qu1ckr00t - Nexus 5X Q&A, Help & Troubleshooting

A new vulnerability in android kernel has been found which leaves the attacker with a root shell, it also affects LG devices running oreo
Source: https://github.com/grant-h/qu1ckr00t
According to this: https://github.com/kangtastic/cve-2019-2215
Some customizations can be made for this to work on other affected devices, Unfortunately I don't have enough knowledge to do that :/
I did compile and ran it through termux but no use.
My usb port has been broken for more than a year, if someone can help me compile this for N5X i would really appreciate it.
Thanks
EDIT: I managed to compile and run that app on my device but it gets stuck (see screen shot).
if i'm missing anything, please help.

Update:
Someone in lgv20 forums managed to modify this exploit to work with 3.18 kernels, deleted the repo for some reason but it's available on GitHub with the file name su98.c, see:
https://github.com/timwr/CVE-2019-2215
According to issue on gitlab, our device IS vulnerable:
https://gitlab.com/LineageOS/issues/android/issues/1414
I managed to extract necessary kernel offsets and modify the exploit. The writev() functions returns positive but apparently it still needs a few modifications.
If any developer can take a look at this, will be greatly appreciated.

Please can someone compile it to run on zte blade A5 2019? please

Related

[How To] [GSM] Getting started with porting

Ok, so after having a million questions I thought I'd write up a quick little 'how to' with regards to porting.
And now the warning
Read and learn first, doing this could cause serious issues with your tab or even brick it. The tab is really tough, and hard to brick if you do everthing right but it could still happen. I'm not responsible if it does.
Where to start
Get good at reading, google searching and searching XDA. Lots of porting discussion regarding other phones can apply to the tab.
Learn to use Heimdell
Have a linux distro available, either by virtual box, or natively.
Technomancer where it all began
I've said it before and I'll say it again, without techs work miui wouldn't have been possible.
Reference technomancers thread here: http://forum.xda-developers.com/showthread.php?t=931857 on how to download the cm7 + sgt source, you're also going to want to follow the kernel making part, cause most likely you'll need to make adjustments to the init.rc which is inside the initramfs and requires building the kernel again.
porting x build
Get X build onto your computer and extract the update.zip for it.
Copy the boot.img into your linux environment and extract it using splitbootimg.pl script (note: Google it, plus this doesn't work with samsung builds). Compare the init.rc to your init.rc (from the sgt cm7 kernel source root folder). Specifically the most important part here is the PATH, LD_LIBRARY_PATH statement and BOOTCLASSPATH lines.
Build your kernel with the updated init.rc and flash with heimdell, it should still boot your cm7/miui build (if you were running it before) albeit with errors.
The system
Now following the awesome list of proprietary files (either from your source folder or technomancers github link) check the galaxytab-common-vendor-blobs.mk for the GT-P1000. It lists every file you need that's propreitary to the tab and where to put it.
Also you'll probably need the debuggerd from /system/bin on the cm7 build.
Compare the /system/build.prop of the cm7 build to your port, make sure the ril info is the same as well as the ro; model, brand, device, board, and platform lines.
Create an update.zip (or whatever you want to call it.zip) and try it.
It's not booting
Logcat is great, but I really suggest using the ddms from the android sdk tools. It's color coded, and gives a much nicer view of what's happening.
Using winmerge in windows or a linux file compare program start checking what other bin files may be missing that you require. Special notice to the xbin folder.
It works! I want to post it!
Ok, first up, make sure you have permission if this is someone elses custom build you've ported. Most people/groups are really good about it assuming you ask first and give them credit in your post.
Also credit everyone who helped, answered a question or sent you in the right direction. (it's just polite)
Second your going to want to make sure your update.zip flashes the kernel, read the update_script from the cm7 build to understand how it works.
So that's it for a start. roll up your sleves, gather your courage and get to it!
Please if you have other tips, add them to the thread, what's better 1 or 2 'developers/porters' or 100?
Thanks. This is very useful for me.
Thanks,
Following this method, with slight alterations to adjust, I was able to port an i9000 phone build to the tab in about 10 minutes, it's really not terribly that difficult once you have the right steps.
The first couple times are usually frustrating but after that you get the hang of it
Hi mssmison Thank you for your guide,it will be very useful in the future! I have only one request,how can I contact you? I have a proposal for you about a dev team (regarding an old think tank)
Thanks for the guide...
Is there any ROM left to port by the way?
Sent from my GT-P1000 using XDA Premium App

[Q] [KERNEL] Apply realtime patches to kernel

Hi,
I am trying to apply the preempt_rt patches[2] in order to test the realtime performance of native code on an android device in a study project. The device I have for testing is the Galaxy Nexus.
People here seem to have managed to do that with a Xoom[1].
My starting point was the kernel of the current official (4.2.2) Android release (android-omap-tuna-3.0-jb-mr1.1). According to the version string it is based on linux 3.0.31, so I tried to patch it with the corresponding rt-patchset. Except for a few rejects that went fine. Most of them I could get fixed manually.
My problem atm is that there seem to be quite some backports from newer (3.3/3.4?) kernels, especially for the file "include/linux/plist.h" and "kernel/rtmutex.c" which change some function-declarations. Today I managed to compile the kernel with the "CONFIG_PREEMPT_BASIC" option set, but when I try to boot the phone it gets stuck during the Google-bootscreen. It does not show up as an adb device, so I can't get any output from the device.
For me the question is, how much of the Kernel is actually still 3.0.31, maybe it would be more suitable to use the rt_patches for more recent Linux-kernels?
I was also thinking about trying to patch the kernel the GNex was released with, because this one may be closer to the original Linux kernel (I checked, plist.h and rtmutex.c are not the original ones as well)?
Maybe someone else has a better idea what to test, because I am not overly familiar with all the different subbranches and development trees of Android yet. Any help or suggestions would be greatly appreciated.
Best regards,
Jan
PS: I would have posted this in the development section, but wasn't permitted to. Maybe a mod could move it?
PPS: It seems, I am also not allowed to include working links :-/
[1] Search for: "mauerer real time linux tag" to get the paper
[2] rt.wiki.kernel.org/index.php/CONFIG_PREEMPT_RT_Patch

building from source

Hi,
Amazon release source code as is required by GPL. That is great but to reproduce a binary needs compiler information.
All the stuff I find here on modifying these devices seems to be based on downloading someone else's binaries and hoping they are clean and actually relate to the OS version I have. This info does not always seem to be provided.
If I want to build busybox and su using gcc and copy them across using adb , where can I find the required build info ?
I guess guys here building ROMs must be doing this.
Thanks.

Porting LineageOS to an Unsupported Device (with no similar devices)

Hi,
I am trying to port LineageOS to an unsupported device, an IBall Slide Cuddle A4.
Here's the guide I'm following : https://fat-tire.github.io/porting-intro.html
This is the part where I need help:
"Add the blobs to the vendor/ directory
Once you have a working recovery, it's now time to get CyanogenMod building and working.
The first thing to do is to get all the proprietary, binary blobs into the vendor/ folder, along with a .mk file that will include them in the final build.
This requires three steps:
Create extract-files.sh and setup-makefiles.sh scripts to pull those blob files from the device using adb and put them in the right /vendor/ directory. There are plenty of examples available for other devices.
Create an .mk Makefile to copy those files to the $OUT folder during the build process and put them in the right place. Again, use other devices as a guide for what this Makefile should look like. An example filename might be BoardConfigVendor.mk
Make sure that the Makefile you just created is included from your main BoardConfig.mk via a command such as -include vendor/[vendor]/[codename]/BoardConfigVendor.mk. Again, existing devices can illustrate how this is done.
Now revise the device/ directory
Since you have a working recovery, go back and start modifying the files in the device/ folder. As always, use other similar devices as a reference.
You now have a easy means to do backups and test your builds. So start tweaking the device folder itself, and see if you get it to boot... Once you do, from there its a matter of building and supporting the various parts and peripherals, one-by-one. "
Click to expand...
Click to collapse
Q #1: Where all should I look on my device for the proprietary blobs, and what do they look like? Can I manually extract them out of my existing ROM and paste them into the proper folder of the new one?
Q #2: What do I modify in the device/ folder?
Q #3: What does it mean to "build and support the various parts and peripherals" Does this mean to add the necessary drivers? If so, can I get these drivers from the stock ROM?
The reason I have to ask this here is because my device has NO similar LineageOS-supported devices with the same chipset for me to refer to. My tablet has a MediaTek MT8392 chipset, and I couldn't find any supported devices with an MT8392 (or an MT6592, which is very similar). Also, there is NO code available from the manufacturer, at all. The only resource I have is a stock ROM.
Are there any other ways in which a device can be similar enough for me to use as reference?
It would be really nice if someone could provide links to articles explaining the above 3 things, or if someone has already gone through this process, share their experience.
Also, will my kernel (v3.4.67) be compatible with the latest LineageOS 16 / Android 9 or will I have to build an earlier version?
I am very new to Android development, but that doesn't mean that I can't learn!
That's a hard task for getting started. A mtk device with no twrp available. I recommend to start with low hanging fruits. Like buying an old phone with dropped lineageOS support and building an updated version.
I understand that it is quite difficult. So instead of doing a full port myself, I am now trying the method of taking an image made for a similar MTK device and transferring the device-specific files from my stock ROM, as shown in the following guide:
https://www.techubng.com/2017/09/how-to-port-lineage-os-14-nougat-rom-on-mtk.html
It says:
"From System/lib/hw: Delete all mt6572.so blobs and replace with these blobs: DOWNLOAD BLOBS
Now copy these files from stock to port:
System/lib/hwcomposer.mt65xx.so
System/lib/gralloc
System/lib/lib.audio.primary.so
Systemlib/lib.mali.soS
System/Etc
System/lib/libcameracustom.so
System/etc/firmware
System/lib/libfeatureio.so
boot/kernel
boot/unventd.rc (only if you are getting stuck at logo)
boot/Replace only camera lines under #Camera from stock boot.img init.rc to init.mt6572.rclib/libcamdrv.solib/libcamalgo.so"
But my stock ROM does not have any of the files he listed uner /system/lib! Can I ignore these files, or is there some other place where these files could be? (I checked /vendor)
Also, what about all the other files in /system/lib? Which ones are device-specific and does anything else need to be copied into the new ROM?
As for the TWRP, I have found tools like Easy Magic TWRP Installer ( https://forum.hovatek.com/thread-5162.html ) which will automatically do the porting given the boot.img and recovery.img from the stock ROM. Are these safe to use, as long as I provide the right info to the tool?
I want to use LineageOS on this tablet because the stock OS has some annoying bugs and is quite old (Android 4.4.2) considering how recent the tablet is and how much capability the tablet's hardware has. The manufacturer (IBall) has provided no updates at all.
Lineage OS on Samsung Galaxy J3 Achieve (SM-J337P)
Can I pay a developer to make a working ROM to put Lineage OS on the Samsung Galaxy J3 Achieve (SM-J337P) ?
If so, how do I find a developer who can do it?
hey, i have a sm-t280 that have a similar supported device. how i port to it?
i have a sm-t280 that i wan't to update the android. the only exit i found it's build linegeos or aosp for it, can anyone help me?
here is the source tree:
vendor tree: huttps://github.com/gtexswifi/android_vendor_samsung_gtexswifi
-----
device tree: huttps://github.com/gtexswifi/android_device_samsung_gtexswifi
-----
kernel tree: huttps://github.com/pfent/sm-t280-kernel
[i writed huttps because i don't have posted 10 posts already]
Porting similar device mt6750t
vinaypundith said:
I understand that it is quite difficult. So instead of doing a full port myself, I am now trying the method of taking an image made for a similar MTK device and transferring the device-specific files from my stock ROM, as shown in the following guide:
https://www.techubng.com/2017/09/how-to-port-lineage-os-14-nougat-rom-on-mtk.html
It says:
"From System/lib/hw: Delete all mt6572.so blobs and replace with these blobs: DOWNLOAD BLOBS
Now copy these files from stock to port:
System/lib/hwcomposer.mt65xx.so
System/lib/gralloc
System/lib/lib.audio.primary.so
Systemlib/lib.mali.soS
System/Etc
System/lib/libcameracustom.so
System/etc/firmware
System/lib/libfeatureio.so
boot/kernel
boot/unventd.rc (only if you are getting stuck at logo)
boot/Replace only camera lines under #Camera from stock boot.img init.rc to init.mt6572.rclib/libcamdrv.solib/libcamalgo.so"
But my stock ROM does not have any of the files he listed uner /system/lib! Can I ignore these files, or is there some other place where these files could be? (I checked /vendor)
Also, what about all the other files in /system/lib? Which ones are device-specific and does anything else need to be copied into the new ROM?
As for the TWRP, I have found tools like Easy Magic TWRP Installer ( https://forum.hovatek.com/thread-5162.html ) which will automatically do the porting given the boot.img and recovery.img from the stock ROM. Are these safe to use, as long as I provide the right info to the tool?
I want to use LineageOS on this tablet because the stock OS has some annoying bugs and is quite old (Android 4.4.2) considering how recent the tablet is and how much capability the tablet's hardware has. The manufacturer (IBall) has provided no updates at all.
Click to expand...
Click to collapse
I saw Lineage OS 16 for HomTom S99….
I have HomTom HT70 with same Chipset of HomTom S99 MT6750T….
Im trying to read and follow carefully your guide but still i have bootloop..
Is it Possible to Port it to Homtom HT70 so we can have Android 9 too??
https://forum.xda-developers.com/ge...tom-ht70-6-0-hd-189-mt6750t-4gb-64gb-t3803052
hey, I have a samsung j7 j700t (t-mobile), and if it has a similar version that is the j700f / h / m, but I have tried it and it does not work for me. What do I have to do to make it work for me? Help me please!!!
AlexRsl1999 said:
hey, I have a samsung j7 j700t (t-mobile), and if it has a similar version that is the j700f / h / m, but I have tried it and it does not work for me. What do I have to do to make it work for me? Help me please!!!
Click to expand...
Click to collapse
Different processsor. J700t is Qualcomm. J700f is exynos
kurtn said:
Different processsor. J700t is Qualcomm. J700f is exynos
Click to expand...
Click to collapse
But my processor is Exynos 7580 to 1.5GHz
AlexRsl1999 said:
But my processor is Exynos 7580 to 1.5GHz
Click to expand...
Click to collapse
If you haven't already, I'd recommend checking in Geekbench as there's a lot of conflicting information on the web. Usually, Samsung only puts the Exynos chip in GSM only devices sold outside the US.
There is a custom rom for a variant of my device (Huawei g760) please how can i make it work on my device (Huawei g7-UL20) they both have the same specs and processor everything is the same
YomaAroriode said:
There is a custom rom for a variant of my device (Huawei g760) please how can i make it work on my device (Huawei g7-UL20) they both have the same specs and processor everything is the same
Click to expand...
Click to collapse
Have you unlocked the bootloader, before huawei stopped allowing it?
kurtn said:
Have you unlocked the bootloader, before huawei stopped allowing it?
Click to expand...
Click to collapse
Yes my bootloader is unlocked
kurtn said:
Have you unlocked the bootloader, befes ore huawei stopped allowing it?
Click to expand...
Click to collapse
Yes my bootloader is unlocked
I followed this guide: https://forum.xda-developers.com/t/guide-porting-twrp-without-source.3843473/
And ported the twrp recovery made for huawei g760 to my g7-UL20
Now how do i modify the custom rom for it to work on my device. Please i need your help!!
kurtn said:
That's a hard task for getting started. A mtk device with no twrp available. I recommend to start with low hanging fruits. Like buying an old phone with dropped lineageOS support and building an updated version.
Click to expand...
Click to collapse
Hi there, I just noticed this reply you had made and I have a question about a device that may have had Lineage support.
What I would like to do, once I have my new phone that is, is to take my current phone Motorola Edge+ (2020) and turn it into a small Lineage tablet.
However, there is one slight problem with this, and that is rhat there is currently no Lineage support for this device, but there is support for it's younger brother the Motorola Edge (2020).
Now I do know that porting is possible between devices, but I've seen a lot of guides says they should have the certain similarities such as processor and such.
However the CPU, GPU and Chipset are slightly different (Same brands though), will this pose a problem in porting?
I of course do realize that I will of course need the proprietary blobs from Motorola for this device and I believe I have found them.
Finally, I am curious if you know of any up to date guides on porting? I will of course continue researching myself, however I thought I would make an enquiry anyway.
Any help you may be able to provide would be greatly appreciated.
Bloodstalker
Bloodstalker82 said:
Hi there, I just noticed this reply you had made and I have a question about a device that may have had Lineage support.
What I would like to do, once I have my new phone that is, is to take my current phone Motorola Edge+ (2020) and turn it into a small Lineage tablet.
However, there is one slight problem with this, and that is rhat there is currently no Lineage support for this device, but there is support for it's younger brother the Motorola Edge (2020).
Now I do know that porting is possible between devices, but I've seen a lot of guides says they should have the certain similarities such as processor and such.
However the CPU, GPU and Chipset are slightly different (Same brands though), will this pose a problem in porting?
I of course do realize that I will of course need the proprietary blobs from Motorola for this device and I believe I have found them.
Finally, I am curious if you know of any up to date guides on porting? I will of course continue researching myself, however I thought I would make an enquiry anyway.
Any help you may be able to provide would be greatly appreciated.
Bloodstalker
Click to expand...
Click to collapse
Install a gsi
GSI Rom´s For Motorola Edge +?
Hi for everyone! I have been looking for custom rom for our Motorola Edge +. But I haven't found any yet. However there is the option of the GSI rom's, this smartphone has an A / B system partition. 64-bit ARM CPU architecture. (information...
forum.xda-developers.com
Thank you very much for your reply. I had seen that I could uae a GSI, however I had not realized it is actually possible with Lineage. I clearly misread the topic.
kurtn said:
That's a hard task for getting started. A mtk device with no twrp available. I recommend to start with low hanging fruits. Like buying an old phone with dropped lineageOS support and building an updated version.
Click to expand...
Click to collapse
yo i have a phone with an unofficial version of lineageos 15.1 (Lenovo K8 Note) how would i go about building that newer version

[WIP] [ROM] [8.1.x] LineageOS 15.1 [Sumire]

I'm posting this now and hope in doing so some new input can be reached. Due to recent new and old exploits we need this, I have hardened the kernel some, from CopperheadOS, and put in place full "Harden usercopy", updated it to 3.10.108, and before I go any further in breaking the kernel i release this WIP. I refer to this post ( https://forum.xda-developers.com/showpost.php?p=80265757&postcount=50 ) for the current state of mobile calls etc.
Fastboot images:
190919: https://drive.google.com/open?id=1OAzYc_D_FHbbmIyFiSVtGLolB2EfiE40
290819: https://drive.google.com/open?id=1d8FNiFlMN6Bey6xD606pBomqBgSiZ-MO
Features:
OS Version: 8.1.0 Oreo
Kernel: Linux 3.10.108
Important informations:
You should be familiar with general installation of custom roms.
Required for installation: fastboot
This ROM needs a clean install, old /data may cause problems!
Working:
WIFI
Bluetooth
OTG-USB
NFC
These things are NOT working.
Camera; is not included due to inconsistency in the build currently. But failed to connect to the camera last time it did.
GSM; this will require reworking some android code, making some progress i think.
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf8internal20RepeatedPtrFieldBase4SwapEPS2_" referenced by "/system/vendor/lib64/libcneapiclient.so"...'
FM-Radio (not included)
GPS
Bugs:
Installing apps freeze the phone for a while.
Basically, this release needs help.
Source:
https://github.com/threader/local_manifests
https://github.com/threader/kernel
https://github.com/threader/android_device_sony_sumire
https://github.com/threader/android_device_sony_kitakami-common
Patch for external/protobuf attached to this thread.
Modified libcneapiclient.so attached.
Credits:
Everyone involved with the Sony-msm8994 project ( https://github.com/sony-msm8994/android_device_sony_kitakami-common/commits/lineage-15.1 )
Mr. Open devices "jerpelea", for actually answering some of my stupid questions I should have realized myself.
Berni-0815 for trying to do this for the z5c and leaving useful resources.
And everyone posting and following the Guide to port to Lineage-16.0 thread by algui91 (https://forum.xda-developers.com/xperia-z5/general/guide-to-port-to-lineage-16-0-t3931428) and willing to participate, this is a community effort after all.
Please don't quote this thread, I will edit it as I release new builds and make progress.
I was unsuccessful in building a flashable zip image first time I tried some moons ago, I don't know if this was due to the need of a TWRP update or just my half arsed attempt, I would appreciate if someone could direct me to correctly doing so.
Cheers
How can i help including the fact that i am nearly noob in Linux / Unix and havent built any custom ROM at the moment?
DP
threader said:
BuzzerHead.
Click to expand...
Click to collapse
let me think on that, but there are two things that's needed, a libcneapiclient.so that is msm8996 perhaps and for Android 8.x, maybe we can decompile and figure out the differences. And a Qualcomm trust zone from from maybe 8996 to hack and plug the holes. I'm still reading up.on this though but if you Google "chipsec Qualcomm trust zone" or indeed just the first results for " Qualcomm trust zone" you certainly see the problem ( https://blog.quarkslab.com/introduction-to-trusted-execution-environment-arms-trustzone.html , https://www.blackhat.com/docs/us-14/materials/us-14-Rosenberg-Reflections-on-Trusting-TrustZone.pdf )
I'm re-working the external/protobuf modifications just now as I think that is why the bug i listes occurred.
Edit:
Right, great, after unhacking the hacks and returning the protobuf API to its original state I'm stuck an error before the quite impossible error i had earlier, so this is not going as quickly as i thought, either.
Code:
Abort message: 'CANNOT LINK EXECUTABLE "/system/bin/netmgrd": cannot locate symbol "_ZN6google8protobuf2io17CodedOutputStream13WriteVarint32Ej" referenced by "/system/vendor/lib64/libcneapiclient.so"..
This is a clearly defined symbol already but perhaps not behaving as intended and an error my previous attempt somehow worked around.
The following might be the reason it hangs during package install though;
Code:
09-16 18:46:55.875 865 956 W SchedPolicy: add_tid_to_cgroup failed to write '1947' (Permission denied); fd=3
09-16 18:46:38.393 865 1126 W NativeCrashListener: Couldn't find ProcessRecord for pid 2958
Any news?
Is this project dead? Seeing a newer version of LOS on this device would be nice.
Sent from my SM-T580 using XDA Labs
TALUAtXDA said:
Is this project dead? Seeing a newer version of LOS on this device would be nice.
Sent from my SM-T580 using XDA Labs
Click to expand...
Click to collapse
It's resting... My life up ended and screwed my peace and tranquility, I simply have not had the time to look at it, I'm having a look now as long as the peace lasts.
I see there is a 10.0 now, with some collaboration maybe we can get this all working, I argued a lot with the vendor libs, i just need to get a grip on what's going on there with the other project. As far as i can tell quickly looking at it I can merge some of those changes to the unified kernel 3.10.108 I'm using and see how things go, It will take a some time to get going again. As far as the kernel goes I ought get it up to 3.12, there are some pagetable ioslation patches that are required for safe operation etc, but I paused kernel work until i could get Android in shape, then life happened....

Categories

Resources