Develop Bugs

APK root exploit

I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit

Do you have a link to their research or are their findings private?
Regards,

Mr_Bartek said:
Do you have a link to their research or are their findings private?
Regards,
Click to expand...
Click to collapse
saurik - his analysis of the "second master key vuln"
giantpune for his symlnink attack vuln in property space:
Code:
/system/bin/mv /data/property /data/backupprop
/system/bin/mkdir /data/property
/system/bin/ln -s /sys/kernel/uevent_helper /data/property/.temp
/system/bin/setprop persist.sys.fail /data/pwn.sh

jcase said:
I tweeted this a couple week ago before the N1 was publicly out but here you go, nothing fancy, no real ui or output.
Thanks to Saurik and Giantpune for contributing (ie its based on their research)
Install apk, run apk wait 1 minute, install supersu app from market then uninstall with this command
adb uninstall com.qualcomm.privinit
Click to expand...
Click to collapse
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.

coolrevi said:
Will this exploit work in any other device. when i try to install the play store warns about the vulnerability. Will this vulnerability be gone after uninstalling oppoown.
Click to expand...
Click to collapse
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from

jcase said:
Possibly other oppo devices
No it doesnt fix the vuln, just becareful where you install apps from
Click to expand...
Click to collapse
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!

ricky310711 said:
a second mater key vulnurability? hmm, so this could might not be patched in 4.4?
great job by the way, i dont have the device but this is interesting!
Click to expand...
Click to collapse
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely

pulser_g2 said:
It should be patched in 4.4.
But some (read most) OEMs still can't manage to patch their devices up to the latest security updates on release.
Anyway, I tested this root method a week or so ago and it works nicely
Click to expand...
Click to collapse
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...

ricky310711 said:
so your saying in most devices the master key patch could be a possible vulnurabillity still in 4.3?
interesting...
Click to expand...
Click to collapse
It depends on if OEMs backported it, depends on which build OEMs used and depends on the bug. Four or five different zip parser bugs with similar results. This one I used was patched in 4.3, but other exist.

Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.

trickraca said:
Im trying to figure out why oppown apk will not install in my n1. everytime i try it just. Says app not installed. But on the install screen it says something about being an update to an already installed program. Any clues as to what the issue is? all ive done is update to the latest ota software and im currently located in indonesia if that makes a difference.
Click to expand...
Click to collapse
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two

jcase said:
Possible they patched it by now, if you are on cyanogenmod you are certainly patched
Sent from my HTC Two
Click to expand...
Click to collapse
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
It should not come rooted, if it comes rooted then no way did it pass CTS. I'm guessing unlocking the bootloader and flashing a recovery? I don't know, I dont have one

giuliano rigon said:
So show do you root the cyanogenmod edition n1.. Can you help please.. Does it come rooted or what..
Click to expand...
Click to collapse
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk

noobish doubts..
Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
Please i ne ed a walthrough..
1) download twrp
2) put it in root of the telephone robot
3) flash it in recovery?
4) reboot recovery wipe cache and dalvik flash omnirom..
Please correct me..
Thank you

giuliano rigon said:
1) download twrp Yes
2) put it in root of the telephone Yes
Make sure to copy Omnirom to your phone at some point
3) flash it in recovery? No - Flash TWRP in Fastboot if you haven't flashed the recovery already. Use the official Teamwin site for guidance
4) reboot recovery wipe cache and dalvik flash omnirom.. Wipe Cache, Dalvik, System, and Data
Click to expand...
Click to collapse
Updates in Red
This is off-topic for this thread though. Questions/Info for flashing Omnirom should be addressed in the Omnirom thread.

Harfainx said:
You don't need to root if you aren't staying on stock. There's no lock anywhere on the bootloader or anything.
Simply flash TWRP in fastboot, then flash Omni (or whatever else) through TWRP.
You should be able to just flash a SuperSU zip in TWRP as well if you want to root the stock ColorOS.
Sent from my N1 using Tapatalk
Click to expand...
Click to collapse
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks

nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.

not rooted.. confirm i can flash
nowy57 said:
may you provide to right superSU.zip files
I v got superSU from this link and it doesnt work on first and second CM version
I am not rooted yet ...
thnaks
Click to expand...
Click to collapse
I nave tried my damnedest to root .. Fastboot flashing supersu flashing from recovery Direct install from google play complete unroots and reflash letting recovery do it .. No way..
So now i need a last confirmation.. Can i flash omnirom after wipes even if i am unrooted.. And has anyone rooted omnirom or does it come unrooted.. Thanks for the info .. Another idea.. Flashing color OS footing and then flashing omni.. Or is this a late night bad Dream..
---------- Post added at 01:17 AM ---------- Previous post was at 01:05 AM ----------
Harfainx said:
That does work. You're likely not removing root, but rather just uninstalling SuperSU.
I answered you in your Q&A thread on root.
Click to expand...
Click to collapse
Sorry now i got it.. It was in the forums.. Just unchecking the respect cyanogen settings in the super su menu got me roooted and happy.. Sorry for your time.. I flashed super su zip from recovery rebooted and unchecked .. Now i am set..

I were rooted myN1 in yesterday, its really good . thankss
Sent from my N1 using XDA Premium 4 mobile app

Successfuly used FIREWATER & now need correction on next steps

Last time I rooted a phone was the original DROID (great phone).
Now, I'm back on the scene after not fond of the OTA 4.4 so I consider myself a "newbie" since things have changed a lot.
Took some time but managed to successfully use FIREWATER.
Just wondering if I have the correct order of the next steps:
(*Verizon One w/ Mac machine only)
1. FIREWATER
2. Find Recovery to flash
3. Make back-up
4. Root
5. Find desired ROM
So looks like RECOVERY is next but there are MANY links with "recovery" in search results it's a bit overwhelming.
Obviously I need one specifically for Verizon, right?
Thanks in advance

Your phone was android 4.4.2 and you were able to use firewater to unlock? Or are you asking if you can use it to root 4.4.2? Firewater doesn't work the ota we just got.
Sent from my HTC6500LVW using Tapatalk

Everything you need can be found HERE everything is pretty much up to date recovery wise

Everyone has their preferences as what recovery to use but I just went through this about 4 days ago.
A recovery option that will work: http://forum.xda-developers.com/showthread.php?t=2416273
See downloads where it says classic, and touch -- it's your choice which to get.
I will however note that I had an issue wiping cache/data on the 6.0.4.7 update. It might of just been a bad flash but I ended up going to version 6.0.4.4 and I was able to do everything just fine. Mounts/unmounts, backups/restores, wipes and flashes.
Link to the version I used (CWM Classic 6.0.4.4): http://www.radracer.us/otp/droid/recovery-clockwork-6.0.4.4-m7vzw.zip
To get into your recovery you go to your bootloader (or whatever HTC calls it, where you see Fastboot, HBoot version and what not), and you will see Recovery as an option. Once selected you will boot into CWM.

Do you lose data if you use firewater? From what I am reading I dont believe data is lost but haven't seen a clear answer.

disconnecktie said:
Your phone was android 4.4.2 and you were able to use firewater to unlock? Or are you asking if you can use it to root 4.4.2? Firewater doesn't work the ota we just got.
Click to expand...
Click to collapse
No no, sorry should've clarified that: I was on 4.3 and saw the unnecessary changes 4.4.2 brought so I withheld from updating.
onthehole said:
Do you lose data if you use firewater? From what I am reading I dont believe data is lost but haven't seen a clear answer.
Click to expand...
Click to collapse
No, not at all. I think I will lose data when I flash recovery or install a ROM though
vpxf said:
Everyone has their preferences as what recovery to use but I just went through this about 4 days ago.
A recovery option that will work: http://forum.xda-developers.com/showthread.php?t=2416273
See downloads where it says classic, and touch -- it's your choice which to get.
I will however note that I had an issue wiping cache/data on the 6.0.4.7 update. It might of just been a bad flash but I ended up going to version 6.0.4.4 and I was able to do everything just fine. Mounts/unmounts, backups/restores, wipes and flashes.
Link to the version I used (CWM Classic 6.0.4.4): http://www.radracer.us/otp/droid/recovery-clockwork-6.0.4.4-m7vzw.zip
To get into your recovery you go to your bootloader (or whatever HTC calls it, where you see Fastboot, HBoot version and what not), and you will see Recovery as an option. Once selected you will boot into CWM.
Click to expand...
Click to collapse
That's a lot and after this busy weekend, I'll have to sit down and go through everything you just posted. Thanks!

BTW I'm seeing that there are some issues with TWRP not allowing you to BOOT back up if your phone dies?
Any reason why TWRP should be the one or do another RECOVERY?

-XIV- said:
No no, sorry should've clarified that: I was on 4.3 and saw the unnecessary changes 4.4.2 brought so I withheld from updating.
Click to expand...
Click to collapse
Im in the same boat as you. Waiting to see how everything works out. I have heard clockwork is working pretty well for this phone. ALmost ready to S-OFF now.
So, if I S-Off on 4.3, can I then let the ota come over and not lose the abililty to flash SU, or a rom with SU/Root? I should still be able to flash anything I want in recovery with S-OFF no?

how can i unroot and remove recovery ?

my phone has developed a fault and i need to return to vodafone i have installed the backup i made before i installed the custom rom but there is still supersu installer on my phone how can i remove root and twrp please ?

Supersu has an option to fully uproot. Then flash HTC's recovery.

lyall29 said:
Supersu has an option to fully uproot. Then flash HTC's recovery.
Click to expand...
Click to collapse
great thanks where will i find htcs recovery please

Strangeland16 said:
great thanks where will i find htcs recovery please
Click to expand...
Click to collapse
I don't know. I haven't ever looked for it.

lyall29 said:
I don't know. I haven't ever looked for it.
Click to expand...
Click to collapse
just tried supersu remove root and it says uninstalling but just sits there saying that

Strangeland16 said:
just tried supersu remove root and it says uninstalling but just sits there saying that
Click to expand...
Click to collapse
That's all I know to do. I know this won't help you now but, next time make a nandroid as soon as you flash twrp, before you do any mods at all. Maybe someone else with more knowledge can help you. Good luck, I hope you get it fixed!

lyall29 said:
That's all I know to do. I know this won't help you now but, next time make a nandroid as soon as you flash twrp, before you do any mods at all. Maybe someone else with more knowledge can help you. Good luck, I hope you get it fixed!
Click to expand...
Click to collapse
i did make a nandroid straight after recovery was installed but when i went back to the back up i made super su was still present

Strangeland16 said:
i did make a nandroid straight after recovery was installed but when i went back to the back up i made super su was still present
Click to expand...
Click to collapse
That doesn't sound right. After you flashed the nandroid, if you are not rooted twrp may have asked you if you want to install supersu. Did you swipe to install? I would try reflashing the nandroid and make sure not to install supersu in twrp.

if you're going to return it, why not just flash RUU back to stock.

How can I unroot my HTC one m9

Rooting, but keeping stock recovery

Hey all,
I'm a bit of a nub at this, but can I boot into TWRP and root my OP3, without losing stock recovery? If I remember correctly from a while back, when I Odin'd TWRP to a Samsung device, it asked me if I wanted to install TWRP and allow system modification. If I choose not to, will I keep both stock and root?
Thanks!

I am no expert by any means, but for my Nexus 6, I could use the nexus root toolkit to boot into twrp without changing the recovery. It used 'fastboot boot' command I believe, so you should be able to accomplish the same by typing 'fastboot boot twrp.img'.

iScripters said:
Hey all,
I'm a bit of a nub at this, but can I boot into TWRP and root my OP3, without losing stock recovery? If I remember correctly from a while back, when I Odin'd TWRP to a Samsung device, it asked me if I wanted to install TWRP and allow system modification. If I choose not to, will I keep both stock and root?
Thanks!
Click to expand...
Click to collapse
I selected "don't allow system modifications" when it came up but it kept twrp so the stock OP3 rom does not overwrite your custom recovery. Though my ota installed fine using twrp so I see no reason to use the stock recovery.

StykerB said:
I selected "don't allow system modifications" when it came up but it kept twrp so the stock OP3 rom does not overwrite your custom recovery. Though my ota installed fine using twrp so I see no reason to use the stock recovery.
Click to expand...
Click to collapse
Thanks for the info! Can anyone else confirm OTA's will install with TWRP installed?

iScripters said:
Thanks for the info! Can anyone else confirm OTA's will install with TWRP installed?
Click to expand...
Click to collapse
It DOES still required an unmodded + system never being mounted r/w just fyi.

I just got my oneplus 3 and I really wanna root it to be able to switch out the stock android emoji's. On my OPO I were able to temporary run TWRP to get root but on this people are saying different things. AM I able to temporary run TWRP with fastboot boot blabla and then flash SuperSU and then still have stock recovery because I really don't wanna have TWRP if I can't update using the OTA's. And emoji switcher requires root so
Or am I able to flash TWRP, Flash SuperSU and then download emoji switcher and get my iphone emojis and then update with OTA not by flashing?

iScripters said:
Thanks for the info! Can anyone else confirm OTA's will install with TWRP installed?
Click to expand...
Click to collapse
You can read up in oneplus one forum and so on about this. Believe me you are not the first to ask this question so do a little research before flashing its a lot to know.So be on top of what you are trying to do

playya said:
You can read up in oneplus one forum and so on about this. Believe me you are not the first to ask this question so do a little research before flashing its a lot to know.So be on top of what you are trying to do
Click to expand...
Click to collapse
Lame reply. We are in OP3 forums.
After seeing your replies it's clear that you are just a noobish loser. No offense meant, but it's true.
/plonk

pathologo said:
Lame reply. We are in OP3 forums.
Click to expand...
Click to collapse
Must admit your words of wisdom left me breathless. I nicely said stop typing and start searching you noobs need to research the "WEB" which is more than just here for an answer. Bahaha haha you guys kill me... Rookie! Peace out

Have to flash SU systemless

It seems there would be a problem in flashing normal downloaded SU and have to go through the long process of flashing systemless SU after which have to upgrade it.
Is it normal for you guys too?
How come 1+3 bricks after installing normal SU?
b.t.w. personal note: thanks to one of the oneplus rep that was in the euro tour in Rome the TWRP recovery fix worked (sorry forgot your name ). Really appreciate the chat and help out!

No, i downloaded normal su (SuperSU) and then flashed it through TWRP. I don't know which su you are using, but there are loads of us who have installed SuperSU without an issue.

nemexs said:
It seems there would be a problem in flashing normal downloaded SU and have to go through the long process of flashing systemless SU after which have to upgrade it.
Is it normal for you guys too?
How come 1+3 bricks after installing normal SU?
b.t.w. personal note: thanks to one of the oneplus rep that was in the euro tour in Rome the TWRP recovery fix worked (sorry forgot your name ). Really appreciate the chat and help out!
Click to expand...
Click to collapse
You may have the wrong flashable, flashing supersu on the OP3 for me is very quick and painless. Make sure you have the latest from chainfire's website v2.76 at the time of me posting this. : http://download.chainfire.eu/supersu-stable
PS: regular supersu is both systemless and "normal" root it makes a decision during installation determining whether your device can support normal root and if not then it does a systemless boot.img patch.

StykerB said:
You may have the wrong flashable, flashing supersu on the OP3 for me is very quick and painless. Make sure you have the latest from chainfire's website v2.76 at the time of me posting this. : http://download.chainfire.eu/supersu-stable
Click to expand...
Click to collapse
You beat me to pointing him to it. If I can add, there's a dedicated SuperSU thread to seek help if SuperSU causes an issue:
http://forum.xda-developers.com/showthread.php?t=1538053
Highly unlikely but just in case. If you are not sure, there are sufficient number of toolkits out there that can simplify the job for you.

@tropicanapure @StykerB
Have tried them the only way I can flash SU is downloading @ahmed_radaideh 's oneplus3 toolkit and then flashing his SU. Tried the normal version and the problem seems to be present (brick), yes chainfire's su. If I don't want to do full wipe I'd have wipe system and just reflash stock and then systemless su

nemexs said:
@tropicanapure @StykerB
Have tried them the only way I can flash SU is downloading @ahmed_radaideh 's oneplus3 toolkit and then flashing his SU. Tried the normal version and the problem seems to be present (brick), yes chainfire's su. If I don't want to do full wipe I'd have wipe system and just reflash stock and then systemless su
Click to expand...
Click to collapse
Then you may want to check the process y you are using for this.
If I can ask what exactly are you trying to fix? Do you already have SuperSU installed? And you are trying to move to systemless?
Or are you unable to install SuperSU itself? If yes, then you may want to post to the SuperSU thread too.

tropicanapure said:
Then you may want to check the process y you are using for this.
If I can ask what exactly are you trying to fix? Do you already have SuperSU installed? And you are trying to move to systemless?
Or are you unable to install SuperSU itself? If yes, then you may want to post to the SuperSU thread too.
Click to expand...
Click to collapse
I had no problem in installing it systemless, however just wanted to see if everyone else had to go through the same process. It seems not, now I'm trying to find out how come I can't install normally.

nemexs said:
I had no problem in installing it systemless, however just wanted to see if everyone else had to go through the same process. It seems not, now I'm trying to find out how come I can't install normally.
Click to expand...
Click to collapse
You still haven't mentioned the process you use[emoji6]
The process most commonly used via TWRP is to download the zip from the link above and flash it. That's all there is to it.

tropicanapure said:
You still haven't mentioned the process you use[emoji6]
The process most commonly used via TWRP is to download the zip from the link above and flash it. That's all there is to it.
Click to expand...
Click to collapse
my bad, yes I use twrp method 3.0.2 the most recent one, flash stock rom and then flash su

nemexs said:
my bad, yes I use twrp method 3.0.2 the most recent one, flash stock rom and then flash su
Click to expand...
Click to collapse
Assuming your bootloader is already unlocked beforehand, the straight answer to your question is yes, that's how most of us do it.

No problem with flashing SU whatsoever,
and i rather not to use any toolkit to flash either recovery or anything,
fastboot for recovery and recovery for anything else,
Simple, straight and safe

otonieru said:
No problem with flashing SU whatsoever,
and i rather not to use any toolkit to flash either recovery or anything,
fastboot for recovery and recovery for anything else,
Simple, straight and safe
Click to expand...
Click to collapse
doesn't work for me.