adb trickery #2

Apparently some vendors have reviewed android and also fixed
the ashmem issue in 2.2.1 (along with adb and zygote).


However, I got the first reports for KillingInTheNameOf
working on 2.1 devices. So I made it available
here.


It was really my favorite and I hoped it would become
the Gingerbreak, but 2.3 is not using
ashmem for system properties. Thats life :)




[Update:] it seems like the property space has become
the new playground for breaking froyo devices since this post,
as the ashmem implementation has some shortcomings if
it comes to properly protecting the property space :-)
The security of the whole system relies on the property
space due to ro.secure and other properties.
However for Gingerbread, the property implementation has been
redesigned AFAIK.


Also check out this link for another method of exploiting
ashmem which apparently also works on 2.2.1 devices.


My Gingerbreak works, but I wont release it before a couple
of devices are in the wild so the issue is not fixed before
it can become useful.

Zygote trickery -- 743C 27C3 release

The Gingerbread source has recently been released and
a root vulnerability has been fixed inside the
zygote/dalvik framework (if you dont know what it is,
call it a framework). I hoped that this exploit would
still work on Gingerbread, but since the bug is too
similar to the adb issue it has been fixed as well.
Thus, this only affects android phones < 2.3 but
it also works without debugging being enabled e.g.
from inside an evil app.


As always: the code is AS IS.
If you use it, it may crash your
device and makes it totally useless, SO YOU USE IT AT YOUR OWN RISK! THERE IS NO GUARANTEE
THAT IT WILL WORK AT ALL.


If you dont know what jailbreaking is about, dont do it anyways.
Once executed it should create a /system/bin/rootshell or
+s /system/bin/sh.


The apk can be found here. Nevermind the simple GUI,
it was pasted together from various sample/demo programs
just to make it easier to have an activity to start
for zygote.


And fear my publishing skillz! :D

The bootdisk and the rootdisk

The recent discussion at the pub was of course about
the bits and bytes but this time with view on historical
facts. Someone remembers the bootdisk and the rootdisk?
When it was not possible to boot from CD-ROM it was
necessary to dd a bootdisk and a rootdisk image to floppy
disks. After a few installs, one of them was always fscked.
So why were we using Linux at all? Wasn't it a funny time
with TurboPascal at school? Or even better with BorlandC++
which I got hands on in '94 or so on a low-price
(b/c outdated-)version. For a price of just 80 DM
which was still high enough at that time one also got the incredible TurboDebugger and there the fun starts.

While I am not going to explain for what reason exactly
TurboDebugger was cool (I know the even more cool guys
used SoftIce :) it showed you the hard way why
RealMode really sucked in particular if there is a ProtectedMode
since years. So isnt there any good OS utilizing that?
Whats this "Linux" ...?

Gingerbread

If someone already has got a Gingerbread and wants to

save the world, let me know.

Happy Birthday to .no

Special greetings and congratulations to Uschluh today
where the one and only root is celebrating his BD.
May be the force with you to withstand all evil of life
in whatever shape it will appear: users, bosses, women,
burning switches or Fedora 14.
You've got the power. Looking forward to a new Gewaltmarsch. :)

New sshttp feature trickery

sshttp is now able to hide SSH inside HTTPS as well.
SSH behind HTTP was possible before, and so was HTTPS,
but now it is "official" :)
You cannot mix HTTP and HTTPS in the same instance,
but you can run multiple sshttpd's.
I also added multicore support (basically the same
as for lophttpd, see earlier postings) AND support
for Linux capabilities. It runs as nobody in a chroot now
and only keeps CAP_NET_ADMIN and CAP_NET_BIND_SERVICE.

Multicore support for lophttpd

lophttpd (in version 0.86), which is my private research
project for high performance web servers, now comes
with support for multiple cores (Linux only for now).
Unless specified otherwise, one thread per CPU core sleeps
in a accept() loop. Increasing load of the cores will then
result in more and more connections passed to the accept()
sleeping on yet unused cores.
This works since the kernel wakeup's all threads sleeping
in the accept() but only one will actually get the
connection (all others get EAGAIN).
In OS engineering this is known as the thundering herd problem
if you have thousands of processes woken up at once.
However this does not apply here since the number of cores
is small compared to what would "thunder a herd".
So basically we take the good parts of that "problem" but do not
run into the problem itself.


If it turns out to work well, I will also add multicore
support to sshttp. And it is by far more fun to code it
than the OS classes at university discovering scheduling theoretically.

Death of a great mathematican

I just read that the great Mathematican Benoît Mandelbrot
died on Oct 14th.
His Mandelbrot-set fractales were one reason for me to start programming back in the days. Beside its beauty its likely
that all your mobile internet wont work without fractales
since (almost all?) antennas inside small wifi/GSM/UMTS
are self-similar to have maximum gain/space ratio. A lot of other technical and scientific
equipment would be NULL without that too, and I bet the
distribution signature of self replicating code also has to
be self-similar if it wants to be optimal. :-)

New sshttp available

I switched the I/O engine inside sshttpd from blocking to
non-blocking sockets. Blocking I/O is by far easier,
but disappearing IPs could hang all other connections.
This should be fixed now.
Non-blocking socket state engines are really worth
a PhD thesis. :-)
Anything else is as before, just setup nf-setup
and run sshttpd.
Available for download here.

Hiding a sshd inside a httpd trickery

If you always asked yourself how you could run both a sshd and
an apache (or a lophttpd!) on the same TCP port 80
without patching any client or server software and still
getting always the right service, you should
have a look at sshttp.