Develop Bugs

APK root exploit

I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit

Do you have a link to their research or are their findings private?
Regards,

Mr_Bartek said:
Do you have a link to their research or are their findings private?
Regards,
Click to expand...
Click to collapse
saurik - his analysis of the "second master key vuln"
giantpune for his symlnink attack vuln in property space:
Code:
/system/bin/mv /data/property /data/backupprop
/system/bin/mkdir /data/property
/system/bin/ln -s /sys/kernel/uevent_helper /data/property/.temp
/system/bin/setprop persist.sys.fail /data/pwn.sh

jcase said:
I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit
Click to expand...
Click to collapse
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.

coolrevi said:
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.
Click to expand...
Click to collapse
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from

jcase said:
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from
Click to expand...
Click to collapse
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!

ricky310711 said:
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!
Click to expand...
Click to collapse
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely

pulser_g2 said:
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely
Click to expand...
Click to collapse
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...

ricky310711 said:
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...
Click to expand...
Click to collapse
It depends on if OEMs backported it, depends on which build OEMs used and depends on the bug. Four or five different zip parser bugs with similar results. This one I used was patched in 4.3, but other exist.

Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.

trickraca said:
Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.
Click to expand...
Click to collapse
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two

jcase said:
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two
Click to expand...
Click to collapse
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
It should not come rooted, if it comes rooted then no way did it pass CTS. I'm guessing unlocking the bootloader and flashing a recovery? I don't know, I dont have one

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk

noobish doubts..
Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
Please i ne ed a walthrough..
1) download twrp
2) put it in root of the telephone robot
3) flash it in recovery?
4) reboot recovery wipe cache and dalvik flash omnirom..
Please correct me..
Thank you

giuliano rigon said:
1) download twrp Yes
2) put it in root of the telephone Yes
Make sure to copy Omnirom to your phone at some point
3) flash it in recovery? No - Flash TWRP in Fastboot if you haven't flashed the recovery already. Use the official Teamwin site for guidance
4) reboot recovery wipe cache and dalvik flash omnirom.. Wipe Cache, Dalvik, System, and Data
Click to expand...
Click to collapse
Updates in Red
This is off-topic for this thread though. Questions/Info for flashing Omnirom should be addressed in the Omnirom thread.

Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks

nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.

not rooted.. confirm i can flash
nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
I nave tried my damnedest to root .. Fastboot flashing supersu flashing from recovery Direct install from google play complete unroots and reflash letting recovery do it .. No way..
So now i need a last confirmation.. Can i flash omnirom after wipes even if i am unrooted.. And has anyone rooted omnirom or does it come unrooted.. Thanks for the info .. Another idea.. Flashing color OS footing and then flashing omni.. Or is this a late night bad Dream..
---------- Post added at 01:17 AM ---------- Previous post was at 01:05 AM ----------
Harfainx said:
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.
Click to expand...
Click to collapse
Sorry now i got it.. It was in the forums.. Just unchecking the respect cyanogen settings in the super su menu got me roooted and happy.. Sorry for your time.. I flashed super su zip from recovery rebooted and unchecked .. Now i am set..

I were rooted myN1 in yesterday, its really good . thankss
Sent from my N1 using XDA Premium 4 mobile app

SuperSU Error after cf-auto

Hi friendly xda android enthusiasts. I have, after many issues, finally rooted my gt-n5110 using odin and cf-auto. Workered without a hitch. Odin passed, tab rebooted, and BAM, "superSU has stopped working". I immediately navigated myself over to the playstore to reinstall SuperSU and for the first time i have ever seen it wouldnt allow me to. It only gave me a choice to open. No update no uninstall. Going into my apps list it was not present on downloads but was available on device list. Clucked it and no option to uninstall, only to force stop or turn off. So it is incorporated as a system with no access to it. This has me stumped. I have only seen old threads with answers to this and they are temp fixes. Need to know what i can do to fix this on a permanent basis and if someone could help me understand how and why this issue occured it would give me a better understanding and possibly prevent further issues. Thanks in advance guys.

Try the flashable version in this post after you install a custom recovery with odin.
ramjet73

ramjet73 said:
Try the flashable version in this post after you install a custom recovery with odin.
ramjet73
Click to expand...
Click to collapse
This may be a very stupid question but i have to be sure. As i stated the odin DID pass the auto root and tab rebooted. But along with the superSU error i ran root checker and was unable to obtain root. Im assuming its because supersu is not embedded. So with that said is it still ok to attempt to flash a recovery to the tab?

mattdiehl83 said:
This may be a very stupid question but i have to be sure. As i stated the odin DID pass the auto root and tab rebooted. But along with the superSU error i ran root checker and was unable to obtain root. Im assuming its because supersu is not embedded. So with that said is it still ok to attempt to flash a recovery to the tab?
Click to expand...
Click to collapse
Yes. Recovery is independent of whether or not you are rooted. You can install it from Android using tools like Flashify once you are properly rooted, but Odin works fine as long as you have a version of recovery in that format.
Flashing SuperSU from a custom recovery once it is installed should fix the superuser problems you are having.
ramjet73

ramjet73 said:
Yes. Recovery is independent of whether or not you are rooted. You can install it from Android using tools like Flashify once you are properly rooted, but Odin works fine as long as you have a version of recovery in that format.
Flashing SuperSU from a custom recovery once it is installed should fix the superuser problems you are having.
ramjet73
Click to expand...
Click to collapse
Doing now. Thankyou. Fingers crossed.

I had the same issue on my 5110. The flashable root only worked for me until I rebooted, then it would lose root. What ultimately worked for me was to unroot with Kingo. Then with USB debugging enabled, re-rooted with Kingo (which took around 10 min).
Sent from my AT&T Galaxy Note 3 using Tapatalk®

andygev35 said:
I had the same issue on my 5110. The flashable root only worked for me until I rebooted, then it would lose root. What ultimately worked for me was to unroot with Kingo. Then with USB debugging enabled, re-rooted with Kingo (which took around 10 min).
Click to expand...
Click to collapse
If flashing SuperSU from recovery doesn't result in a successful rooted system someone should let @Chainfire know. I've never had a problem rooting a stock ROM that way but let's see what @mattdiehl83 reports.
ramjet73

OS X
ramjet73 said:
If flashing SuperSU from recovery doesn't result in a successful rooted system someone should let @Chainfire know. I've never had a problem rooting a stock ROM that way but let's see what @mattdiehl83 reports.
ramjet73
Click to expand...
Click to collapse
Not near pc. Only have OS X available now. Can anybody walk me through using OS X to flash?

mattdiehl83 said:
Not near pc. Only have OS X available now. Can anybody walk me through using OS X to flash?
Click to expand...
Click to collapse
The recovery? I don't know if there is an OS X version of Odin.
ramjet73

ramjet73 said:
The recovery? I don't know if there is an OS X version of Odin.
ramjet73
Click to expand...
Click to collapse
I am wondering what flashing tool to use with OS X. Odin is for windows. I know of heimdall but that requires ALOT to flash anything. Wondering if there is another odin like tool for OS X

You could try this: http://forum.xda-developers.com/showthread.php?t=2598203
Sent from my AT&T Galaxy Note 3 using Tapatalk®

done.
Hi guys sorry for the delay in update. I ended up using VM ware and it allowed to operate as windows on OS X. I installed TWRP, went into the file manager in TWRP and removed the superSU, i then flashed superSU and rebooted. Once back to the tablet i went and restored services to superSU and went into the play store. And finally the playstore gave me the option the update the superSU. And then the rest was all normal installation of superSU. Hope this thread helps anybody dealing with these issues.

Glad you got it working. :good:
This post in the CF-Autoroot thread might be helpful as well.
ramjet73

there is a easy way to fix it!
download supersu 2.02 and install ta da and it works
2.01 does not work with n5110 well if you flash cf auto root

hmmmm.....
Bordo_Bereli51 said:
there is a easy way to fix it!
download supersu 2.02 and install ta da and it works
2.01 does not work with n5110 well if you flash cf auto root
Click to expand...
Click to collapse
Tada..your a genius. Oh wait i believe i stated it didnt have that option it was disabled. Yes i decided scarcasm would be fitting due to the fact it says ALL OVER xda to please read before you post.

mattdiehl83 said:
Tada..your a genius. Oh wait i believe i stated it didnt have that option it was disabled. Yes i decided scarcasm would be fitting due to the fact it says ALL OVER xda to please read before you post.
Click to expand...
Click to collapse
I read all the post and didnt found something
YOU DONT NEED TO DELETE SUPERSU 2.0.1
Install 2.02 apk and go to supersu, then to settings and push to /system
This is the easiest way. the one you found: go to recovery delete that and this. download supersu 2.0.2 apk and install it not the recovery zip i mean the APK! i didnt say the flashable supersu zip.
oh wait, yes you are a intelligent boy, you know everything.

mattdiehl83 said:
I am wondering what flashing tool to use with OS X. Odin is for windows. I know of heimdall but that requires ALOT to flash anything. Wondering if there is another odin like tool for OS X
Click to expand...
Click to collapse
That's a bit of a dilemma.
Unfortunately Samsung does not support using fastboot and bootloader mode (they call it download mode) so that standard SDK tool Google provides for Windows, Linux and MAC OS X isn't applicable. Your best bet would be to find a Windows PC that you can use to flash the recovery with Odin since that is the most common and best documented method.
Edit: NVM, somehow I responded to an old post of yours.
ramjet73

TWRP doesn't work

Hello. I'm having an issue with TWRP , the first time I flashed it , it worked perfectly , but this morning I decided to go back to stock and make it like out of the box , because my old rom was messed up.
So I successfully flashed the factory image , I set everything up , I decided to flash TWRP again , everything went well , after that I booted into TWRP and it asked me for a password , I didn't set any password , so I ask myself "WHAT THE F***". Then I decided to retry flashing the factory image , then flashing TWRP , and the same thing happened. I did this circle 10 times , I'm running out of ideas... I just need TWRP to flash SuperSu to install my Pentest tool for work... I can't do anything without them , I'm going to get killed tomorrow If I can't get this done ... ^^ Thank for your help.
Best Regards,
Rozalina

TWRP currently isn't working with MHC19J. Use MMB29V for now if you need TWRP. I'm here looking to see if anyone has found a workaround/fix

Is this on the latest version of the stock ROM (March Update)? If so, they released 2 versions. The MHC19J and MMB29V. The problem is between TWRP and the Nexus 5X's encryption. If that is the case, reflash with the MMB29V version of the March Update. That fixed this problem for me. If you don't have the March Update version of the stock ROM, then you can also try default_password as the password and see if TWRP will then work for you.
Good luck.

The other way to get around the issue if you want to stay on the newest update (MHC19J) is to use an OTG cable to flash SU. I did this just now, and it works. Another suggestion that I saw is to mount cache, since it's not encrypted and flash SU from there, but I did not try that since an OTG cable is easier. This will allow you to be on the newest update until TWRP is fixed to work again.

bg1906 said:
Is this on the latest version of the stock ROM (March Update)? If so, they released 2 versions. The MHC19J and MMB29V. The problem is between TWRP and the Nexus 5X's encryption. If that is the case, reflash with the MMB29V version of the March Update. That fixed this problem for me. If you don't have the March Update version of the stock ROM, then you can also try default_password as the password and see if TWRP will then work for you.
Good luck.
Click to expand...
Click to collapse
havens1515 said:
TWRP currently isn't working with MHC19J. Use MMB29V for now if you need TWRP. I'm here looking to see if anyone has found a workaround/fix
Click to expand...
Click to collapse
That explains everything then! I think I'm going to downgrade! I thought about downgrading but I was so desperate I didn't want to mess everything up again.
Thank you so much!

Rozalina340 said:
That explains everything then! I think I'm going to downgrade! I thought about downgrading but I was so desperate I didn't want to mess everything up again.
Thank you so much!
Click to expand...
Click to collapse
Not sure if its a downgrade because they released both versions. I just think Google needs to be explicit in what is released and what the differences actually are. I anticipate TWRP will have a fix soon for the problem between it and MHC19J.
---------- Post added at 12:10 PM ---------- Previous post was at 12:08 PM ----------
pkadavid said:
The other way to get around the issue if you want to stay on the newest update (MHC19J) is to use an OTG cable to flash SU. I did this just now, and it works. Another suggestion that I saw is to mount cache, since it's not encrypted and flash SU from there, but I did not try that since an OTG cable is easier. This will allow you to be on the newest update until TWRP is fixed to work again.
Click to expand...
Click to collapse
The flashing isn't the problem, it's getting into TWRP all together. Seems the problem stemmed from those of us who purchased the phone at launch and those that purchased after January 2016. If you had no problems getting into TWRP with MHC19J, then you probably got your phone after January 2016. I got mine at launch and MHC19J and TWRP would not play nicely for me so I had to install the MMB29V version of the March Update.

I didn't take any risks , I downgraded to MMB29Q and it works like a charm! I will stay on MMB29Q until TWRP fixes the issue with MHC19J.

New version of TWRP is available which is compatible with MHC19J:
https://plus.google.com/u/0/+JoshuaLynch50036/posts/ZcNqBDvNmo7

havens1515 said:
New version of TWRP is available which is compatible with MHC19J:
https://plus.google.com/u/0/+JoshuaLynch50036/posts/ZcNqBDvNmo7
Click to expand...
Click to collapse
Thanks and YES it does work. I was able to install MHC19J and Root SuperSU 2.68 with TWRP

With the Test1-Version of TWRP works fine for me with MHC19J.:good:
Thanks.

https://dl.twrp.me/bullhead/twrp-3.0.0-1-bullhead.img.html

havens1515 said:
New version of TWRP is available which is compatible with MHC19J:
https://plus.google.com/u/0/+JoshuaLynch50036/posts/ZcNqBDvNmo7
Click to expand...
Click to collapse
Installed today , works perfectly. Thank you!
Sent from my Nexus 5X using Tapatalk

Updated to NMF26O, Lost Root

Hey - followed this guide (https://matthewtraughber.github.io/pixel_manual-update_guide/) to update my rooted XL to NMF26O, lost root along the process. Flashing the SR5 supersu.zip didn't give me any errors in TWRP, but supersu isn't installed on boot. If I go into the Play Store and install it manually, I get an error about the SU binary not being installed. Any suggestions?

cantsingh said:
Hey - followed this guide (https://matthewtraughber.github.io/pixel_manual-update_guide/) to update my rooted XL to NMF26O, lost root along the process. Flashing the SR5 supersu.zip didn't give me any errors in TWRP, but supersu isn't installed on boot. If I go into the Play Store and install it manually, I get an error about the SU binary not being installed. Any suggestions?
Click to expand...
Click to collapse
That update permanently block root for your device

cwalker0906 said:
That update permanently block root for your device
Click to expand...
Click to collapse
Even if I have an unlocked bootloader already?

cantsingh said:
Even if I have an unlocked bootloader already?
Click to expand...
Click to collapse
No I'm messing with you, many people have had this problem. Easy fix, read last few pages of root thread

cwalker0906 said:
No I'm messing with you, many people have had this problem. Easy fix, read last few pages of root thread
Click to expand...
Click to collapse
Lol you terrified me. What's the fix? I'm looking for the root thread right now..

cantsingh said:
Lol you terrified me. What's the fix? I'm looking for the root thread right now..
Click to expand...
Click to collapse
Fastboot boot twrp alpha 2, flash the su zip, and reboot

cwalker0906 said:
Fastboot boot twrp alpha 2, flash the su zip, and reboot
Click to expand...
Click to collapse
Got it. Thanks, buddy. I'll post back here to confirm.

Confirmed. If you lost root when updating to NMF26O (or after installing TWRP RC1), then hot-boot TWRP Alpha 2 (fastboot boot twrp-alpha-2.img), flash supersu and reboot. Thanks!

confirmed - worked for me!
cantsingh said:
Got it. Thanks, buddy. I'll post back here to confirm.
Click to expand...
Click to collapse
Confirmed, this saved my life
I had a Pixel XL that had 7.1 on it and rooted it successfully. Not sure when but my phone got updated to 7.1.1 I was careful not to take the update, maybe I inadvertently clicked it (I don't think so) but I think it got forced on me. So I ended up with 7.1.1. Tried using my hotspot which worked before and it didn't. Fortunately my device boot loader was still unlocked, but previous root technique using twrp-3.0.2-0-RC1-fastboot-marlin.img didn't work (seems like it does but after reboot, no joy). Figured if I flashed stock 7.1 image that would do the trick - no joy.
Found this post
Followed suggestion above and used twrp-3.0.2-0-alpha2-fastboot-marlin.img and used same SR5-SuperSU-v2.78 - reboot worked great. FYI, I downloaded the stock 7.1.1 (marlin-nof26v-factory-1dce14a1.zip) and rooting works with that.
Note: turn off "Automatic System Updates" (obviously that was probably the originally culprit) under developer options.

miker2069 said:
Confirmed, this saved my life
I had a Pixel XL that had 7.1 on it and rooted it successfully. Not sure when but my phone got updated to 7.1.1 I was careful not to take the update, maybe I inadvertently clicked it (I don't think so) but I think it got forced on me. So I ended up with 7.1.1. Tried using my hotspot which worked before and it didn't. Fortunately my device boot loader was still unlocked, but previous root technique using twrp-3.0.2-0-RC1-fastboot-marlin.img didn't work (seems like it does but after reboot, no joy). Figured if I flashed stock 7.1 image that would do the trick - no joy.
Found this post
Followed suggestion above and used twrp-3.0.2-0-alpha2-fastboot-marlin.img and used same SR5-SuperSU-v2.78 - reboot worked great. FYI, I downloaded the stock 7.1.1 (marlin-nof26v-factory-1dce14a1.zip) and rooting works with that.
Note: turn off "Automatic System Updates" (obviously that was probably the originally culprit) under developer options.
Click to expand...
Click to collapse
You fastboot twrp rc1 but then flash the twrp rc1 zip and then it should be fine and then flash SuperSU 2.79 sr3.

Root for A320fl?

I saw the other post about how to root the a3, but the answers weren't accurate, I didn't understand all of it in which me trying to root got me resetting my phone, so can someone tell what exactly to do and install? And where do I find twrp for a3 nougat?
thanks in advance

Hi
I rooted my device when I got it, back in May. But a few days ago updated it to Nougat, so I had to re-root. (Off: not much difference between android 6 and 7, maybe just a few little things). I used odin to update + twrp recovery + root. Sadly the root reverted back my recovery to stock, but I don't care about it too much, the working root was my main goal. I used this https://forum.xda-developers.com/sa...root-sm-a320f-fl-y-samsung-galaxy-a3-t3556026 guide to the letter, and it worked. Good luck on your device

pmajci said:
Hi
I rooted my device when I got it, back in May. But a few days ago updated it to Nougat, so I had to re-root. (Off: not much difference between android 6 and 7, maybe just a few little things). I used odin to update + twrp recovery + root. Sadly the root reverted back my recovery to stock, but I don't care about it too much, the working root was my main goal. I used this https://forum.xda-developers.com/sa...root-sm-a320f-fl-y-samsung-galaxy-a3-t3556026 guide to the letter, and it worked. Good luck on your device
Click to expand...
Click to collapse
Stupid question , but the part where it say's clear data+cache and flash before device initial initialization, was this done in twrp? Or Odin? I can't find twrp for the a3 Nougat. Or is it the same file as MM ? Thanks for your help

I think I used the same, but the wipe was done in stock recovery. As I wrote, rooting reverted it back.

Thanks, worked )
But can't find how to install magisk on an already patched boot image ???

Can't help you there, I don't even know what magisk is XD
Just needed root, I seriously can't stand ads.

pmajci said:
Can't help you there, I don't even know what magisk is XD
Just needed root, I seriously can't stand ads.
Click to expand...
Click to collapse
Ok, thanks for the help still