing cleanrom on my device?
Also, the cleanrom thread says to flash the appropriate version of twrp. Am I to assume the latest version on goo is the ticket for that?
Also, while the dev has indicated there will be further versions after 1.2, can I expect to simply download updates, or expect to flash new versions every time? I guess this particular question doesn't really matter I'm just interested.
And finally, has anybody used heimdall with any success with the p600? Google says no...
I would have posted this on the clean rom thread but was not allowed since I have not had enough posts yet. moving this to there would not hurt my feelings.
I appreciate any and all help and of course feel appreciation and give thanks to the developers who have put in such great effort. Thank you.
Click to expand...
Click to collapse
That's a lot questions! Lol.... here's two answers:
If you want to flash CleanRom, then you don't need to root your stock rom, just use Odin to flash TWRP and that will either let you install CleanRom or let you install SuperSU (root). You can the recovery from their website.
I'm on the P600 and the goomanager didn't install the recovery correctly, so I had to flash with odin.
I don't know about Heimdal. Good luck on your ten posts
Sent from my SM-P600

Odin eh?
grmcrkrs said:
That's a lot questions! Lol.... here's two answers:
If you want to flash CleanRom, then you don't need to root your stock rom, just use Odin to flash TWRP and that will either let you install CleanRom or let you install SuperSU (root). You can the recovery from their website.
I'm on the P600 and the goomanager didn't install the recovery correctly, so I had to flash with odin.
I don't know about Heimdal. Good luck on your ten posts
Sent from my SM-P600
Click to expand...
Click to collapse
My understanding is that root is neccesary to flash twrp. If that is not the case, they why use Odin at all?
Heimdall is a program reverse engineered to work on Samsung devices. Potentially more stable than odin. Open source. I use a linux box but will have access to a windows box in a week or so.

supersu
Furthermore, for verification, super su does not root your device, it only manages the permissions of those programs that need root access. Can somebody else chime in for verification?

sleekmason said:
Furthermore, for verification, super su does not root your device, it only manages the permissions of those programs that need root access. Can somebody else chime in for verification?
Click to expand...
Click to collapse
No, you CAN flash recovery without rooting, and if your not rooted then TWRP asks if you'd like to install SuperSU and root that way. I guess you don't have to believe me though
Sent from my SM-P600

grmcrkrs said:
No, you CAN flash recovery without rooting, and if your not rooted then TWRP asks if you'd like to install SuperSU and root that way. I guess you don't have to believe me though
Sent from my SM-P600
Click to expand...
Click to collapse
that sounds great but doesn't TWRP need root in order to be installed? my understanding is yes. If not I should be able to install it using Goo manager. from what I've read the developers for GooManager are very serious and would not allow a non working application to remain in their program.

sleekmason said:
Howdy, I plan on rooting my tablet in a few days. The instructions say to root, then, flash stock recovery. Is flashing the stock recovery necessary if i plan on using goo to install twrp recovery prior to flashing cleanrom on my device?
Also, the cleanrom thread says to flash the appropriate version of twrp. Am I to assume the latest version on goo is the ticket for that?
Also, while the dev has indicated there will be further versions after 1.2, can I expect to simply download updates, or expect to flash new versions every time? I guess this particular question doesn't really matter I'm just interested.
And finally, has anybody used heimdall with any success with the p600? Google says no...
I would have posted this on the clean rom thread but was not allowed since I have not had enough posts yet. moving this to there would not hurt my feelings.
I appreciate any and all help and of course feel appreciation and give thanks to the developers who have put in such great effort. Thank you.
Click to expand...
Click to collapse
You wont need to root if your intent is to just flash my ROM.
Appropriate version would be 2.6.3.3
As far as updates / patches... Depends on the issue. Mostly do full updates if something changes. If its a bug fix then I would just do a patch.
Hemidall? No, never tried it.
Basically to flash a custom ROM you just need to flash TWRP using Odin then flash the ROM using TWRP.
You dont techincally need to root unless you want to stay stock and have root. But that is no fun!
Also, the goo.im app does not work with this device so you have to use Odin manually (for simplicity).
Hope this helps!

sleekmason said:
that sounds great but doesn't TWRP need root in order to be installed? my understanding is yes. If not I should be able to install it using Goo manager. from what I've read the developers for GooManager are very serious and would not allow a non working application to remain in their program.
Click to expand...
Click to collapse
I read the TWRP thread, and others are having problems installing through goomanager. I also wanted to install it that way, but it wouldn't work. But it didnt work. It also wouldn't flash through the stock recovery. Hence, odin.
Sent from my SM-P600

thank you for the clarification! in order to flash TWRP in Odin do I simply use the AP slot as you would to flash autoroot by their directions?
one of the things thats tripped me up is that on the TWR P site as well as in Google Play it says you must have a rooted device. This would suggest that in order to get TWRP on your device it would already have to be rooted. it seems strange to me that the tablet will allow odin to install it on a non rooted device.
hoops I guess. So being a non Windows user, that is not familiar with the Windows operating system,( bet you don't hear that everyday) ,I would suppose the order would go something like this.
1 download Samsung drivers from kies.1
2. Download TWRP from site for odin.
3. Open odin.
4. go to download mode on device.
5. Plugin device and wait for it to be recognized.
6. Drag the Twrp zip for odin to the AP slot, enter,
7. Wait for it to .......?
8. Reboot.
9 download the cleanrom rom.
10. Reboot into recovery
11. Installcleanrom
12 enjoy.
a couple of other questions concerning the SD card. Should I leave it in during any or all of these processes? I've seen where other people have had problems with their SD card not being read is this due to it not being installed when they install clean rom? I really do appreciate all the help.
not breaking my device by doing something stupid is paramount. Lol! as I will be using my daughters computer any other information regarding the installation of the Samsung drivers or Odin would be much appreciated I do not want to hurt her computer.

I kept my SD card installed while flashing TWRP in Odin and had no problems. If you're worried then take it out. As far as Odin goes... run it as an admin and after connecting your Note (in DL mode) just click on "AP" and navigate to the directory where you saved the TWRP file. From there just hit "start" and your good to go. Odin isn't gonna mess anything up on your daughters pc and if you have a copy of the stock recovery just reflash it if you run into problems with TWRP. Also, read through all the different threads/watch YouTube videos. Most of this has been covered many times over and you can see what success or problems others have had.

I really need your Help pls!

Hello to everyone, I came from LG G2 T-Mobile, and flashing was so easy. but now I got the Sprint version, and I really need your help on how to flash and unlock... I had read does threats but I dont really understand well.
I would Apreciate if someone could post here the files and steps to flash to kitkat and unlock...:good:

danieldp1990 said:
Hello to everyone, I came from LG G2 T-Mobile, and flashing was so easy. but now I got the Sprint version, and I really need your help on how to flash and unlock... I had read does threats but I dont really understand well.
I would Apreciate if someone could post here the files and steps to flash to kitkat and unlock...:good:
Click to expand...
Click to collapse
Check out Ioroot25. http://forum.xda-developers.com/showpost.php?p=48709232
and then after that, Autorec will install TWRP for you. http://www.droidviews.com/install-twrp-recovery-on-lg-g2-running-android-4-4-2-kitkat/
you may get a white line issue when unlocking device after the flash, you will just need to use TWRP to flash the jdi kernal, whcih can be found here: http://forum.xda-developers.com/showpost.php?p=51974589&postcount=281

danieldp1990 said:
Hello to everyone, I came from LG G2 T-Mobile, and flashing was so easy. but now I got the Sprint version, and I really need your help on how to flash and unlock... I had read does threats but I dont really understand well.
I would Apreciate if someone could post here the files and steps to flash to kitkat and unlock...:good:
Click to expand...
Click to collapse
To root from stock (either 4.2.2 or 4.4.2) use ioroot (I'll attach the version I used for my LS980).
After you're rooted (verify with the Root Checker on Android Play Store or by Terminal Emulator >
Code:
su
Download FreeGee Free from the Google Play Store.
Open FreeGee, let it download the device list, then tap "Backup EFS" I HIGHLY Recommend This, as if you lose your EFS it's nearly impossible to get it back!
After your EFS is backed up, tap on TWRP or CWM, whichever you prefer (Team Win Recovery Project, or ClockWork Mod Recovery).
Now you're all set -- rooted and with a custom recovery installed. For more information about flashing ROMs, look here or ask me. The Sprint G2 is touchy with flashing ROMs with the new update.

[Q] D851, BUMP, TWRP, and Stock Lollipop Questions

Hello, I have the T-Mobile LG G3 D851 and I've been trying to find the best configuration. I came from a Nexus 5 that I would either run stock 5.x or CM 12. The CM12 for LG G3 is great but it doesn't have a good camera.
Anyway, I've come to enjoy the stock firmware that LG puts on these phones. So here's what I want to accomplish, however I feel I cannot find enough information to do it confidently.
I would like the have TWRP installed with Stock Lollipop 20b, with root.
Can I just bump a TWRP image and use flashify or something to flash it? or dd?
I installed the 20b KDZ and rooted using the one click method, and that's how my phone sits currently.
From what I understand I need to downgrade to do something with the boot.img so that I can manually flash 20b with a bumped recovery? I'm not sure what bump really is entirely. Do I need to bump all TWRP images that I install? If bump is required for the G3, do they not come pre bumped?
I know that my first go around, I had flashed TWRP with flashify, then installed CM12 without any issues. So I'm wondering if this is just for stock ROMs or did they do something to the boot in 20b that would stop anything from installing without being bump'd?
I also noticed most of the bump'd threads don't list the d851 so I'm wondering if T-Mobile doesn't require this?
Keep in mind I've searched and read extensively and cannot come up with a clear picture of what to do. I've become too used to Nexus devices it seems :-\

Revert to stock KK > root > install TWRP > flash ROM
Find everything here : http://forum.xda-developers.com/lg-g3/help/help-thread-lg-g3-question-t2947298

Thot Ctrl said:
Revert to stock KK > root > install TWRP > flash ROM
Find everything here : http://forum.xda-developers.com/lg-g3/help/help-thread-lg-g3-question-t2947298
Click to expand...
Click to collapse
Thanks, and finally, do I need to bump the TWRP images from their site? or are they good to go?

troy` said:
Thanks, and finally, do I need to bump the TWRP images from their site? or are they good to go?
Click to expand...
Click to collapse
Autorec for d851 coming soon. See here: forum.xda-developers.com/lg-g3/general/apk-flash-twrp-autorec-thanks-to-t3081396
@bender_007 is making autorec version for D851 to install twrp and bump boot

troy` said:
Thanks, and finally, do I need to bump the TWRP images from their site? or are they good to go?
Click to expand...
Click to collapse
D851 has unlocked bootloader. You don't need bump. Just flash twrp via trwo manager or get the inage and use flashify.

Swizzle82 said:
D851 has unlocked bootloader. You don't need bump. Just flash twrp via trwo manager or get the inage and use flashify.
Click to expand...
Click to collapse
Great to know! Just used flashify and it worked like a charm

[Q] Clarification of TWRP Install

Sorry for the nooby question. I am a little familiar with rooting and such but have been in Samsung world with TMo for 3 years. I just got an LG G3 (still TMo, D851) that has already been updated to Lollipop v 5.0.1 (v20b). I have found the one-click root by avicohh, so I am comfortable with that. I have read everything I can find and just want to make certain of one thing. Is it correct that we CANNOT flash TWRP while staying on Lollipop? Do I really have to downgrade the software, then root, flash TWRP, and then upgrade back to Lollipop? Thats what I've read but I am hoping someone can tell me that is not true. I need some good news!
Thanks to everyone for the help and support.

hodgestl said:
Sorry for the nooby question. I am a little familiar with rooting and such but have been in Samsung world with TMo for 3 years. I just got an LG G3 (still TMo, D851) that has already been updated to Lollipop v 5.0.1 (v20b). I have found the one-click root by avicohh, so I am comfortable with that. I have read everything I can find and just want to make certain of one thing. Is it correct that we CANNOT flash TWRP while staying on Lollipop? Do I really have to downgrade the software, then root, flash TWRP, and then upgrade back to Lollipop? Thats what I've read but I am hoping someone can tell me that is not true. I need some good news!
Thanks to everyone for the help and support.
Click to expand...
Click to collapse
No because the 851 variant is the only variant with an unlocked bootloader. You don't have to do anything except get the 851 twrp recovery img and flash it..

Swizzle82 said:
No because the 851 variant is the only variant with an unlocked bootloader. You don't have to do anything except get the 851 twrp recovery img and flash it..
Click to expand...
Click to collapse
Thank you very much for the response. So can I just use Flashify to get current TWRP? (the phone is rooted!)? So the T-Mo bootloader is different than other variants? My confusion comes comes from this quote below...
"I saw a lot of questions of G3 users about how to install Twrp after the root, so I will explain briefly:
For now, if you are on stock lollipop you can't just flash Twrp via flashify etc like the old days in KitKat, but you can follow this guide over here."
that is a direct quote from this thread, http://forum.xda-developers.com/lg-g3/general/guide-root-lg-firmwares-kitkat-lollipop-t3056951. It is true that that statement came from the General LG G3 forum, not the T-Mo forum. If I can just do Flashify or TWRP Manager and keep on going, that would be great. I guess I don't know exactly how I would flash it? Thanks again. I just need a little more clarification. After a couple years I just figured out Samsung procedures! Now starting over with LG procedures. THANK YOU FOR THE HELP.

hodgestl said:
Thank you very much for the response. So can I just use Flashify to get current TWRP? (the phone is rooted!)? So the T-Mo bootloader is different than other variants? My confusion comes comes from this quote below...
"I saw a lot of questions of G3 users about how to install Twrp after the root, so I will explain briefly:
For now, if you are on stock lollipop you can't just flash Twrp via flashify etc like the old days in KitKat, but you can follow this guide over here."
that is a direct quote from this thread, http://forum.xda-developers.com/lg-g3/general/guide-root-lg-firmwares-kitkat-lollipop-t3056951. It is true that that statement came from the General LG G3 forum, not the T-Mo forum. If I can just do Flashify or TWRP Manager and keep on going, that would be great. I guess I don't know exactly how I would flash it? Thanks again. I just need a little more clarification. After a couple years I just figured out Samsung procedures! Now starting over with LG procedures. THANK YOU FOR THE HELP.
Click to expand...
Click to collapse
Flashify still works in lollipop, I know cause thats how I got TWRP on my device and I have done it more than I can count. But I suggest you go to TWRP's official site and download their latest .img for the D851. Put that on your phone external SD then use Flashify to flash that img. Sometimes flashify does not have the most current TWRP img for the device when you download it through their collection.

vel0city said:
Flashify still works in lollipop, I know cause thats how I got TWRP on my device and I have done it more than I can count. But I suggest you go to TWRP's official site and download their latest .img for the D851. Put that on your phone external SD then use Flashify to flash that img. Sometimes flashify does not have the most current TWRP img for the device when you download it through their collection.
Click to expand...
Click to collapse
Yes sir! Flashify worked great on the D851 with Lollipop installed. Thank you so much. I wish the info out here about the need to downgrade back to KK were a lot clearer. Evidently, T-Mo G3 (D851) users have it best. That info can be tough to find. Thank you for your support. I am good to go now!